This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Good Component Practices Project"

From OWASP
Jump to: navigation, search
m
m
Line 5: Line 5:
 
== Gateways of Component Vulnerability ==
 
== Gateways of Component Vulnerability ==
 
   
 
   
−
When establishing a framework for Good Component Practices, there are three gateways at which a vulnerability may occur:
+
When establishing a framework for '''Good Component Practices''', there are three gateways at which a vulnerability may occur:
−
 
+
<br /><br />
−
#Selection of the component and where it came from (provenance)</li>
+
#Selection of the component and where it came from (provenance)
−
#Integration of the component into the development environment</li>
+
#Integration of the component into the development environment
−
#Integration and maintenance of the component within the production environment</li>
+
#Integration and maintenance of the component within the production environment
−
 
+
<br />
 
We will look at each level of vulnerability and establish a series of best practices for managing the component usage at that level. The conclusion of the project will be a set of best practices for managing open source components as part of a larger application within an enterprise system.
 
We will look at each level of vulnerability and establish a series of best practices for managing the component usage at that level. The conclusion of the project will be a set of best practices for managing open source components as part of a larger application within an enterprise system.
  
 
[[User:Mark Miller|Mark Miller]] 22:04, 24 April 2013 (UTC)
 
[[User:Mark Miller|Mark Miller]] 22:04, 24 April 2013 (UTC)
  
−
== Simplified Framework for Component Vulnerability Management ==
+
== Simplified Framework for Good Component Practices ==
  
 
==== Component Selection ====
 
==== Component Selection ====
 +
*Set standards and policy for component usage
 +
**Components must be actively maintained
 +
**Component projects must have a security contact and security announcement list
 +
**Component projects must use security tools and make the results public
 +
**Component projects must have a history of responding to security vulnerability reports in a timely manner
 +
**Component binaries must be generated directly from project source code using trusted tools
 +
**Components with known vulnerabilities must be removed or updated within 1 month of vulnerability announcement
 +
*Identify components needed
 +
==== Integration into Development Environment ====
  
−
==== Integration into Development Environment ====
 
  
 
==== Integration and Maintenance within Production Environment ====
 
==== Integration and Maintenance within Production Environment ====
−
 
+
*Scan runtime enviroment for libraries, frameworks and components
 +
*Monitor components for vulnerabilities
 +
**Use Maven “Versions” plugin to check which components are out of date
 +
*Update risky components
  
 
=Project About=
 
=Project About=

Revision as of 17:24, 25 April 2013

Main

This project will document a set of best practices for managing component vulnerability at three main gateways.

Gateways of Component Vulnerability

When establishing a framework for Good Component Practices, there are three gateways at which a vulnerability may occur:

  1. Selection of the component and where it came from (provenance)
  2. Integration of the component into the development environment
  3. Integration and maintenance of the component within the production environment


We will look at each level of vulnerability and establish a series of best practices for managing the component usage at that level. The conclusion of the project will be a set of best practices for managing open source components as part of a larger application within an enterprise system.

Mark Miller 22:04, 24 April 2013 (UTC)

Simplified Framework for Good Component Practices

Component Selection

  • Set standards and policy for component usage
    • Components must be actively maintained
    • Component projects must have a security contact and security announcement list
    • Component projects must use security tools and make the results public
    • Component projects must have a history of responding to security vulnerability reports in a timely manner
    • Component binaries must be generated directly from project source code using trusted tools
    • Components with known vulnerabilities must be removed or updated within 1 month of vulnerability announcement
  • Identify components needed

Integration into Development Environment

Integration and Maintenance within Production Environment

  • Scan runtime enviroment for libraries, frameworks and components
  • Monitor components for vulnerabilities
    • Use Maven “Versions” plugin to check which components are out of date
  • Update risky components

Project About

PROJECT INFO
What does this OWASP project offer you? 		RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Good Component Practices Project (home page)
Purpose: Good Component Practice is one of the most over looked silver bullets in the Open Source arsenal. Because of business pressure, we have found that companies are willing to risk using unverified open source components, trading off security for enhanced speed in development.

This project will use community input to document an industry acceptable process for the creation, maintenance and use of open source components.

License: Creative Commons Attribution ShareAlike 3.0 License (best for documentation projects)
who is working on this project?
Project Leader(s):
  • Mark Miller @
Project Contributor(s):
  • Trusted Software Alliance
  • Sonatype
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
  • Contact Mark Miller @ to contribute to this project
  • Contact Mark Miller @ to review or sponsor this project
current release
Not Yet Published
last reviewed release
Not Yet Reviewed


other releases

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Good_Component_Practices_Project&oldid=150481"