In this section:
The Parasoft OWASP Compliance artifact is a set of assets for your DTP infrastructure that enable you to demonstrate compliance with OWASP coding guidelines. The artifact is shipped as part of the Security Compliance Pack. Contact your Parasoft representative to download and license the Security Compliance Pack.
"OWASP Top 10: The Ten Most Critical Web Application Security Risks" is a collection of coding guidelines for ensuring web application security. OWASP Top 10 is focused on identifying the most serious web application security risks that affect many organizations. For each risk, OWASP provides information about the likelihood of a security vulnerability resulting from a violation, as well as its technical impact, using a ratings scheme based on the OWASP Risk Rating Methodology.
Where possible, the names of the risks in the Top 10 are aligned with Common Weakness Enumeration (CWE) weaknesses to promote generally accepted naming conventions and to reduce confusion.
See https://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project for additional information about OWASP Top 10.
In this documentation, we assume that you are familiar with the OWASP Top 10 guidelines, CWE, and associated terminology.
Code analysis data is required from one of the following Parasoft tools
See Security Compliance Pack for additional prerequisites information.
The following artifacts are included in the package and added to your DTP environment when you install the Security Compliance Pack.
This file is the custom logic flow for Extension Designer. Installing the Security Compliance Pack adds the flow to the Extension Designer library. You can then add the flow to a service and deploy it to your DTP infrastructure.
You can configure your tool to run either the test configurations it ships with or the test configurations installed with the Security Compliance Pack. Refer to your tool's documentation for details. The following test configurations are included in the compliance pack:
Dashboard templates include preconfigured widgets to help you quickly view specific information about your projects. Refer the Dashboards section to learn more about dashboards in DTP. See Adding the OWASP Dashboards for details about viewing the widgets that appear in the dashboard templates.
The Security Compliance pack ships with the following additional dashboard templates that include a combination of widgets configured to show CWE and OWASP compliance.
Individual code analysis rules belong to a category, such as Security, Exceptions, etc. The OWASP Compliance artifact includes files that map code analysis rules to OWASP-specific categories, i.e., weakness type or impact. You can configure widgets to report violations according to the categories defined in the following files to view them according to their OWASP category:
Profiles provide a range of functions in a DTP infrastructure, such as providing inputs for custom calculations executed by an extension and providing data for compliance reports. Profiles take their structure from models, which define fields, headers, or other components used in the profile. See Working with Model Profiles for information about understanding profiles in DTP Enterprise Pack.
The following profile files are included with the artifact:
For your convenience, PDFs that show the association between Parasoft rules and OWASP guidelines are located in the <PACK>/rules/jtest and <PACK>/rules/dottest directories:
OWASP_Top_10-2017.pdf
OWASP Compliance is installed as part of the Security Compliance Pack (see Installation for instructions). After installing the artifact, you must deploy the assets to your DTP environment.
You will now be able to add the OWASP dashboard and widgets.
The OWASP and UL 2900 dashboard templates enable you to quickly add a set of preconfigured widgets that monitor OWASP compliance. See Dashboard Templates for a list of the templates included with the OWASP Compliance artifact.
The dashboard template are deployed to your DTP environment as part of the Security Compliance Pack installation. If you do not see the dashboard template, restart DTP Services (see Stopping DTP Services and Starting DTP Services).
You can add the OWASP widgets shipped with the artifact to an an existing dashboard. See Adding Widgets for general instructions on adding widgets to a dashboard. After deploying the artifact, the OWASP widgets will appear in the OWASP category in the Add Widget overlay:
The following configurations are available:
| Title | Enter a new title to replace the default title that appears on the dashboard. |
|---|---|
| Filter | Choose a specific filter or Dashboard Settings from the drop-down menu. See Creating and Managing Filters for additional information. |
| Target Build | Choose a specific build from the drop-down menu. The build selected for the entire dashboard is selected by default. See Using Build Administration for additional information about understanding builds. |
| Compliance Profile | Specify a compliance profile (see Profile Configuration). The compliance profile data is used in compliance reports. |
| Exploitability | Choose an exploitability category (1 - 3) that you want to view. Refer to the OWASP guidelines for details. Only applies to the OWASP Compliance - Weakness by Status widget. |
| Prevalence | Choose a prevalence category (1 - 3) that you want to view. Refer to the OWASP guidelines for details. Only applies to the OWASP Compliance - Weakness by Status widget. |
| Detectability | Choose a detectability category (1 - 3) that you want to view. Refer to the OWASP guidelines for details. Only applies to the OWASP Compliance - Weakness by Status widget. |
| Impact | Choose an impact level (1 - 3) that you want to view. Refer to the OWASP guidelines for details. Only applies to the OWASP Compliance - Weakness by Status widget. |
See Dashboard Templates for a list of the dashboard templates shipped with the compliance artifact. The following widgets are included on one or more the dashboards:
This widget is included with the OWASP Compliance artifact. It shows the current state of compliance with OWASP Top 10.
