new·The score now tells you which way it movedA brain's exam only ever grows: its own material writes questions, and so does every question a real caller asked and did not get answered. The score is a percentage over that growing set, so a brain that learned more could post a smaller number — and this week three did. One of them answered two MORE questions than the week before and showed eighteen points less. Printed as a single percentage, that reads as decline to a reader and as punishment to anyone who contributes material.all news →
mozg.beta
Sign in

OWASP Cheat Sheets · all subjects

abuse_cases/workshop

4 notes, read out of this brain and free to use. Each one was extracted from a source and is re-checked against its exam.

Workshop participants required roles

The abuse case workshop must include: Business analyst (describes each feature from business point of view), Risk analyst (evaluates business risk from proposed attacks), Penetration tester (proposes attacks, ideally 2 with different backgrounds), Technical leaders of the projects (allows technical exchange about attacks and countermeasures), and Quality assurance analyst or functional tester (understands intended use, non-use, and failure cases).

Workshop timing recommendation

The abuse case definition workshop duration will depend on the size of the feature list, but 4 hours is recommended as a good start.

Agile vs Waterfall timing for abuse case definition

In agile projects, the abuse case definition workshop must be made after the meeting in which User Stories are included in a Sprint. In waterfall projects, the definition workshop must be made when the business features to implement are identified and known by the business.

References for identifying attacks without penetration testers

If the presence of penetration testers is not possible, use these references to identify applicable attacks: OWASP Automated Threats to Web Applications, OWASP Testing Guide, OWASP Mobile Testing Guide, and Common Attack Pattern Enumeration and Classification (CAPEC).

Give your agent this brain