OWASP - User contributions [en]

User:Luisenriquez

2019-06-03T10:34:36Z

Luisenriquez:

'''EDUCATION'''
- PHD (c)in cybersecurity and law - Univerité de Lille (France)
- LLM in Information Technology Law, Leibniz Universität Hannover (Germany)
- CEH, CHFI, ECSA, CIH (Ec Council certifications)
- HD Data Recovery Expert (Ace Labs - Russia)
- SONOLOGY AND ALGORITHM COMPOSITION, Institute of Sonology ( The
Netherlands), 2003 – 2005.

'''PROFESSIONAL PROFILE'''

- Expert in GDPR compliance.

- GDPR metrics.

- Lawyer specialized in Copyrights, Copylefts, FOSS licenses(GPL, LGPL, Apache, Mozilla, BSD,
MIT), E-discovery, Data Protection, Data Security, Privacy, and all issues related to the Internet and new technologies.

- IT security expert : Ethical Hacker, Pen Tester, Digital Forensics Examiner, and Data Recovery expert.

- Programmer with high level in C, C++ and Python.

- Ethical Hacking and Digital Forensics teacher : Université de Lille.
- Cybercrime teacher : Universidad Andina Simón Bolívar.
- Digital Forensics teacher: Universidad UTE.
- Data protection teacher: Foundation pour le droit continental - Université de Paris 2.
- Electronic voting teacher: IAEN.

OWASP Security Labeling System Project

2019-06-03T10:28:19Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications.

== HOW DOES IT WORK?==
:There are 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is based on the OWASP Application Security Verification Standard(ASVS). Web applications will get a rating based on the Applications Security Verification levels on the AVSV standard(cursory, standard, opportunistic, and advanced).

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden backdoors, and non-transparent policies. This label will require a Privacy scanning policy that may be based on the OWASP Top Ten Privacy project. Web applications must follow ethical principles of data processing and data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is only possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, APIs, and so on. This label is about Web Applications exposing all their ingredients, including third party code and dependencies.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This label consists on a scanning policy based on the OWASP Top Ten project, and making the scan visible.

| style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in June - 2015. In the mean time we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered into the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) in a visible place within your Web application, copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling system requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, Web service providers assume a direct compromise with their users.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| style="padding-left:25px;width:200px;" valign="top" |

== NEWS AND EVENTS ==
* The proposal of this project has been relaunched. We are examining with a new team the possibilities of a joint venture for complying the new legal regulations such as GDPR in the summer of 2019.

'''YOU ARE ALL INVITED TO JOIN THIS SECURITY PROJECT'''.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| rowspan="2" width="50%" valign="top" align="center" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| width="50%" valign="top" align="center" | [[File:Owasp-builders-small.png|link=]]
|-
| width="50%" valign="top" align="center" | [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses on your web applications in a visible place. You could also add them into your license contracts, terms of services or privacy policies. If your software is licensed under the terms of a generic-purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security starts with secure coding and mantainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Web application uses a scan policy based on the OWASP top ten Privacy project. Reports can be downloaded here.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This Web application discloses a list of all its components and third party code, including source code, plug-ins, shared libraries. Reports can be downloaded here.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application is regularly scanned by a policy based on the OWASP top ten project. Reports can be downloaded here.

THIS COMPROMISE IS VALID AS LONG AS THE WEB APPLICATION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: It is based on trust and reputation.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: Web Applications must be developed and maintained with a security orientation.

'''Why is the Security label (S) relevant?'''
: Users have the right to know if web applications are secure enough. This is the main purpose of OWASP. Currently we propose using the AVSV standard as it provides a basis for testing web application technical security controls.

'''What is the Privacy label (P) about?'''
: Surveillance code, misuse of personal data, and non-transparent policies are as dangerous as code vulnerabilities.

'''Why is the Privacy label relevant?'''
: Users have the right to know how their information is processed and stored. We propose developing a privacy scan policy based on the OWASP Top Ten Privacy Project.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, and shared libraries.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to rate security. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Vulnerabilities such as XSS scripting and SQL injection must be efficiently fixed.
: Scan policies must be based on the OWASP Top ten Project.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a logo and a declaration. The logo must be visible within the web application, and linked to the declaration and reports stored on the OWASP security labeling system records. The declaration may also be included within the web application, or as part of IT contracts, copyright licenses(additional terms for public licenses), terms of service, or privacy policies.

'''(3) Create a secure server in order to generate genuine certificates for the labeled web applications. '''WE ARE HERE

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''OPENNESS LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Get into the testing program.
* Improve the system.
* Translate the documents to other languages.
* Improve this wiki.

---------------------------------------------------------------

=DEMO (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */'''''

'''''/*FIRST: The logos could be placed in the front page of the website: */'''''

[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:''

1. OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.

SECURITY LABEL CLAUSE: Security starts with secure coding and maintainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".

PRIVACY LABEL CLAUSE: Security is about Trust. This Web application uses a scan policy based on the OWASP top ten Privacy project. Reports can be downloaded here.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application is regularly scanned by a policy based on the OWASP top ten project. Reports can be downloaded here.

THIS COMPROMISE IS VALID AS LONG AS THIS WEB APPLICATION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Document]]

OWASP Security Labeling System Project

2019-06-03T10:19:48Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications.

== HOW DOES IT WORK?==
:There are 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is based on the OWASP Application Security Verification Standard(AVSV). Web applications will get a rating based on the Applications Security Verification levels on the AVSV standard(cursory, standard, opportunistic, and advanced).