There are seven possible states:
Click on the widget to open the OWASP Compliance Report.
If you deploy deploy the CWE Compliance and the UL 2900 dashboard for Java or .NET, a CWE Compliance - Status widget will also be included.
This widget is included with the OWASP Compliance artifact. It shows the concentration of violations and deviations by weakness risk for exploitability and prevalence.
Mouse over a cell in the chart to view the number of violations and suppressions for the specified risk level. Click on a cell to open the OWASP Compliance Report filtered according to the risk.
This widget is included with the OWASP Compliance artifact. It provides a chart showing the distribution of violations according to its risk as defined in the OWASP standard.
Mouse over a cell in the chart to view the number of violations and suppressions for the specified risk level. Click on a cell to open the OWASP Compliance Report filtered according to the risk.
This widget is included with the OWASP Compliance artifact. It shows the percentage of OWASP weaknesses that the code is in compliance with. Click on the widget to open the OWASP Compliance Report.
If you deploy the UL 2900 dashboard for Java or .NET, a CWE Compliance - Percentage will also be included.
Click on the widget to open the CWE Compliance report (see CWE Compliance for additional information).
This widget is included with the OWASP Compliance artifact. The red segment of the pie chart represents the weaknesses that the code is not compliant with. The green segment represents weaknesses that the code is in compliance with. The widget also shows the number of violations and deviations.
You can perform the following actions:
The UL 2900 dashboard for Java or .NET includes a CWE Compliance - Weakness by Status widget.
This widget is an implementation of the native DTP Rules in Compliance widget. It shows the percentage of Parasoft rules that are mapped to OWASP weaknesses that are not reporting a violation (are in compliance). See Rules in Compliance - Summary for details about the widget.
If you deploy the UL 2900 dashboard for Java or .NET, a Rules in Compliance widget configured for CWE compliance will be included.
The dashboard includes an instance of the native Categories - Top 5 Table widget configured for OWASP Top 10. It shows the five OWASP categories with the most violations. See Categories - Top 5 Table for details about the widget.
If you deploy the UL 2900 dashboard for Java or .NET, a Categories - Top 5 Table widget configured for CWE compliance will be included.
Rules - Top 5 Table
The dashboard includes an instance of the native Rules - Top 5 Table widget configured for OWASP Top 10. It shows the five Parasoft rules mapped to OWASP categories with the most violations. See Rules - Top 5 Table for details about the widget.
This widget shows the violations grouped by weakness in a tree map. Each tile is assigned a color and represents a weakness from the OWASP guidelines. See Configuring Security Compliance Pack Widgets for details on how to configure this widget.
The UL 2900 dashboards for Java or .NET include tree map widgets for CWE that opens to the Violations Explorer.
The main OWASP compliance report provides details about your OWASP compliance status and serves as the primary document for demonstrating compliance.
You can perform the following actions:
The Weakness Detection Plan shows which static analysis rules are used to enforce the OWASP guidelines and is intended to describe how you are enforcing each guideline. This report uses the data specified in the compliance profile (see Profile Configuration). In the profile, you can configure the values associated with each weakness property to better reflect the specific challenges associated with your project.
Your code can contain violations and still be OWASP-compliant as long as the deviations from the standard are documented and that the safety of the software is unaffected. Deviations are code analysis rules that have been suppressed either directly in the code or in the DTP Violations Explorer. See the dotTEST and Jtest documentation for details on suppressing violations in the code. See Suppressing Violations in the Violations Explorer documentation for information about suppressing violations in DTP.
Click on the Deviations Report link in the OWASP Compliance report to open the Deviations Report.
The Deviations Report shows all guideline IDs and headers, but guidelines that have been suppressed will show additional information. You can perform the following actions:
The Build Audit Report shows an overview of code analysis violations, as well as test results and coverage information, associated with the build. This report also allows you to download an archive of the data, which is an artifact you can use to demonstrate compliance with OWASP during a regulatory audit.
In order to download an archive, the build has to be locked. See Build Audit Report for additional details about this report.
Models and profiles are assets that enable DTP Enterprise Pack to perform custom calculations and data processing tasks. The model defines the attributes to be used in the calculations and acts as the template for a profile. See Working with Model Profiles to learn more about models and profiles.
The OWASP Compliance artifact ships with a default model and profiles for code analysis results from Parasoft dotTEST and Jtest. The model/profile assigns values to the detected weaknesses' exploitability, prevalence, and detectability. It also contains categorization information for mapping Parasoft rules to OWASP and OWASP API weaknesses.
The profile includes information necessary for generating compliance reports, as well as displaying data in the widgets shipped with the OWASP artifact. You can modify the profile if you want to re-categorize guidelines to meet your specific goals or specify additional metadata for your reports. Changes will be reflected in the Weakness Detection Plan.
We recommend creating a copy of the default profile and modifying the copy:
You will be able to choose an alternate profile when configuring the widgets shipped with the OWASP artifact.