OWASP · andreashappe · Sep 1, 2024 · Aug 31, 2024 · Aug 31, 2024 · Aug 31, 2024
diff --git a/.DS_Store b/.DS_Store
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
@@ -0,0 +1,24 @@
+name: Build Github Pages
+on:
+  push:
+    branches:
+      - main
+permissions:
+  contents: write
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - uses: actions/setup-python@v5
+        with:
+          python-version: 3.x
+      - uses: actions/cache@v2
+        with:
+          key: ${{ github.ref }}
+          path: .cache
+      - name: Install Dependencies
+        run: pip install mkdocs-material
+      - run: mkdocs gh-deploy --force --clean
diff --git a/.gitignore b/.gitignore
@@ -2,3 +2,4 @@ __pycache__
 env
 .vscode
 _site/
+.DS_Store
diff --git a/Gemfile b/Gemfile
diff --git a/LICENSE b/LICENSE
diff --git a/_config.yml b/_config.yml
diff --git a/assets/images/README.md b/assets/images/README.md
diff --git a/CNAME → docs/CNAME b/CNAME → docs/CNAME
diff --git a/v4/en/0x04-introduction.md → docs/about-top-10/introduction.md b/v4/en/0x04-introduction.md → docs/about-top-10/introduction.md
@@ -1,13 +1,3 @@
----
-
-layout: col-document
-tags: OWASP Top Ten Proactive Controls 2024, Intro
-document: OWASP Top Ten Proactive Controls 2024
-order: 404
-permalink: /v4/en/introduction
-
----
-
 # Introduction
 
 For years, developers have suffered through introducing the same security issues into the things they build. The most common issues, which have existed for decades, have been documented by the OWASP Top Ten. Many of the issues in the earliest version still exist in some form today. A mechanism is needed to counter these challenges, and that mechanism is proactive controls.
@@ -24,30 +14,18 @@ Please note that while complying with best proactive practices will reduce the c
 
 The OWASP Top 10 Proactive Controls 2024 is a list of security techniques every software architect and developer should know and heed. The main goal of this document is to provide concrete, practical guidance that helps developers build secure software. These techniques should be applied proactively at the early stages of software development to ensure maximum effectiveness.
 
-***How to Use this Document***
+### How to Use this Document
 
 This document’s main purpose is to provide a solid foundation of topics to help drive introductory software security developer training. To be effective, these controls should be used consistently and thoroughly throughout all applications.
 
 However, this document is a starting point rather than a comprehensive set of techniques and practices.
 
 A fully secure development process should include comprehensive requirements from a standard such as the OWASP ASVS in addition to including a range of software development activities described in maturity models such as [OWASP SAMM](https://www.owasp.org/index.php/OWASP_SAMM_Project) and [BSIMM](https://www.bsimm.com/).
 
-***Target Audience***
+### Target Audience
 
 This document is primarily written for developers. However, development managers, product owners, Q/A professionals, program managers, and anyone involved in building software can also benefit from this document. 
 
-***How this List Was Created***
-This list was originally created by the current project leads with contributions from several volunteers. The document was then shared globally so even anonymous suggestions could be considered. Hundreds of changes were accepted from this open community process.
-
-## Relationship to other OWASP Projects
-OWASP is a volunteer-driven organization. Those volunteers contributed many useful documents, and this section points to some related OWASP documents and projects:
-
-- The best-known OWASP document is the [OWASP Top 10](https://owasp.org/Top10/). They detail the most common web application vulnerabilities and are also the base for this document. In contrast, this document is focused on defensive techniques and controls as opposed to risks. Each control in this document will map to one or more items in the risk-based OWASP Top 10. This mapping information is included at the end of each control description.
-- The OWASP ASVS: [The OWASP Application Security Verification Standard (ASVS)](https://owasp.org/www-project-application-security-verification-standard/) is a catalog of available security requirements and verification criteria. OWASP ASVS can be a source of detailed security requirements for development teams. Security requirements are categorized into different buckets based on a shared higher order security function. For example, the ASVS contains categories such as authentication, access control, error handling / logging, and web services. Each category contains a collection of requirements that represent the best practices for that category drafted as verifiable statements.
-- OWASP SAMM [Software Assurance Maturity Model (SAMM)](https://www.opensamm.org/) is an open framework to help organizations implement a strategy for maturing the software security tailored to the specific risks of the organization. . [SAMM] (https://owaspsamm.org/about/) supports the complete software lifecycle and can be used to identify what
-- Threat Modeling is an important part of secure application development, which can help identify potential security threats, derive security requirements, and tailor security controls to prevent potential threats. Successful use of security requirements involves four steps: discovery, documentation, implementation, and verification of the correct implementation of the functionality within an application. Threat modelling is one way to derive security requirements. Other sources are: industry standards, applicable laws, history of past vulnerabilities. Modeling tools, like [OWASP Threat Dragon](https://owasp.org/www-project-threat-dragon/) can be used to create threat model diagrams as part of a secure development lifecycle. 
-
-It is important to notice that this document primarily focuses on web applications, but other Top 10s could apply to your application, too. Examples of those are:
-- OWASP API Top 10
-- OWASP Mobile Application Top 10
+### How this List Was Created
 
