|
Web Application Security Consortium Establishes Official Charter and Delivers Web Security Threat Classification
Group Promotes Industry Standard Terminology of Web Security Threats
LAS VEGAS, Nev. - July 28, 2004 - Web Application Security Consortium (WASC), a group dedicated to developing and
promoting "security standards of best practice" for the World Wide Web, announced the completion of the WASC official
Charter and Web Security Threat Classification. Rising to meet the escalating challenges of Web security, WASC through
a collaborative effort focuses on assisting developers, security professionals and software vendors. WASC members include
industry professionals and representatives from Application Security, NT OBJECTives, Inc., Sanctum, SPI Dynamics, Inc. and
WhiteHat Security.
The Web Security Threat Classification is a cooperative effort to clarify and organize the threats to the security of a
Web site. The members of the WASC created this project to develop and promote industry standard terminology for describing
these issues. With the creation of the Web Security Threat Classification, application developers, security professionals,
software vendors and compliance auditors have the ability to access a consistent language for Web security related issues.
"The Web Application Security Consortium brings together leading experts in the field to
develop a common classification of Web application security problems." said Jeremiah Grossman, spokesperson and co-founder
of WASC. "WASC members are eager to continue the momentum of our efforts and look forward to new projects to share with the
security community."
Web security vulnerabilities continually impact the critical risk of doing business on the Web. When any Web security
vulnerability is identified, performing the attack requires using at least one of several application attack techniques,
or class of attack. These techniques include types of attacks such as Buffer Overflows, SQL Injection and Cross-Site
Scripting. As a baseline, the class of attack is the method the Web Security Threat Classification uses to explain and
organize the threats to a Web site. The Web Security Threat Classification compiles and distills the known unique classes
of attack, which have presented a threat to Web sites in the past. Independent security review methodologies, secure
development guidelines, and product/service capability requirements will all benefit from WASC's Web Security Threat
Classification.
WASC has identified its primary objectives to best address the challenges of developing security standards for the Web,
which include:
1. Identify the security risks to e-business and privacy on the Web.
2. Establish consistent technical terminology relating to Web security issues.
3. Establish Web application security standards of best practice for secure software development, independent
security review and policy guidelines.
WASC welcomes feedback and contribution from the industry. For more information on becoming a member of WASC, please visit
http://www.webappsec.org or e-mail contact@webappsec.org.
About the Web Application Security Consortium
Founded in January 2004, the Web Application Security Consortium (WASC) is a group of top security experts dedicated to
developing and promoting standards of best practice for the World Wide Web. Through firsthand experience, WASC members
understand the risks of conducting business online and the challenges of securing Web sites against all conceivable
threats. WASC will improve Web application security by assisting application developers, security professionals and
software vendors. Through a collaborative effort with the community, WASC feels strongly that significant progress
can be made to enhance the overall security of the Web. For more information, please visit the Web Application Security
Consortium homepage: http://www.webappsec.org
|