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden backdoors, and non-transparent policies. This label will require a Privacy scanning policy that may be based on the OWASP Top Ten Privacy project. Web applications must follow ethical principles of data processing and data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is only possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, APIs, and so on. This label is about Web Applications exposing all their ingredients, including third party code and dependencies.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This label consists on a scanning policy based on the OWASP Top Ten project, and making the scan visible.

| style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in June - 2015. In the mean time we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered into the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) in a visible place within your Web application, copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling system requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, Web service providers assume a direct compromise with their users.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| style="padding-left:25px;width:200px;" valign="top" |

== NEWS AND EVENTS ==
* The proposal of this project has been relaunched. We are examining with a new team the possibilities of a joint venture for complying the new legal regulations such as GDPR in the summer of 2019.

'''YOU ARE ALL INVITED TO JOIN THIS SECURITY PROJECT'''.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| rowspan="2" width="50%" valign="top" align="center" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| width="50%" valign="top" align="center" | [[File:Owasp-builders-small.png|link=]]
|-
| width="50%" valign="top" align="center" | [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses on your web applications in a visible place. You could also add them into your license contracts, terms of services or privacy policies. If your software is licensed under the terms of a generic-purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security starts with secure coding and mantainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Web application uses a scan policy based on the OWASP top ten Privacy project. Reports can be downloaded here.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This Web application discloses a list of all its components and third party code, including source code, plug-ins, shared libraries. Reports can be downloaded here.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application is regularly scanned by a policy based on the OWASP top ten project. Reports can be downloaded here.

THIS COMPROMISE IS VALID AS LONG AS THE WEB APPLICATION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: It is based on trust and reputation.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: Web Applications must be developed and maintained with a security orientation.

'''Why is the Security label (S) relevant?'''
: Users have the right to know if web applications are secure enough. This is the main purpose of OWASP. Currently we propose using the AVSV standard as it provides a basis for testing web application technical security controls.

'''What is the Privacy label (P) about?'''
: Surveillance code, misuse of personal data, and non-transparent policies are as dangerous as code vulnerabilities.

'''Why is the Privacy label relevant?'''
: Users have the right to know how their information is processed and stored. We propose developing a privacy scan policy based on the OWASP Top Ten Privacy Project.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, and shared libraries.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to rate security. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Vulnerabilities such as XSS scripting and SQL injection must be efficiently fixed.
: Scan policies must be based on the OWASP Top ten Project.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a logo and a declaration. The logo must be visible within the web application, and linked to the declaration and reports stored on the OWASP security labeling system records. The declaration may also be included within the web application, or as part of IT contracts, copyright licenses(additional terms for public licenses), terms of service, or privacy policies.

'''(3) Create a secure server in order to generate genuine certificates for the labeled web applications. '''WE ARE HERE

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''OPENNESS LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Get into the testing program.
* Improve the system.
* Translate the documents to other languages.
* Improve this wiki.

---------------------------------------------------------------

=DEMO (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */'''''

'''''/*FIRST: The logos could be placed in the front page of the website: */'''''

[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:''

1. OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.

SECURITY LABEL CLAUSE: Security starts with secure coding and maintainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".

PRIVACY LABEL CLAUSE: Security is about Trust. This Web application uses a scan policy based on the OWASP top ten Privacy project. Reports can be downloaded here.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application is regularly scanned by a policy based on the OWASP top ten project. Reports can be downloaded here.

THIS COMPROMISE IS VALID AS LONG AS THIS WEB APPLICATION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Document]]

OWASP Security Labeling System Project

2019-06-03T10:17:05Z

Luisenriquez: /* MOTIVATION */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications.

== HOW DOES IT WORK?==
:There are 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is based on the OWASP Application Security Verification Standard(AVSV). Web applications will get a rating based on the Applications Security Verification levels on the AVSV standard(cursory, standard, opportunistic, and advanced).

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden backdoors, and non-transparent policies. This label will require a Privacy scanning policy that may be based on the OWASP Top Ten Privacy project. Web applications must follow ethical principles of data processing and data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is only possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, APIs, and so on. This label is about Web Applications exposing all their ingredients, including third party code and dependencies.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This label consists on a scanning policy based on the OWASP Top Ten project, and making the scan visible.

| style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in June - 2015. In the mean time we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered into the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) in a visible place within your Web application, copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling system requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, Web service providers assume a direct compromise with their users.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| style="padding-left:25px;width:200px;" valign="top" |

== NEWS AND EVENTS ==
* The proposal of this project is being FIXED. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Openness label''' in June - 2015.

'''YOU ARE ALL INVITED TO JOIN THIS SECURITY PROJECT'''.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| rowspan="2" width="50%" valign="top" align="center" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| width="50%" valign="top" align="center" | [[File:Owasp-builders-small.png|link=]]
|-
| width="50%" valign="top" align="center" | [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses on your web applications in a visible place. You could also add them into your license contracts, terms of services or privacy policies. If your software is licensed under the terms of a generic-purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security starts with secure coding and mantainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Web application uses a scan policy based on the OWASP top ten Privacy project. Reports can be downloaded here.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This Web application discloses a list of all its components and third party code, including source code, plug-ins, shared libraries. Reports can be downloaded here.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application is regularly scanned by a policy based on the OWASP top ten project. Reports can be downloaded here.

THIS COMPROMISE IS VALID AS LONG AS THE WEB APPLICATION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: It is based on trust and reputation.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: Web Applications must be developed and maintained with a security orientation.

'''Why is the Security label (S) relevant?'''
: Users have the right to know if web applications are secure enough. This is the main purpose of OWASP. Currently we propose using the AVSV standard as it provides a basis for testing web application technical security controls.

'''What is the Privacy label (P) about?'''
: Surveillance code, misuse of personal data, and non-transparent policies are as dangerous as code vulnerabilities.

'''Why is the Privacy label relevant?'''
: Users have the right to know how their information is processed and stored. We propose developing a privacy scan policy based on the OWASP Top Ten Privacy Project.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, and shared libraries.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to rate security. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Vulnerabilities such as XSS scripting and SQL injection must be efficiently fixed.
: Scan policies must be based on the OWASP Top ten Project.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a logo and a declaration. The logo must be visible within the web application, and linked to the declaration and reports stored on the OWASP security labeling system records. The declaration may also be included within the web application, or as part of IT contracts, copyright licenses(additional terms for public licenses), terms of service, or privacy policies.

