Comments (7)
Thank you for feedback, we had similar discussion some time (2 years) ago, #813 (comment)
My opinion is - techies need language for techies. Non-techies can not do the tasks which requires deep-techies knowledge. So I am failing to understand, what problem it solves from ASVS side?
To be clear: extra explanation in general is never bad, the question is - where it should be located (and who maintains and synchronizes it).
Where it may give extra value is to "translate" ASVS requirement to abstract business logical functional requirements, but this is out of ASVS scope.
In general - if some requirement text is not understandable, we need to fix the requirement. And there should be difference, is it not understandable because of bad text or because lack of knowledge on the topic. ASVS is not for education and requirement texts can not educate. Often they need to be abstract enough to be valid for different technologies.
Does it give you more ideas and questions? :)
from asvs.
Hi @gobrtg,
Thanks for taking the time to suggest this.
A few thoughts:
- Specifically on 2.2.1 I think that the requirement needs some TLC as it is a little wordy and I have opened #1763 to deal with that separately. Overall for 5.0 we need to be clarifying requirements better.
- The ideal is that ASVS requirements should be understandable to developers and I think we need to get better at that for 5.0. On the other hand, we do try and keep the requirements themselves as short as possible.
- Currently, we have two mechanisms to provide extra context for ASVS requirements:
- The text surrounding the requirements although it isn't clear how often people are reading that.
- The CWE reference to explain which weakness it is aiming to address but again CWEs are not always super clear and sometimes the mapping is not exact.
- For 5.0, we are hoping to map to OpenCRE which is a far more varied and specific software security taxonomy. We also have a lot more input and control with OpenCRE.
- As a general point, I think the use of user stories to explain security controls would be really valuable and not necessarily limited to the ASVS but to explain controls/vulnerabilities in general. Mapping them to
- However, as was suggested in #813, this would probably be best pitched as a separate project. Having the user stories mapped using OpenCRE would be incredibly powerful as well (I don't think OpenCRE existed when the original issue was discussed).
In summary,
- I think your ideas would be super valuable combined with the resources here and here to further develop the OWASP User Security Stories project. If you want to help getting that OWASP project moving again and getting more involved with it, email me at firstname [dot] lastname [at] owasp [dot] org and I can try and help connect you to the relevant people :)
- If you are aware of other ASVS items that are not very understandable (as at the "bleeding edge version", please check if an issue has already been opened about them and if not, open an issue with your thoughts/suggestions.
Thanks again :)
from asvs.
Ok, I obviously read the plans for the asvs wrong. My bad. It was just meant as an idea, not criticism. Personally I love the work you have done, but I also have the problem of "selling it" to project and product management without me or team members having to be hands on. So that's what problem it was meant as a suggestion on how to solve. No matter, keep ut the good work! :)
from asvs.
This suggestion seems like another project/cheatsheet, maybe? Since this is out of ASVS scope.
from asvs.
I also have the problem of "selling it" to project and product management without me or team members having to be hands on
Is it more security awareness issue for the leaders rather than ASVS is not "human" readable?
The point is - let's say ASVS is more human readable, would it solve the mentioned problem or the problem is somewhere else?
from asvs.
Just to be clear, I didn't mean that the ASVS should change its basic wording or language, only that the suggested construct could represent one possible way of making more people understand why there's a need for the different requirements. IMHO it could potentially help make the case for using ASVS for a lot more people, not only management. It's not a question of being human readable or not, it's a question of making what is read more comprehensible to more people.
In my experience devs usually both understand and want to implement the ASVS requirements. It's the people around them that don't necessarily see the need nor the value in giving time and resources to fulfill them. So maybe it's an awareness issue, but that was quite frankly what I got out of what I heard Grossman talked about regarding the plans for version 5, on the mentioned podcast.
from asvs.
From my point of view it's awareness issue. Non-tech leaders just need to hire good tech persons for giving them good advice.
As it all related to @tghosth , then I leave it to him :)
from asvs.
Related Issues (20)
- discussion OAuth/OIDC: accepted flows and grants HOT 7
- 4.3.1 and 4.3.3 HOT 7
- Password Storage Algorithms 2.4.1 revisited HOT 3
- Make 2.1.14 easier and more simplified HOT 7
- Implement Requirement for Anomalous Behavior Detection HOT 4
- cloud config scanning HOT 1
- Link checker is temperamental and apparently deprecated HOT 2
- 5.5.4 should be removed as a duplicate of 5.2. HOT 1
- 5.3.4 should also mention stored procedures. HOT 2
- Do we need CSS to be mentioned in both 5.3.1 and 5.2.8. HOT 2
- Add HTML comments to 5.3.1
- Dynamically generated HTML HOT 11
- Proposal/discussion: OIDC nonce claim requirement HOT 1
- Proposal/discussion: OIDC requirement to ensure issuer URL == issuer claim HOT 2
- Proposal/discussion: OIDC requirement about ID token only being used to prove that the user has been authenticated HOT 7
- 5.6.2 Adding Server-side validation proposal HOT 12
- 7.1 Proposal for Masked Data Logging Need HOT 4
- 8.2.2 advice on sessionStorage breaks multi-tab web application use unlike cookies HOT 13
- Set Account Lockout ASVS Levels 1-3 Aligned to NIST, PCI-DSS, CIS et al
- CWE indicated in requirement 50.2.1 (previously v4.0.3-14.4.3) seems incorrect HOT 5
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from asvs.