Security: Difference between revisions

From MozillaWiki
Jump to navigation Jump to search
(Update link to Guidelines)
 
(208 intermediate revisions by 35 users not shown)
Line 1: Line 1:
==Mozilla Security==
“Individuals’ security and privacy on the Internet are
fundamental and must not be treated as optional.”
  - [http://www.mozilla.org/en-US/about/manifesto/ Mozilla Manifesto Principle 4]


Welcome to the Mozilla Security wiki.  There is not much here yet so feel free to contribute.
'''The Mozilla Security community provides leadership in security by building security features, testing software and systems, and leading industry standards to ensure that individuals retain the ability to make meaningful choices about security and privacy on the Internet. '''


===Security-related bugs===
This page documents the security-related activities for Mozilla and how to join us.


[[Security Severity Ratings]]
__TOC__


[http://www.mozilla.org/security/#For_Developers How to report a security issue]
== Reporting Security Issues ==
Mozilla relies on the security community to help secure our products and websites by reporting security issues. Our preference is to receive '''[[Security/Fileabug|bug reports]]''' via our bug tracking system Bugzilla, however [https://www.mozilla.org/security/#For_Developers emailing security@mozilla.org ] (preferably encrypted) is also an option.


===Security feature work===
Details on the way we classify security bugs can be [[Security Severity Ratings|found here]].


[http://people.mozilla.org/~bsterne/content-security-policy Content Security Policy proposal]
== Security at Mozilla ==
=== Who are we? ===
Security at Mozilla is distributed among the following teams:
* [[SecurityEngineering|Security Engineering]] makes users of Firefox safer on the Internet.
* [[Security/FoxSec|Security Operations]] protects the product infrastructure and builds security services.
* Firefox Fuzzing finds vulnerabilities in Firefox.
* [[Security/InfoSec|Security Assurance]] leads incident response, product security strategy, and risk management.


===Mozilla Security resources and blogs ===
=== Contacting Us ===
The Mozilla security team is available via a number of channels:
* Via email
** security@mozilla.org: to contact us privately or [https://www.mozilla.org/security/#For_Developers reporting security bugs]
** dev-security@lists.mozilla.org: this is the best place to ask security questions that don't need to be private. You might also try searching this list for answers to your questions
** You can also find us on a number of security related mailing lists including W3C WebAppSec
* Via the [https://matrix.to/#/!xSFwJMLGSLXLaSUrHr:mozilla.org?via=mozilla.org&via=matrix.org #security] channel on Mozilla's [[Matrix]] instance.


[http://www.mozilla.org/security Mozilla Security Center]
'''Need a security review for Firefox feature/change? See [[Security/Testing]].'''


[http://developer.mozilla.org/en/Security Mozilla security developer docs]
== Information for developers ==
===Security Bug Processes ===
* [[Security/Firefox_security_bug_fixing|Guidelines for fixing a core-security bug in Firefox]]
* [[Security/Bug_Approval_Process|Approval for Landing Security Bugs]]
* [[Security/Web_Bug_Rotation|Web Bug Verification Rotation]]
* [[Security/Firefox/Security_Bug_Triage_Process|Security Bug Triage Process]]
* [[Security/Firefox/Security_Bug_Life_Cycle|Security Bug Life Cycle]]


[http://blog.mozilla.com/security Window Snyder's blog]
== Contributing to the security of Mozilla products ==
There are a range of ways to contribute to security engineering at Mozilla.


[http://blog.mozilla.com/ladamski Lucas Adamski's blog]
=== Developers ===
* Implement security features
* Fix outstanding security bugs
* Contribute to security feature development
 
=== Security Testers ===
* Test Firefox or Mozilla Websites as part of our bug bounty programs
 
=== Community ===
* Test & provide feedback on new security features
* Improve security documentation
 
== Mozilla Official Sites ==
* [http://www.mozilla.org/security Mozilla Security Center]
* [http://developer.mozilla.org/en/Security Mozilla security developer docs]
* [[CA|Mozilla CA Root Program]]
* [http://blog.mozilla.com/security Mozilla Security blog]
* [https://infosec.mozilla.org/guidelines/ Security/Guidelines/]

Latest revision as of 23:03, 12 March 2021

“Individuals’ security and privacy on the Internet are
fundamental and must not be treated as optional.”
  - Mozilla Manifesto Principle 4

The Mozilla Security community provides leadership in security by building security features, testing software and systems, and leading industry standards to ensure that individuals retain the ability to make meaningful choices about security and privacy on the Internet.

This page documents the security-related activities for Mozilla and how to join us.

Reporting Security Issues

Mozilla relies on the security community to help secure our products and websites by reporting security issues. Our preference is to receive bug reports via our bug tracking system Bugzilla, however emailing security@mozilla.org (preferably encrypted) is also an option.

Details on the way we classify security bugs can be found here.

Security at Mozilla

Who are we?

Security at Mozilla is distributed among the following teams:

  • Security Engineering makes users of Firefox safer on the Internet.
  • Security Operations protects the product infrastructure and builds security services.
  • Firefox Fuzzing finds vulnerabilities in Firefox.
  • Security Assurance leads incident response, product security strategy, and risk management.

Contacting Us

The Mozilla security team is available via a number of channels:

  • Via email
    • security@mozilla.org: to contact us privately or reporting security bugs
    • dev-security@lists.mozilla.org: this is the best place to ask security questions that don't need to be private. You might also try searching this list for answers to your questions
    • You can also find us on a number of security related mailing lists including W3C WebAppSec
  • Via the #security channel on Mozilla's Matrix instance.

Need a security review for Firefox feature/change? See Security/Testing.

Information for developers

Security Bug Processes

Contributing to the security of Mozilla products

There are a range of ways to contribute to security engineering at Mozilla.

Developers

  • Implement security features
  • Fix outstanding security bugs
  • Contribute to security feature development

Security Testers

  • Test Firefox or Mozilla Websites as part of our bug bounty programs

Community

  • Test & provide feedback on new security features
  • Improve security documentation

Mozilla Official Sites

Retrieved from "https://wiki.allizom.org/index.php?title=Security&oldid=1234410"