Open Worldwide Application Security Project (OWASP)

Under the motto "no more insecure software," the non-profit organisation Open Worldwide Application Security Project (OWASP) works to improve the security of software.

OWASP operates as an open community with tens of thousands of members across more than 250 local chapters around the world. In Sweden there is the OWASP Stockholm Chapter. The work is carried out through projects that produce open-source code, documentation and standards. OWASP organises local and global conferences that offer participants talks by security experts, security training, and the opportunity to network with peers in the industry.

Like CIS Controls and other frameworks, OWASP can be used when setting requirements for system or software vendors, to ensure good security on an ongoing basis or in connection with procurement.

Projects are at the core of OWASP, and they are divided into three types.

• Flagship projects are those that have contributed strategic value to OWASP and to application security as a whole.
• Production projects consist of a team of volunteers working on a specific area within security, where they can test their theories and ideas with the help of the OWASP community.
• Other projects offer, among other things, lab environments.

Below are a few examples of OWASP projects.

• OWASP Top Ten describes the most critical security risks in web applications. Organisations should start by minimising these risks. The OWASP Top 10 is considered an effective first step toward more secure web application development.
• OWASP Dependency-Track is a platform that can be used to monitor the use of software components across all versions of all applications in an organisation's portfolio. Its purpose is to identify and manage risk and to deliver in line with a Software Bill of Materials (SBOM).
• OWASP Juice Shop is a deliberately insecure application developed to give people the opportunity to practice finding vulnerabilities and test security tools. It contains vulnerabilities from the OWASP Top 10, supplemented with other known vulnerabilities found in real-world applications.
• OWASP Web Security Testing Guide is a comprehensive guide that developers and security experts can use to test web applications.

OWASP was founded in 2001 in the United States and is classified as a non-profit organisation. OWASP works to raise awareness of vulnerabilities and threats to applications. Security is meant to be strengthened throughout the entire application lifecycle, from design and development to operation and maintenance. Secure system development is promoted by providing tools, guides, training and other resources that are freely available to everyone, regardless of an organisation's size or financial resources.