'''(3) Create a secure server in order to generate genuine certificates for the labeled web applications. '''WE ARE HERE

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''OPENNESS LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Get into the testing program.
* Improve the system.
* Translate the documents to other languages.
* Improve this wiki.

---------------------------------------------------------------

=DEMO (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */'''''

'''''/*FIRST: The logos could be placed in the front page of the website: */'''''

[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:''

1. OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.

SECURITY LABEL CLAUSE: Security starts with secure coding and maintainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".

PRIVACY LABEL CLAUSE: Security is about Trust. This Web application uses a scan policy based on the OWASP top ten Privacy project. Reports can be downloaded here.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application is regularly scanned by a policy based on the OWASP top ten project. Reports can be downloaded here.

THIS COMPROMISE IS VALID AS LONG AS THIS WEB APPLICATION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]]
[[Category:OWASP_Builders]]
[[Category:OWASP_Defenders]]
[[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-09-26T23:00:55Z

Luisenriquez: /* AGENDA */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Our first KBAPMP draft is finished. It is temporary hosted at github: [https://github.com/luisenriquez/kbapmp KBAPMP_DRAFT]. We are building a dynamic KBA sandbox for testing purposes. We need contributors.

KBAPMP Archive: Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NNI (NIST NSTIC IDESG) Initiative: https://www.owasp.org/index.php/OWASP_NNI_Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:bev.corwin@owasp.org Bev Corwin]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===

[https://github.com/luisenriquez/kbapmp KBAPMP] <br>

==== AGENDA ====

We will be presenting the KBAPMP standard at the OWASP APP SEC USA 2016 in Washington between October 11th and October 14th. For more information about the OWASP APP Sec USA 2016, please visit this link: [https://2016.appsecusa.org/ USA_APPSEC_2016]

All Meetings are Open and All are Welcome

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== September 23, 2016 ==

== Knowledge Based Authentication Performance Metrics Project (KBA-PMP) will be at AppSecUSA in Washington DC USA, October 11-14, 2016 for the OWASP Project Summit, for details see https://2016.appsecusa.org ==

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin <br>
Noreen Whysel <br>

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-09-26T23:00:22Z

Luisenriquez: /* News and Events */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Our first KBAPMP draft is finished. It is temporary hosted at github: [https://github.com/luisenriquez/kbapmp KBAPMP_DRAFT]. We are building a dynamic KBA sandbox for testing purposes. We need contributors.

KBAPMP Archive: Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NNI (NIST NSTIC IDESG) Initiative: https://www.owasp.org/index.php/OWASP_NNI_Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:bev.corwin@owasp.org Bev Corwin]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===

[https://github.com/luisenriquez/kbapmp KBAPMP] <br>

==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== September 23, 2016 ==

== Knowledge Based Authentication Performance Metrics Project (KBA-PMP) will be at AppSecUSA in Washington DC USA, October 11-14, 2016 for the OWASP Project Summit, for details see https://2016.appsecusa.org ==

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin <br>
Noreen Whysel <br>

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-09-26T22:59:36Z

Luisenriquez: /* News and Events */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Our first KBAPMP draft is finished. It is temporary hosted at github: [https://github.com/luisenriquez/kbapmp KBAPMP_DRAFT]. We ae building a dynamic KBA sandbox for testing purposes. We need contributors.

We will be presenting the KBAPMP standard at the OWASP APP SEC USA 2016 in Washington between October 11th and October 14th. For more information about the OWASP APP Sec USA 2016, please visit this link: [https://2016.appsecusa.org/ USA_APPSEC_2016]

KBAPMP Archive: Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NNI (NIST NSTIC IDESG) Initiative: https://www.owasp.org/index.php/OWASP_NNI_Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:bev.corwin@owasp.org Bev Corwin]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===

[https://github.com/luisenriquez/kbapmp KBAPMP] <br>

==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== September 23, 2016 ==

== Knowledge Based Authentication Performance Metrics Project (KBA-PMP) will be at AppSecUSA in Washington DC USA, October 11-14, 2016 for the OWASP Project Summit, for details see https://2016.appsecusa.org ==

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin <br>
Noreen Whysel <br>

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-09-26T22:56:54Z

Luisenriquez: /* News and Events */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Our first KBAPMP draft is finished. It is temporary hosted at github: [https://github.com/luisenriquez/kbapmp KBAPMP_DRAFT]
We will be presenting the KBAPMP standard at the OWASP APP SEC USA 2016 in Washington between October 11th and October 14th. For more information about the OWASP APP Sec USA 2016, please visit this link: [https://2016.appsecusa.org/ USA_APPSEC_2016]

KBAPMP Archive: Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NNI (NIST NSTIC IDESG) Initiative: https://www.owasp.org/index.php/OWASP_NNI_Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:bev.corwin@owasp.org Bev Corwin]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===

[https://github.com/luisenriquez/kbapmp KBAPMP] <br>

==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== September 23, 2016 ==

== Knowledge Based Authentication Performance Metrics Project (KBA-PMP) will be at AppSecUSA in Washington DC USA, October 11-14, 2016 for the OWASP Project Summit, for details see https://2016.appsecusa.org ==

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin <br>
Noreen Whysel <br>

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T12:43:28Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===

[https://github.com/luisenriquez/kbapmp KBAPMP] <br>

==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T12:40:05Z

Luisenriquez: /* Standard DRAFT */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===

[https://github.com/luisenriquez/kbapmp KBAPMP] <br>

==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T12:38:55Z

Luisenriquez: /* Standard DRAFT */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T12:35:00Z

Luisenriquez: /* Standard DRAFT */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===



[[KBAPMP draft]]

==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T12:33:16Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Standard DRAFT ===



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T09:30:43Z

Luisenriquez: /* Standard DRAFT */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

== Standard DRAFT ==



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T09:28:14Z

Luisenriquez: /* Contributors */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

== Standard DRAFT ==



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

== Current Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T09:25:14Z

Luisenriquez: /* April 20, 2016 */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

== Standard DRAFT ==



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github. We are closing our Second Phase. Now is time to Debug and test.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T09:23:47Z

Luisenriquez: /* May 19-20, 2015 */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

== Standard DRAFT ==



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== April 20, 2016 ==

First draft is released on github.

== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T09:21:23Z

Luisenriquez: /* Contributors */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

== Standard DRAFT ==



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Luis Enriquez <br>
Robert Faron <br>
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T09:20:55Z

Luisenriquez: /* Contributors */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

== Standard DRAFT ==



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Luis Enriquez
Robert Faron
Bev Corwin

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T09:19:12Z

Luisenriquez: /* KBA-PMP Project Metrics */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

== Standard DRAFT ==



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==




== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2016-04-21T09:15:58Z

Luisenriquez: /* Main */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== News and Events ==
Please see the [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#News News] and [https://www.owasp.org/index.php/OWASP_Knowledge_Based_Authentication_Performance_Metrics_Project#Talks Talks] tabs

==What is KBA-PMP ==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBA-PMP's goal is to establish standard performance metrics for knowledge based authentication, following a transnational perspective.

=='''KBA-PMP Best Practices'''==









'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



== Related Projects ==


[[ASVS]]

[[https://www.owasp.org/index.php/Choosing_and_Using_Security_Questions_Cheat_Sheet] Choosing and Using Security Questions Cheat Sheet]

OWASP NIST NSTIC Initiative

==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

== Standard DRAFT ==



==== AGENDA ====
All Meetings are Open and All are Welcome

* We are currently debugging draft v12. Join us on github. Don't forget to commit.

== KBA-PMP Project Metrics ==

https://github.com/KBA-PMP-ADMIN



== Classification ==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

= News =

== May 19-20, 2015 ==
== Knowledge Based Authentication Performance Metrics (KBA-PMP) holds its first Project Summit in Amsterdam, Netherlands see https://2015.appsec.eu/conference-program/ KBA-PMP and https://2015.appsec.eu/project-summit/. ==

= Talks =
== May 21, 2015 ==
== Co-Project Leaders Luis Enriquez and Ann Racuya-Robbins co-create a Lightning talk on the project's current essential features at the OWASP AppSec EU 2015 in Amsterdam, Netherlands. https://2015.appsec.eu/conference-program/ ==

= Road Map - Time Line =

OWASP KBA-PMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"

= Glossary =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

Performance Metrics

==Q==

==R==

==S==

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= KBA Concepts =

{{taggedDocument
| type=partialOld
| mode=silent
}}
{{compactTOC}}

{{SecureSoftware}}

==0–9==

==A==

==B==

==C==

==D==

==E==

==F==

==G==

==H==

==I==

==J==

==K==

==L==

==M==

==N==

==O==

==P==

==Q==

==R==

==S==

Scalability

==T==

==U==

==V==

==W==

==X==

==Y==

==Z==

= Acknowledgements =

==Contributors==

Luis Enriquez Project Co-Leader

= FAQs =

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2015-05-14T18:06:45Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications.

== HOW DOES IT WORK?==
:There are 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is based on the OWASP Application Security Verification Standard(AVSV). Web applications will get a rating based on the Applications Security Verification levels on the AVSV standard(cursory, standard, opportunistic, and advanced).

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden backdoors, and non-transparent policies. This label will require a Privacy scanning policy that may be based on the OWASP Top Ten Privacy project. Web applications must follow ethical principles of data processing and data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is only possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, APIs, and so on. This label is about Web Applications exposing all their ingredients, including third party code and dependencies.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This label consists on a scanning policy based on the OWASP Top Ten project, and making the scan visible.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in June - 2015. In the mean time we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered into the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) in a visible place within your Web application, copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling system requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, Web service providers assume a direct compromise with their users.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is being FIXED. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Openness label''' in June - 2015.

'''YOU ARE ALL INVITED TO JOIN THIS SECURITY PROJECT'''.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses on your web applications in a visible place. You could also add them into your license contracts, terms of services or privacy policies. If your software is licensed under the terms of a generic-purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security starts with secure coding and maintainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Web application uses a scan policy based on the OWASP top ten Privacy project. Reports can be downloaded here.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This Web application discloses a list of all its components and third party code, including source code, plug-ins, shared libraries. Reports can be downloaded here.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application is regularly scanned by a policy based on the OWASP top ten project. Reports can be downloaded here.

THIS COMPROMISE IS VALID AS LONG AS THE WEB APPLICATION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: It is based on trust and reputation.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: Web Applications must be developed and maintained with a security orientation.

'''Why is the Security label (S) relevant?'''
: Users have the right to know if web applications are secure enough. This is the main purpose of OWASP. Currently we propose using the AVSV standard as it provides a basis for testing web application technical security controls.

'''What is the Privacy label (P) about?'''
: Surveillance code, missuse of personal data, and non-transparent policies are as dangerous as code vulnerabilities.

'''Why is the Privacy label relevant?'''
: Users have the right to know how their information is processed and stored. We propose developing a privacy scan policy based on the OWASP Top Ten Privacy Project.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, and shared libraries.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to rate security. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Vulnerabilities such as XSS scripting and SQL injection must be efficiently fixed.
: Scan policies must be based on the OWASP Top ten Project.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Mauricio Gálvez (Security Consultant - Hosting)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a logo and a declaration. The logo must be visible within the web application, and linked to the declaration and reports stored on the OWASP security labeling system records. The declaration may also be included within the web application, or as part of IT contracts, copyright licenses(additional terms for public licenses), terms of service, or privacy policies.

