OWASP Assimilation Project

• Main
• FAQs
• Acknowledgements
• Road Map and Getting Involved
• Minimum Viable Product
• Project About

OWASP Assimilation Project Summary Many people compare securing systems against attackers as a form of warfare. In The Art of War, Sun Tzu said "If you know your enemies and know yourself, you will not be imperiled in a hundred battles". The Assimilation helps you know yourself - your systems, networks, configurations in great detail, and then keeps it all that information continually up to date in a graph-based Configuration Management Database. Description The Assimilation Project tracks many aspects of system configuration and security and compares them against best practices in quasi-real-time. Here are a few of the kinds of things we track for you: IP and MAC addresses Services - including details on which ports, which binaries and what arguments, user id, group id, current directory Client connections (same details as above) Security-sensitive configuration details Versions of packages Checksums of network-facing binaries, libraries, and JARs. This is all done in a highly scalable way which cannot set off network security alarms and requires minimal human configuration. In addition, we continually evaluate system configurations against best practices from the IT Best Practices project and compute risk scores for servers based on how they compare to security best practices. Since everything is stored in the Neo4J graph database, visualizations of things like your attack surface are natural and straightforward. The project includes event APIs and canned queries. Licensing This program is free software: you can redistribute it and/or modify it under the terms of the GNU GPL v3 License as published by the Free Software Foundation.

Project Resources Universal Installation Script Released Packages Source Code Release History Project Home Page and Documentation Issue Tracker Slide Presentations Talk Videos Project Leader Project leader: Alan Robertson Related Projects This is where you can link to other OWASP Projects that are similar to yours. OWASP_Code_Project_Template OWASP_Documentation_Project_Template Classifications

News and Events This is where you can provide project updates, links to any events like conference presentations, Project Leader interviews, case studies on successful project implementations, and articles written about your project. [12 Feb 2013] Support for Spanish is now available with this release. [11 Jan 2014] The 1.0 stable version has been released! Thanks everyone for your feedback and code fixes that made this happen! [18 Dec 2013] 1.0 Release Candidate is available for download. This release provides final bug fixes and product stabilization. Any feedback (good or bad) in the next few weeks would be greatly appreciated. [20 Nov 2013] 1.0 Beta 2 Release is available for download. This release offers several bug fixes, a few performance improvements, and addressed all outstanding issues from a security audit of the code. [30 Sep 2013] 1.0 Beta 1 Release is available for download. This release offers the first version with all of the functionality for a minimum viable product.

Many projects have "Frequently Asked Questions" documents or pages. However, the point of such a document is not the questions. The point of a document like this are the answers. The document contains the answers that people would otherwise find themselves giving over and over again. The idea is that rather than laboriously compose and post the same answers repeatedly, people can refer to this page with pre-prepared answers. Use this space to communicate your projects 'Frequent Answers.'

How can I participate in your project?

All you have to do is make the Project Leader's aware of your available time to contribute to the project. It is also important to let the Leader's know how you would like to contribute and pitch in to help the project meet it's goals and milestones. There are many different ways you can contribute to an OWASP Project, but communication with the leads is key.

If I am not a programmer can I participate in your project?

Yes, you can certainly participate in the project if you are not a programmer or technical. The project needs different skills and expertise and different times during its development. Currently, we are looking for researchers, writers, graphic designers, and a project administrator. See the Road Map and Getting Involved tab for more details.

Contributors

The success of OWASP is due to a community of enthusiasts and contributors that work to make our projects great. This is also true for the success of your project. Be sure to give credit where credit is due, no matter how small! This should be a brief list of the most amazing people involved in your project. Be sure to provide a link to a complete list of all the amazing people in your project's community as well.

The OWASP Tool Project Template is developed by a worldwide team of volunteers. A live update of project contributors is found here.

The first contributors to the project were:

• Colin Watson who created the OWASP Cornucopia project that the template was derived from
• Chuck Cooper who edited the template to convert it from a documentation project to a Tool Project Template
• YOUR NAME BELONGS HERE AND YOU SHOULD REMOVE THE PRIOR 3 NAMES

Roadmap

Future plans include:

• Expanding the best practices we cover
• Making it easy to see which machines are in need of security patches - take that into account with the security scores.
• Taking better advantage of checksums - take that into account with security scores.

There is also a page that describes the future thinking as of August 2015 on our blog. This does not include any thinking about security scoring.

There are a variety of roadmap-related artifacts on the project's Trello boards. You can find them here:

• feature board
• Issue/bug/feature board

You should also consider contributing to our sister project the IT Best Practices project - since that's where the best practices we implement are defined.

You can also read more about the project's "current thinking" in our mailing list archives.

Getting Involved

Involvement in the development and promotion of Assimilation Project is actively encouraged! You do not have to be a security expert or a programmer to contribute. Some of the ways you can help are as follows:

Coding

Localization

Testing

Feedback

• What do like?
• What don't you like?
• What features would you like to see prioritized on the roadmap?

This page is where you should indicate what is the minimum set of functionality that is required to make this a useful product that addresses your core security concern. Defining this information helps the project leader to think about what is the critical functionality that a user needs for this project to be useful, thereby helping determine what the priorities should be on the roadmap. And it also helps reviewers who are evaluating the project to determine if the functionality sufficiently provides the critical functionality to determine if the project should be promoted to the next project category.

The Tool Project Template must specify the minimum set of tabs a project should have, provide some an example layout on each tab, provide instructional text on how a project leader should modify the tab, and give some example text that illustrates how to create an actual project.

It would also be ideal if the sample text was translated into different languages.

This page is where you need to place your legacy project template page if your project was created before October 2013. To edit this page you will need to edit your project information template. You can typically find this page by following this address and substituting your project name where it says "OWASP_Example_Project". When in doubt, ask the OWASP Projects Manager. Example template page: https://www.owasp.org/index.php/Projects/OWASP_Example_Project

PROJECT INFO What does this OWASP project offer you?	RELEASE(S) INFO What releases are available for this project?
what is this project? Name: N/A Purpose: N/A License: N/A who is working on this project? Project Leader(s): N/A how can you learn more? Project Pamphlet: Not Yet Created Project Presentation: Mailing list: N/A Project Roadmap: Not Yet Created Key Contacts Contact the GPC to contribute to this project Contact the GPC to review or sponsor this project	current release pending last reviewed release pending other releases