OWASP Threat Dragon Project Update

OWASP Threat Dragon Project
Project: Leader: Mike Goodwin   Github Link

Threat modelling is a very powerful technique for finding and fixing design-level flaws in applications. It is especially good at promoting defence-in-depth. However, the free tooling that is currently available is limited. OWASP Threat Dragon aims to fix that by providing a free, open source threat modelling tool that

• Is cross-platform
• Is easy and enjoyable to use
• Integrates well with other SDLC tools
• Has a powerful threat generation rule engine

Although Threat Dragon is an Incubator project, it is progressing well and I hope it will be ready to be promoted to Labs soon. Some highlights of the project so far:

• The original working prototype has been given a major architecture review. This was my first node.js project and my first significant Angular application so there were quite a few kinks to be straightened out. Also, I completely rethought the model storage approach - originally it was using browser local storage like Mozilla SeaSponge, but this turned out to be problematic in practice.
• A web application variant that uses GitHub as a backend for storing model files. I have plans to add support for BitBucket and possibly other backends soon. This source control system integration is key to the success of the project IMO and I have lots of plans for deeper and better integration in the future.
• An installable, cross-platform desktop variant based on Electron and using the local file systems for model storage. This is important for people who use a source control system that is not supported by the web app variant, or for people who want to evaluate the tool without giving it access to their repos. The desktop variant shares >85% of it's code with the web app variant - including most of it's UI. This is critical to make it manageable by a small team (just me at the moment!). The desktop app is still a little rough around the edges compared to the web app (e.g. no auto-update on OSX yet) but it is getting there and most of my effort on the project is going into that at the moment.
• Good unit test coverage (>90%). Quality is not just for Flagship projects - Incubator projects need it too!
• A cute logo dragon called Cupcakes :o) (based on an original image by DreamsOfMine)

So what's next for Threat Dragon? Well, firstly, although I think it's progressing well on the first 3 key project aims, that's just my opinion. It needs feedback. Lots of feedback. All feedback is welcome - feature requests, bug reports or comments on any aspect of the project. Secondly, at the moment it can be used for basic threat modelling, but the threat generation engine is just a stub. You have to come up with all the threats yourself. Threat generation is the next major functional area that I plan to tackle - hopefully with some collaborators. Thirdly, did I say I was interested in feedback?

Please give it a try and let me know what you think!  

OWASP Project Releases

OWASP ZAP 

New Release 2/6/17

• Change Session to no longer call/use ExtensionActiveScan.
• Change ActiveScanController to obtain the excluded URLs (session and global) instead of having the Session to set them.
• Change ExtensionActiveScan to allow to set a list of excluded URLs and to not change running active scans, normalizing the behavior with the normal spider.

OWASP Code Pulse

New Release 1/19/2017 Latest Release Version 1.1.4

Code Pulse 1.1.4 brings along updates to the distributed stack:

• ASM has been updated to version 5.1 - this enables Java 8 tracing support
• Java, Jetty, and NW.js have been updated to the latest versions
• Dependency-Check has been updated to the latest version

OWASP Juice Shop

New Release 1/30/2017 Latest Release Version v2.21.2

• The name field of all challenges was changed to a more human- and CTF-friendly form (see #264)

OWASP Off  The Record 4 Java

OWASP Foundation would like to welcome Project Leader Jigar Joshi !

Type of Project: Code Project

Project: OWASP Off  The Record 4 Java

Brief Description:

Privacy is daily reality for many internet users. Eavesdropping user's content and using it for various reason is not desired by many of the application users. Putting trust on communication channel, service provider or government not to intercept your content is not a good idea.

OTR framework solves this problem by cryptographically processing the users content in transit and at rest. No eavesdropper can read the content, not even the service provider.

Combating the Vulnerability Chaos with OWASP DefectDojo

Four short years ago, I spent 35% of my time actually hacking on products and 65% of my time writing reports and recording metrics. Our team tried a multitude of tools to make our lives easier, but it seemed to only increase our turnover rates. The landscape of security has never been harder to manage with the numerous hoops engineers and penetration testers have to jump through to actually do their job.To alleviate our frustration and lack of options we created DefectDojo, a free and open-source vulnerability management tool.

Home Screen:  Here is what you will see when you first login to DefectDojo.
It provides a quick overview of the state of your security program.

DefectDojo is a tool that not only stores findings, but also helps to streamline your entire application security program. It simplifies vulnerability management by offering templating, report generation, metrics, finding deduplication, and baseline self-service tools to allow security engineers and penetration testers to spend their time on their actual expertise, hacking. Comprehensive details on all of DefectDojo’s features can be found on our official docs.

Templating: DefectDojo's templating system saves time on reporting
 by allowing users to recycle previous entries on similar issues.

Report Generation: DefectDojo includes a multitude of options to generate custom reports including
 filtering for a specific engagement or test-type. For an example report see the link below.

Sample Report

Self-Service Tools: DefectDojo includes self-service tools that allow teams to schedule
their own scans and store the results back into DefectDojo.

Scanner Integration: DefectDojo allows you to import scan data from multiple commercial and open-source security tools.

Every code change is checked for quality and security with continuous testing using Travis CI.  We do this to ensure that future updates do not break the current build.  We also run the same series of tests against any contributed code.  Speaking of contributions, we’re happy to take your pull requests, feature requests or donations to keep DefectDojo moving forward.  We’ve had several pull requests from new contributors, including a recent one that added file uploads to the REST API.  

Continuous Integration: Every code change is run against a series of of tests to ensure stable updates.

It is easy to make Dojo your own.  You can install DefectDojo using a single command on all Linux systems and OS X. There is also an option for Docker. The project is written with Python/Django. If you wanted to add or alter any features or displays to personalize your instance, only three files need to be changed (models.py, views.py, and templates).

DefectDojo is currently used by multiple large enterprises and has core contributors from five different organizations including Rackspace, Rapid7, Pearson, Cengage, and the OWASP Foundation.

DefectDojo works at scale. For example, Pearson uses DefectDojo to manage application security engagements for 2,000+ applications written by 5,000+ developers with operations on every continent.

If you’re curious about DefectDojo, there is a live demo.

You can log in as an administrator like so:

You can also log in as a product owner / non-staff user:

Please direct all inquires to greg.anderson@owasp.org