+This list was originally created by the current project leads with contributions from several volunteers. The document was then shared globally so even anonymous suggestions could be considered. Hundreds of changes were accepted from this open community process.
diff --git a/v4/en/0x03-about-structure.md → docs/about-top-10/structure.md b/v4/en/0x03-about-structure.md → docs/about-top-10/structure.md
@@ -1,28 +1,4 @@
----
-
-layout: col-document
-tags: OWASP Top Ten Proactive Controls 2024, Document Structure
-document: OWASP Top Ten Proactive Controls 2024
-order: 403
-
----
-
-# Document Structure
-
-This document is structured as a list of security controls. The list is ordered by importance with list item number 1 being the most important:
-
-* C1: Implement Access Control 
-* C2: Use Cryptography the right way
-* C3: Validate, Escape, Sanitize or Parameterize Untrusted Data
-* C4: Address Security from the Start
-* C5: Secure By Default Configurations 
-* C6: Assess and Update your Components 
-* C7: Implement Digital Identity
-* C8: Leverage Browser Security Features
-* C9: Implement Security Logging and Monitoring
-* C10: Stop Server Side Request Forgery
-
-## Security Controls
+# Security Controls
 
 The description of each control has the same structure. The control itself has an unique name preceeded by the control number: **Cx: Control Name**, e.g., *C1: Implement Access Control*.
 

diff --git a/v4/en/final-word.md → docs/final-word.md b/v4/en/final-word.md → docs/final-word.md
@@ -1,12 +1,3 @@
----
-
-layout: col-document
-tags: OWASP Top Ten Proactive Controls 2024, Final Word
-document: OWASP Top Ten Proactive Controls 2024
-order: 416
-
----
-
 # Final word
 
 This document should be seen as a starting point rather than a comprehensive set of techniques and practices. We want to again emphasize that this document is intended to provide initial awareness around building secure software.
@@ -20,5 +11,3 @@ Good next steps to help build an application security program include:
 
 
 If you have any questions for the project leadership team, please contact with your questions, comments, and ideas at our GitHub project repository: https://github.com/OWASP/www-project-proactive-controls/issues
-
-
diff --git a/v4/en/0x02-about-project.md → docs/index.md b/v4/en/0x02-about-project.md → docs/index.md
@@ -1,30 +1,20 @@
----
-
-layout: col-document
-tags: OWASP Top Ten Proactive Controls 2024, About Project
-document: OWASP Top Ten Proactive Controls 2024
-order: 402
-
----
-
 # About this Project
+
 Insecure software is undermining our financial, healthcare, defense, energy, and other critical infrastructure worldwide. As our digital, global infrastructure gets increasingly complex and interconnected, the difficulty of achieving application security increases exponentially. We can no longer afford to tolerate relatively simple security problems.
 
 ## Aim & Objective
-The goal of the **OWASP Top 10 Proactive Controls project** (OPC) is to raise awareness about application security by describing the most important areas of concern that software developers must be aware of. We encourage you to use the OWASP Proactive Controls to get your developers started with application security. Developers can learn from the mistakes of other organizations. We hope that the OWASP Proactive Controls is useful to your efforts in building secure software.
 
