This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Docker Top 10"
Dirk Wetter (talk | contribs) (1st draft: About section) |
Dirk Wetter (talk | contribs) (Firt draft of Roadmap, more) |
||
Line 10: | Line 10: | ||
==About Docker Top 10== | ==About Docker Top 10== | ||
− | |||
− | |||
The OWASP Docker Top 10 is giving you ten bullet points to plan and implement a secure docker container environment. The 10 bullet points are ordered by relevance. They don't represent risks as each single point in the OWASP Top 10, they represent security controls. The controls range from baseline security to more advanced controls, depended on your security requirements. | The OWASP Docker Top 10 is giving you ten bullet points to plan and implement a secure docker container environment. The 10 bullet points are ordered by relevance. They don't represent risks as each single point in the OWASP Top 10, they represent security controls. The controls range from baseline security to more advanced controls, depended on your security requirements. | ||
You should use it as a guidance in the design phase as a system specification or for auditing a docker environment. Also for procurement it could provide a basis for specifying requirements in contracts. | You should use it as a guidance in the design phase as a system specification or for auditing a docker environment. Also for procurement it could provide a basis for specifying requirements in contracts. | ||
− | |||
− | |||
==Description== | ==Description== | ||
+ | <!-- | ||
<span style="color:#ff0000"> | <span style="color:#ff0000"> | ||
This is where you need to add your more robust project description. A project description should outline the purpose of the project, how it is used, and the value it provides to application security. Ideally, project descriptions should be written in such a way that there is no question what value the project provides to the software security community. This section will be seen and used in various places within the Projects Portal. Poorly written project descriptions therefore detract from a project’s visibility, so project leaders should ensure that the description is meaningful. | This is where you need to add your more robust project description. A project description should outline the purpose of the project, how it is used, and the value it provides to application security. Ideally, project descriptions should be written in such a way that there is no question what value the project provides to the software security community. This section will be seen and used in various places within the Projects Portal. Poorly written project descriptions therefore detract from a project’s visibility, so project leaders should ensure that the description is meaningful. | ||
Line 29: | Line 26: | ||
Contextual custom dictionary builder with character substitution and word variations for pen-testers | Contextual custom dictionary builder with character substitution and word variations for pen-testers | ||
+ | --> | ||
==Licensing== | ==Licensing== | ||
+ | <!-- | ||
<span style="color:#ff0000"> | <span style="color:#ff0000"> | ||
A project must be licensed under a community friendly or open source license. For more information on OWASP recommended licenses, please see [https://www.owasp.org/index.php/OWASP_Licenses OWASP Licenses]. While OWASP does not promote any particular license over another, the vast majority of projects have chosen a Creative Commons license variant for documentation projects, or a GNU General Public License variant for tools and code projects. This example assumes that you want to use the AGPL 3.0 license. | A project must be licensed under a community friendly or open source license. For more information on OWASP recommended licenses, please see [https://www.owasp.org/index.php/OWASP_Licenses OWASP Licenses]. While OWASP does not promote any particular license over another, the vast majority of projects have chosen a Creative Commons license variant for documentation projects, or a GNU General Public License variant for tools and code projects. This example assumes that you want to use the AGPL 3.0 license. | ||
Line 36: | Line 35: | ||
This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright © by {the Project Leader(s) or OWASP} {Year(s)}. | This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.gnu.org/licenses/agpl-3.0.html link GNU Affero General Public License 3.0] as published by the Free Software Foundation, either version 3 of the License, or (at your option) any later version. OWASP XXX and any contributions are Copyright © by {the Project Leader(s) or OWASP} {Year(s)}. | ||
+ | --> | ||
==Roadmap== | ==Roadmap== | ||
− | + | As of <strong>August 2018, the highest priorities for the next 3 months</strong> are: | |
− | As of <strong> | ||
<strong> | <strong> | ||
− | * Complete the first draft of the Documentation | + | * Complete the first draft of the Documentation |
− | * Get other people to review the Documentation | + | * Get other people involved to review the Documentation and provide feedback |
− | * Incorporate feedback into | + | * Incorporate feedback into the Documentation |
* Finalize the Documentation Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project | * Finalize the Documentation Project template and have it reviewed to be promoted from an Incubator Project to a Lab Project | ||
</strong> | </strong> | ||
Line 49: | Line 48: | ||
Subsequent Releases will add | Subsequent Releases will add | ||
<strong> | <strong> | ||
− | * | + | * Go from Draft to a solid basis |
− | * | + | * Being Promoted from an Incubator Project to a Lab Project |
− | |||
</strong> | </strong> | ||
==Getting Involved== | ==Getting Involved== | ||
− | + | ||
− | + | For all communication, releases and more please use [https://github.com/OWASP/Docker-Top-10 github] | |
− | |||
− | |||
| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" | | | valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" | | ||
== Project Resources == | == Project Resources == | ||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | |||
− | [https:// | + | [https://2018.appsec.eu/presos/DevOps_Docker_201_Security_Dirk-Wetter_AppSecEU2018.pdf Dirk Wetter: Slides of Presentation at OWASP AppSec Europe 2018] |
− | [https:// | + | [https://2018.appsec.eu/presos/DevOps_Securing-Containers_Jack-Mannino_Abdullah-Munawar_AppSecEU2018.pptx Jack Mannino and Abdullah Munawar: Slides of Presentation at OWASP AppSec Europe 2018] |
== Project Leader == | == Project Leader == | ||
− | |||
− | |||
− | |||
− | |||
Dirk Wetter | Dirk Wetter | ||
== Related Projects == | == Related Projects == | ||
− | < | + | <!-- |
− | |||
− | |||
* [[OWASP_Code_Project_Template]] | * [[OWASP_Code_Project_Template]] | ||
* [[OWASP_Tool_Project_Template]] | * [[OWASP_Tool_Project_Template]] | ||
+ | --? | ||
==Classifications== | ==Classifications== | ||
Revision as of 18:39, 31 August 2018
Project About
About Docker Top 10The OWASP Docker Top 10 is giving you ten bullet points to plan and implement a secure docker container environment. The 10 bullet points are ordered by relevance. They don't represent risks as each single point in the OWASP Top 10, they represent security controls. The controls range from baseline security to more advanced controls, depended on your security requirements. You should use it as a guidance in the design phase as a system specification or for auditing a docker environment. Also for procurement it could provide a basis for specifying requirements in contracts.
DescriptionLicensingRoadmapAs of August 2018, the highest priorities for the next 3 months are:
Subsequent Releases will add
Getting InvolvedFor all communication, releases and more please use github |
Project ResourcesDirk Wetter: Slides of Presentation at OWASP AppSec Europe 2018 Jack Mannino and Abdullah Munawar: Slides of Presentation at OWASP AppSec Europe 2018 Project LeaderDirk Wetter Related Projects
|