'''(3) Create a secure server in order to generate genuine certificates for the labeled web applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''OPENNESS LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Get into the testing program.
* Improve the system.
* Translate the documents to other languages.
* Improve this wiki.

---------------------------------------------------------------

=DEMO (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.

SECURITY LABEL CLAUSE: Security starts with secure coding and maintainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".

PRIVACY LABEL CLAUSE: Security is about Trust. This Web application uses a scan policy based on the OWASP top ten Privacy project. Reports can be downloaded here.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application is regularly scanned by a policy based on the OWASP top ten project. Reports can be downloaded here.

THIS COMPROMISE IS VALID AS LONG AS THIS WEB APPLICATION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2015-03-31T18:12:57Z

Luisenriquez: /* NEWS AND EVENTS */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in March - 2015. In the mean time we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Privacy label''' in April - 2015

'''YOU ARE ALL INVITED TO JOIN THIS SECURITY PROJECT'''.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Mauricio Gálvez (Security Consultant)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Knowledge Based Authentication Performance Metrics Project

2015-03-23T14:15:44Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>


{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

==The KBAPM Project==

There is a lack of standard performance metrics regarding the use of knowledge based authentication (KBA) for remote identity proofing. KBAPMP's goal is to establish standard performance metrics for knowledge based authentication.

=='''The KBA Paradigms and Challenges'''==

=='''KBA Best Practices'''==







====KBAPM Project Supports the NSTIC Guiding Principles ====
KBAPM Project is dedicated to developing KBA Standards in alignment the the NSTIC Guiding Principle. To that end KBAPM Project has answered the IDESG Standards Committee Solicitation to develop Knowledge Based Authentication Performance Metrics Standards.

The IDESG, its components, and its members shall at all times operate in accordance with four Guiding Principles set forth in the NSTIC. They are:

'''1. Identity solutions will be privacy-enhancing and voluntary.'''



'''2. Identity solutions will be secure and resilient.'''



'''3. Identity solutions will be interoperable.'''



'''4. Identity solutions will be cost-effective and easy to use.'''



==Licensing==

Creative Commons Attribution ShareAlike 3.0 License


| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |



== Project Leaders ==

* [mailto:luis.enriquez@owasp.org Luis Enriquez]
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

== Project Manager ==
* [mailto:ann.racuya.robbins@owasp.org Ann Racuya-Robbins]

=== Join our Mailing List ===

[https://lists.owasp.org/mailman/listinfo/owasp_kbapm_project Mailing List]<br>

=== Follow us on Twitter ===

[https://twitter.com/owasp_kbapmp @OWASP_KBAPMP]<br>

== Our Next Meeting ==



==== Monday March 23, 2015 at 11:00 AM - 12:30 PM US Eastern Time ====
Our Meetings are Open and All are Welcome to Attend


*[https://www.dropbox.com/s/a8mm4msrkg9s6z5/2015-02-23%2011.20%20OWASP%20KBAPMP.mp3?dl=0 '''RECORDING of CONVERSATION with CRYPTOGRAPHER BILL BURR''']

==== AGENDA ====

Welcome

*'''Discussions:'''
** Building a KBA Evaluation Structure and Testing Methodology
** KBA Questions
** Outreach to KBA Providers and other Stakeholders Continues

*'''Ongoing:'''
*International Participants
*Discuss and Document Tools/Ways Update
*Information Management Update
*Blog Article Update
*Application to Conference in Amsterdam Update
**https://2015.appsec.eu/call-for-papers/
**https://2015.appsec.eu/call-for-research/

*Take aways: Tasks
*Schedule next meeting
*Adjourn

==== WHERE ====

GoToMeeting
'''https://www3.gotomeeting.com/join/642177878'''
'''Access Code: 642-177-878'''

2. Use your microphone and speakers (VoIP) - a headset is recommended. Or, call in using your telephone.
Dial +1 (571) 317-3112
Audio PIN: Shown after joining the meeting
Meeting ID: 642-177-878
GoToMeeting®
Online Meetings Made Easy®
Not at your computer? Click the link to join this meeting from your iPhone®, iPad® or Android® device via the GoToMeeting app
<br>









== Related Projects ==
OWASP Security Labeling System Project

[https://www.owasp.org/index.php/Projects/OWASP_Security_Labeling_System_Project]

OWASP NIST NSTIC Initiative

== KBAPM Project Metrics ==
https://www.openhub.net/accounts/KBAOpenHub
A performance metrics tool for the KBAPM Project

== Quick Download ==

== News and Events ==

== In Print ==

==Classifications==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:New projects.png|100px|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_DOC.jpg|link=]]
|}

|}

=FAQs=

==How can I participate in your project?==
All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

==If I am not a programmer can I participate in your project?==
Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator.

= Acknowledgements =

==Contributors==

= Road Map and Time Line =

OWASP KBAPMP - Knowledge Based Authentication Performance Metrics Project

Goals - To meet the requirements of the IDESG KBA Solicitation:

'''KBA PROJECT PHASES''' (PROPOSAL)
Dear KBA collegues, we propose an action plan divided in the following phases:

'''FIRST PHASE: SCANNING THE MARKET'''
The goal of this first phase, is to understand how KBA is working today (static and dynamic), and
how KBA methodologies have been implemented by KBA providers. I think this a good departure
point.
*1. Footprinting the KBA market providers.
*2. Identifying the KBA product providers used by the main market players.
*3. Identifying the advantages and drawbacks of KBA provider's methodology.
*4. Draw the document's structure.
**Complete document structure v1
*5. Initial Timeline
*5. Launch Participant Outreach

'''SECOND PHASE: DEVELOPMENT'''
Once the advantages and drawbacks of the KBA market have been clearly identified, it would be
necessary to have our own platform for testing purposes. This will give us the right perspective about
developing a transnational, neutral, secure, and market wise KBA standard. I would also suggest
building an open wiki, to get community feedback.
*1. Setting an Application for KBA testing purposes.
*2. Build an open wiki for community feedback.
*3. Test the KBA proposals in our test application.
*4. Analyzing the framework in crucial legal areas (such as Dynamic KBA and privacy).

