The Open Web Application Security Project (OWASP) is a non-profit foundation that works to improve software security. It was launched on 1 December 2001 and has been supporting developers with free guides and resources ever since.
The guides are free, and anyone can join the project. They cover many topics, and their pages offer help for many types of development.
One of OWASP’s flagship projects is the OWASP Top Ten, which lists the ten most critical security risks affecting web applications. In recent years it has become a widely accepted industry reference.
Following in the footsteps of the Top Ten, the Web Security Testing Guide was developed and is now recommended for testing web applications. It helps ethical hackers examine web applications. The guide is constantly evolving; at the time of writing, the latest version was released on 12 April 2020.
The OWASP Application Security Verification Standard is not only for security professionals; it is also recommended for developers. Version 4.0.1 was released on 2 March 2019, and the version on GitHub is under continuous development. It is particularly useful that it sorts applications into three security levels and gives recommendations for each, helping developers find their way.
The OWASP Mobile Security Testing Guide helps you test mobile applications. It is not only for security experts: it also lets developers easily review the requirements for a secure mobile app, whether for Android or iOS. Most of the tips and tricks in it are a must-read for any mobile developer!
What has the OWASP given us?
Plenty of research and development support. The freely available knowledge built up over the years has helped make many applications secure. It has given us hackers an open standard that is generally accepted across the industry. It created a common reference and laid the foundations of a shared language for application security.
The Whiteshield team has been working according to OWASP guidelines for years, and our assessment reports are built on the same principles. The vulnerability descriptions in our reports include direct references that help developers fix the issues, because the purpose of every assessment is not only to find the bugs but also to provide guidance on fixing them.