OWASP Security Labeling System Project

=Main=



{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 * valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

OWASP Security Labeling System Project
The purpose of this project is creating a transnational and market wise software security labeling system. Security is invisible, so the OWASP labeling system will help to make it visible. The system consists on different kinds of OWASP security labels for Web applications and Software( Please send your proposals):

* Ingredients criterion label (I). This label certifies that the software reveals all software components that integrate the software, or that were used to create it(eg. Shared libraries, APIs, and so on).

* Security 'good enough' criterion label (S). This would be the standard certification label. This label certifies that the software is 'good enough' because follows good security practices in its development life cycle, updates and security patches(Eg. OWASP Top Ten, SO, OpenSAMM, the AVSV Security and verification standard, security control programming interfaces - ESAPIs).

* Legal 'good enough' criterion label (L). This is an additional label in case that the contract  includes  security software clauses following the OWASP principles.The OWASP legal principles would be based in the OWASP secure contract annex, and perhaps a soft law document containing  relevant legal issues such as third party source code, Privacy, Data protection, and so forth.

* Disclosure of vulnerabilities criterion label (D). This label consists in the open disclosure of vulnerabilities of the software or Web Applications to the public.

Motivation
After joining the OWASP community in my local chapter, I got the idea of a security labeling system. When I contacted Jeff Williams I found out that he already proposed a very similar idea few years ago. We think we can revive it. The OWASP international community has the purpose of making security visible, and opinions from different sides are crucial in order to create a practical and widely used labeling system.

Licensing
The OWASP Security Labeling System Project is free to use. All documentation is licensed under the http://creativecommons.org/licenses/by-sa/3.0/ Creative Commons Attribution-ShareAlike 3.0 license], so you can copy, distribute and transmit the work, and you can adapt it, and use it commercially, but all provided that you attribute the work and if you alter, transform, or build upon this work, you may distribute the resulting work only under the same or similar license to this one.


 * valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

What is OWASP Security Labeling System?
The goal is labeling the security of web applications and software, with the purpose of making security more visible. The OWASP Security Labeling System provides:


 * The Labeling logos linked in html format.
 * A certificate of authenticity.

Presentation
http://slideshare.net/luisenriquezA/owasplabelingsystem-presentation.

Project Leader
Luis Enriquez

Related Projects

 * OWASP_Legal_Project
 * OWASP_CISO_Survey


 * valign="top" style="padding-left:25px;width:200px;" |

News and Events

 * The project will be oficially launched the 20th of January 2014.

Classifications

 * }

=FAQs=

 Why creating a security labeling system is important? Making security more visible. Is a transnational and market wise solution. Visual, and easy to apply. Different labeling categories for diferent purposes.

Why legal liability by default is NOT a wise option? It doesn't encourage development There are so many laws and jurisdictions around the planet. In practice it produces the opposite effect(hiding vulnerabilities), as no one wants to be liable by default.

Which security labels can I use? Ingredients label(I). Security 'good enough' label(S). Legal label(L). Disclosure label(D).

What is the Ingredients label about? Because it will help developers and users to identify properly third party code, evaluate the risks of using it, avoid non intentional license compatibility controversies, and so forth.

Why is the Ingredients label relevant? Because it will help developers and users to identify properly third party code, evaluate the risks of using it, avoid non intentional license compatibility controversies, and so forth.

What is the Security 'good enough' label about? It certifies that certain software follows a secure life cycle, secure coding practices, quick vulnerabilties patches, and is programmed and mantained by developers with a software security orientation.

Why is the Security label relevant? Many software developer projects are already using OWASP tools. A lot of them already belong to the OWASP network. The label will make these security practices visible for users.

What is the Legal label(L) about? Is an aditional label provided when certain software includes software security principles, in its license(or contract).

Why is the legal label relevant? Developers assume some legal responsabilties, such as not include hidden security bugs, spyware, backdoors, or unauthorized use of personal data. The impact is huge in terms of Transparency, software security, privacy, data protection.

What is the Disclosure label(D) about? It is dedicated to high security envinroments. Web Applications will expose their vulnerabilties of the last vulnerability scan the public. They will have the time to patch them until the next vulnerabilties scan. The scans should be fixed in a regular basis(e.g. each week).

Why is the disclosure label relevant? Getting this label means that a security team reveals their vulnerabilities to the public as expected. but at the same time, it shows to the public how good and fast they are in order to fix them.

= Acknowledgements =

Volunteers
The OWASP Security Labeling System is developed by a worldwide team of volunteers. The primary contributors to date have been:


 * Luis Enriquez
 * Jeff Williams
 * Jorge Lara

= Road Map and Getting Involved = The priorities of the OWASP Security Labeling System are:

(1)Create and Distribute opinion polls to different sides involved in the IT environment(such as software developers, e-commerce agents, IT security firms, Cyber communities, Internet rights NGOs, lawyers, and of course, users). (2)Choose the sources of the security labeling system(which OWASP projects).

(3)Application of the labeling system. A platform in which developers can apply for the chosen label, a fast verification process, and to generate certificates (Of course, this methodology may change during the fist phases of the life cycle).

Involvement in the development and promotion of the OWASP Security Labeling System is actively encouraged! You do not have to be a security or legal expert in order to contribute. Some of the ways you can help:
 * Help us to distribute the opinion polls.
 * We might need a creative graphical designer for the logos.

=Project About=