'''THIRD PHASE: EDITION'''
This phase is very important, as it concerns the text edition. Once all proposals have being tested in our
lab, we should translate them into a clear document.
*1. Edit the contents of the sources (sources such as the wiki).
*2. Release the version 1.0. and license it under the terms of a suitable license.

Initial Overview
# Survey and research the Global OWASP Community and other networks to identify and recruit appropriate participation.
# Develop Opinion polls, foundations' research, interviews, perspectives on project, input from communities outside of the networks.
# Survey and research other standards groups and their interests.
# Phase I footprinting
# Phase II Development
# Phase III Implementation, Lessons Learned, Continuous refinement, Ongoing participation model, etc.
# Research Licensing models //

= Research Papers =

'''1. Knowledge Based Authentication: Paradigms and Challenges '''
https://drive.google.com/file/d/0B3AkniUi7NFeRXduS3pPQTJ6Mm8/view?usp=sharing"


__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2015-02-01T16:45:53Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in March - 2015. In the mean time we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Openness label''' in March - 2015

'''YOU ARE ALL INVITED TO JOIN THIS LIST'''.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Mauricio Gálvez (Security Consultant)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2015-01-22T16:24:28Z

Luisenriquez: /* NEWS AND EVENTS */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in March - 2015. In the mean we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Openness label''' in March - 2015

'''YOU ARE ALL INVITED TO JOIN THIS LIST'''.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Mauricio Gálvez (Security Consultant)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2015-01-22T16:23:42Z

Luisenriquez: /* NEWS AND EVENTS */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in March - 2015. In the mean we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Openness label''' in March - 2015

Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Mauricio Gálvez (Security Consultant)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2015-01-22T16:23:05Z

Luisenriquez: /* NEWS AND EVENTS */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in March - 2015. In the mean we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. A this is an experimental idea, We will start implementing each label by separate. We will start with the Openness label in March - 2015

Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Mauricio Gálvez (Security Consultant)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2015-01-22T16:21:44Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in March - 2015. In the mean we need open security promoters, to get submitted into the project's records.

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Mauricio Gálvez (Security Consultant)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-09-19T13:26:34Z

Luisenriquez: /* Road Map and Getting Involved */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-09-19T13:24:57Z

Luisenriquez: /* Road Map and Getting Involved */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet.''' This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-09-19T13:24:00Z

Luisenriquez: /* Road Map and Getting Involved */

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Create a secure server in order to generate genuine certificates for the labeled applications. '''WE ARE HERE'''

'''(4) Evaluate the labeling system with a voluntary Application on the Internet. This application will be promoted as the first Labeled application. We would start with the '''SECURITY LABEL''' If the results are good enough, we will add the other labels.

'''(4) Open the labeling system for any Application''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The labels can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:

* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-09-19T13:06:13Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A description of the security guides and the secure methodology used by the developer(s) of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not require unnecessary personal data of users. Personal data shall not be sold, commercialized, or miss-used without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-08-09T21:53:17Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-08-09T21:49:27Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install the executable), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This label is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy label is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-20T16:29:10Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his :device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Labelingsystem-widget.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

File:Labelingsystem-widget.png

2014-05-20T16:27:49Z

Luisenriquez: Another example

Another example

File:Example-web-labeling.png

2014-05-20T16:08:27Z

Luisenriquez: Luisenriquez uploaded a new version of "File:Example-web-labeling.png": width

example of widgets and look, for labeling system

File:Example-report.png

2014-05-20T16:07:12Z

Luisenriquez: Luisenriquez uploaded a new version of "File:Example-report.png": width

example for labeling system

OWASP Security Labeling System Project

2014-05-20T15:47:47Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his :device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
: '''S'''ecurity label (S).
: '''P'''rivacy label (P).
: '''I'''ngredients label (I).
: '''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Example-web-labeling.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-20T15:46:31Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
:It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his :device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
:The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following :recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency : check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or :surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data :protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is :built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their :components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on :exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
: Making security more visible.
: Is a transnational and market wise solution.
: Visual, and easy to apply.
: Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label (S).
'''P'''rivacy label (P).
'''I'''ngredients label (I).
'''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
: Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This :label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
: This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized :without your permission.

'''Why is the Privacy label relevant?'''
: Developers assume the legal compromise of not including hidden backdoors and surveillance code.
: The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
: Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
: Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
: avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
: It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
: last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
: The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
: Getting this label means that a security team reveals their vulnerabilities to the public as expected.
: but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Example-web-labeling.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-20T15:43:31Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
Making security more visible.
Is a transnational and market wise solution.
Visual, and easy to apply.
Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label (S).
'''P'''rivacy label (P).
'''I'''ngredients label (I).
'''O'''penness label (O).

'''What is the Security label (S) about?'''
: It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is : programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized without your permission.

'''Why is the Privacy label relevant?'''
Developers assume the legal compromise of not including hidden backdoors and surveillance code.
The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
Getting this label means that a security team reveals their vulnerabilities to the public as expected.
but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Example-web-labeling.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-20T15:39:23Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
The labeling system is classified by 4 labels:

'''* Security (S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy (P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients (I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness (O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
Making security more visible.
Is a transnational and market wise solution.
Visual, and easy to apply.
Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label (S).
'''P'''rivacy label (P).
'''I'''ngredients label (I).
'''O'''penness label (O).

'''What is the Security label (S) about?'''
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

'''Why is the Security label (S) relevant?'''
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

'''What is the Privacy label (P) about?'''
This label certifies that your software does not come with non-authorized spyware, and that your personal data will not be transfered or commercialized without your permission.

