Announcing the OWASP Product Security Project

I'm pleased to announce the creation of a new project to research the most important security risks for the new generation of product security as part of the OWASP Foundation.

In an era where cybersecurity threats loom large, it is imperative that we equip ourselves with the knowledge and resources necessary to protect against evolving risks. The OWASP Product Security Guide will emerge as a guiding light for developers, engineers, and security professionals alike, empowering them to ensure the integrity of their digital products.

While there has been a lot written lately on new LLM-related security threats, there hasn't been a single, well-organized, and vetted resource for coders and security researchers to learn about them. So, product security or Software Development Lifecycle require to be rethought from a new perspective. While the OWASP Product Security Guide is an outstanding resource "for developers and product security" teams, these newly developed LLM-based products have their own unique set of requirements that differ from standard web apps. That's why I proposed creating a new OWASP Product Security Guide. The project was just approved by the OWASP board and you can visit the new homepage on the OWASP site. If you'd like to dive in and participate more directly we have a new GitHub repository as well.

If you're already an OWASP member, we've set up a channel on the OWASP Slack Workspace. You can join the discussion on the #owasp-product-security-guide.

Resources

If you're new to Product security and you'd like to learn more about security threats to Products here are some good resources to start to educate yourself so you can jump in and help with the project. I hope you find them interesting and useful.

• https://www.dhirubhai.net/pulse/product-security-essentials-guide-keeping-your-products-/
• https://www.enterpriseready.io/features/product-security/
• https://simplemdm.com/product-security/
• https://hockeyinjune.medium.com/product-security-14127b5838ba
• https://chisellabs.com/blog/product-security/
• https://assets.thermofisher.com/TFS-Assets/CAD/Product-Guides/2023_PSIG_OMNIC_ProductSecurity_TP_FINAL.pdf
• https://www.cisa.gov/sites/default/files/2023-06/principles_approaches_for_security-by-design-default_508c.pdf