OWASP Jupiter
Thank you for visiting OWASP.org. We recently migrated our community to a new web platform and regretably the content for this page needed to be programmatically ported from its previous wiki page. There’s still some work to be done. The historical content can be found here.
Please visit our Page Migration Guide for more information about updating pages for the new website as well as examples of github markdown.
This is an example of a Project or Chapter Page.
Main
An Application Security program is more successful when coverage of its processes and tooling can be proven. Unfortunately, software inventory lists consist of some custom-written applications for an organization but also include systems and software that aren't in scope for a traditional AppSec program (Active Directory or Adobe Reader, for instance). Making matters worse, organizations are constantly transforming the ways they operate. New software is being written and deployed every day: Making matters worse, organizations are constantly transforming the ways they operate. New software is being written and deployed every day:
Traditional ITAM solutions aren't tracking these custom-written applications that are the lifeblood of your organization because they aren't designed to find them. Traditional ITAM solutions aren't tracking these custom-written applications that are the lifeblood of your organization because they aren't designed to find them. If "who owns this?" or "did you know this was in production?" sounds familiar, you're not alone. |
OWASP Jupiter - Application Inventory Management System
OWASP Jupiter - Application Inventory Management System
Inventory Management Console (COMING SOON)
login.png|Jupiter Inventory Management Console Home antecessors.png|Manage Antecessors collectors.png|Manage Collector Instances
</td>Project Leader
Matt Stanchek
</td> </table> # Roadmap ## Jupiter Application Inventory Management System Roadmap 1. Collector Service 1. Authentication - Utilize Auth Service for JWT validation 2. Authorization - Based on JWT payload, enforce restrictions on CRUD operations 3. Database Connectivity - Update Mongo connection code to update deprecated connection method 4. Input Validation - Input length checks - Input type checks 5. Data Fields - Enable data fields beyond Common Name and Primary Owner 6. Containerization - Prepare Dockerfile - Build Docker container - Deploy and test Docker container 2. Curated Inventory Service 1. Authentication - Utilize Auth Service for JWT validation 2. Authorization - Based on JWT payload, enforce restrictions on CRUD operations 3. Input Validation - Input length checks - Input type checks 4. Data Fields - Enable Application-specific data fields beyond Common Name and Primary Owner - Enable capture of Collector Service instance ID 5. Data Integrity - Restrict Common Name to unique values 6. Containerization - Prepare Dockerfile - Build Docker container - Deploy and test Docker container 3. Auth Service 1. Authentication 1. Enable LDAP authentication - Build LDAP integration capabilities - Based on successful username/password LDAP authentication, provide time-limited JSON Web Token for subsequent requests - Enable facility to validate expiration of tokens and deny access to expired tokens 2. Authentication - Define user roles (administrator, reader, creator/updater) - Enable issuance of tokens that restrict access based on user role 4. Management Console 1. Base Architecture 1. Add Local SQLite Database - Enable saving of configuration and preferences 2. Authentication 1. Collector Services - Build an interface to allow configuration of Collector Services 2. Curated Inventory Service - Build an interface to allow configuration of Curated Inventory Service 3. Data Fields - Enable Application-specific data fields beyond Common Name and Primary Owner 4. External Integrations - Consistent naming across multiple external Application Security tools will allow for greater future automation and reporting as well as utilization. - Enable set up of Application in Fortify Software Security Center - Enable set up of Application in OWASP Dependency-Track - Enable set up of Application in OWASP Defect Dojo - Enable set up of Application in OWASP SecurityRAT 5. User Experience 1. Antecessors - Aggregate all Collectors’ data in available Antecessors list when there is more than one Collector Service defined 5. Jenkins Collector Plugin 1. Input Validation - Input length checks - Input type checks 2. Connectivity Validation - Add a “Test Connection…” button to the Global config screen to test the Collector URL and token 3. Data Fields - Enable Application-specific data fields beyond Common Name and Primary Owner under “Advanced” # About Jupiter ## FAQ Q: Why is this project named "Jupiter"? A: In *2001: A Space Odyssey*, the Discovery One embarked on a mission to investigate the signal sent from the monolith on the Moon to Jupiter. In *2010: The Year We Make Contact*, the crews of the Discovery and Leonov witness countless monoliths emerge from Jupiter before it is converted into a star. Aside from the cool sci-fi reference, there is an analog to what this project is for -- to start with a small amount of information about software applications in an organization's portfolio and build upon that knowledge to find more. __NOTOC__FAQ
Q: Why is this project named “Jupiter”?
A: In 2001: A Space Odyssey, the Discovery One embarked on a mission to investigate the signal sent from the monolith on the Moon to Jupiter. In 2010: The Year We Make Contact, the crews of the Discovery and Leonov witness countless monoliths emerge from Jupiter before it is converted into a star. Aside from the cool sci-fi reference, there is an analog to what this project is for – to start with a small amount of information about software applications in an organization’s portfolio and build upon that knowledge to find more.