Summit 2011 Working Sessions/Session203/Deliverable 1 - Revision history

Sarah Baso at 16:16, 23 June 2011

2011-06-23T16:16:44Z

Chris Schmidt at 01:05, 12 February 2011

2011-02-12T01:05:15Z

Chris Schmidt at 00:58, 12 February 2011

2011-02-12T00:58:57Z

Chris Schmidt at 19:28, 11 February 2011

2011-02-11T19:28:56Z

Chris Schmidt at 19:27, 11 February 2011

2011-02-11T19:27:02Z

Chris Schmidt at 18:17, 10 February 2011

2011-02-10T18:17:20Z

Chris Schmidt at 17:54, 7 February 2011

2011-02-07T17:54:04Z

Sandra Paiva: Created page with '== Deliverable 1 == '''OWASP Project Disclosure Policy''' To be filled in.'

2011-01-28T19:49:30Z

Created page with '== Deliverable 1 == '''OWASP Project Disclosure Policy''' To be filled in.'

New page

== Deliverable 1 ==

'''OWASP Project Disclosure Policy'''

To be filled in.

@@ Line 1: / Line 1: @@
-= OWASP Project Disclosure Policy' =
+= OWASP Project Disclosure Policy =
 This policy describes the official OWASP Policies on reporting security vulnerabilities, project staff responsibilities, how users are protected, and the lifecycle of reported vulnerabilities in OWASP branded projects.
@@ Line 8: / Line 8: @@
 == Initial Contact ==
-The Global Projects Committee (GPC) will notify the security liason or leader of the project if a security liaison is not assigned as listed on the project information page of the issue, along with any details provided by the discoverer and a reference to the open issue in the GPC Security Issue Vulnerability Database. It is expected that project leaders or other personnel from the project acknowledge the vulnerability within seven (7) days of initial contact. This acknowledgment should present an estimate of the expected time to resolve the issue and if available, a workaround solution that can be provided to users who subscribe to the security-alerts@owasp.org mailing list as well as users subscribed to the security-alerts@[project].owasp.org mailing list.
+The Global Projects Committee (GPC) will notify the security liaison or leader of the project if a security liaison is not assigned as listed on the project information page of the issue, along with any details provided by the discoverer and a reference to the open issue in the GPC Security Issue Vulnerability Database. It is expected that project leaders or other personnel from the project acknowledge the vulnerability within seven (7) days of initial contact. This acknowledgment should present an estimate of the expected time to resolve the issue and if available, a workaround solution that can be provided to users who subscribe to the security-alerts@owasp.org mailing list as well as users subscribed to the security-alerts@[project].owasp.org mailing list.
 == Second Contact ==

← Older revision		Revision as of 01:05, 12 February 2011
Line 56:		Line 56:

	Projects will be required to assign a person to fill the role of security liaison as part of the process of becoming a OWASP Mainstream Projects.		Projects will be required to assign a person to fill the role of security liaison as part of the process of becoming a OWASP Mainstream Projects.
		+
		+	Creation of a new mailing list security-alerts for users to subscribe to be notified of vulnerabilities and software patches with the disclosure template
		+
		+	Project leaders will be responsible for notifying their users mailing list of vulnerabilities with the GPC provided disclosure alert
		+
		+	Projects should have available a private mailing list security-alerts@[project].owasp.org for early notification of vulnerabilities and workaround solutions

← Older revision		Revision as of 00:58, 12 February 2011
Line 54:		Line 54:

	The maximum resolution period that will be granted cannot extend beyond 365 from the date of initial contact.		The maximum resolution period that will be granted cannot extend beyond 365 from the date of initial contact.
		+
		+	Projects will be required to assign a person to fill the role of security liaison as part of the process of becoming a OWASP Mainstream Projects.

@@ Line 1: / Line 1: @@
-== Deliverable 1 ==
+= OWASP Project Disclosure Policy' =
+This policy describes the official OWASP Policies on reporting security vulnerabilities, project staff responsibilities, how users are protected, and the lifecycle of reported vulnerabilities in OWASP branded projects.
 = What to do if you find a vulnerability =

@@ Line 2: / Line 2: @@
 '''OWASP Project Disclosure Policy'''
 Ack. From Leader of Issue
@@ Line 15: / Line 55: @@
 The maximum resolution period that will be granted cannot extend beyond 365 from the date of initial contact.

← Older revision		Revision as of 18:17, 10 February 2011
Line 2:		Line 2:

	'''OWASP Project Disclosure Policy'''		'''OWASP Project Disclosure Policy'''
		+
		+	Ack. From Leader of Issue
		+
		+	First Notice to Project Leaders - Response Expected within 7 days from initial notice to leader
		+	Second Notice to Project Leaders - Response Expected within 14 days from initial notice to leader
		+	Final Notice to Project Leaders - Response Expected within 30 days from initial notice to leader
		+
		+	If no ack of issue, full disclosure or disclosure of the issue will be released. Full or partial disclosure to be determined and voted on by GPC on a case by case basis.
		+
		+	Ack. of Resolution within 180 days of initial contact
		+	* if project leader provides detailed explanation of why a fix will take longer, GPC can decide to extend the disclosure period in 30 day increments.
		+
		+	The maximum resolution period that will be granted cannot extend beyond 365 from the date of initial contact.
		+

← Older revision		Revision as of 17:54, 7 February 2011
Line 4:		Line 4:


−	To be ~~filled~~ in.	+	=== Example Policies and Bylaws from Founding of the Apache Security Team ===
		+
		+	A. Reestablishing the Apache Security Team
		+
		+	WHEREAS, the Board of Directors deems it to be in the best
		+	interests of the Foundation and consistent with the
		+	Foundation's purpose to establish the ASF Board Committee
		+	charged with maintaining the security of software produced by
		+	the various projects established under the ASF's umbrella,
		+	but not for the security of the servers and other
		+	infrastructure used by the ASF.
		+
		+	NOW, THEREFORE, BE IT RESOLVED, that the ASF Board Committee,
		+	known as the "Apache Security Team", be and hereby is
		+	reestablished pursuant to Bylaws of the Foundation; and be it
		+	further
		+
		+	RESOLVED, that the Apache Security Team be and hereby is
		+	responsible for organization and oversight of efforts to
		+	maintain the security of ASF projects and shall act as a
		+	single point of contact between the ASF and any entity
		+	wishing to report or fix any security related issue in any
		+	project.
		+
		+	RESOLVED, that each project shall appoint at least one
		+	non-voting liaison to the committee, who shall have commit
		+	privilege for the project's repository, and the technical
		+	ability to release new versions, advisories or security
		+	patches on behalf of the project.
		+
		+	RESOLVED, that the committee shall have the power to act on
		+	behalf of any project in matters of security.
		+
		+	RESOLVED, that Mark Cox shall serve at the direction of
		+	the Board of Directors as the chair of the Security Team and
		+	have primary responsibility for managing the Security Team;
		+	and be it further
		+
		+	RESOLVED, that the persons listed immediately below be and
		+	hereby are appointed to serve as the members of the Apache
		+	Security Team:
		+
		+	Ben Laurie
		+	Mark Cox
		+
		+	There was some discussion over the small number of "initial"
		+	members of the team. It was noted that it was expected that
		+	new members would be added as soon as the team rebooted.
		+
		+	Special Order 6A, Reestablishing the Apache Security Team, was
		+	approved by Unanimous Vote.
		+
		+	=== Mozilla Security Policies ===
		+
		+	[https://www.mozilla.org/projects/security/security-bugs-policy.html https://www.mozilla.org/projects/security/security-bugs-policy.html]