Industry:Draft NIST SP 800-122 - Revision history

Clerkendweller at 15:38, 13 March 2009

2009-03-13T15:38:06Z

Clerkendweller: /* Submission Response */ Added link to PDF

2009-03-13T15:36:31Z

‎Submission Response: Added link to PDF

Clerkendweller: Final version created / status changed to completed

2009-03-13T15:26:50Z

Final version created / status changed to completed

Clerkendweller: Added about OWASP for Draft 2

2009-03-12T15:31:43Z

Added about OWASP for Draft 2

Clerkendweller: Created draft 1 with explanations

2009-02-16T14:54:08Z

Created draft 1 with explanations

Clerkendweller: Colin added as primary contact

2009-02-11T14:43:54Z

Colin added as primary contact

Clerkendweller at 12:53, 31 January 2009

2009-01-31T12:53:28Z

Clerkendweller: Mailing list

2009-01-29T18:16:43Z

Mailing list

Clerkendweller: Wording change

2009-01-29T17:00:57Z

Wording change

Clerkendweller: New page

2009-01-21T17:21:50Z

New page

New page

__NOTOC__

Return to [[Global Industry Committee]]

{| style="width:100%" border="0" align="center"
! colspan="4" align="center" style="background:#4058A0; color:white"|'''ACTIVITY IDENTIFICATION'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Activity Name'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|'''Draft NIST SP 800-122'''
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Short Description'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|Provide response to "Draft NIST Special Publication 800-122 Guide to Protecting the Confidentiality of Personally Identifiable Information (PII)"
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Related Projects '''
| colspan="3" style="width:75%; background:#cccccc" align="left"|None
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
| style="width:25%; background:#cccccc" align="center"|'''Primary''' [mailto:name(at)owasp.org '''TBC''']
| style="width:25%; background:#cccccc" align="center"|'''Secondary''' [mailto:name(at)owasp.org '''TBC''']
| style="width:25%; background:#cccccc" align="center"|'''Mailing list''' None
|}

{| style="width:100%" border="0" align="center"
! colspan="4" align="center" style="background:#4058A0; color:white"|'''ACTIVITY SPECIFICS'''
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Objectives'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|
* Review Draft SP - in particular issues relating to web application security
* Where appropriate, draft a response for submission
* Submit the response as an official OWASP statement
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Deadlines'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|
* ''TBC'' - Complete final draft response
* ''TBC'' - Submit to OWASP Board for approval
* 13 Mar 2009 - Submit to NIST
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Status'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|
* Started
* 1st draft in discussion
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Resources'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|[http://csrc.nist.gov/publications/PubsDrafts.html#800-122 Call for responses, 13 Jan 2009]

[http://csrc.nist.gov/publications/drafts/800-122/Draft-SP800-122.pdf Full draft SOP text]

Submit comments to 800-122comments(at)nist.gov with "Comments SP 800-122" in the subject line.
|-
|}

== Submission Response ==

''Latest first''

=== Final version ===

TBC

=== Draft Text version 2 ===

TBC

=== Draft Text version 1 ===

TBC

=== Initial Comments ===

'''Possibly four areas where OWASP might comment - initial ideas below (no justifications provided yet).'''

In "3.2.5 Access to an Location of the PII", amend the sentence which ends "Another element is the scope of access to the PII, such as whether the PII needs to be accessed from teleworkers' systems and other systems outside the direct control of the organization." to "Another element is the scope of access to the PII, such as whether the PII needs to be STORED ON OR accessed from teleworkers' systems and other systems SUCH AS WEB APPLICATIONS outside the direct control of the organization.".

In "3.3.3 Example 3: Fraud, Waste, and Abuse Reporting Application", in the section "Access to and location of the PII: The database is only accessed by a few people who investigate fraud, waste, and abuse claims. All access to the database occurs only from the organization's own systems.", change this to be "Access to and location of the PII: THE DATA EXISTS TEMPORARILY ON A SERVER OUTSIDE THE ORGANIZATION'S NETWORK (THE ONLINE SYSTEM) AND ANY VULNERABILITIES IN THE ONLINE WEB APPLICATION COULD LEAD TO A BREACH OF THE PII. ONCE TRANSFERRED INTERNALLY, the database is only accessed by a few people who investigate fraud, waste, and abuse claims MEANING access to the INTERNAL database occurs only from the organization's own systems.".

