This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Security Labeling System Project"

From OWASP
Jump to: navigation, search
Line 6: Line 6:
 
| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
  
−
==OWASP Security Labeling System Project ==
+
== PURPOSE ==
 +
Making security VISIBLE for everybody. We can make it VISIBLE by applying a transnational and market wise software security labeling system
  
−
The purpose of this project is creating a transnational and market wise software security labeling system. Security is invisible, so the OWASP labeling system will help to make it visible. The system consists on four kinds of OWASP security labels for Web applications and Software:
+
== WHAT IS THE OWASP SECURITY LABELING SYSTEM?
 +
The labeling system is composed by 4 badges. Each badge is independent of each other, and there is not hierarchy between them:
 +
'''* Security badge (S).'''  Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, DEpendency check...)
  
−
'''* Privacy label (P).'''  This label certifies to the public that your software does not come with non-authorized spyware. Security is about TRUST, and there is not trust if software comes hacked by default. This label is obtained by adding the 'privacy clause' to your contracts or licenses.
+
'''* Privacy badge (P).'''  Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.
  
−
'''* Openness label (O).'''  This label consists about exposing to the public your web application vulnerabilities. The requirement to obtain this label is to expose your last vulnerability scans, and adding the 'openness clause' to your contracts or licenses.
+
'''* Ingredients badge (I).'''  Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on.  This badge consists on Software exposing their components and third party code.
  
−
'''* Security label (S).'''  This is the standard security certification label. This label certifies that the software is 'good enough' because it follows good security practices in its development life cycle, updates and security patches following relevant security projects(such as OWASP Top Ten, OWASP security coding principles) and using relevant tools(such as Zed Attack Proxy, SAINT, Dependency Checker, and so on). This label is obtained by adding the 'security clause' to your contracts or licenses.
+
'''* Openness badge (O).'''  Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness badge consists on exposing the Software or Web Application last vulnerability reports to the public.
−
 
 
−
'''* Ingredients label (I).'''  This label certifies that the software reveals all software components that integrate the software such as shared libraries, third party code, and so on. The requirement to obtain this label is to openly publish your software ingredients information, and adding the 'ingredients clause' declaration in your contracts or licenses.
 
  
  
Line 32: Line 33:
 
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 
| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
  
−
== What is OWASP Security Labeling System? ==
+
== IMPLEMENTATION(From July 2014) ==
  
−
The goal is labeling the security of web applications and software, with the purpose of making security more visible. The OWASP Security Labeling System  provides:
+
The System consists on 4 logos and 4 clauses(1 for each badge).
  
−
* The Labeling linking logos.
+
STEP 1: Register the application in the OWASP Security Labeling system Site.
−
* The contract clauses model for the 4 labels: P(Privacy).O(Openness).S(Security).I(Ingredients).
+
STEP 2: Download the badge-logo and paste it into your website or distributed medium.
−
* A certificate of authenticity.
+
STEP 3: Incorporate the correspondent badge-clause into your contract, license,terms of service,or privacy policy(if any).
  
 +
== COMPROMISES ==
 +
- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the badge-logo, the Developer acquires the compromise of following the OWASP labeling requirements.
 +
- Between DEVELOPER and USERS. By incorporating the badge-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract.
 +
- Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers. 
  
 
== Presentation ==
 
== Presentation ==
Line 61: Line 66:
  
 
== News and Events ==
 
== News and Events ==
−
* The project has begun. In this first phase we are shaping the labeling models. Please help us filling these OPINION POLLS:
+
* The project has begun. In this second phase we are shaping the labeling models. Please help us filling these OPINION POLLS:
 
*USERS POLL: https://docs.google.com/a/owasp.org/forms/d/1A0aijN4dI2HPZOktnRx8bWebrXlwI1C5Zh0gGcjSczE/
 
*USERS POLL: https://docs.google.com/a/owasp.org/forms/d/1A0aijN4dI2HPZOktnRx8bWebrXlwI1C5Zh0gGcjSczE/
 
*DEVELOPERS POLL: https://docs.google.com/a/owasp.org/forms/d/1GNnve1SIxf8q5XGWZXJSmeSUzmKIEH5sQPQR3a-TTE8
 
*DEVELOPERS POLL: https://docs.google.com/a/owasp.org/forms/d/1GNnve1SIxf8q5XGWZXJSmeSUzmKIEH5sQPQR3a-TTE8
Line 91: Line 96:
  
 
  '''Which security labels can I add to my Software?'''
 
