OWASP Jupiter - Revision history

Mattstanchek at 02:36, 18 April 2019

2019-04-18T02:36:02Z

Mattstanchek: Fixed formatting

2019-04-16T02:25:13Z

Fixed formatting

Mattstanchek: Fixing formatting issues

2019-04-16T02:21:52Z

Fixing formatting issues

Mattstanchek: Added description of what data Jupiter captures

2019-04-16T02:18:55Z

Added description of what data Jupiter captures

Mattstanchek at 03:22, 9 April 2019

2019-04-09T03:22:56Z

Mattstanchek: Added Roadmap and FAQ

2019-03-23T22:58:12Z

Added Roadmap and FAQ

Mattstanchek: /* High Level Design */

2019-03-23T22:31:24Z

‎High Level Design

Mattstanchek: Formatting

2019-03-23T22:20:09Z

Formatting

Mattstanchek: Formatting

2019-03-23T20:49:53Z

Formatting

Mattstanchek: Jupiter logo

2019-03-23T20:39:13Z

Jupiter logo

@@ Line 74: / Line 74: @@
 |[[File:Jupiter HLD.png|alt=Jupiter High Level Design|thumb|Jupiter High Level Design]]
 |}
 | style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |

@@ Line 32: / Line 32: @@
 * Enhanced metrics capabilities to determine tool and process coverage as well as the organization’s Application Security maturity level
 |}
 == High Level Design ==

@@ Line 32: / Line 32: @@
 * Enhanced metrics capabilities to determine tool and process coverage as well as the organization’s Application Security maturity level
 |}
 == High Level Design ==

@@ Line 32: / Line 32: @@
 * Enhanced metrics capabilities to determine tool and process coverage as well as the organization’s Application Security maturity level
 |}
 == High Level Design ==

@@ Line 37: / Line 37: @@
 |Jupiter is a microservice-based solution that consists of several components.
-First, the '''Inventory Antecessor Collector Service''' can gather primitive inventory data (antecessors) directly from DevOps tools, such as continuous integration servers like Jenkins via the '''Jupiter Inventory Plugin''', when the software is built and deployed.
+First, the '''Jupiter Collector Service''' can gather primitive inventory data (antecessors) directly from DevOps tools, such as continuous integration servers like Jenkins via the '''Jupiter Collector Plugin''', when the software is built and deployed.
 The '''Inventory Management Console''' connects to the collector service and facilitates enrichment of the antecessor data into “gold records” representing an application.  These records are stored by the '''Curated Inventory Service''' via REST API or through the management console.

@@ Line 68: / Line 68: @@
 = Roadmap =
-Coming soon
+==Jupiter Application Inventory Management System Roadmap==
 = About Jupiter =
-Coming soon
+==FAQ==
 __NOTOC__ <headertabs></headertabs>

@@ Line 46: / Line 46: @@
 == Project Resources ==
-[https://github.com/xpert98 Source Code]
+[https://github.com/xpert98?tab=repositories Source Code]
 == Project Leader ==

@@ Line 1: / Line 1: @@
 <div style="width:100%;height:160px;border:0,margin:0;overflow: hidden;">[[File:OWASP_Project_Header.jpg|link=]]</div>
@@ Line 65: / Line 66: @@
     |}
 |}
-__NOTOC__ <headertabs />
+__NOTOC__ <headertabs></headertabs>
 [[Category:OWASP Project]]

@@ Line 4: / Line 4: @@
 | style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 == Introduction ==
-An Application Security program is more successful when coverage of its processes and tooling can be proven. Unfortunately, software inventory lists consist of some custom-written applications for an organization but also include systems and software that aren't in scope for a traditional AppSec program (Active Directory or Adobe Reader, for instance).
+{|
 Making matters worse, organizations are constantly transforming the ways they operate. New software is being written and deployed every day:
@@ Line 16: / Line 17: @@
 If "who owns this?" or "did you know this was in production?" sounds familiar, you're not alone.
 == OWASP Jupiter - Application Inventory Management System ==
-Existing DevOps processes already know what software is being built and when it is being deployed.
+{|
+| colspan="2" |Existing DevOps processes already know what software is being built and when it is being deployed.
 * Improved insight into what is being built and deployed across the software portfolio
 * Efficient onboarding to Application Security tools and processes (static analysis, dynamic analysis, open source software component analysis, penetration testing, vulnerability management)
 * Enhanced metrics capabilities to determine tool and process coverage as well as the organization’s Application Security maturity level
 == High Level Design ==
-[[File:Jupiter HLD.png|alt=Jupiter High Level Design|thumb|Jupiter High Level Design]]Jupiter is a microservice-based solution that consists of several components.
+{|
 First, the '''Inventory Antecessor Collector Service''' can gather primitive inventory data (antecessors) directly from DevOps tools, such as continuous integration servers like Jenkins via the '''Jupiter Inventory Plugin''', when the software is built and deployed.
 The '''Inventory Management Console''' connects to the collector service and facilitates enrichment of the antecessor data into “gold records” representing an application.  These records are stored by the '''Curated Inventory Service''' via REST API or through the management console.
 | style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |

@@ Line 20: / Line 20: @@
 Existing DevOps processes already know what software is being built and when it is being deployed.
-What if we leveraged those DevOps processes to gather crucial information about the organization’s software applications?
+What if we leveraged those DevOps processes to gather crucial information about the organization’s software applications?[[File:Jupiter.png|left|frameless|200x200px]]
 Having quality application inventory data enables:
 * Improved insight into what is being built and deployed across the software portfolio
 * Efficient onboarding to Application Security tools and processes (static analysis, dynamic analysis, open source software component analysis, penetration testing, vulnerability management)