Industry:ICO Data Sharing CoP - Revision history

Clerkendweller: Status closed / Deadline date correction

2011-01-19T18:15:37Z

Status closed / Deadline date correction

Clerkendweller: Final version added

2010-12-20T11:22:31Z

Final version added

Clerkendweller at 08:09, 12 October 2010

2010-10-12T08:09:53Z

Clerkendweller: /* Draft Text version 1 */ First draft added

2010-10-12T08:08:19Z

‎Draft Text version 1: First draft added

Clerkendweller: New

2010-10-11T22:23:31Z

New

New page

__NOTOC__

Return to [[Global Industry Committee]]

{| style="width:100%" border="0" align="center"
! colspan="4" align="center" style="background:#4058A0; color:white"|'''ACTIVITY IDENTIFICATION'''
|-
| style="width:15%; background:#7B8ABD" align="center"|'''Activity Name'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|'''ICO Data Sharing CoP'''
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Short Description'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|Provide response to "Data Sharing Code of Practice Consultation"
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Related Projects '''
| colspan="3" style="width:75%; background:#cccccc" align="left"|None
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
| style="width:25%; background:#cccccc" align="center"|'''Primary''' [mailto:colin.watson(at)owasp.org '''Colin Watson''']
| style="width:25%; background:#cccccc" align="center"|'''Secondary''' [mailto:(at)owasp.org '''TBC''']
| style="width:25%; background:#cccccc" align="center"|'''Mailing list''' Please use the [http://lists.owasp.org/mailman/listinfo/global_industry_committee Industry Committee list]
|}

{| style="width:100%" border="0" align="center"
! colspan="4" align="center" style="background:#4058A0; color:white"|'''ACTIVITY SPECIFICS'''
|-
| style="width:25%; background:#7B8ABD" align="center"|'''Objectives'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|
* Review CoP - in particular issues relating to web application security
* Where appropriate, draft a response for submission
* Submit the response as an official OWASP statement
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Deadlines'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|
* 18 Oct 2010 - Complete first draft response
* 25 Oct 2010 - Circulated to OWASP GIC mailing list
* 30 Oct 2010 - Prepare final version
* 31 Oct 2010 - Submit to ICO
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Status'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|
* In Progress
|-
| style="width:25%; background:#7B8ABD" align="center"| '''Resources'''
| colspan="3" style="width:75%; background:#cccccc" align="left"|[http://www.ico.gov.uk/upload/documents/library/corporate/research_and_reports/data_sharing_code_of_practice_consultation_paper.pdf Consultation document]

[http://www.ico.gov.uk/upload/documents/library/corporate/research_and_reports/data_sharing_consultation_questions.pdf Consultation questions]

[http://www.ico.gov.uk/upload/documents/pressreleases/2010/data_sharing_consultation_press_release_07102010.pdf Press release]

Response submission by email to consultations@ico.gsi.gov.uk by 5th January 2010
|-
|}

== Submission Response ==

''Latest first''

=== Final version ===

=== Draft Text version 2 ===

=== Draft Text version 1 ===

Return to [[Global Industry Committee]]

@@ Line 17: / Line 17: @@
 | style="width:25%; background:#7B8ABD" align="center"|'''Email Contacts & Roles'''
   | style="width:25%; background:#cccccc" align="center"|'''Primary'''<br>[mailto:colin.watson(at)owasp.org '''Colin Watson''']
-  | style="width:25%; background:#cccccc" align="center"|'''Secondary'''<br>[mailto:(at)owasp.org '''TBC''']
+  | style="width:25%; background:#cccccc" align="center"|'''Secondary'''<br>[mailto:alexander.fry(at)owasp.org '''Alexander Fry''']
   | style="width:25%; background:#cccccc" align="center"|'''Mailing list'''<br>Please use the [http://lists.owasp.org/mailman/listinfo/global_industry_committee Industry Committee list]
   |}
@@ Line 35: / Line 35: @@
 * 25 Oct 2010 - Circulate to OWASP UK chapters and GIC mailing lists
 * 30 Oct 2010 - Prepare final version
-* 31 Oct 2010 - Submit to ICO
+* 24 Dec 2010 - Submit to ICO
   |-
   | style="width:25%; background:#7B8ABD" align="center"| '''Status'''
@@ Line 61: / Line 61: @@
 === Final version ===
-''tbc''
+[[File:Owasp-ico-data-sharing-cop-consultation-response-1.pdf]]

← Older revision		Revision as of 08:08, 12 October 2010
Line 71:		Line 71:
	=== Draft Text version 1 ===		=== Draft Text version 1 ===

		+	==== Introduction ====

		+	This official response has been submitted on behalf of the Open Web Application Security Project (OWASP) by the OWASP Global Industry Committee, following our own consultation process.
		+
		+	==== Response ====
		+
		+	The OWASP response only replies to two questions.
		+
		+	'''6. Is the code relevant to the types of data sharing your organisation is involved in? If not, which additional areas should we cover?'''
		+
		+	In "Technical Security" on page 15, there is no mention of websites, yet these are one of the common channels that lead to personal data breaches. Our suggestion is to add an item:
		+	"If personal data is collected or processed using a web site or mobile application, have the most common security risks been identified, removed or mitigated?"
		+
		+	This could reference as footnotes, or in other supporting materials, the following free guidance documents:
		+	* [http://www.owasp.org/index.php/Category:OWASP_Top_Ten_Project#tab=Main OWASP Top Ten - The Ten Most Critical Web Application Security Risks] and further guidance contained therein
		+	* [http://projects.webappsec.org/Threat-Classification WASC Threat Classification]
		+	* [http://www.sans.org/top25-software-errors/ CWE/SANS TOP 25 Most Dangerous Software Errors]
		+
		+	'''10. Is there anything else you think the code should cover or are there any other ways in which you think the code could be improved?'''
		+
		+	In "technical security" on page 15, we believe "is your information encrypted" is too simplistic. Many difficulties exist in implementing encryption properly and problems can be introduced in unexpected ways. Whilst we understand this document cannot provide all the detail required, a better question would be "How is encryption implemented and managed?"
		+
		+	On page 17 in the discussion of data standards, non-Latin characters are mentioned, but the more generic issues of encoding (e.g. UTF-8) and escaping are not. These are significant factors in successful data sharing and for ensuring the integrity of the data once it has been exported from one system and imported into another. If not properly defined and implemented, data that is safe in one system might actively exploit a weakness in another leading to data loss, destruction, etc (e.g. by SQL injection). Our suggestion is to add after "capabilities of its system.", a new sentence "Ensure the data are correctly encoded and escaped when output so they can safely be used by the receiving system.".
		+
		+	==== About OWASP ====
		+
		+	''to be added in final draft''


	Return to [[Global Industry Committee]]		Return to [[Global Industry Committee]]

@@ Line 39: / Line 39: @@
   | style="width:25%; background:#7B8ABD" align="center"| '''Status'''
   | colspan="3" style="width:75%; background:#cccccc" align="left"|
-* In Progress
+* Closed
   |-
   | style="width:25%; background:#7B8ABD" align="center"| '''Resources'''
@@ Line 48: / Line 48: @@
 [http://www.ico.gov.uk/upload/documents/pressreleases/2010/data_sharing_consultation_press_release_07102010.pdf Press release]
-Response submission by email to consultations@ico.gsi.gov.uk by 5th January 2010
+Response submission by email to consultations@ico.gsi.gov.uk by 5th January 2011
   |-
 |}