  '''Which security labels can I add to my Software?'''
−
'''P'''rivacy label(P).  
+
'''S'''ecurity label(S).  
−
'''O'''penness label(O).  
+
'''P'''rivacy label(P).  
−
'''S'''ecurity label(S).  
+
'''I'''ngredients label(I).
−
'''I'''ngredients label(I).
+
'''O'''penness label(O).  
 +
 
   
 
   
 +
'''What is the Security label(S) about?'''
 +
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.
 +
 +
'''Why is the Security label(S) relevant?'''
 +
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.
 +
 
'''What is the Privacy label(P) about?'''
 
'''What is the Privacy label(P) about?'''
−
  This label certifies that your software does not come with non-authorized spyware.
+
  This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.
  
 
  '''Why is the Privacy label relevant?'''
 
  '''Why is the Privacy label relevant?'''
 
  Developers assume the legal compromise of not including hidden backdoors and surveillance code.  
 
  Developers assume the legal compromise of not including hidden backdoors and surveillance code.  
 
  The user would also have the obligation of checking the software hashsums.
 
  The user would also have the obligation of checking the software hashsums.
 +
 +
'''What is the Ingredients label(I) about?'''
 +
Is about exposing all the components of your software, such as API's, shared libraries, third party software.
 +
 +
'''Why is the Ingredients label(I) relevant?'''
 +
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
 +
avoid non intentional license compatibility controversies, and so forth.
 +
 
   
 
   
 
'''What is the Openness label(O) about?'''
 
'''What is the Openness label(O) about?'''
Line 113: Line 133:
 
  but at the same time, it shows to the public how good and fast they are in order to fix them.  
 
  but at the same time, it shows to the public how good and fast they are in order to fix them.  
  
−
'''What is the Security label(S) about?'''
 
−
It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices,
 
−
quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.
 
  
−
'''Why is the Security label(S) relevant?'''
 
−
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the
 
−
OWASP secure coding principles. This label will make these security practices visible for users.
 
−
 
−
'''What is the Ingredients label(I) about?'''
 
−
Is about exposing all the components of your software, such as API's, shared libraries, third party software.
 
−
 
−
'''Why is the Ingredients label(I) relevant?'''
 
−
Because it will help developers and users to identify properly third party code, evaluate the risks of using it,
 
−
avoid non intentional license compatibility controversies, and so forth.
 
−
 
−
 
−
 
−
 
−
 
−
 
 
−
 
  
  
Line 140: Line 140:
 
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:
 
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:
  
−
* Luis Enriquez  
+
* Luis Enriquez (IT Lawyer)
−
* Jeff Williams
+
* Jeff Williams (Security Expert)
−
* Jorge Lara
+
* Jorge Lara   (Graphical Dessigner)
  
  
Line 151: Line 151:
 
the model.
 
the model.
 
   
 
   
−
'''(2)Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each label type, which will have to be included in IT contracts, or copyright licenses(additional terms for public licenses). The developer
+
'''(2)Create the most suitable methodology for the security labeling system'''. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.
−
has the compromise of providing the OWASP labeling system conditions.
 
  
−
'''(3)Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. If a
+
'''(3)Application of the labeling system.''' The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.  
−
Web application is not comitting their compromise, the label can be removed.  
 
  
 
Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!
 
Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged!

Revision as of 22:09, 13 March 2014

OWASP security labeling system2.png

PURPOSE

Making security VISIBLE for everybody. We can make it VISIBLE by applying a transnational and market wise software security labeling system

== WHAT IS THE OWASP SECURITY LABELING SYSTEM? The labeling system is composed by 4 badges. Each badge is independent of each other, and there is not hierarchy between them: * Security badge (S). Security starts with SECURE CODING, and secure maintenance. This badge is for Software developed with a secure life cycle, following recommended security coding practices(OWASP TOP TEN, OWASP security principles...) and recommended security tools(Zed Attack Proxy, SAINT, DEpendency check...)

* Privacy badge (P). Security is also about TRUST. Technical security is not relevant if Software comes with hidden non-authorized backdoors, or surveillance code by default. This Privacy badge is for Software free of non-authorized spyware, and web applications following ethical principles of data protection.

* Ingredients badge (I). Security is also about TRANSPARENCY. This condition is possible through the use of Open Source Software. Contemporary Software is built(and linked) by many components such as shared libraries, third party code, APIS, and so on. This badge consists on Software exposing their components and third party code.

* Openness badge (O). Security might also be OPEN. Open security means having a fast and reliable IT security team. This openness badge consists on exposing the Software or Web Application last vulnerability reports to the public.