'''Why is the Privacy label relevant?'''
Developers assume the legal compromise of not including hidden backdoors and surveillance code.
The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label (I) about?'''
Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label (I) relevant?'''
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label (O) about?'''
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label (O) relevant?'''
Getting this label means that a security team reveals their vulnerabilities to the public as expected.
but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1) Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2) Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3) Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1 (source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2 (Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Example-web-labeling.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-14T20:15:31Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
The labeling system is classified by 4 labels:

'''* Security(S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy(P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients(I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness(O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://owaspsecuritylabelingsystem.blogspot.com/
http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator,legal representer, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
Making security more visible.
Is a transnational and market wise solution.
Visual, and easy to apply.
Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label(S).
'''P'''rivacy label(P).
'''I'''ngredients label(I).
'''O'''penness label(O).

'''What is the Security label(S) about?'''
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

'''Why is the Security label(S) relevant?'''
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

'''What is the Privacy label(P) about?'''
This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.

'''Why is the Privacy label relevant?'''
Developers assume the legal compromise of not including hidden backdoors and surveillance code.
The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label(I) about?'''
Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label(I) relevant?'''
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label(O) about?'''
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label(O) relevant?'''

Getting this label means that a security team reveals their vulnerabilities to the public as expected.
but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1)Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2)Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3)Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1(source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2(Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Example-web-labeling.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-14T20:09:38Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
The labeling system is classified by 4 labels:

'''* Security(S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy(P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients(I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness(O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator,legal representer, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO page for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
Making security more visible.
Is a transnational and market wise solution.
Visual, and easy to apply.
Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label(S).
'''P'''rivacy label(P).
'''I'''ngredients label(I).
'''O'''penness label(O).

'''What is the Security label(S) about?'''
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

'''Why is the Security label(S) relevant?'''
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

'''What is the Privacy label(P) about?'''
This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.

'''Why is the Privacy label relevant?'''
Developers assume the legal compromise of not including hidden backdoors and surveillance code.
The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label(I) about?'''
Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label(I) relevant?'''
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label(O) about?'''
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label(O) relevant?'''

Getting this label means that a security team reveals their vulnerabilities to the public as expected.
but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1)Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2)Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3)Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1(source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''

'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2(Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Example-web-labeling.png]]

'''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''''*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-14T20:07:12Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
The labeling system is classified by 4 labels:

'''* Security(S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy(P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients(I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness(O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator,legal representer, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO page for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
Making security more visible.
Is a transnational and market wise solution.
Visual, and easy to apply.
Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label(S).
'''P'''rivacy label(P).
'''I'''ngredients label(I).
'''O'''penness label(O).

'''What is the Security label(S) about?'''
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

'''Why is the Security label(S) relevant?'''
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

'''What is the Privacy label(P) about?'''
This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.

'''Why is the Privacy label relevant?'''
Developers assume the legal compromise of not including hidden backdoors and surveillance code.
The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label(I) about?'''
Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label(I) relevant?'''
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label(O) about?'''
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label(O) relevant?'''

Getting this label means that a security team reveals their vulnerabilities to the public as expected.
but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1)Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2)Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3)Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1(source code)=
'''''/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/'''''

'''''/* FIRST: Show the labels on the download page*/'''''

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

'''''/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */'''''

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

'''''/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/'''''

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/'''''Italic text''
''
'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2(Web Apps)=
'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */
'''''
'''''/*FIRST: The logos could be placed in the front page of the website: */''
'''
[[File:Example-web-labeling.png]]

'''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''Italic text''

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:'''/*(from here, clauses are not important)*/'''
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''*/FOURTH: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/'''''Italic text''

'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-12T23:43:01Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
The labeling system is classified by 4 labels:

'''* Security(S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy(P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients(I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness(O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The proposal of this project is READY. Time for Opinions and Corrections.

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator,legal representer, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO page for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
Making security more visible.
Is a transnational and market wise solution.
Visual, and easy to apply.
Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label(S).
'''P'''rivacy label(P).
'''I'''ngredients label(I).
'''O'''penness label(O).

'''What is the Security label(S) about?'''
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

'''Why is the Security label(S) relevant?'''
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

'''What is the Privacy label(P) about?'''
This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.

'''Why is the Privacy label relevant?'''
Developers assume the legal compromise of not including hidden backdoors and surveillance code.
The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label(I) about?'''
Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label(I) relevant?'''
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label(O) about?'''
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label(O) relevant?'''

Getting this label means that a security team reveals their vulnerabilities to the public as expected.
but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1)Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2)Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3)Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1(source code)=
/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2(Web Apps)=
/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */

[[File:Example-web-labeling.png]]

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:(from here, clauses are not important)
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-12T23:10:20Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
The labeling system is classified by 4 labels:

'''* Security(S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy(P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients(I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness(O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The project has begun. In this second phase we are shaping the labeling models. Please help us filling these OPINION POLLS:
*USERS POLL: https://docs.google.com/a/owasp.org/forms/d/1A0aijN4dI2HPZOktnRx8bWebrXlwI1C5Zh0gGcjSczE/
*DEVELOPERS POLL: https://docs.google.com/a/owasp.org/forms/d/1GNnve1SIxf8q5XGWZXJSmeSUzmKIEH5sQPQR3a-TTE8

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator,legal representer, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO page for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
Making security more visible.
Is a transnational and market wise solution.
Visual, and easy to apply.
Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label(S).
'''P'''rivacy label(P).
'''I'''ngredients label(I).
'''O'''penness label(O).

'''What is the Security label(S) about?'''
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

'''Why is the Security label(S) relevant?'''
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

'''What is the Privacy label(P) about?'''
This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.

'''Why is the Privacy label relevant?'''
Developers assume the legal compromise of not including hidden backdoors and surveillance code.
The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label(I) about?'''
Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label(I) relevant?'''
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label(O) about?'''
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label(O) relevant?'''

