diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 254c960..4533be8 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -118,5 +118,5 @@ This initiative operates under the [OWASP Code of Conduct](https://policy.owasp. ## Questions? - **Slack:** `#team-genai-data-security-initiative` on [OWASP Slack](https://owasp.slack.com) -- **Initiative Lead:** [Emmanuel Guilherme Junior](https://www.linkedin.com/in/emmanuelgjr/) via Slack or LinkedIn +- **Initiative Lead:** Emmanuel Guilherme Junior via Slack - **GitHub Issues:** Open an issue in this repository for bugs, feature requests, or dataset questions diff --git a/README.md b/README.md index 33b54eb..f026f0a 100644 --- a/README.md +++ b/README.md @@ -14,7 +14,9 @@ Part of the [OWASP GenAI Security Project](https://genai.owasp.org/) ยท [Initiat [![License](https://img.shields.io/badge/license-CC%20BY--SA%204.0-lightgrey)](https://creativecommons.org/licenses/by-sa/4.0/legalcode) [![PRs Welcome](https://img.shields.io/badge/PRs-welcome-brightgreen)](CONTRIBUTING.md) -[**๐ŸŒ Explore the Crosswalk webapp โ†’**](https://genai-security-project.github.io/crosswalk/) +The GenAI Crosswalk webapp: 26 frameworks, 3,771 mappings, 51 entries + +**[๐ŸŒ Open the Crosswalk webapp](https://genai-security-project.github.io/crosswalk/)**  ยท  **[๐Ÿ›ก๏ธ Get the DSGAI Scanner](https://github.com/GenAI-Security-Project/dsgai)**  ยท  **[๐Ÿ“„ Read the 2026 risk taxonomy](https://genai.owasp.org/resource/owasp-genai-data-security-risks-mitigations-2026/)** [White Papers](#deliverables) ยท [Crosswalk](#crosswalk) ยท [Scanner](#scanner) ยท [Datasets](#datasets) ยท [Contribute](#contribute) @@ -22,6 +24,41 @@ Part of the [OWASP GenAI Security Project](https://genai.owasp.org/) ยท [Initiat --- +## ๐Ÿš€ Start here + +The initiative ships three things you can use today: the risk taxonomy (white papers below), the **Crosswalk** webapp, and the **DSGAI Scanner**. The webapp and the scanner each have their own repository. + + + + + + +
+ +### ๐ŸŒ Framework Crosswalk + +Crosswalk Visualizer: OWASP GenAI risks linked to the frameworks that map to them + +Map every OWASP GenAI risk to **26 frameworks**, from NIST AI RMF and ISO/IEC 42001 to the EU AI Act and DORA. You can score your coverage, find gaps, and export OSCAL or STIX. + +**[Open the webapp โ†’](https://genai-security-project.github.io/crosswalk/)**
+Source and data: [`GenAI-Security-Project/crosswalk`](https://github.com/GenAI-Security-Project/crosswalk) + +		 + +### ๐Ÿ›ก๏ธ DSGAI Scanner + +DSGAI Scanner compliance report: status of all 21 DSGAI controls + +Audit a GenAI or agentic codebase against all **21 DSGAI controls**. Findings are deterministic and SARIF-ready, and secrets never leave your machine. Use the free CLI in CI, or the Claude Code skill for a narrative report. + +**[Get the scanner โ†’](https://github.com/GenAI-Security-Project/dsgai)**
+`pip install ./dsgai && dsgai audit .` + +
+ +--- + ## Overview The OWASP GenAI Data Security Initiative addresses the data security risks unique to Large Language Models, Generative AI, and Agentic AI systems. AI introduces new data surfaces โ€” prompts, context windows, embeddings, vector stores, agent traces, tool payloads โ€” and new failure modes โ€” prompt-driven extraction, cross-session bleed, inference attacks, plugin data drains โ€” that traditional data security frameworks no longer map cleanly onto. @@ -34,8 +71,8 @@ This initiative produces community-developed, peer-reviewed guidance, interactiv | --- | --- | --- | | ๐Ÿ“„ **DSGAI Risk Taxonomy 2026** | 21 GenAI data