Motivation

After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

Licensing

The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


IMPLEMENTATION(From July 2014)

The System consists on 4 logos and 4 clauses(1 for each badge).

STEP 1: Register the application in the OWASP Security Labeling system Site. STEP 2: Download the badge-logo and paste it into your website or distributed medium. STEP 3: Incorporate the correspondent badge-clause into your contract, license,terms of service,or privacy policy(if any).

COMPROMISES

- Between DEVELOPER and the OWASP SECURITY LABELING PROJECT. By including the badge-logo, the Developer acquires the compromise of following the OWASP labeling requirements. - Between DEVELOPER and USERS. By incorporating the badge-Clauses, the Developer assumes a direct compromise with their software users. This compromise has a legal value as it is incorporated into the contract. - Between OWASP SECURITY LABELING PROJECT and USERS. Users can report violations of the labeling system to the OWASP labeling project Volunteers.

Presentation

http://www.slideshare.net/luisenriquezA/owasp-security-labelingsystem


Project Leader

Luis Enriquez

Related Projects


News and Events


Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files CODE.jpg

Why creating a security labeling system is important? 

Making security more visible.
Is a transnational and market wise solution. 
Visual, and easy to apply. 
Different labeling categories for different purposes.

Which security labels can I add to my Software?

Security label(S). Privacy label(P). Ingredients label(I). Openness label(O).


What is the Security label(S) about? 

It certifies that certain software follows a secure life cycle, recommended scan policies, secure coding practices, quick vulnerabilities patches, and is programmed and maintained by developers with a software security orientation.

Why is the Security label(S) relevant?
Many software projects are already using OWASP guides and tools. A lot of them require developers to follow the OWASP secure coding principles. This label will make these security practices visible for users.

What is the Privacy label(P) about? 

This label certifies that your software does not come with non-authorized spyware, and that your personal data will be respected.

Why is the Privacy label relevant?
Developers assume the legal compromise of not including hidden backdoors and surveillance code. 
The user would also have the obligation of checking the software hashsums.

What is the Ingredients label(I) about? 

Is about exposing all the components of your software, such as API's, shared libraries, third party software.

Why is the Ingredients label(I) relevant?
Because it will help developers and users to identify properly third party code, evaluate the risks of using it, 
avoid non intentional license compatibility controversies, and so forth.


What is the Openness label(O) about? 

It is dedicated to high security environments. Web Applications will expose their vulnerabilities of the 
last vulnerability scan the public. They will have the time to patch them until the next vulnerabilities scan. 
The scans should be fixed in a regular basis(e.g. each week).

Why is the Openness label(O) relevant?

Getting this label means that a security team reveals their vulnerabilities to the public as expected. 
but at the same time, it shows to the public how good and fast they are in order to fix them.



Volunteers

The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:

  • Luis Enriquez (IT Lawyer)
  • Jeff Williams (Security Expert)
  • Jorge Lara (Graphical Dessigner)


The priorities of the OWASP Security Labeling System are:

(1)Create and Distribute opinion polls to different sides involved in the IT environment(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). This stage has already begun, and results are helping us to shape the model.

(2)Create the most suitable methodology for the security labeling system. At this point seems that the best methodology is to create a clause(or declaration) for each badge type, which will have to be included in IT contracts, licenses(additional terms for public licenses), terms of service, or privacy policies. The Developer has the compromise of providing the OWASP labeling system conditions.

(3)Application of the labeling system. The OWASP labeling system volunteers will contribute to check that the system is working properly. The label can always be removed.

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged! You do not have to be a security or legal expert in order to contribute. Some of the ways you can help:

  • Distribute the opinion polls.
  • Improve the system.
  • Translate the 'clauses' to other languages in a legal way.
  • Improve this wiki.


PROJECT INFO
What does this OWASP project offer you? 		RELEASE(S) INFO
What releases are available for this project?
what is this project?
Name: OWASP Security Labeling System Project
Purpose: Creating a security labeling system for software and web applications This labeling system would be based in different criteria It concerns technical and legal security The former idea was proposed by jeff Williams years ago
License: Creative Commons Share Alike 3.0
who is working on this project?
Project Leader(s):
  • Luis Enriquez @
how can you learn more?
Project Pamphlet: Not Yet Created
Project Presentation:
Mailing list: Mailing List Archives
Project Roadmap: View
Key Contacts
  • Contact Luis Enriquez @ to contribute to this project
  • Contact Luis Enriquez @ to review or sponsor this project
current release
Not Yet Published
last reviewed release
Not Yet Reviewed


other releases

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Security_Labeling_System_Project&oldid=170059"