This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org

Difference between revisions of "OWASP Video Game Security Framework"

From OWASP
Jump to: navigation, search
m (→‎Governance & Compliance)
(→‎Governance & Compliance)
Line 319: Line 319:
 
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
 
| style="border-right: 1px dotted gray;padding-right:25px;" valign="top" |
  
−
== Governance & Compliance Attack Surface ==
+
== Governance & Compliance ==
−
The purpose of the Governance & Compliance phase in the framework is to layout a guiding path to establishing and maintaining a G&C operating model.
+
The purpose of the Governance & Compliance phase in the framework is to layout a guiding path to establishing and maintaining a G&C operating model. With the current trends in gaming raising the risk to the public's privacy, having a proper G&C model will keep the business continuity high therefore lowering the risks related to non-compliance.
  
−
Governance & Risk Process
+
<br />
 +
'''Governance & Compliance Process'''
 +
<br />
 +
:1.    Regulation
  
 +
:2.    Audit
 +
 +
:3.    Monitor
 +
 +
:4.    Control
 +
<br />
 +
'''1. Regulation'''
 +
 +
<br />
 +
There are many regulations that attribute to organizational compliance and understanding policies that adhere to the business model and future security strategy is the first step.
 +
 +
<br />
 +
'''''Example Questions to ask:'''''
 +
 +
<br />
 +
'''''What''''' are some of the current industry standards related to gaming?
 +
<br />
 +
:1)    Government
 +
 +
::a)    General Data Protection Regulation (GDPR)
 +
::b)    Payment Card Industry Data Security Standard (PCI)
 +
::c)    The National Institute for Standards and Technology (NIST)
 +
 +
:2)    Community
 +
 +
::a)    Open Web Application Security Project (OWASP)
 +
::b)    Payment Card Industry Data Security Standard (PCI)
 +
::c)    The National Institute for Standards and Technology (NIST)
 +
 +
:3)    Vendor
 +
 +
::a)    Microsoft
 +
::b)    Sony
 +
::c)    Nintendo
 +
::d)    Google
 +
::e)    Amazon
 +
::f)    Apple
 +
::g)    Steam
 +
 +
<br />
 +
'''''Which''''' ones are mandatory?
 +
''**Prioritize by impact on business (financial, reputation,etc)''
 +
<br />
 +
 +
 +
:1)    Methodology
 +
 +
::a)    Waterfall
 +
 +
::b)    Agile
 +
<br />
 +
'''''Who''''' are the parties involved?
 +
<br />
 +
:1)    Key Stake Holders
 +
 +
:2)    Subject Matter Experts (SMEs)
 +
 +
:3)    Project Managers & Staff
 +
<br />
 +
'''''What''''' are the Risks, Barriers & Concerns?
 +
<br />
 +
:1)    Resource Availability
 +
 +
::a)    Staff
 +
 +
::b)    Technology
 +
 +
::c)    Finances
 +
 +
:2)    Complexity of project
 +
 +
::a)    No SME
 +
 +
::b)    Vendor support
 +
<br />
 +
'''''What''''' are the known tasks that need to be accomplished?
 +
 +
:1)    Varies by project
 +
<br />
 +
2. '''Compliance'''
 +
 +
<br />
 +
Assessing the current security capabilities within a company is the next step. This will allow an organization to understand certain strengths and developing areas in their sec operations. The very detailed information from the results of the assessments are vital to the next step.
 +
 +
<br />
 +
''Example Questions to ask:''
 +
 +
<br />
 +
'''''What''''' security controls do we currently have in place?
 +
 +
:1)    Physical Security
 +
 +
:2)    Network Security
 +
 +
:3)    System Integrity
 +
 +
:4)    Application Security
 +
 +
:5)    User Security
 +
<br />
 +
'''''Are''''' licensed security technologies being utilized to their fullest potential?
 +
 +
<br />
 +
'''''What''''' are the gaps in the security technologies currently used?
 +
 +
:1)    Lack of scalability
 +
 +
:2)    Cannot perform data analytics
 +
<br />
 +
3. '''Monitoring'''
 +
 +
<br />
 +
The vision for org security needs to be created with the overall business objectives in mind. This needs to start out very high level and can be tailored a bit more later. Understanding industry trends and being innovative allows for a better vision.
 +
 +
<br />
 +
Example Questions to ask:
 +
 +
<br />
 +
'''''What''''' do we want our security posture to look like in the future?
 +
 +
:1)    Better alignment with the business
 +
 +
::a)    Budget planning
 +
 +
::b)    Make security a part of future business decisions
 +
 +
:2)    Improve financials decisions
 +
 +
::a)    Decrease spending
 +
 +
::b)    Smarter spending
 +
 +
:3)    Lower cyber risks to organization
 +
 +
::a)    Address current and future security challenges
 +
 +
::b)    Implement detection, prevention, response
 +
 +
:4)    Higher Return on Investment (ROI)
 +
 +
::a)    Competitive advantage
 +
 +
::b)    Higher market share
 +
 +
::c)    Increased consumer trust
 +
<br />
 +
'''''What''''' are the current threats to the organization?
 +
 +
<br />
 +
'''''What''''' does the org need to protect?
 +
 +
:1)    Based on value of asset
 +
 +
::a)    Cost
 +
 +
::b)    Rarity
 +
 +
:2)    Based on impact to business
 +
 +
::a)    Stop operations
 +
 +
::b)    Impact user privacy
 +
<br />
 +
'''4. Security Controls'''
 +
 +
<br />
 +
During this phase an org must create a list with the end-resulted actions necessary to get to the newly accepted vision. This list must be prioritized and grouped to form the initiatives needed for implementation.
 +
 +
<br />
 +
''Example Questions to ask:''
 +
 +
<br />
 +
'''''How''''' do we achieve ones are mandatory?
 +
 +
:1)    People
 +
 +
:2)    Process
 +
 +
:3)    Technology
 +
<br />
 +
'''''What''''' can be done to ensure continued maintenance on the defined vision?
 +
 +
:1)    Retrospect meetings
 +
 +
:2)    Revamp Strategy & Risk
 +
<br/>
 
