Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm a Java EE developer and I was wondering if anybody has had experience with the OWASP Project and could weigh-in as to how it measures up as a security standards organization. They have a huge website with multitudes of documents, sub-projects, frameworks/APIs, etc., and I just want to be sure that they are well-regarded before I start heading down the path of learning about it from the ground-up. I would hate to spend the next couple of weeks investing time & energy in this group only to find out that they aren't credible for whatever reason.

Are there other project bodies that are also open source that I should consider, as well?

share|improve this question

migrated from Sep 21 '11 at 19:10

This question came from our site for professional programmers interested in conceptual questions about software development.

up vote 4 down vote accepted

OWASP itself does have a large number of projects, some at greater maturity than others. As an organisation OWASP does have key initiatives which have been accepted globally, so you wouldn't be alone in choosing to learn more.

My main market includes global banks and other financial services organisations, as well as some other industries such as oil and gas, and aside from standards such as PCI-DSS, ISO 27001 etc, the single de-facto standard across their web security teams is the OWASP Top Ten.

ESAPI is also extensively used across the IT Security space, along with a few others.

share|improve this answer
Thanks @Rory - that was just the assurance I was looking for. – zharvey Sep 21 '11 at 19:54

Official "standards" are largely independent of actual bugs, and instead focus on the "process" for dealing with bugs. For example, they generally don't mention something specific like "SQL injection".

OWASP is the reverse. It's all about the Top 10 most common problems, but light on the processes you might use to fix them.

Certainly, there is considerable overlap, but that's the general idea.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.