OWASP Proactive Controls

Creative Commons License Github stars Twitter Follow

What is This?

The OWASP Top Ten Proactive Controls describes the most important controls and control categories that every architect and developer should absolutely, 100% include in every project.

OWASP Top 10 Proactive Controls 2018

Software developers are the foundation of any application. In order to achieve secure software, developers must be supported and helped by the organization they author code for. As software developers author the code that makes up a web application, they need to embrace and practice a wide variety of secure coding techniques. All tiers of a web application, the user interface, the business logic, the controller, the database code and more – all need to be developed with security in mind. This can be a very difficult task and developers are often set up for failure. Most developers did not learn about secure coding or crypto in school. The languages and frameworks that developers use to build web applications are often lacking critical core controls or are insecure by default in some way. It is also very rare when organizations provide developers with prescriptive requirements that guide them down the path of secure software. And even when they do, there may be security flaws inherent in the requirements and designs. When it comes to software, developers are often set up to lose the security game.

The OWASP Top Ten Proactive Controls 2018 is a list of security techniques that should be included in every software development project. They are ordered by order of importance, with control number 1 being the most important. This document was written by developers for developers to assist those new to secure development.

For more information, see the complete document in the tab to the right.

Presentation

Use the extensive project presentation that expands on the information in the document.

Key Contributors

  • Massimiliano Graziani (Italian Translation)
  • Taras Ivashchenko (Russian Translation)
  • Jay Zudilin (Russian Translation)
  • Danny Harris
  • Hiroaki Kuramochi (Japanese Translation)
  • Hiroshi Fujimoto (Japanese Translation)
  • Hidenori Nagai (Japanese Translation)
  • Riotaro OKADA (Japanese Translation)
  • Robert Dracea (Japanese Translation)
  • Koichiro Watanabe (Japanese Translation)
  • Tony Hsu Hsiang Chih (Chinese Translation)
  • Abdessamad Temmar
  • Eyal Estrin (Hebrew Translation)
  • Cyrille Grandval (French Translation)
  • Frédéric Baillon (French Translation)
  • Danny Harris
  • Stephen de Vries
  • Andrew Van Der Stock
  • Gaz Heyes
  • Colin Watson
  • Jason Coleman
  • Cassio Goldschmidt
  • Wallace Soares (Brazilian Portuguese Translation)
  • Chris Romeo
  • Dan Anderson
  • David Cybuck
  • Dave Ferguson
  • Josh Grossman
  • Osama Elnaggar
  • Rick Mitchell

OWASP Proactive Controls 2018

OWASP Proactive Controls 2018 is currently available in the following formats:

News

Formal Numbering

2018 Numbering

2016 Numbering

  • OWASP-2016-C1: Verify for Security Early and Often
  • OWASP-2016-C2: Parameterize Queries
  • OWASP-2016-C3: Encode Data
  • OWASP-2016-C4: Validate All Inputs
  • OWASP-2016-C5: Implement Identity and Authentication Controls
  • OWASP-2016-C6: Implement Appropriate Access Controls
  • OWASP-2016-C7: Protect Data
  • OWASP-2016-C8: Implement Logging and Intrusion Detection
  • OWASP-2016-C9: Leverage Security Frameworks and Libraries
  • OWASP-2016-C10: Error and Exception Handling

2014 Numbering

  • OWASP-2014-C1: Parameterize Queries
  • OWASP-2014-C2: Encode Data
  • OWASP-2014-C3: Validate All Inputs
  • OWASP-2014-C4: Implement Appropriate Access Controls
  • OWASP-2014-C5: Establish Identity and Authentication Controls
  • OWASP-2014-C6: Protect Data and Privacy
  • OWASP-2014-C7: Implement Logging, Error Handling and Intrusion Detection
  • OWASP-2014-C8: Leverage Security Features of Frameworks and Security Libraries
  • OWASP-2014-C9: Include Security-Specific Requirements
  • OWASP-2014-C10: Design and Architect Security In

Translations

2018 Version

  • Top 10 Proactive Controls 2018 Italian Translation: PDF Download
  • Top 10 Proactive Controls 2018 Chinese Translation: PDF Download
  • Top 10 Proactive Controls 2018 Russian Translation: PDF Download
  • Top 10 Proactive Controls 2018 Polish Translation: PDF Download
  • Top 10 Proactive Controls 2018 Arabic Translation: PDF Download

2016 Version

  • Top 10 Proactive Controls 2016 Traditional Chinese Translation:PDF Download
  • Top 10 Proactive Controls 2016 Simplified Chinese Translation:PDF Download
  • Top 10 Proactive Controls 2016 Japanese Translation: PDF Download
  • Top 10 Proactive Controls 2016 Hebrew Translation: PDF Download

2014 Version

  • Hebrew and French translations of the Top 10 Proactive Controls 2014 can be found on the 2014 archive tab.

Roadmap

Welcome to the OWASP Top 10 Proactive Controls Project!

2024 Roadmap

  • Create wiki for 2024 version (in progress)

2018 Roadmap

  • Create new PowerPoint and other artifacts for 2018 version (done)
  • Create wiki for 2018 version (done)

2016 Roadmap

  • Create new PowerPoint and other artifacts for 2016 version (done)
  • Proactive Control Mapping to Cheatsheet (done)

Status

  • January 15, 2016: 2016 Proactive Controls Released!
  • August 6, 2015: Kickoff for 2.0 effort, in progress
  • March 10, 2014: We released an early beta of this document to the OWASP leaders list for review and commentary.
  • February 21, 2014 Moved 2014 info to archive tab
  • February 3, 2014: We are currently working towards a beta release of this document and have begun working with a designer for the final release PDF.
Watch Star