-## Call to Action  
-Please don’t hesitate to contact the OWASP Proactive Control project with your questions, comments, and ideas, either publicly by adding issues or providing commits on [our github page](https://github.com/OWASP/www-project-proactive-controls), to our email list, or privately to [jim@owasp.org](mailto:jim@owasp.org).
+The goal of the **OWASP Top 10 Proactive Controls project** (OPC) is to raise awareness about application security by describing the most important areas of concern that software developers must be aware of. We encourage you to use the OWASP Proactive Controls to get your developers started with application security. Developers can learn from the mistakes of other organizations. We hope that the OWASP Proactive Controls is useful to your efforts in building secure software.
 
 ## Copyright and Licence
-This document is released under the Creative Commons Attribution ShareAlike 3.0 license. For any reuse or distribution, you must make it clear to others the license terms of this work.
 
-## Project Leaders  
+This document is released under the Creative Commons Attribution-ShareAlike 4.0 International license. For any reuse or distribution, you must make it clear to others the license terms of this work.
 
-* Jim Manico 
-* Andreas Happe
-* Katy Anton 
-
+## Project Leaders (in alphabetical order)
+
+* [Andreas Happe](mailto:andreas.happe@owasp.org), connect through [linkedin](https://www.linkedin.com/in/andreashappe/), [github](https://github.com/andreashappe), [twitter/x](https://twitter.com/andreashappe)
+* [Jim Manico](mailto:jim.manico@owasp.org), connect through [linkedin](https://www.linkedin.com/in/jmanico/), [github](https://github.com/jmanico), [twitter/x](https://twitter.com/manicode)
+* [Katy Anton ](mailto:katy.anton@owasp.org), connect through [linkedin](https://www.linkedin.com/in/katyanton/), [github](https://github.com/katyanton), [twitter/x](https://twitter.com/katyanton)
 
 ## Contributors
 
@@ -34,6 +24,3 @@ This document is released under the Creative Commons Attribution ShareAlike 3.0
 * Carl Sampson
 * Eyal Estrin
 * Israel Chorzevski
-
-
-
diff --git a/v4/en/0x01-about-owasp.md → docs/introduction/about-owasp.md b/v4/en/0x01-about-owasp.md → docs/introduction/about-owasp.md
@@ -1,13 +1,3 @@
----
-
-layout: col-sidebar
-tags: OWASP Top Ten Proactive Controls 2024, AboutOWASP
-document: OWASP Top Ten Proactive Controls 2024
-order: 401
-permalink: /v4/en/
-
----
-
 # About OWASP
 
 The *Open Web Application Security Project* (OWASP) is a 501c3 non for profit educational charity dedicated to enabling organizations to design, develop, acquire, operate, and maintain secure software. All OWASP tools, documents, forums, and chapters are free and open to anyone interested in improving application security. We can be found at [www.owasp.org](https://www.owasp.org).

