This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Security Labeling System Project"

From OWASP
Jump to: navigation, search
Line 8: Line 8:
 
==OWASP Security Labeling System Project ==
 
==OWASP Security Labeling System Project ==
  
−
The purpose of this project is creating a transnational and market wise software security labeling system. Security is invisible, so the OWASP labeling system will help to make it visible. The system consists on different kinds of OWASP security labels for Web applications and Software( Please send your proposals):
+
The purpose of this project is creating a transnational and market wise software security labeling system. Security is invisible, so the OWASP labeling system will help to make it visible. The system consists on four kinds of OWASP security labels for Web applications and Software:
  
−
'''* Ingredients criterion label (I).'''  This label certifies that the software reveals all software components that integrate the software, or that were used to create it(eg. Shared libraries, third party code, and so on). The requirement to obtain this label is to openly publish your software ingredients information.
+
'''* Privacy  criterion label (P).'''  This label certifies to the public that your software does not come with non-authorized spyware. Security is about TRUST, and there is not trust if software comes hacked by default. This label is obtained by adding the 'privacy clause' to your contracts or licenses.
  
−
'''* Security 'good enough' criterion label (S).'''  This would be the standard certification label. This label certifies that the software is 'good enough' because it follows good security practices in its development life cycle, updates and security patches(Eg. OWASP Top Ten, OWASP security coding principles). In web applications, the requirement to obtain this label is to use a Top Ten scan policy (using tools such as Zed Attack Proxy, SAINT, and so on).  
+
'''* Openness criterion label (O).'''  This label consists about exposing to the public your web application vulnerabilities. The requirement to obtain this label is to expose your last vulnerabilities scans, and adding the 'openness clause' to your contracts or licenses.
 +
 
 +
'''* Security criterion label (S).'''  This is the standard security certification label. This label certifies that the software is 'good enough' because it follows good security practices in its development life cycle, updates and security patches following relevant security projects(such as OWASP Top Ten, OWASP security coding principles) and using relevant tools(such as Zed Attack Proxy, SAINT, Dependency Checker, and so on). This label is obtained by adding the 'security clause' to your contracts or licenses.
 +
 
 +
'''* Ingredients criterion label (I).'''  This label certifies that the software reveals all software components that integrate the software such as shared libraries, third party code, and so on. The requirement to obtain this label is to openly publish your software ingredients information, and adding the 'ingredients clause' declaration in your contracts or licenses.
  
−
'''* Legal 'good enough' criterion label (L).'''  This is an additional label when the contract  includes  security software clauses in relevant legal issues such as third party source code, risks of vulnerabilities, Privacy, and Data protection.
 
  
−
'''* Disclosure of vulnerabilities criterion label (D).'''  This label consists in the open disclosure of vulnerabilities of the software or Web Applications to the public. 
 
  
  
Line 86: Line 88:
 
  Different labeling categories for different purposes.
 
  Different labeling categories for different purposes.
  
−
  '''Which security labels can I add to my Web Applications?'''
+
  '''Which security labels can I add to my Software?'''
−
  Ingredients label(I).
+
  '''P'''rivacy label(P).  
−
  Security 'good enough' label(S).
+
  '''O'''penness label(O).  
−
  Legal label(L).  
+
  '''S'''ecurity label(S).  
−
  Disclosure label(D).
+
  '''I'''ngredients label(I).
 +
  
 
  '''What is the Ingredients label about?'''
 
  '''What is the Ingredients label about?'''

Revision as of 20:16, 3 March 2014

OWASP security labeling system.jpg

OWASP Security Labeling System Project

The purpose of this project is creating a transnational and market wise software security labeling system. Security is invisible, so the OWASP labeling system will help to make it visible. The system consists on four kinds of OWASP security labels for Web applications and Software:

* Privacy criterion label (P). This label certifies to the public that your software does not come with non-authorized spyware. Security is about TRUST, and there is not trust if software comes hacked by default. This label is obtained by adding the 'privacy clause' to your contracts or licenses.

* Openness criterion label (O). This label consists about exposing to the public your web application vulnerabilities. The requirement to obtain this label is to expose your last vulnerabilities scans, and adding the 'openness clause' to your contracts or licenses.

