Difference between revisions of "OWASP Security Labeling System Project"

/*Add these clauses into your license contracts, terms of services or privacy policy(for the privacy label). If your software is licensed under the terms of a generic purpose FOSS public license(such as the GPL license, the Apache license, the Mozilla license, and so on...),you might add these clauses before the license terms as a license exception, or as additional terms.*/

OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE ADMINISTRATOR or LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

Security Label

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

Privacy Label

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The administrator, legal representative, or person in charge of this software will not sale, commercialize, or miss-use user's personal data without the user's permission.

Ingredients Label

INGREDIENTS LABEL CLAUSE: Security is about Transparency. This software discloses a list of all its software components in a human readable file, including source code, plug-ins, shared libraries, and third party code. This compromise is only effective is the provider distributes a list of all components within the packet, and a link to access the source code.

Openness Label

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE'S VERSION IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

IF THE SOFTWARE COMES AS SOURCE CODE OR BINARIES, PLEASE ADD THIS CLAUSE:

The user must download this software from trusted sources, verify the correspondent hash-sum of the packets, and maintain the software with the recommended security updates and patches.

Please visit the DEMO pages for a guide on how to apply this system to your computer programs distribution, or web applications.

Why creating a security labeling system is important?

Making security more visible.
Is a transnational and market wise solution. 
Visual, and easy to apply. 
Different labeling categories for different purposes.

Which security labels can I add to my Software?

Security label(S).   
Privacy label(P). 
Ingredients label(I).
Openness label(O). 

What is the Security label(S) about?

It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

Why is the Security label(S) relevant?

Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

What is the Privacy label(P) about?

This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.

Why is the Privacy label relevant?

Developers assume the legal compromise of not including hidden backdoors and surveillance code. 
The user would also have the obligation of checking the software hashsums.

What is the Ingredients label(I) about?

Is about exposing all the components of your software, such as API's, shared libraries, third party software.

Why is the Ingredients label(I) relevant?

Because it will help developers and users to identify properly third party code, evaluate the risks of using it, 
avoid non intentional license compatibility controversies, and so forth.

What is the Openness label(O) about?

It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the 
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan. 
The scans should be fixed in a regular basis(e.g. each week).

Why is the Openness label(O) relevant?

Getting this label means that a security team reveals their vulnerabilities to the public as expected. 
but at the same time, it shows to the public how good and fast they are in order to fix them.

Volunteers

The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

• Luis Enriquez (Copyright & IT Lawyer)
• Jeff Williams (Computer Security Expert)
• Jorge Lara (Graphical Designer)

The priorities of the OWASP Security Labeling System are:

(1)Create and Distribute opinion polls to different sides involved in the IT environment(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape the model.

(2)Create the most suitable methodology for the security labeling system. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

(3)Application of the labeling system. The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged! You do not have to be a security or legal expert in order to contribute. Some of the ways you can help:

• Distribute the opinion polls.
• Improve the system.
• Translate the 'clauses' to other languages in a legal way.
• Improve this wiki.

/*This example shows how to include the OWASP Security Labeling System clauses into a software download. The computer program jazz-scales.zip includes the SECURITY, PRIVACY and INGREDIENTS labels:*/

/* FIRST: Show the labels on the download page*/

Jazz-scales is labeled under the OWASP SECURITY LABELING SYSTEM as:

Download jazz-scales.zip from here: File:Jazz-scales.zip

/*SECOND: Show the hash sum or a link of the hash sum in case of Privacy Label */

You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

/*THIRD: The demo program is licensed under a GPL v3 license, with an OWASP Security Labeling System exception(Please read the license):*/

YOU MUST read the READ-ME file, and the LICENSE agreement before using this software.

/* FOURTH: The logos will be linked to the Security Labeling System Site. The certificate could look like this:*/

CERTIFICATE(something like this, after clicking the logo)

LEGAL REPRESENTATIVE: Jazz scales corporation.

TYPE: Computer program. (Source code )

NAME: Jazz-Scales.zip

FURTHER INFORMATION:

SECURITY LABEL: This software has been developed using the following security guides: OWASP Security Principles Project, OWASP Software security Assurance Process.

PRIVACY LABEL: You must verify the hash-sum of the .zip package before installing:

MD5sum= faffffac8cb288233951cee6587dee33

SHA1sum= 00c533903ab6c3afc717021e724b479f8637c41a

This Software will not sale or transfer you personal data without authorization.

INGREDIENTS LABEL: This computer program is distributed as source code and contains the following source files:

scales.h modal_music2.cpp

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project

/*This example shows how to apply the OWASP Security Labeling system clauses into your Web Site's TERMS AND CONDITIONS. They should be placed inside an OWASP Security Labeling System section. The labeling logos could be placed in your anywhere as long as they remain visible. (as in the front page of this Website, as widget). This Web Site uses 3 labels: security, Privacy, and Openness */

/*FIRST: The logos could be placed in the front page of the website: */

/*SECOND: Add the OWASP Security Labeling System clause to your Terms and Conditions: */

Please read carefully the following terms and conditions before registering and using this WebSite:

1. OWASP SECURITY LABELING SYSTEM. This Software has been labeled under the OWASP security labeling system with the purpose of making security VISIBLE for everybody. THIS LEGAL COMPROMISE IS BETWEEN THE LEGAL REPRESENTATIVE OF THIS SOFTWARE, AND THE END USER.

SECURITY LABEL CLAUSE: Security is about secure coding. This software has been developed and is maintained following the highest OWASP secure coding practices. A list of all the security guides and tools used by the developers of this software must be included or linked through this notice.

PRIVACY LABEL CLAUSE: Security is about Trust. This Software comes free of non authorized spy-ware or surveillance code of any kind. The legal representative, or person in charge of this software will not sale, commercialize, or missuse user's personal data without the user's permission.

OPENNESS LABEL CLAUSE: Security is about Transparency. This Web Application makes available its latest vulnerability reports to the public. The report or a link to the report must be clearly published in this Web Application. This compromise is only effective if the vulnerability report's date is not older than 1 week.

THIS COMPROMISE IS ONLY VALID AS LONG AS THIS SOFTWARE IS REGISTERED INTO THE OWASP SECURITY LABELING SYSTEM RECORDS.

2.LIABILITY:/*(from here, clauses are not important)*/ - By signing this agreement, the user assumes complete responsibility over their own uploaded content, including posts, comments, and forums. The FOSS lawyers Institute denies any liability and damages of any kind, concerning contents uploaded by the users.

3.INTELLECTUAL PROPERTY: - The contents published in this website are licensed by default using the CC by NC license. User's cannot publish works violating the copyrights of others. Such contents will be deleted.

4. TERMINATION: - You can always close your account in this website. We also reserve the right of closing user's accounts if they infringe the terms and conditions of this website.

*/THIRD: The labeling logos of the front WebSite page should link to the OWASP Security Labeling System Site, and generate a certificate, such as:*/

CERTIFICATE(something like this)

LEGAL REPRESENTATIVE: FOSS Lawyers Institute.

TYPE: Web Application.

URL: http://172.16.208.128/mutillidae

FURTHER INFORMATION:

SECURITY LABEL: This Web Application has been developed and is maintained using: The OWASP TOP TEN Project, OWASP secure coding practices, and OWASP Security Principles Project.

PRIVACY LABEL: This Web Application will not sale or transfer you personal data without your authorization. This Web Application follows the OWASP Top Ten Privacy Project.

OPENNESS LABEL: Here you can find the lastest vulnerability report of this web application:

REPORT VIOLATIONS TO: OWASP_Security_Labeling_System_Project