diff --git a/docs/introduction/contributing.md b/docs/introduction/contributing.md
@@ -0,0 +1,31 @@
+# How to Contribute?
+
+Please don’t hesitate to contact the OWASP Proactive Control project with your questions, comments, and ideas, either publicly by adding issues or providing commits on [our github page](https://github.com/OWASP/www-project-proactive-controls).
+
+You find the source code of the current version of the OWASP Top 10 Proactive Controls in the `docs/` directory within the git repository.
+
+When you check [our open issues on github](https://github.com/OWASP/www-project-proactive-controls/issues), you can see that some issues are tagged with `help wanted` or `good first issue`. Choose these if you want to help out the project!
+
+## How to test the OWASP Proactive Control website locally?
+
+If you can run python, you can locally run the OWASP Proactive Control website locally. We recommend this to test your changes before pushing them to github.
+
+To do this, we will use `venv` to create a local python environment to install the needed `mkdocs` package.
+
+```shell
+# creates and activates a new python environment in a new `venv` directory
+$ python3 -m venv venv
+$ source venv/bin/activate
+
+# install the mkdocs package
+$ pip install mkdocs-material
+
+# switch into your checked-out OWASP Proactive Controls directory
+$ cd owasp-proactive-controls
+
+# run the local webserver
+$ mkdocs server
+
+# now you can point your browser to http://localhost:8000 and check
+# how your changes will look like
+```
diff --git a/docs/introduction/in-the-news.md b/docs/introduction/in-the-news.md
@@ -0,0 +1,47 @@
+# OWASP Top 10 Proactive Controls in the News
+
+## 2024
+
+Introduction of the OWASP Top 10 Proactive Controls v4 and switch to new wiki system.
+
+## 2022
+
+- \[10 Nov 2022] [Blog Post by Kerr](https://kerr.ventures/2022/11/10/owasp-proactive-controls-the-answer-to-the-owasp-top-ten/)
+- \[13 June 2022] Featured on the [GitHub Blog](https://github.blog/open-source/write-more-secure-code-owasp-top-10-proactive-controls/)
+
+## 2019
+
+- \[July 2019\] Featured in Coursera course from UCDavies
+    [Identifying Security Vulnerabilities](https://www.coursera.org/directory/videos?courseId=V1k0pBtIEemZRAqH7m9oGA)
+- \[23 June 2019\] Featured on HackerCombat: [Implement OWASP Proactive Controls to Work](https://hackercombat.com/implement-owasp-proactive-controls-to-work/)
+- \[7 June 2019\] Feature on OWASP DevSlop Show [Proactive Controls](https://www.youtube.com/watch?v=Jdb3qweDc_Q)
+- \[15 May 2019\] Featured in TechBeacon: [Put OWASP Top 10 Proactive Controls to work](https://techbeacon.com/security/put-owasp-top-10-proactive-controls-work)
+- \[2 Mar 2019\] Webinar: [The OWASP Top Ten Proactive Controls with Jim Manico](https://www.youtube.com/watch?v=ldXe8f5yVq8)
+
+## 2018
+
+The OWASP Top 10 Proactive Controls 2018 (v3) were released.
+
+- \[Dec 2018\] Featured as the resource for Security “Shifting to the Left”\! in the ISC2 course: "DevSecOps: Integrating Security into DevOps”
+- \[20 Sep 2018\] Featured in TechBeacon: [OWASP Top 10 Proactive Controls 2018: How it makes your code more secure](https://techbeacon.com/owasp-top-10-proactive-controls-2018-how-it-makes-your-code-more-secure)
+- \[17 Sep 2018\] Binary Blogger Podcast Episodes: [OWASP Top 10 Proactive Controls Podcast Episodes](https://binaryblogger.com/2018/09/17/owasp-top-10-proactive-controls-podcast-episodes/)
+- \[9 May 2018\] Featured in [Developer's security guide: 50 online resources to shift left](https://techbeacon.com/developer-secure-code-starter-kit-resources)
+- \[7 May 2018\] 3.0 released\!
+
+## 2017
+
+- \[11 Aug 2017\] Presented at [Northeast PHP Conference](https://northeastphp2017.sched.com/event/B6uo/owasp-top-10-proactive-controls-2016)
+- \[25 July 2017\] Podcast about at [OWASP Top 10 Proactive Controls](https://www.appsecpodcast.org/2017/07/25/the-owasp-top-10-proactive-controls/)
+- \[12 May 2017\] Presented at [AppSec EU'17 -    Belfast](https://appseceurope2017.sched.com/event/A652/the-path-of-secure-software)
+- \[14 Feb 2017\] Featured in [Managing Cloud Infrastructure to Prevent Security    Gaps](http://wwpi.com/2017/02/14/managing-cloud-infrastructure-to-prevent-security-gaps/)
+- \[Feb 2017 \] Featured in "[Application Security Program: Protect    Against Data Breaches](http://assets.unisys.com/Documents/Global/POVPapers/POV_170062_ApplicationSecurityProgramProtectAgainstDataBreaches.pdf)"
+
+
+## 2016
+
+The OWASP Top 10 Proactive Controls 2016 (v2) were released on Jan, 14th 2016.
+
+- \[1 Oct 2016\] Presented at [PHPNW16](http://conference.phpnw.org.uk/phpnw16/speakers/katy-anton/)
+- \[5 July 2016\] Featured in [Incorporating Security Best Practices     into Agile   Teams](https://www.thoughtworks.com/insights/blog/incorporating-security-best-practices-agile-teams)
+- \[June 2016 \] Featured in [A Transformative Approach to Secure    Systems    Delivery](http://www.booz-allen.co.in/content/dam/boozallen/documents/Viewpoints/2016/06/transformative-approach-to-secure-systems-delivery.pdf)
+- \[2 June 2016\] Featured in [DevOpsSec - Securing Software through    Continuous    Delivery](http://www.oreilly.com/webops-perf/free/devopssec.csp)
-Original file line number
+Diff line change
@@ Expand Up / @@ -2,3 +2,4 @@ __pycache__ @@
     env
     .vscode
     _site/
+    .DS_Store