CONFidence 2016: OWASP-SKF Making the web secure by design (Glenn ten Cate)

### Overview At CONFidence 2016, Glenn ten Cate introduced the OWASP Security Knowledge Framework (OWASP-SKF), an open-source project co-created with his brother, Riccardo ten Cate. Drawing from over a decade of penetration testing and code auditing experience, ten Cate highlighted that the same vulnerabilities recur continuously because developers lack reliable, centralized, and trusted security guidance. Using analogies from *The Matrix*, he emphasized that developers are "Neo"—the central figure possessing the context and capability to build secure applications by design, rather than treating security as an afterthought or relying on end-stage vulnerability patching.

### Key Topics - **OWASP-SKF Core Features:** The tool provides over 200 knowledge base items detailing attack vectors and mitigation guidance, alongside curated code examples in PHP and .NET (with Java and Python in development) to avoid insecure snippets commonly found on public forums. - **Pre-Development Threat Analysis:** During sprint planning, developers can map proposed functional features (such as user registration, forms, and sessions) to relevant security requirements and knowledge base items before writing code. - **OWASP ASVS Integration:** SKF adopts the OWASP Application Security Verification Standard (ASVS), created by Andrew van der Stock, incorporating around 170 security controls at Level 3. Developers choose among three verification levels based on application criticality (from basic Level 1 up to "paranoid" Level 3 used in banking and energy). - **Continuous Integration and Quality Gates:** Integrating security with code quality via automated CI/CD pipelines using GitHub, Travis CI, Coveralls, and Scrutinizer to catch regressions, maintain test coverage, and detect complex or duplicated code.

### Technical Details OWASP-SKF is developed as a Python Flask application that can be run locally on a developer's workstation or deployed on web servers like Apache or AWS. During the demo, ten Cate showed how selecting components in the pre-development phase prompts developers with critical implementation controls—such as enforcing GET/POST methods, implementing single-point input validation, audit logging, and using context-aware output encoding (such as distinguishing HTML body, HTML attribute, JavaScript, and href contexts to prevent XSS).

In the post-development phase, SKF acts as a dynamic checklist based on ASVS categories including architecture, authentication, session management, malicious input handling, and cryptography. Items marked as non-implemented correlate directly back to actionable knowledge base guidance. For software delivery, ten Cate illustrated a continuous pipeline where Travis CI handles build and dependency testing, Coveralls tracks unit test coverage, and Scrutinizer evaluates code quality metrics, enabling rapid and reliable security releases.

### Takeaways Automated SAST and DAST scanners act merely as secondary safety nets because they lack the business and architectural context that developers possess. Security must be established "by design" through clear upfront requirements, pre-sprint threat modeling, ASVS verification, and peer code reviews for high-risk features. The speaker encouraged community contributions and peer mentorship across development teams to structurally close the software security gap.