The OWASP ASVS and Sustainable Software Security Practices – Josh Grossman – ASW #232
In this segment, Josh will talk about the OWASP ASVS project which he co-leads. He will talk a little about its background and in particular how it is starting to be used within the security industry.
We will also discuss some of the practicalities and pitfalls of trying to get development teams to include security activities and considerations in their day-to-day work and examples of how Josh has seen this “in the wild”.
Segment Resources:
- Josh's personal website, https://joshcgrossman.com, and mastodon handle, https://infosec.exchange/@JoshCGrossman
- OWASP ASVS site, https://owasp.org/asvs
- More detailed talk about ASVS v4.0.3, https://www.youtube.com/watch?v=zqj4YuoAlcA
- The most recent, stable version of the standard (v4.0.3), https://github.com/OWASP/ASVS/tree/v4.0.3/4.0
- The “bleeding edge”/in-progress version, https://github.com/OWASP/ASVS/tree/master/5.0
- Building a High Value AppSec Scanning Programme at Black Hat USA 2023: https://www.blackhat.com/us-23/training/schedule/#building--a-high-value-appsec-scanning-programme-sca-sast-dast-and-more-30622
Announcements
Join us at an upcoming Official Cyber Security Summit in a city near you! This series of one-day, invitation-only, executive level conferences are designed to educate senior cyber professionals on the latest threat landscape. We are pleased to offer our listeners $100 off admission when you use code SecWeek23 to register. Visit securityweekly.com/cybersecuritysummit to learn more and register today!
Guest
Josh Grossman has worked as a consultant in IT and Application Security and Risk for 15 years now, as well as a Software Developer. This has given him an in-depth understanding of how to manage the balance between business needs, developer needs and security needs which goes into a successful software security programme.
Josh is currently CTO for Bounce Security where he helps clients improve and get better value from their application security processes and provides specialist application security advice. His consultancy work has led him to work, speak and deliver training both locally and worldwide including privately for ISACA and Manicode and publicly for OWASP’s Global AppSec conferences.
In his spare time, he co-leads the OWASP Application Security Verification Standard project and is on the OWASP Israel chapter board.
Hosts
