This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "Positive Security Project"
Camargoneves (talk | contribs) (→References) |
Camargoneves (talk | contribs) (→References) |
||
Line 52: | Line 52: | ||
For each company listed, the following information are stated on this page: | For each company listed, the following information are stated on this page: | ||
− | |||
* '''Summary:''' A brief description of the company, normally copied from Wikipedia or their own website. | * '''Summary:''' A brief description of the company, normally copied from Wikipedia or their own website. |
Revision as of 13:01, 28 October 2008
Welcome to the Positive Security Project
A common approach on most companies is adequate the protection of their assets as part of a post mortem lessons learned process. A web site changes, data compromised and unavailability as a result of a DoS attack are common examples on a start point to accept the existence of security flaws and initiate the security enhancement to avoid future occurrences. Even in these cases the adequate security is not always performed as a consequence of the enhancement process and the most common result is to allocate efforts on the problem’s source and simply forget about the rest.
The Positive Security Project was initiated on the OWASP Summer of Code 2008 as a long term initiative to support a continuous learning process for the market on adopt a “positive security attitude” as part of their common IT management practices through a marketing campaign to encourage a positive approach.
The broader vision for this project is to work for change in the software market. To increase application security, we need to make it possible for people to make informed decisions about the software they buy. Then the market can work to encourage security. To enable informed decisions, we need real information about the people, process, and technology used to create an application. And that means we need positive disclosure. The negative approach to security leads to the penetrate-and-patch hamster wheel of pain security management process. The time has come to be positive and proactive.
Get Involved on Positive Security
What is Positive Security?
Positive security focuses on verifying that security controls are present, properly implemented, and used in all the right places. It involves white lists and only allowing what's specifically allowed. And it involves disclosing what a company does to ensure the security of the software it produces (positive disclosure). Disclosing vulnerabilities (negative disclosure/full disclosure) has a role in the market, but the metrics produced are meaningless.
How to Adopt a Positive Security Approach? (For Suppliers)
- An Overview of the Positive Security Approach - The Supplier Side
How to Adopt a Positive Security Approach? (For Customers)
- An Overview of the Positive Security Approach - The Customer Side
- How to sell the Positive Security Approach within your company
- How to explain the Positive Security Approach amongst your IT colleagues
- How to explain the Positive Security Approach for your internal customers
Public Resources on Positive Security (Companies Related)
Public Resources on Positive Security (Government Related)
Public Resources on Positive Security (Community Related)
Updates
28 October 2008
- Page layout changed to include more resources
23 September 2008
- The Top 50 Software Companies list was updated with relative information and links to companies' resources on Positive Security.
Get Involved
Everyone has something to contribute. Sharing public available information on how companies are dealing with the Positive Security Attitude is well appreciated and also the vice-versa, where companies simply don’t care about their security controls until a problem occurs and a considerable impact. If you want to contribute to the project as an author, reviewer or in any other fashion, please send a message to owasp (at) camargoneves.com explaining what you can do and how much effort you can allocate to this non-profit volunteer process.
References
Top 50 Software Companies
The Top 50 Software Companies were defined following The Big International Software Index, published at Software Top 100 web site and these companies are being studied to understand what kind of approach they maintain to deal with IT Security and if the material can be useful as reference for the Positive Security Project. This list was also defined as the reference for the OWASP Corporate Application Security Rating Guide.
For each company listed, the following information are stated on this page:
- Summary: A brief description of the company, normally copied from Wikipedia or their own website.
- Related Websites: Links to these companies’ websites where information on Positive Security Approach is published and available for public use.
- Related Resources: Documents, methodologies, presentations and all other resources directly related to the Positive Security approach which are available for the community.
Note: All links and supportive information was directly collected from the software companies' web sites without any change or adjustment. Please read it understanding that some marketing approach may be in use and apply your own critical view. :-)
(01) Microsoft
- Summary
- Related Websites
- Microsoft Security Main Page
- Microsoft Security Development Lifecycle (SDL): The Microsoft Security Development Lifecycle (SDL) is the industry-leading software security assurance process. A Microsoft-wide initiative and a mandatory policy since 2004, SDL has played a critical role in embedding security and privacy into Microsoft software and culture. Combining a holistic and practical approach, SDL introduces security and privacy early and throughout the development process. It has led Microsoft to measurable and widely recognized security improvements in flagship products such as Windows Vista and SQL Server. As part of its commitment to supporting a more secure and trustworthy computing ecosystem, Microsoft is making SDL process guidance, tools and training available for every developer.
- SDL Pro Network: The SDL Pro Network is a group of security service providers that specialize in application security and have been trained by Microsoft in the tools and guidance associated with its Security Development Lifecycle. These service providers will guide and support organizations - both large and small - in implementing the SDL in their environments. The program, currently in its build-out phase, includes nine industry leading consultancies. The one-year pilot phase of the program will commence in November.
(02) IBM
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(03) Oracle
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(04) SAP
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(05) HP
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(06) Symantec
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(07) Computer Associates
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(08) Electronic Arts
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(09) Adobe
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(10) Nintendo
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(11) EMC
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(12) Autodesk
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(13) NCR
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(14) Activision
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(15) Cisco
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(16) SunGard
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(17) BMC
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(18) Intuit
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(19) Cadence
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(20) Dassault
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(21) THQ
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(22) Synopsys
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(23) Vivendi Universal Games
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(24) Take 2 Interactive
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(25) SAS Institute
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(26) Citrix
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(27) BEA
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(28) UGS
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(29)Cognos
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(30 Reynolds & Reynolds
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(31) Compuware
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(32) Trend Micro
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(33) Qualcomm
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(34) Apple
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(35) Novell
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(36) Sage
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(37) Misys
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(38) Infor
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(39) McAfee
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(40) Business Objects
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(41) Hyperion Solutions
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(42) Parametric Technology
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(43) Sybase
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(44) Fair Isaac
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(45) Checkpoint
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(46) Mentor Graphics
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(47) Software AG
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(48) Intergraph
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(49) Philips
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites
(50) Eclipsys
Summary
Here is the text.
Public Resources
- Resource: Resource Description.
Related Websites