Getting this label means that a security team reveals their vulnerabilities to the public as expected.
but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1)Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2)Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3)Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1(source code)=
/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2(Web Apps)=
/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */

[[File:Example-web-labeling.png]]

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:(from here, clauses are not important)
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

OWASP Security Labeling System Project

2014-05-12T23:05:16Z

Luisenriquez:

=Main=

<div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_security_labeling_system2.png|link=]]</div>

{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

== PURPOSE ==
Making security VISIBLE for everybody.

== WHAT IS IT?==
It is system of security labels for web applications and software(in general). It can be used for any distributed software (when the user install in his device), or in web applications where the user connects to a server(as in cloud services).

== HOW DOES IT WORK?==
The labeling system is classified by 4 labels:

'''* Security(S).''' Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, Dependency check...)

'''* Privacy(P).''' Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

'''* Ingredients(I).''' Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This label consists on Software exposing their components and third party code.

'''* Openness(O).''' Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness label consists on exposing the Software or Web Application last vulnerability reports to the public.

| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

== IMPLEMENTATION==

The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.

STEP 1: Get Registered in the OWASP Security Labeling system Site.

STEP 2: Download the label-logo(s) and paste before your copyright license, license contract, terms of service, or privacy policy.

STEP 3: Incorporate the correspondent label-clause(s) into your copyright license, license contract,terms of service,or privacy policy.

== COMPROMISES ==
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the Labeling-logos, the Developer gets the compromise of following the OWASP labeling requirements.

- Between DEVELOPER and USERS. By incorporating the Labeling-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.

- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

== PRESENTATION ==

http://www.slideshare.net/luisenriquezA/owaspsecuritylabelingsystem

== MOTIVATION ==

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

| valign="top" style="padding-left:25px;width:200px;" |

== NEWS AND EVENTS ==
* The project has begun. In this second phase we are shaping the labeling models. Please help us filling these OPINION POLLS:
*USERS POLL: https://docs.google.com/a/owasp.org/forms/d/1A0aijN4dI2HPZOktnRx8bWebrXlwI1C5Zh0gGcjSczE/
*DEVELOPERS POLL: https://docs.google.com/a/owasp.org/forms/d/1GNnve1SIxf8q5XGWZXJSmeSUzmKIEH5sQPQR3a-TTE8

== PROJECT LEADER ==

Luis Enriquez

==LICENSING==
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.

== RELATED PROJECTS ==

* [[OWASP_Legal_Project]]
* [[OWASP_CISO_Survey]]

==CLASSIFICATIONS==

{| width="200" cellpadding="2"
|-
| align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
| align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
|-
| align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
|-
| colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
|-
| colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
|}

|}

= Labeling clauses =
''/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/''

----

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

==Security Label==

[[File:Owasp-security-scaled.png]]

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

==Privacy Label==
[[File:Privacy-scaled.png]]

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator,legal representer, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

==Ingredients Label ==
[[File:Owasp-ingredients-scaled.png]]

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

==Openness Label ==
[[File:Openness-scaled.png]]

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.
----

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

----
Please visit the DEMO page for a guide on how to apply this system to your computer programs distribution, or web applications.

=FAQs=

''' Why creating a security labeling system is important?'''
Making security more visible.
Is a transnational and market wise solution.
Visual, and easy to apply.
Different labeling categories for different purposes.

'''Which security labels can I add to my Software?'''
'''S'''ecurity label(S).
'''P'''rivacy label(P).
'''I'''ngredients label(I).
'''O'''penness label(O).

'''What is the Security label(S) about?'''
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

'''Why is the Security label(S) relevant?'''
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

'''What is the Privacy label(P) about?'''
This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.

'''Why is the Privacy label relevant?'''
Developers assume the legal compromise of not including hidden backdoors and surveillance code.
The user would also have the obligation of checking the software hashsums.

'''What is the Ingredients label(I) about?'''
Is about exposing all the components of your software, such as API's, shared libraries, third party software.

'''Why is the Ingredients label(I) relevant?'''
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
avoid non intentional license compatibility controversies, and so forth.

'''What is the Openness label(O) about?'''
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan.
The scans should be fixed in a regular basis(e.g. each week).

'''Why is the Openness label(O) relevant?'''

Getting this label means that a security team reveals their vulnerabilities to the public as expected.
but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =
==Volunteers==
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

* Luis Enriquez (Copyright & IT Lawyer)
* Jeff Williams (Computer Security Expert)
* Jorge Lara (Graphical Designer)

= Road Map and Getting Involved =
The priorities of the OWASP Security Labeling System are:

'''(1)Create and Distribute opinion polls to different sides involved in the IT environment'''(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape
the model.

'''(2)Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

'''(3)Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
You do not have to be a security or legal expert in order to contribute.
Some of the ways you can help:
* Distribute the opinion polls.
* Improve the system.
* Translate the 'clauses' to other languages in a legal way.
* Improve this wiki.

=DEMO1(source code)=
/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

[[File:Owasp-security-scaled.png]] [[File:Privacy-scaled.png]] [[File:Owasp-ingredients-scaled.png]]

Download jazz-scales.zip from here: [[File:Jazz-scales.zip]]

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

-------------------------------------------------
'''CERTIFICATE'''(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h
modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

---------------------------------------------------------------

=DEMO2(Web Apps)=
/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */

[[File:Example-web-labeling.png]]

''Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:(from here, clauses are not important)
- By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY:
- The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION:
- You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.
''
--------------------------------------------------------
'''CERTIFICATE'''(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://fosslawyers.org

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application: [[File:Example-report.png]]

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

=Project About=
{{:Projects/OWASP_Security_Labeling_System_Project}}

__NOTOC__ <headertabs />

[[Category:OWASP Project]] [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]] [[Category:OWASP_Document]]

File:Example-web-labeling.png

2014-05-12T23:04:05Z

Luisenriquez: example of widgets and look, for labeling system

example of widgets and look, for labeling system