In "4.3 Security Controls", add at the end of the first paragraph (before the bulleted items), "SEE THE OPEN WEB APPLICATION SECURITY PROJECT APPLICATION SECURITY VERIFICATION STANDARD (ASVS) FOR ONLINE WEB SYSTEM SECURITY CONTROL VERIFICATION.". (footnote link http://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project)

In "Appendix A, Scenario 2: Protecting Survey Data" under the "additional questions for the scenario", add a new item between items 2 and 3 "HOW ARE THE DATA ELEMENTS COLLECTED, STORED AND USED SECURELY IN THE ONLINE SYSTEMS".

Return to [[Global Industry Committee]]

← Older revision		Revision as of 15:36, 13 March 2009
Line 58:		Line 58:

	=== Final version ===		=== Final version ===
		+
		+	Final version uploaded 13th March 2009 [[Image:Owasp-nist-sp-800-122.pdf]]
		+
		+	''Text version:''

	This response is submitted on behalf of the Open Web Application Security Project (OWASP). The response includes explanations and suggested changes.		This response is submitted on behalf of the Open Web Application Security Project (OWASP). The response includes explanations and suggested changes.

@@ Line 41: / Line 41: @@
   | style="width:25%; background:#7B8ABD" align="center"| '''Status'''
   | colspan="3" style="width:75%; background:#cccccc" align="left"|
-* 2nd Draft
+* Completed
   |-
   | style="width:25%; background:#7B8ABD" align="center"| '''Resources'''
@@ Line 59: / Line 59: @@
 === Final version ===
-TBC
+This response is submitted on behalf of the Open Web Application Security Project (OWASP). The response includes explanations and suggested changes.

@@ Line 34: / Line 34: @@
 * 16 Feb 2009 - Produce initial draft response
 * 16 Feb 2009 - Circulate to OWASP lists for comment
-* 2 Mar 2009 - Deadline for comments from OWASP lists
+* 4 Mar 2009 - Deadline for comments from OWASP lists
-* 6 Mar 2009 - Complete final draft response
+* 11 Mar 2009 - Complete final draft response
-* 6 Mar 2009 - Submit for approval by [[Global Industry Committee]]
+* 12 Mar 2009 - Submit for approval by [[Global Industry Committee]]
 * 13 Mar 2009 - Submit to NIST
   |-
   | style="width:25%; background:#7B8ABD" align="center"| '''Status'''
   | colspan="3" style="width:75%; background:#cccccc" align="left"|
-* Started
+* 2nd Draft
   |-
   | style="width:25%; background:#7B8ABD" align="center"| '''Resources'''
@@ Line 65: / Line 64: @@
 === Draft Text version 2 ===
-TBC
+''As Draft version 1 plus:''

@@ Line 32: / Line 32: @@
   | style="width:25%; background:#7B8ABD" align="center"| '''Deadlines'''
   | colspan="3" style="width:75%; background:#cccccc" align="left"|
-* ''TBC'' - Produce initial draft response
+* 16 Feb 2009 - Produce initial draft response
-* ''TBC'' - Circulate to OWASP lists for comment
+* 16 Feb 2009 - Circulate to OWASP lists for comment
-* ''TBC'' - Deadline for comments from OWASP lists
+* 2 Mar 2009 - Deadline for comments from OWASP lists
-* ''TBC'' - Complete final draft response
+* 6 Mar 2009 - Complete final draft response
-* ''TBC'' - Submit for approval by [[Global Industry Committee]]
+* 6 Mar 2009 - Submit for approval by [[Global Industry Committee]]
 * 13 Mar 2009 - Submit to NIST
   |-
@@ Line 42: / Line 42: @@
   | colspan="3" style="width:75%; background:#cccccc" align="left"|
 * Started
-* 1st draft in discussion
+* 1st draft produced
   |-
   | style="width:25%; background:#7B8ABD" align="center"| '''Resources'''
@@ Line 61: / Line 61: @@
 TBC
 === Draft Text version 2 ===
 TBC
 === Draft Text version 1 ===
-TBC
+==== 3.2.5 Access to an Location of the PII ====
 === Initial Comments ===

@@ Line 16: / Line 16: @@
   |-
 | style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
-  | style="width:25%; background:#cccccc" align="center"|'''Primary'''<br>[mailto:name(at)owasp.org '''TBC''']
+  | style="width:25%; background:#cccccc" align="center"|'''Primary'''<br>[mailto:colin.watson(at)owasp.org '''Colin Watson''']
   | style="width:25%; background:#cccccc" align="center"|'''Secondary'''<br>[mailto:name(at)owasp.org '''TBC''']
   | style="width:25%; background:#cccccc" align="center"|'''Mailing list'''<br>Please use the [http://lists.owasp.org/mailman/listinfo/global_industry_committee Industry Committee list]