Open Web Application Security Project

Open Web Application Security Project
Name	Open Web Application Security Project
Type	Non-profit organization
Founded	2001
Location	Global
Focus	Web application security, application security

Open Web Application Security Project is an international non-profit organization focused on improving software security through community-led open-source projects, standards, and training. It produces widely cited resources, engages volunteers across industry and academia, and influences secure development practices used by corporations, governments, and technology communities. The organization operates via local chapters, working groups, and global events that connect practitioners, researchers, and policymakers.

History

Founded in 2001 amid rising public attention to software vulnerabilities and exploits following incidents involving Kevin Mitnick, Mudge (Peiter Zatko), Iain Thompson and high-profile breaches, the organization emerged as part of a broader movement alongside initiatives like CERT Coordination Center, SANS Institute, SecurityFocus, and Bugtraq (mailing list). Early contributors included members from Microsoft, IBM, HP, Sun Microsystems, and independent researchers active in forums such as DEF CON, Black Hat (conference), and Chaos Communication Congress. Throughout the 2000s it expanded in parallel with regulatory developments exemplified by Sarbanes–Oxley Act, Payment Card Industry Data Security Standard, and sector responses to incidents affecting Yahoo!, TJX Companies, Equifax, and Sony Interactive Entertainment. During the 2010s it partnered with standards bodies such as ISO/IEC JTC 1 committees, engaged with initiatives like OWASP Top Ten adoption discussions involving Department of Homeland Security, European Union Agency for Cybersecurity, and worked alongside academic programs at institutions including MIT, Stanford University, Carnegie Mellon University, and University of Cambridge.

Mission and Organization

The group's mission emphasizes collaborative improvement of software security across stakeholders including vendors, auditors, and developers. Governance has involved board members drawn from corporations like Google, Facebook, Amazon, Cisco Systems, Verizon, and nonprofit alliances including Internet Engineering Task Force, World Wide Web Consortium, and Institute of Electrical and Electronics Engineers. Structural elements include volunteer-driven working groups, regional chapters modeled on networks like ISACA chapters and ACM local chapters, and corporate sponsorship programs resembling partnerships with The Linux Foundation and European Cybercrime Centre. The organization maintains policies for intellectual property and contribution similar to practices at Apache Software Foundation and Mozilla Foundation.

Projects and Initiatives

Signature publications and initiatives have been developed by collaborative teams often intersecting with research from Stanford University, University of California, Berkeley, and labs such as Google Project Zero and Microsoft Research. Prominent outputs have influenced secure coding curricula at Carnegie Mellon University Software Engineering Institute, regulatory guidance from National Institute of Standards and Technology, and procurement frameworks used by agencies like United States Department of Defense and European Commission. Initiatives often collaborate with testing consortia such as OWASP Mobile Security Project analogs, penetration testing communities at Offensive Security, and vulnerability disclosure programs modeled on HackerOne and Bugcrowd.

Tools and Resources

The organization produces toolkits, standards, and educational materials used by security teams and developers at companies like Adobe Systems, Oracle Corporation, Intel Corporation, and Salesforce. Notable outputs have been integrated into continuous integration environments and developer platforms such as Jenkins (software), GitHub, GitLab, and Bitbucket. Tool categories include static analysis guidance comparable to products from Coverity and Fortify (software), dynamic testing references paralleling Burp Suite and Nmap, and threat modeling patterns related to work at Microsoft Threat Modeling Tool and STRIDE model. Resources are cited in textbooks authored by academics at Princeton University, ETH Zurich, and University of Oxford, and in training programs run by SANS Institute and ISC2.

Community and Events

Local and regional chapters host meetups and training modeled after formats used by IEEE Computer Society chapters and developer conferences like PyCon, JSConf, and QCon. Major events and summits attract delegates from corporations such as IBM, Accenture, Deloitte, and public-sector representatives from US-CERT, ENISA, and NATO Cooperative Cyber Defence Centre of Excellence. Volunteer contributors frequently come from research labs at Bell Labs, Sandia National Laboratories, and commercial security teams at CrowdStrike and Palo Alto Networks. The project’s community engagement resembles open-source collaboration seen in Linux kernel development and standards discussions within IETF working groups.

Impact and Criticism

The organization’s materials have been adopted widely by industry, referenced in academic research at Harvard University and Yale University, and cited in government procurement and compliance documents. Critics from some vendor communities and certain academic circles have raised concerns analogous to debates involving Common Vulnerabilities and Exposures attribution and the balance between disclosure and exploitation, paralleling controversies seen around Responsible disclosure and platforms like Exploit Database. Discussions have involved legal observers from firms linked to Electronic Frontier Foundation and policy analysts from Brookings Institution and Chatham House regarding influence, governance transparency, and commercial partnerships with corporations such as Microsoft and Amazon Web Services. Overall, its outputs continue to shape secure development practices used across enterprise, financial institutions like JPMorgan Chase and Goldman Sachs, and technology providers including Apple Inc. and Samsung Electronics.

Category:Computer security organizations