Google, Salesforce, others team up to launch MVSP security baseline project

guest · Oct 29, 2021

Google, Salesforce, others team up to launch MVSP security baseline project
The collaboration is focused on creating a vendor-neutral security standard
October 29, 2021
https://portswigger.net/daily-swig/...m-up-to-launch-mvsp-security-baseline-project

Industry giants including Google and Salesforce have announced the creation of a “vendor-neutral” security baseline for businesses.

Dubbed the ‘Minimum Viable Secure Product’ (MVSP), Google’s Royal Hansen, vice president of security, said in a blog post on Wednesday that the scheme will establish “minimum acceptable security baselines” for corporations.
In particular, the project will focus on securing business-to-business software developers and businesses that outsource to suppliers.
Click to expand...

According to research conducted by the Opus and the Ponemon Institute, 59% of US organizations say they have suffered a data breach caused by third parties, including their vendors.

In a report published by ENISA on software supply chain attacks in Europe, 62% of incidents began with malware deployment, and more than 60% of attacks abused the trust of customers in their suppliers. In total, 58% of attacks reported were focused on data theft.
Click to expand...

To keep things simple, the group has adopted a checklist for users to work their way through, which includes:

A website point of contact for vulnerability reports

Responses to vulnerability reports managed in a reasonable time period

Annual penetration testing

Data sanitization based on NIST SP 800-88 or equivalent

Establishing minimally permissive Content Security Policies

Secure backups

Click to expand...

By creating a base standard that organizations are expected to keep – no matter which cybersecurity solutions they adopt or who their favorite vendors are – this could ramp up the pressure on companies to maintain adequate security levels in order to remain competitive and to be considered suitable for future business relationships.

MVSP “highlight[s] opportunities for improvement and [can] raise their visibility within the organization, with clearly defined benefits,” the executive commented.
Click to expand...

Google: Launching a collaborative minimum security baseline

Up until today, organizations of all sizes have had to design and implement their own security baselines for vendors that align with their risk posture. Unfortunately, this creates an impossible situation for vendors and organizations alike as they try to accommodate thousands of different requirements.

To solve this challenge, organizations across the industry teamed up to design Minimum Viable Secure Product or MVSP – a vendor-neutral security baseline that is designed to eliminate overhead, complexity and confusion during the procurement, RFP and vendor security assessment process by establishing minimum acceptable security baselines.
Click to expand...

Log in or Sign up

Google, Salesforce, others team up to launch MVSP security baseline project

guest Guest

Log in or Sign up

Google, Salesforce, others team up to launch MVSP security baseline project

guest Guest

Useful Searches