Rename framework to business logic abuse definition framework

Feedback from @RB-KSDA: A substantial change we see is a move away from the term "attack" toward using "abuse," which implies a continued campaign and provides more scope for downstream mitigations. The term attack could imply an immediate need for remediation and force a binary response, such as blocking or not blocking. In cases of business logic abuse multiple levers could be pulled to assist companies facing these challenges. Customers often need to make a business decision, not just a security decision.

Author: cyber-cyril

CHANGELOG.md

@@ -171,4 +171,5 @@
 - None
 
 ## Website
+- Renamed framework from Business Logic *Attack* Definition Framework to Business Logic *Abuse* Definition Framework and updated terminology accordingly. The term attack could imply an immediate need for remediation and force a binary response, such as blocking or not blocking. In cases of business logic abuse, multiple levers could be pulled to assist companies facing these challenges. Customers often need to make a business decision, not just a security decision
 - Tactics and techniques in Matrix and Killchain views are now displayed in alphabetical order

_config.yml

@@ -1,6 +1,6 @@
-title: "OWASP BLADE: Business Logic Attack Definition Framework"
+title: "OWASP BLADE: Business Logic Abuse Definition Framework"
 locale: "en-US"
-description: "The OWSAP Business Logic Attack Definition (BLADE) Framework, is an open-source knowledge-base created to help cybersecurity professionals fight cyber threats."
+description: "The OWASP Business Logic Abuse Definition (BLADE) Framework, is an open-source knowledge-base created to help cybersecurity professionals fight cyber threats."
 #tagline: "The BLADE framework for Bot attacks"
 remote_theme: "mmistakes/minimal-mistakes@4.23.0"
 

_layouts/home.html

@@ -4,10 +4,10 @@
 ---
 
 
-<p class="standfirst">The <a href="/matrix">OWASP Business Logic Attack Definition (BLADE) Framework</a>, is an open-source knowledge-base created to help cybersecurity professionals identify the <a href="/phases">phases</a>, <a href="/tactics">tactics</a> and <a href="/techniques">techniques</a> used by adversaries to exploit weaknesses in the business logic of web facing systems (websites and APIs).</p>
+<p class="standfirst">The <a href="/matrix">OWASP Business Logic Abuse Definition (BLADE) Framework</a>, is an open-source knowledge-base created to help cybersecurity professionals identify the <a href="/phases">phases</a>, <a href="/tactics">tactics</a> and <a href="/techniques">techniques</a> used by adversaries to exploit weaknesses in the business logic of web facing systems (websites and APIs).</p>
 <div class="columns">
-<p>There are a range of attack frameworks (such as Mitre ATT&CK and Lockheed-Martin Kill Chain) available to allow cyber-security experts to model and respond to traditional cyber-attacks which aimed to exploit technology weaknesses in systems. These frameworks are not well suited for modelling business logic focused attacks yet these kind of attacks are becoming increasingly common.<p>
-<p>Netacea's threat research team has worked with a range of security professionals to capture real world experience into a <a href="/matrix">framework</a> that captures the range of business logic attack types into a series of comprehensive <a href="/kill-chains">kill chains</a>, to allow security professionals to take a proactive approach in putting in defences against automated and business logic targeted attacks.</p>
+<p>There are a range of attack frameworks (such as Mitre ATT&CK and Lockheed-Martin Kill Chain) available to allow cyber-security experts to model and respond to traditional cyber-attacks which aimed to exploit technology weaknesses in systems. These frameworks are not well suited for modelling business logic focused abuse, yet this kind of abuse is becoming increasingly common.<p>
+<p>Netacea's threat research team has worked with a range of security professionals to capture real world experience into a <a href="/matrix">framework</a> that captures the range of business logic abuse types into a series of comprehensive <a href="/kill-chains">kill chains</a>, to allow security professionals to take a proactive approach in putting in defences against automated and business logic targeted abuse.</p>
 <p>If you wish to provide feedback or join the project team, please refer to the <a href="/contribute">Contribute</a> page for guidelines on how to do so. For further guidance on how to read and understand the framework please refer to the <a href="/resources">Resources</a> page. </p>
 <p>Not sure where to begin? Read our <a href="/assets/pdf/BLADE_guide_2022.pdf">'Getting Started with the OWASP BLADE Framework'</a> guide.</p>
 <p><a class="button" href="/matrix">Continue to the OWASP BLADE Framework matrix</a></p>

_pages/contribute.md

@@ -16,10 +16,10 @@ permalink: /contribute.html
 <p>If you wish to join the Core Contributors team, then please send an email to <a href="mailto:blade@netacea.com?subject=BLADE Framework - join core contributors">blade@netacea.com</a>. Please include your name, job role, and any associated company with whom you work.</p>
 
