Copyright 2007 © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP Good WebAppSec Resources Module (to be combined) Education Project

OWASP 2 Just the start!  Moving Target  Changing Ecosystem

OWASP 3 Hard Copy

OWASP 4 Hard Copy  IEEE Security & Privacy (bimonthly magazine)  Security Engineering – Anderson (free download)  Building Secure Software – Viega & McGraw  Secure Coding – Graff & van Wyk  Exploiting Software : How to Break Code – Hoglund & McGraw  19 Deadly Sins of Software Security - Howard, LeBlanc & Viega  Hacking Exposed Web Applications (2nd Ed) – Joel Scambray, Mike Shema, Caleb Sima  Writing Secure Code (2nd Ed) – Howard & Leblanc  Enterprise Java Security – Pistoia, et al

OWASP 5 Hard Copy  Secure Programming with Static Analysis – Brian Chess, Jacob West  The Art of Software Security Assessment – Mark Dowd, John McDonald, Justin Schuh  The Security Development Lifecycle – Michael Howard  Threat Modeling – Frank Swiderski, Window Snyder  Securing Web Services with WS-Security – Rosenberg & Remy  Core Security Patterns – Steel, Nagappan & Ray Lai  Security Metrics – Andrew Jaquith  Software Security: Building Security In – Gary McGraw

OWASP 6 6 OWASP Projects Are Alive! …

OWASP 7 Web Sites

OWASP 8 8

OWASP 9 OWASP Knowledge and Tools Core Application Security Knowledge Base Acquiring and Building Secure Applications Verifying Application Security Managing Application Security Application Security Tools AppSec Education and CBT Research to Secure New Technologies Guide to Building Secure Web Applications and Web Services Guide to Application Security Testing and Guide to Application Security Code Review Tools for Scanning, Testing, Simulating, and Reporting Web Application Security Issues Web Based Learning Environment and Education Project Guidance and Tools for Measuring and Managing Application Security Research Projects on Securing New Technologies (like Web Services & Ajax)

OWASP 10 Online    buildsecurityin.us-cert.gov buildsecurityin.us-cert.gov     Tools 

OWASP 11 Mailing Lists

OWASP 12 Mailing Lists  OWASP Project Mailing lists  Secure Coding List   (WASC)  SANS NewsBites

OWASP 13 Blogs

OWASP 14 Blog Selection  ha.ckers.org/blog (RSnake) ha.ckers.org/blog  shiflett.org (Chris Shiflett) shiflett.org  jeremiahgrossman.blogspot.com jeremiahgrossman.blogspot.com  (PDP)  sylvanvonstuppe.blogspot.com sylvanvonstuppe.blogspot.com  (Billy Hoffman)  taosecurity.blogspot.com (Richard Bejtlich) taosecurity.blogspot.com  (Nitesh Dhanjani)  Check Anurag Agarwal’s Reflection SeriesReflection