OWASP
New CS proposal: Secure Design Principles
What is the proposed Cheat Sheet about?
Core Principles for Secure Design
What security issues are commonly encountered related to this area?
Insecure Design
What is the objective of the Cheat Sheet?
To help developers with secure design and architecture, it's a gap in OWASP offerings at the moment.
What other resources exist in this area?
There used to be a section from the old dev guide. https://github.com/OWASP/DevGuide/blob/master/02-Design/01-Principles%20of%20Security%20Engineering.md
A variant of guidance from the UK https://www.ncsc.gov.uk/collection/cyber-security-design-principles/cyber-security-design-principles
CISA Archive https://us-cert.cisa.gov/bsi/articles/knowledge/principles/design-principles
Hey @infosecdad this is a good idea. Do you want to create it? We will review and help you with the process.
I believe this should be reopened as this is an invaluable resource.
Some of the other places I have found valuable information regarding this topic: https://patchstack.com/articles/security-design-principles-owasp/ https://www.linkedin.com/learning/csslp-cert-prep-3-secure-software-design/secure-design-principles-and-patterns https://www.ncsc.gov.uk/collection/cyber-security-design-principles https://medium.com/ouspg/security-design-with-principles-a8c045765b93
If it's reopened, I'll write it; I have more sources that I found in the last six months.
Sure, it would be cool to create this CS! If someone can write draft of the ToC for it that would be awesome.
Do you have a template you would like me to follow or is it best to just look at others and mimic?
From the ReadMe `- Start with a H1 of the cheat sheet name
- The first section of the cheat sheet should be an introduction which briefly sums up the contents, and provides a short list of key bullet points.
- The table of contents will be automatically generated on the site, so does not need to be added as a section.
- Headings should have a blank line after them.`
We do not have a template. Just bullet points/headers that we will fill the content.
@infosecdad Let me know when you would like a proof read or any other input from myself.
Hey @infosecdad 👋 I am interested in helping contribute to this - what's the current status? Is there a branch I can review and contribute to / collaborate with you?
Hey @nekosoft there is no work done yet for this issue. If you want to start it would be awesome! it is easier to find contributors if you already have some content ToC :)
Apologies, this semester was wicked busy, and I finished up finals last night. I have a draft that I will submit later today, thanks for the patience!
I will close this issue as we have new https://github.com/OWASP/CheatSheetSeries/issues/1114