* Security criterion label (S). This is the standard security certification label. This label certifies that the software is 'good enough' because it follows good security practices in its development life cycle, updates and security patches following relevant security projects(such as OWASP Top Ten, OWASP security coding principles) and using relevant tools(such as Zed Attack Proxy, SAINT, Dependency Checker, and so on). This label is obtained by adding the 'security clause' to your contracts or licenses.

* Ingredients criterion label (I). This label certifies that the software reveals all software components that integrate the software such as shared libraries, third party code, and so on. The requirement to obtain this label is to openly publish your software ingredients information, and adding the 'ingredients clause' declaration in your contracts or licenses.



Motivation

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

Licensing

The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


What is OWASP Security Labeling System?

The goal is labeling the security of web applications and software, with the purpose of making security more visible. The OWASP Security Labeling System provides:

  • The Labeling logos linked in html format.
  • A certificate of authenticity.


Presentation

http://www.slideshare.net/luisenriquezA/owaspsecuritylabelsystem-presentation


Project Leader

Luis Enriquez

Related Projects


News and Events


Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files CODE.jpg

Why creating a security labeling system is important? 

Making security more visible.
Is a transnational and market wise solution. 
Visual, and easy to apply. 
Different labeling categories for different purposes.

Which security labels can I add to my Software?
Privacy label(P). 
Openness label(O). 
Security label(S).   
Ingredients label(I).


What is the Ingredients label about?
Because it will help developers and users to identify properly third party code, evaluate the risks of using it, 
avoid non intentional license compatibility controversies, and so forth.

Why is the Ingredients label relevant?
Because it will help developers and users to identify properly third party code, evaluate the risks of using it, 
avoid non intentional license compatibility controversies, and so forth.

What is the Security 'good enough' label about?
It certifies that certain software follows a secure life cycle, secure coding practices, quick vulnerabilities patches, 
and is programmed and maintained by developers with a software security orientation.

Why is the Security label relevant?
Many software projects are already using OWASP tools. A lot of them require developers to follow the OWASP secure coding principles.
The label will make these security practices visible for users.

What is the Legal label(L) about?
Is an additional label provided when certain software includes software security principles in its license(or contract).

Why is the legal label relevant?
Developers assume some legal responsabilities, such as not include hidden security bugs, spyware, backdoors, 
or unauthorized use of personal data. The impact is huge in terms of Transparency, Risks of vulnerabilities, 
privacy, data protection. 

What is the Disclosure label(D) about?
It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the 
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan. 
The scans should be fixed in a regular basis(e.g. each week).

Why is the disclosure label relevant?

Getting this label means that a security team reveals their vulnerabilities to the public as expected. 
but at the same time, it shows to the public how good and fast they are in order to fix them.


Volunteers

The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

  • Luis Enriquez
  • Jeff Williams
  • Jorge Lara


The priorities of the OWASP Security Labeling System are:

(1)Create and Distribute opinion polls to different sides involved in the IT environment(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users).

(2)Choose the sources of the security labeling system(which OWASP projects).

(3)Application of the labeling system. A platform in which developers can apply for the chosen label, a fast verification process, and to generate certificates (Of course, this methodology may change during the fist phases of the life cycle).

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged! You do not have to be a security or legal expert in order to contribute. Some of the ways you can help:

  • Distribute the opinion polls.
  • Create a secure server to host the user's labeling information.
  • Improve this wiki.


PROJECT INFO
What does this OWASP project offer you? 		RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Security Labeling System Project
Purpose: Creating a security labeling system for software and web applications This labeling system would be based in different criteria It concerns technical and legal security The former idea was proposed by jeff Williams years ago
License: Creative Commons Share Alike 3.0
who is working on this project?
Project Leader(s):
  • Luis Enriquez @
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
  • Contact Luis Enriquez @ to contribute to this project
  • Contact Luis Enriquez @ to review or sponsor this project
current release
Not Yet Published
last reviewed release
Not Yet Reviewed


other releases

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Security_Labeling_System_Project&oldid=169346"