OWASP Security Labeling System Project - Revision history

Luisenriquez at 10:28, 3 June 2019

2019-06-03T10:28:19Z

Luisenriquez at 10:19, 3 June 2019

2019-06-03T10:19:48Z

Luisenriquez: /* MOTIVATION */

2019-06-03T10:17:05Z

‎MOTIVATION

Luisenriquez at 18:06, 14 May 2015

2015-05-14T18:06:45Z

Show changes

Luisenriquez: /* NEWS AND EVENTS */

2015-03-31T18:12:57Z

‎NEWS AND EVENTS

Luisenriquez at 16:45, 1 February 2015

2015-02-01T16:45:53Z

Luisenriquez: /* NEWS AND EVENTS */

2015-01-22T16:24:28Z

‎NEWS AND EVENTS

Luisenriquez: /* NEWS AND EVENTS */

2015-01-22T16:23:42Z

‎NEWS AND EVENTS

Luisenriquez: /* NEWS AND EVENTS */

2015-01-22T16:23:05Z

‎NEWS AND EVENTS

Luisenriquez at 16:21, 22 January 2015

2015-01-22T16:21:44Z

@@ Line 17: / Line 17: @@
 :There are 4 labels:
-'''* Security (S).'''  Security starts with SECURE CODING, and secure maintenance. This label is based on the OWASP Application Security Verification Standard(AVSV). Web applications will get a rating based on the Applications Security Verification levels on the AVSV standard(cursory, standard, opportunistic, and advanced).
+'''* Security (S).'''  Security starts with SECURE CODING, and secure maintenance. This label is based on the OWASP Application Security Verification Standard(ASVS). Web applications will get a rating based on the Applications Security Verification levels on the AVSV standard(cursory, standard, opportunistic, and advanced).
 '''* Privacy (P).'''  Security is also about TRUST. Technical security is not relevant if Software comes with hidden backdoors, and non-transparent policies. This label will require a Privacy scanning policy that may be based on the OWASP Top Ten Privacy project. Web applications must follow ethical principles of data processing and data protection.

@@ Line 58: / Line 58: @@
 == NEWS AND EVENTS ==
-* The proposal of this project is being FIXED. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Openness label''' in June - 2015.
+* The proposal of this project has been relaunched. We are examining with a new team the possibilities of a joint venture for complying the new legal regulations such as GDPR in the summer of 2019.
 '''YOU ARE ALL INVITED TO JOIN THIS SECURITY PROJECT'''.

@@ Line 5: / Line 5: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
+| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 == PURPOSE ==
@@ Line 25: / Line 25: @@
 '''* Openness (O).'''  Security might also be OPEN. Open security means having a fast and reliable IT security team. This label consists on a scanning policy based on the OWASP Top Ten project, and making the scan visible.
+| style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 == IMPLEMENTATION==
@@ Line 57: / Line 55: @@
 After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of  making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.
+| style="padding-left:25px;width:200px;" valign="top" |
 == NEWS AND EVENTS ==
@@ Line 83: / Line 79: @@
     {| width="200" cellpadding="2"
     |-
-    | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
+    | rowspan="2" width="50%" valign="top" align="center" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects]]
-    | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=]]
+    | width="50%" valign="top" align="center" | [[File:Owasp-builders-small.png|link=]]
     |-
-    | align="center" valign="top" width="50%"| [[File:Owasp-defenders-small.png|link=]]
+    | width="50%" valign="top" align="center" | [[File:Owasp-defenders-small.png|link=]]
     |-
-    | colspan="2" align="center"  | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
+    | colspan="2" align="center" | [[File:Cc-button-y-sa-small.png|link=http://creativecommons.org/licenses/by-sa/3.0/]]
     |-
-    | colspan="2" align="center"  | [[File:Project_Type_Files_CODE.jpg|link=]]
+    | colspan="2" align="center" | [[File:Project_Type_Files_CODE.jpg|link=]]
     |}
@@ Line 108: / Line 104: @@
 [[File:Owasp-security-scaled.png]]
-SECURITY LABEL CLAUSE: Security starts with secure coding and maintainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".
+SECURITY LABEL CLAUSE: Security starts with secure coding and mantainance. This Web application is following the security guidelines of the OWASP Application Security Verification Standard. Reports can be downloaded "here".
@@ Line 153: / Line 149: @@
 '''What is the Privacy label (P) about?'''
-: Surveillance code, missuse of personal data, and non-transparent policies are as dangerous as code vulnerabilities.
+: Surveillance code, misuse of personal data, and non-transparent policies are as dangerous as code vulnerabilities.
 '''Why is the Privacy label relevant?'''
@@ Line 180: / Line 176: @@
 * Luis Enriquez (Copyright & IT Lawyer)
 * Jeff Williams (Computer Security Expert)
@@ Line 193: / Line 187: @@
-'''(3) Create a secure server in order to generate genuine certificates for the labeled web applications. '''WE ARE HERE'''
+'''(3) Create a secure server in order to generate genuine certificates for the labeled web applications. '''WE ARE HERE
@@ Line 216: / Line 210: @@
 =DEMO (Web Apps)=
-'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */
+'''''/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: Security, Privacy, and Openness */'''''
 '''''
-'''''/*FIRST: The logos could be placed in the front page of the website: */''
+'''''/*FIRST: The logos could be placed in the front page of the website: */'''''
 '''
 [[File:Labelingsystem-widget.png]]
 '''''/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */'''''
-''Please read carefully the following terms and conditions before registering and using this WebSite:
+''Please read carefully the following terms and conditions before registering and using this WebSite:''
 . OWASP SECURITY LABELING SYSTEM. This Web Application is labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS IS A SECURITY COMPROMISE BETWEEN THE ADMINISTRATOR of this Web Application, and the end users. This system is only based on trust and reputation. OWASP denies any liability, or damage claims of any kind.
@@ Line 252: / Line 246: @@
 __NOTOC__ <headertabs />
-[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Document]]
+[[Category:OWASP Project]]

@@ Line 61: / Line 61: @@
 == NEWS AND EVENTS ==
-* The proposal of this project is READY. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Openness label''' in March - 2015
+* The proposal of this project is READY. As this is an experimental idea, We will start implementing each label by separate. We will start with the '''Privacy label''' in April - 2015
-'''YOU ARE ALL INVITED TO JOIN THIS LIST'''.
+'''YOU ARE ALL INVITED TO JOIN THIS SECURITY PROJECT'''.
 == PROJECT LEADER ==

@@ Line 30: / Line 30: @@
 == IMPLEMENTATION==
-Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in March - 2015. In the mean we need open security promoters, to get submitted into the project's records.
+Due to the complexity of the tasks, the Labels will be implemented 1 by 1. The first Label to be implemented is the OPENNESS LABEL. We will start with this experimental implementation in March - 2015. In the mean time we need open security promoters, to get submitted into the project's records.
 The System provides 4 logos and 4 clauses(1 for each label). The clauses can be added before the copyright public licenses as a "license exception", or included in the warranty clause(or any other) in custom copyright licenses, license contracts, terms of services, or even privacy policies.