security risks with tiered mitigations | [White paper](https://genai.owasp.org/resource/owasp-genai-data-security-risks-mitigations-2026/) | | ๐Ÿ“„ **Data Security Best Practices** | Companion implementation guide | [White paper](https://genai.owasp.org/resource/llm-and-gen-ai-data-security-best-practices/) | -| ๐ŸŒ **Framework Crosswalk** | 51 risk entries ร— 26 frameworks, 3,800+ control mappings, interactive webapp | [Webapp](https://genai-security-project.github.io/crosswalk/) ยท [Repo](https://github.com/GenAI-Security-Project/crosswalk) | -| ๐Ÿ›ก๏ธ **DSGAI Scanner** | Deterministic compliance scanner for AI codebases (SARIF, CI-ready) | [`GenAI-Security-Project/dsgai`](https://github.com/GenAI-Security-Project/dsgai) โ†— | +| ๐ŸŒ **Framework Crosswalk** | 51 risk entries ร— 26 frameworks, 3,700+ control mappings, interactive webapp | [Webapp](https://genai-security-project.github.io/crosswalk/) ยท [Repo](https://github.com/GenAI-Security-Project/crosswalk) | +| ๐Ÿ›ก๏ธ **DSGAI Scanner** | Deterministic compliance scanner for AI codebases (SARIF, CI-ready) | [Repo](https://github.com/GenAI-Security-Project/dsgai) ยท [Quick start](https://github.com/GenAI-Security-Project/dsgai#quick-start) | | ๐Ÿ“Š **Community Datasets** | Exploits, vulnerabilities, test cases, incidents, traces | [`datasets/`](datasets/) | | โœ… **Data Validation** | Schemas and checks for contributed data | [`data_validation/`](data_validation/) | | ๐Ÿ“š **Literature Review** | Categorized corpus of LLM-security research papers | [`literature/`](literature/) | @@ -97,7 +134,7 @@ The companion implementation guide covering data security principles, secure dep ## ๐ŸŒ Framework Crosswalk -The initiative's flagship interactive deliverable: **51 risk entries** across four OWASP source lists โ€” LLM Top 10 2026, Agentic Top 10 2026, DSGAI 2026, and Agentic Skills Top 10 โ€” mapped to **26 industry frameworks** through **3,800+ individual control mappings**, with **131 tracked AI security incidents**. +The initiative's flagship interactive deliverable: **51 risk entries** across four OWASP source lists โ€” LLM Top 10 2026, Agentic Top 10 2026, DSGAI 2026, and Agentic Skills Top 10 โ€” mapped to **26 industry frameworks** through **3,700+ individual control mappings**, with **131 tracked AI security incidents**. > ### [๐Ÿš€ Open the Crosswalk webapp](https://genai-security-project.github.io/crosswalk/) > @@ -109,6 +146,10 @@ The initiative's flagship interactive deliverable: **51 risk entries** across fo > | [**Incidents**](https://genai-security-project.github.io/crosswalk/#/incidents) | Real-world AI security incidents, filterable by severity, year, and layer | > | [**Submit a Standard**](https://genai-security-project.github.io/crosswalk/#/submit) | Propose any framework for automated mapping | +

+Crosswalk framework coverage cards for MAESTRO, AIUC-1, CIS Controls, DORA, the EU AI Act and more +

+ Crosswalk source data, per-framework compliance gap reports (Markdown, CSV, JSON, OSCAL), and enterprise exports (STIX 2.1, OSCAL Component Definition) are maintained in the dedicated [`GenAI-Security-Project/crosswalk`](https://github.com/GenAI-Security-Project/crosswalk) repository. **Frameworks covered:** @@ -142,12 +183,7 @@ pip install ./dsgai dsgai audit . --sarif DSGAI-scan.sarif --json-out DSGAI-scan.json ``` -
-Sample report - -![DSGAI Scanner sample report](https://github.com/GenAI-Security-Project/dsgai/raw/main/DSGAI-samplereport.png) - -
