1. Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP http://www.owasp.org OWASP Nederland Implementation of Security by Design Martin Knobloch Sogeti Nederland B.V. martin.knobloch@sogeti.nl +31-(0)6 52 32 76 79 2007-01-11

2. OWASP 2 Presentation Objectives What is…? Awareness! Task Force! Join Forces! Education! Get known! Finish line?

3. OWASP 3 What is…? Security By Design A Secure Application Awareness! Task Force! Join Forces! Education! Get known! Finish line?

4. OWASP 4 What is… Security by Design Secure Software Development Initiative Applications designed to be secure Design how to develop secure applications Everything about designing, developing, testing and implementing secure applications!

5. OWASP 5 What is… A Secure Application? How to design, develop a secure application? How secure has an application to be? How to prove the application meets the customer expectations and needs of security? 50 current OWAP Projects 6 Release Quality Projects 15 Beta Status Projects 15 Alpha Status Projects

6. OWASP 6 What is…? Secure Development Life Cycle

7. OWASP 7 What is… A Secure Application.. An application is secure if the applications behaves as expected at all times!

8. OWASP 8 Awareness! What is… ? Awareness! Who? Why? How? Task Force! Join Forces! Education! Get known! Finish line?

9. OWASP 9 Awareness! Who? Colleagues Development Staff –Architects / Designers –Developers –Tester Sales / Business Management Customer Architects Administrators Users …each and everyone!

10. OWASP 10 Awareness! Why? Colleagues Development Staff Sales / Business Management Customer Architects Administrators Users

11. OWASP 11 Awareness! How? By recognition of their interests, understanding and knowledge of security! Communicate on the level of their knowledge Communicate in the scope of their understanding Communicate in the context of their interests

12. OWASP 12 Awareness!

13. OWASP 13 Task Force! What is…? Awareness! Task Force! Its not a one-man-show Join Forces! Education! Get known! Finish line?

14. OWASP 14 Task Force! Its not a one-man-show Java Microsoft Oracle SAP CMS C++ Uniface PHP … Software Control

15. OWASP 15 Task Force! Proactive Security Strategy (PaSS)

16. OWASP 16 Join Forces! What is…? Awareness! Task Force! Join Forces! Who else is busy with security? Education! Get known! Finish line?

17. OWASP 17 Join Forces! Business Process Networking System Administration Application Administration

18. OWASP 18 Join Forces! Company wide security initiatives

19. OWASP 19 Educate! What is…? Awareness! Task Force! Join Forces! Educate! Education Certification Get known! Finish line?

20. OWASP 20 Educate! Presentations, Courses, Technical meetings To create awareness! About Security Threats About Security Standards About Best Practices About Standards About …

21. OWASP 21 Educate! Certifications Get certified CISSP Symantec – SCSP MSCE Cisco ISS RSA »OWASP Top Ten certification?!

22. OWASP 22 Get known! What is…? Awareness! Task Force! Join Forces! Education! Get known! Make yourself heard! Finish line?

23. OWASP 23 Get known! Write! Papers Newsletters Blogs Talk! Presentations Meetings Lunch Bother! Whenever there is a change!

24. OWASP 24 Get known! Make yourself notorious!

25. OWASP 25 Finish line? What is…? Awareness! Task Force! Join Forces! Get known! Education! Finish line? When is the job done?

26. OWASP 26 Finish line? When is the job done? … NEVER!