{{Social Media Links}}
 
{{Social Media Links}}
  

Revision as of 21:16, 30 April 2019

OWASP Project Header.jpg

OWASP Video Game Security Framework (VGSF)

OWASP Video Game Security Framework (VGSF) defines an approach to discovering solutions for strategy, development, operations, and management surrounding security for video game industry business models


Most organizations that operate in the digital landscape approach security as a last afterthought when compared to the overall business strategy and operations. In the recent years it has become more apparent the consequences of such behavior with increasingly amounts of data breaches happening. The cost associated with an organization’s loss of intellectual property and other digital assets has reached the millions.


With the fast growth of the video game industry (174 billion by 2021 - Newzoo Global Game Forecast) in recent years, it is critical that organizations operating in this space have a strong security posture. Cyber-attacks aimed at various components of a business can affect the interoperability, user protected info, end-game product, and overall business model. As more businesses and clients operate in the cyber space its important to leverage security as a way to create sustainable trust, lead competitively, and operate more agile with different types of data.

The framework is comprised of five discipline areas that could produce many best practice methodologies:
VGSF-LOGO.png


I. Business Strategy & Risk


II. Governance & Compliance


III. Prevention

This will be one of the largest sections as it is comprised of many different aspects of overall cyber security


IV. Management


V. Service Delivery & Support

Licensing

The OWASP Video Game Security Framework is free to use. It is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


Share this:  E-mail this story Bookmark with Facebook Share on Digg.com Share on delicious Share on reddit.com Share on stumbleupon.com Share on LinkedIn.com Share on twitter.com Seed on Newsvine

What is the OWASP Video Game Security Framework?

The goal of the OWASP Video Game Security Framework is to provide an adaptable blueprint to guide the development and deployment of cyber resiliency within a video game enterprise operation.

The target audience for the project includes:

  • Game Publishers
  • Game Developers
  • Security Professionals
  • Consumer Gamers
  • Quality Assurance Testers
  • Business Stakeholders in the Gaming Industry
  • Industry Enthusiasts

Project Leaders

  • Romen Brewer

Contributors

  • TBD

Related Projects

Collaboration

Join the discord channel: [1]

Quick Download

COMING SOON

News and Events

  • April, 2019: Site Creation and Discord channel creation.


Classifications

Owasp-incubator-trans-85.png Owasp-builders-small.png
Owasp-defenders-small.png
Cc-button-y-sa-small.png
Project Type Files DOC.jpg

Retrieved from "https://wiki.owasp.org/index.php?title=OWASP_Video_Game_Security_Framework&oldid=250859"