+๐Ÿ“‹ [Full sample report](https://github.com/GenAI-Security-Project/dsgai/blob/main/DSGAI-samplereport.png): a scan of the scanner's own vulnerable fixture app, with the compliance dashboard shown [above](#-start-here). See the [scanner README](https://github.com/GenAI-Security-Project/dsgai#readme) for the full feature set, CI/CD integration, and the Claude Code skill. Scanner issues and pull requests go to that repo. @@ -184,6 +220,13 @@ Contributions to every dataset are validated by the schemas and checks in [`data โ””โ”€โ”€ SECURITY.md โ† vulnerability reporting policy ``` +**Sibling repositories** + +| Repo | What lives there | +| --- | --- | +| [`GenAI-Security-Project/crosswalk`](https://github.com/GenAI-Security-Project/crosswalk) | Crosswalk data, generators, gap reports, OSCAL/STIX exports, and the [webapp](https://genai-security-project.github.io/crosswalk/) source | +| [`GenAI-Security-Project/dsgai`](https://github.com/GenAI-Security-Project/dsgai) | The DSGAI Scanner: CLI, rules, fixtures, GitHub Action, and the Claude Code skill | + --- ## ๐Ÿงญ Workstreams @@ -219,7 +262,7 @@ All contributions are welcome โ€” from security practitioners, AI engineers, res - ๐Ÿ’ฌ **Slack:** Join `#team-genai-data-security-initiative` on the [OWASP Slack workspace](https://owasp.slack.com) ยท [New to OWASP Slack? Join here](https://owasp.org/slack/invite) - ๐Ÿง‘โ€๐Ÿ’ป **GitHub:** Submit issues or pull requests โ€” [CONTRIBUTING.md](CONTRIBUTING.md) has starting points for every role and experience level - ๐Ÿ”’ **Security:** Report vulnerabilities via [GitHub Private Vulnerability Reporting](https://github.com/GenAI-Security-Project/GenAI-Data-Security-Initiative/security/advisories/new) โ€” see [SECURITY.md](SECURITY.md) ยท researchers are credited in [SECURITY-THANKS.md](SECURITY-THANKS.md) -- โœ‰๏ธ **Contact:** Reach out to Emmanuel Guilherme Junior (Initiative Lead) via [Slack](https://owasp.slack.com) or [LinkedIn](https://www.linkedin.com/in/emmanuelgjr/) +- โœ‰๏ธ **Contact:** Reach out to Emmanuel Guilherme Junior (Initiative Lead) via [Slack](https://owasp.slack.com) --- @@ -242,7 +285,9 @@ This initiative is one of several under the [OWASP GenAI Security Project](https ## ๐Ÿ™ Acknowledgments -**Initiative Lead:** [Emmanuel Guilherme Junior](https://www.linkedin.com/in/emmanuelgjr/) +**Initiative Lead:** Emmanuel Guilherme Junior + +**DSGAI Scanner:** initiated by Emmanuel Guilherme Junior and Harish Ramachandran. Harish Ramachandran is the initial contributor; he wrote the original v0.1 Claude Code skill. This initiative is made possible by the contributions of its authors, contributors, and reviewers from across the global AI security community. Thank you to everyone who has helped build and shape this community resource. Full contributor lists are included in each published document. diff --git a/assets/readme/crosswalk-frameworks.png b/assets/readme/crosswalk-frameworks.png new file mode 100644 index 0000000..5536027 Binary files /dev/null and b/assets/readme/crosswalk-frameworks.png differ diff --git a/assets/readme/crosswalk-home.png b/assets/readme/crosswalk-home.png new file mode 100644 index 0000000..8b82bf1 Binary files /dev/null and b/assets/readme/crosswalk-home.png differ diff --git a/assets/readme/crosswalk-matrix.png b/assets/readme/crosswalk-matrix.png new file mode 100644 index 0000000..7755584 Binary files /dev/null and b/assets/readme/crosswalk-matrix.png differ diff --git a/assets/readme/dsgai-report-dashboard.png b/assets/readme/dsgai-report-dashboard.png new file mode 100644 index 0000000..408a776 Binary files /dev/null and b/assets/readme/dsgai-report-dashboard.png differ