lmoyle1989 / gsd-project

Global Security Database Project

Global Security Database Project Plans

The Global Security Database is a new Working Group project from the Cloud Security Alliance meant to address the gaps in the current vulnerability identifier space.

The world of vulnerability identifiers has changed drastically in the last 20 years while the infrastructure and management of public and private vulnerability data have changed very little. This has created a sizable gap between the current needs of industry and the ability of existing projects to be effective.

This is the Global Security Database (GSD) Project Plans which contains all the GSD project plans and related material. For more informaiton please see https://csaurl.org/gsd-quick-links.

For more information please see https://csaurl.org/gsd-quick-links.

Table of contents

*** TODO ***

Quick Links

• Quick links (this section): https://csaurl.org/gsd-quick-links
• Website: https://globalsecuritydatabase.org
• Request a GSD: https://requests.globalsecuritydatabase.org/ 
• Edit a GSD entry: https://edit.globalsecuritydatabase.org/
• WG Landing Page: https://csaurl.org/gsd-landing-page
• Circle Community (Forums): https://csaurl.org/gsd-circle 
• Mailing-list: https://csaurl.org/gsd-mailing-list
• Github: https://csaurl.org/gsd-github
• WG Meeting Agenda: https://csaurl.org/gsd-agenda
• GitHub Repos: https://globalsecuritydatabase.org/repos/
• Slack: https://csaurl.org/csa-public-slack #gsd-working-group
• Press mentions: https://globalsecuritydatabase.org/press

GSD Repos

There are 3 primary repositories in GitHub.

gsd-database

The gsd-database repo is the actual data for identifiers in the Global Security Database in the form of GSD-YEAR-INTEGER. To maintain easier compatibility with the CVE ecosystem we have decided to reserve numbers below 1 million for CVE data, using the same integer to make matching up entries easy.

Issues

Please file any data related issues in the gsd-database repo. If you need to file issues against the data format(s) themselves please file an issue in the gsd-project repo.

gsd-project

The gsd-project repo is designed to support the project, meeting times, agendas, minutes, planning, roadmaps, vision, etc. are contained here.

Issues

Please file any project, governance, road maps, planning, data formats, process related issues or any general cross repo or project issues in the gsd-project repo.

gsd-tools

The gsd-tools repo is the Global Security Database (GSD) tools repo which contains all the GSD tools. For more informaiton please see https://csaurl.org/gsd-quick-links.

Issues

Please file any tooling related issues in the gsd-tools repo. If you need to file issues against the data format(s) themselves please file an issue in the gsd-project repo.

Goals / Vision

The goal and vision of the Global Security Database is to create a new security identifier ecosystem that complements existings standards and systems, but also allows for future growth and change. IT is constantly changing (TCP-IP, the Web, the Cloud, IoT, Blockchains, etc.) and we need vulnerability and secuerity identifiers that change with it.

Project Roadmap

Currently we are working on standing up basic technology, e.g. these repos, the editing button for current entries, and so on. If you have an item for the roadmap or other ideas please file an issue in gsd-project to make us aware, or bring it up on the mailing list/circle/slack/etc. so it can be captured and discussed.

GSD Contacts / communications channels

• Circle Community (Forums): https://csaurl.org/gsd-circle 
• Mailing-list: https://csaurl.org/gsd-mailing-list
• Slack: https://csaurl.org/csa-public-slack #gsd-working-group

Meetings

Meeting times and locations

Meeting agendas

Meeting recordings

Governance

Charter

https://cloudsecurityalliance.org/artifacts/global-security-database-working-group-charter/

Roles

Process

Related groups, activities and events

Global Security Vulnerability Summit

https://events.linuxfoundation.org/open-source-summit-north-america/about/global-security-vulnerability-summit/

June 23 – 24 in Austin Texas

GSD Project Chairs

Licenses

We use the Creative Commons Legal Code CC0 1.0 Universal for the gsd-database and gsd-project and Apache License Version 2.0, January 2004 for the gsd-tools.

Participation

The GSD uses the Contributor Covenant Code of Conduct CODE_OF_CONDUCT.md *** TODO ***

Identity and attribution for participation

Currently the GSD requires identity/atttribution for participation in GitHub to a GitHub account, this is a technical limitation/feature of the platform. Participation in the public email lists/Twitter/etc. for example does NOT require a GitHub account (or any identity beyond a working email address/Twitter account/etc.). Truly anonymous participation is not explicitly supported, however pseudonymity is supported and welcome.