 <h2>History</h2>
-<p>The framework was initially created by the Threat Research Team at Netacea. This team consisted of Matthew Gracey-McMinn, Antony Barnett, and Liam Jones. Netacea is a specialist in handling Business Logic Attacks and providing Bot Management solutions. The Project initially began to aid Netacea in the detection and mitigation of business logic threats, but quickly evolved into an open-source project sponsored by Netacea. The team analysed the extensive data gathered by Netacea, and combined it with the results of focussed research into the stages of different Business Logic Attacks. These were then used to create the basis of a first draft of the BLADE Framework.</p>
+<p>The framework was initially created by the Threat Research Team at Netacea. This team consisted of Matthew Gracey-McMinn, Antony Barnett, and Liam Jones. Netacea is a specialist in handling Business Logic Abuse and providing Bot Management solutions. The Project initially began to aid Netacea in the detection and mitigation of business logic threats, but quickly evolved into an open-source project sponsored by Netacea. The team analysed the extensive data gathered by Netacea, and combined it with the results of focussed research into the stages of different cases of Business Logic Abuse. These were then used to create the basis of a first draft of the BLADE Framework.</p>
 
-<p>This first draft was then shared with a variety of individuals (several of whom later joined the Core Contributors team). These individuals provided feedback including new definitions, changes to existing definitions, and removal of unnecessary definitions. Once these changes had been implemented the framework was rolled out to further individuals and began to be employed in the detection and mitigation of Business Logic Attacks in a variety of business cases.
-On June 16th, 2021, the BLADE Framework was formally released as an open source framework. Its goal being to provide all defenders with a tool by which to understand and improve their ability to detect and defend against Business Logic Attacks.</p>
+<p>This first draft was then shared with a variety of individuals (several of whom later joined the Core Contributors team). These individuals provided feedback including new definitions, changes to existing definitions, and removal of unnecessary definitions. Once these changes had been implemented the framework was rolled out to further individuals and began to be employed in the detection and mitigation of Business Logic Abuse in a variety of business cases.
+On June 16th, 2021, the BLADE Framework was formally released as an open source framework. Its goal being to provide all defenders with a tool by which to understand and improve their ability to detect and defend against Business Logic Abuse.</p>
 
 <h2>Original Authors</h2>
 <ul>

_pages/kill-chains.html

@@ -5,7 +5,7 @@
 ---
 {% capture written_label %}'None'{% endcapture %}
 
-<p>Kill chains represent the attack lifecycles of specific business logic attacks. They describe the phases of the attack, the order in which the attack progresses through these phases, and the tactics and techniques employed by the adversary in each phase.</p>
-<p>The kill chains for common business logic attacks are provided below:</p>
+<p>Kill chains represent the abuse lifecycles of specific business logic abuse cases. They describe the phases of the abuse, the order in which the abuse progresses through these phases, and the tactics and techniques employed by the adversary in each phase.</p>
+<p>The kill chains for common business logic abuses are provided below:</p>
 <!--{% include page__kc.html %}-->
 {% include page__glossary.html %}

_pages/matrix.html

@@ -36,7 +36,7 @@
     }
 </script>
 
-<p>The BLADE Framework matrix depicts the relationship between the phases, tactics and techniques that may be employed by an adversary during a business logic attack.</p>
+<p>The BLADE Framework matrix depicts the relationship between the phases, tactics and techniques that may be employed by an adversary during business logic abuse.</p>
 
 <table id="matrix">
     <tr>

_pages/phases.html

@@ -5,7 +5,7 @@
 ---
 {% capture written_label %}'None'{% endcapture %}
 
-<p>Phases describe the distinct stages that a business logic attack may progress through. The specific phases employed by an adversary during an attack and the order in which the attack progresses through them depend on the adversary's goal.</p>
+<p>Phases describe the distinct stages that business logic abuse may progress through. The specific phases employed by an adversary during abuse and the order in which the abuse progresses through them depend on the adversary's goal.</p>
 
 <table class="blade-table">
     <thead>

_pages/tactics.html

@@ -5,7 +5,7 @@
 ---
 {% capture written_label %}'None'{% endcapture %}
 
-<p>Tactics describe the strategies that may be employed by adversaries during specific phases of business logic attacks. They are the high level activities that the adversary performs during each phase.</p>
+<p>Tactics describe the strategies that may be employed by adversaries during specific phases of business logic abuse. They are the high level activities that the adversary performs during each phase.</p>
 
 <table class="blade-table">
     <thead>

_pages/techniques.html

@@ -5,7 +5,7 @@
 ---
 {% capture written_label %}'None'{% endcapture %}
 
-<p>Techniques detail the specific actions or methods that may be employed by adversaries during business logic attacks. They are the low level activies that the adversary performs to achieve their tactical goal.</p>
+<p>Techniques detail the specific actions or methods that may be employed by adversaries during business logic abuse. They are the low level activities that the adversary performs to achieve their tactical goal.</p>
 
 <table class="blade-table">
     <thead>