The Global Security Database is a new Working Group project from the Cloud Security Alliance meant to address the gaps in the current vulnerability identifier space.
The world of vulnerability identifiers has changed drastically in the last 20 years while the infrastructure and management of public and private vulnerability data have changed very little. This has created a sizable gap between the current needs of industry and the ability of existing projects to be effective.
This is the Global Security Database (GSD) Project Plans which contains all the GSD project plans and related material. For more informaiton please see https://csaurl.org/gsd-quick-links.
For more information please see https://csaurl.org/gsd-quick-links.
*** TODO ***
- Quick links (this section): https://csaurl.org/gsd-quick-links
- Website: https://globalsecuritydatabase.org
- Request a GSD: https://requests.globalsecuritydatabase.org/
- Edit a GSD entry: https://edit.globalsecuritydatabase.org/
- WG Landing Page: https://csaurl.org/gsd-landing-page
- Circle Community (Forums): https://csaurl.org/gsd-circle
- Mailing-list: https://csaurl.org/gsd-mailing-list
- Github: https://csaurl.org/gsd-github
- WG Meeting Agenda: https://csaurl.org/gsd-agenda
- GitHub Repos: https://globalsecuritydatabase.org/repos/
- Slack: https://csaurl.org/csa-public-slack #gsd-working-group
- Press mentions: https://globalsecuritydatabase.org/press
There are 3 primary repositories in GitHub.
The gsd-database repo is the actual data for identifiers in the Global Security Database in the form of GSD-YEAR-INTEGER. To maintain easier compatibility with the CVE ecosystem we have decided to reserve numbers below 1 million for CVE data, using the same integer to make matching up entries easy.
Please file any data related issues in the gsd-database repo. If you need to file issues against the data format(s) themselves please file an issue in the gsd-project repo.
The gsd-project repo is designed to support the project, meeting times, agendas, minutes, planning, roadmaps, vision, etc. are contained here.
Please file any project, governance, road maps, planning, data formats, process related issues or any general cross repo or project issues in the gsd-project repo.
The gsd-tools repo is the Global Security Database (GSD) tools repo which contains all the GSD tools. For more informaiton please see https://csaurl.org/gsd-quick-links.
Please file any tooling related issues in the gsd-tools repo. If you need to file issues against the data format(s) themselves please file an issue in the gsd-project repo.
The goal and vision of the Global Security Database is to create a new security identifier ecosystem that complements existings standards and systems, but also allows for future growth and change. IT is constantly changing (TCP-IP, the Web, the Cloud, IoT, Blockchains, etc.) and we need vulnerability and secuerity identifiers that change with it.
Currently we are working on standing up basic technology, e.g. these repos, the editing button for current entries, and so on. If you have an item for the roadmap or other ideas please file an issue in gsd-project to make us aware, or bring it up on the mailing list/circle/slack/etc. so it can be captured and discussed.
- Circle Community (Forums): https://csaurl.org/gsd-circle
- Mailing-list: https://csaurl.org/gsd-mailing-list
- Slack: https://csaurl.org/csa-public-slack #gsd-working-group
https://cloudsecurityalliance.org/artifacts/global-security-database-working-group-charter/
June 23 – 24 in Austin Texas
We use the Creative Commons Legal Code CC0 1.0 Universal for the gsd-database and gsd-project and Apache License Version 2.0, January 2004 for the gsd-tools.
The GSD uses the Contributor Covenant Code of Conduct CODE_OF_CONDUCT.md *** TODO ***
Currently the GSD requires identity/atttribution for participation in GitHub to a GitHub account, this is a technical limitation/feature of the platform. Participation in the public email lists/Twitter/etc. for example does NOT require a GitHub account (or any identity beyond a working email address/Twitter account/etc.). Truly anonymous participation is not explicitly supported, however pseudonymity is supported and welcome.