This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Security Labeling System Project"

From OWASP
Jump to: navigation, search
Line 10: Line 10:
 
The purpose of this project is creating a transnational and market wise software security labeling system. Security is invisible, so the OWASP labeling system will help to make it visible. The system consists on different kinds of OWASP security labels for Web applications and Software( Please send your proposals):
 
The purpose of this project is creating a transnational and market wise software security labeling system. Security is invisible, so the OWASP labeling system will help to make it visible. The system consists on different kinds of OWASP security labels for Web applications and Software( Please send your proposals):
  
−
'''- Ingredients criterion label (I).'''  This label certifies that the software reveals all software components that integrate the software, or that were used to create it(eg. Shared libraries, APIs, and so on).
+
'''* Ingredients criterion label (I).'''  This label certifies that the software reveals all software components that integrate the software, or that were used to create it(eg. Shared libraries, APIs, and so on).
  
−
'''- Security 'good enough' criterion label (S).'''  This would be the standard certification label.  This label certifies that the software is 'good enough' because follows good security practices in its development life cycle, updates and security patches(Eg. OWASP Top Ten, the AVSV Security and verification standard, security control programming interfaces as OWASP ESAPIs).
+
'''* Security 'good enough' criterion label (S).'''  This would be the standard certification label.  This label certifies that the software is 'good enough' because follows good security practices in its development life cycle, updates and security patches(Eg. OWASP Top Ten, the AVSV Security and verification standard, security control programming interfaces as OWASP ESAPIs).
  
−
'''- Legal 'good enough' criterion label (L).'''  This is an additional label in case that the contract  includes  security software clauses following the OWASP principles.The OWASP legal principles would be based in the OWASP secure contract annex, and perhaps a soft law document containing  relevant legal issues such as third party source code, Privacy, Data protection, and so forth.  
+
'''* Legal 'good enough' criterion label (L).'''  This is an additional label in case that the contract  includes  security software clauses following the OWASP principles.The OWASP legal principles would be based in the OWASP secure contract annex, and perhaps a soft law document containing  relevant legal issues such as third party source code, Privacy, Data protection, and so forth.  
  
−
'''- Disclosure of vulnerabilities criterion label (D).'''  This label consists in the open disclosure of vulnerabilities of the software or Web Applications to the public.   
+
'''* Disclosure of vulnerabilities criterion label (D).'''  This label consists in the open disclosure of vulnerabilities of the software or Web Applications to the public.   
  
 
==Introduction==
 
==Introduction==
  
  
−
After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of  making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.
+
After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of  making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.
  
  
Line 28: Line 28:
 
This project is about creating different kinds of labels for software. The labeling system will be based mostly in other OWASP projects such as OWASP Top ten, OWASP AVSV standard, OWASP ESAPIs, OWASP legal project, and so forth.
 
This project is about creating different kinds of labels for software. The labeling system will be based mostly in other OWASP projects such as OWASP Top ten, OWASP AVSV standard, OWASP ESAPIs, OWASP legal project, and so forth.
  
−
We need to create a smart system of interaction, and auditing with the purpose of delivering the labels.
+
The labels will be conceded to any developer or applicant who meets the label requirements. We need to create a smart system of interaction, and auditing with the purpose of delivering the labels.  
  
  
Line 40: Line 40:
 
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
  
−
== What is XXX? ==
+
== What is OWASP Security Labeling System? ==
  
−
The OWASP Security Labeling System  provides:
+
The goal is labeling the security of web applications and software, with the purpose of making security more visible. The OWASP Security Labeling System  provides:
  
−
*  
+
* The Labeling logos linked in html format.
−
*  
+
* A certificate of authenticity.
  
  

Revision as of 15:59, 9 December 2013

OWASP Project Header.jpg

OWASP Security Labeling System Project

The purpose of this project is creating a transnational and market wise software security labeling system. Security is invisible, so the OWASP labeling system will help to make it visible. The system consists on different kinds of OWASP security labels for Web applications and Software( Please send your proposals):

* Ingredients criterion label (I). This label certifies that the software reveals all software components that integrate the software, or that were used to create it(eg. Shared libraries, APIs, and so on).

* Security 'good enough' criterion label (S). This would be the standard certification label. This label certifies that the software is 'good enough' because follows good security practices in its development life cycle, updates and security patches(Eg. OWASP Top Ten, the AVSV Security and verification standard, security control programming interfaces as OWASP ESAPIs).

* Legal 'good enough' criterion label (L). This is an additional label in case that the contract includes security software clauses following the OWASP principles.The OWASP legal principles would be based in the OWASP secure contract annex, and perhaps a soft law document containing relevant legal issues such as third party source code, Privacy, Data protection, and so forth.

* Disclosure of vulnerabilities criterion label (D). This label consists in the open disclosure of vulnerabilities of the software or Web Applications to the public.

Introduction

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.


Description

This project is about creating different kinds of labels for software. The labeling system will be based mostly in other OWASP projects such as OWASP Top ten, OWASP AVSV standard, OWASP ESAPIs, OWASP legal project, and so forth.

The labels will be conceded to any developer or applicant who meets the label requirements. We need to create a smart system of interaction, and auditing with the purpose of delivering the labels.



Licensing

The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


What is OWASP Security Labeling System?

The goal is labeling the security of web applications and software, with the purpose of making security more visible. The OWASP Security Labeling System provides:

  • The Labeling logos linked in html format.
  • A certificate of authenticity.


Presentation

Link to presentation



Project Leader

Luis Enriquez


Related Projects

Quick Download

  • Link to page/download


News and Events

  • [20 Nov 2013] News 2
  • [30 Sep 2013] News 1


In Print

This project can be purchased as a print on demand book from Lulu.com


Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files CODE.jpg
Q1
A1
Q2
A2

Volunteers

XXX is developed by a worldwide team of volunteers. The primary contributors to date have been:

  • xxx
  • xxx

Others

  • xxx
  • xxx

As of XXX, the priorities are:

  • xxx
  • xxx
  • xxx

Involvement in the development and promotion of XXX is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:

  • xxx
  • xxx


PROJECT INFO
What does this OWASP project offer you? 		RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Security Labeling System Project
Purpose: Creating a security labeling system for software and web applications This labeling system would be based in different criteria It concerns technical and legal security The former idea was proposed by jeff Williams years ago
License: Creative Commons Share Alike 3.0
who is working on this project?
Project Leader(s):
  • Luis Enriquez @
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
  • Contact Luis Enriquez @ to contribute to this project
  • Contact Luis Enriquez @ to review or sponsor this project
current release
Not Yet Published
last reviewed release
Not Yet Reviewed


other releases

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Security_Labeling_System_Project&oldid=164445"