供应商安全性评估调查问卷的解决方案VSAQ

VSAQ(Vendor Security Assessment Questionnaire)是谷歌开源的供应商安全性评估调查问卷开源解决方案, 但是Google声称VSAQ并非是谷歌的官方开源产品。VSAQ实际上是一系列安全调查问卷模板，调查问卷直观、灵活, 能够根据网络的基本情况让系统和网络管理员作答，评估其所管理的企业本地网络的安全措施强度的大致情况。通过 VSAQ 自动化收集大部分初步信息。VSAQ 框架包括四个可扩展的调查问卷模板，涵盖网络应用、隐私计划、基础架构以及物理安全性和数据中心安全性。

Demo演示（需科学上网）: https://vsaq-demo.withgoogle.com.

[repo owner=”google” name=”vsaq”]
-------------------------------------------------

VSAQ is an interactive questionnaire application to assess the security programs of third parties.

https://vsaq-demo.withgoogle.com 

Introduction

Note: VSAQ is not an official Google product (experimental or otherwise); it's just code that happens to be owned by Google.

VSAQ is an interactive questionnaire application. Its initial purpose was to support security reviews by facilitating not only the collection of information, but also the redisplay of collected data in templated form.

At Google, questionnaires like the ones in this repository are used to assess the security programs of third parties. But the templates provided can be used for a variety of purposes, including doing a self-assessment of your own security program, or simply becoming familiar with issues affecting the security of web applications.

To test the application without deploying it, go to https://vsaq-demo.withgoogle.com.

Example Third-Party Security Review Workflow

1. Reviewer sends questionnaire link(s) to assessment target (e.g., https://vsaq-demo.withgoogle.com/vsaq.html?qpath=questionnaires/webapp.json).
2. Assessment target completes the questionnaire(s).
3. Assessment target clicks the Save button at the bottom of the questionnaire to export the answers.
4. Assessment target sends the answers file back to reviewer.
5. Reviewer opens the same questionnaire(s) and loads the answers received from assessment target.

Project Structure

• / — top-level directory for common files.
• /questionnaires — directory for questionnaire templates.
• /vsaq — directory for the questionnaire rendering engine library.
• /client_side_only_impl — directory for a client-side reference implementation.

Build Prerequisites

These instructions have been tested with the following software:

• java >= 1.7 — for running the Closure Compiler
• ant — for building VSAQ dependencies
• git
• curl
• maven
• a web server (an optional Python development server is provided)
• a browser with HTML5 support

VSAQ Setup

These instructions assume a working directory of the repository root.

VSAQ includes an easy-to-use setup script called do.sh. It supports the following commands:

• Setup: ./do.sh {install_deps|check_deps}
• Build: ./do.sh {build|build_prod|build_templates|build_docs} [debug]
• Run: ./do.sh {run}
• Cleanup: ./do.sh {clean|clean_deps}
• Other: ./do.sh {lint}

Build

To build VSAQ, run the following commands:

1. ./do.sh install_deps
2. ./do.sh build

Local Development Server

To run the VSAQ development server locally, use the run command:

1. ./do.sh run

Note that the development app server uses a snapshot of the code, taken at the time you run it. If you make changes to the code, be sure to run the appropriate build command again and restart the dev server:

• Run ./do.sh build to refresh the source code, static files, and templates.
• Run ./do.sh build_templates to rebuild only the Closure Templates. Then run ./do.sh run to restart the dev server.

Deployment

The open source version of VSAQ does not require a dedicated back end. This means VSAQ can be hosted as a static application on any web server.

To deploy VSAQ, complete the following steps:

1. ./do.sh build_prod — This will run a normal build, but will also remove test files.
2. Copy the content of the build directory into any directory hosted on your web server.
3. The questionnaire should now be available under https://[yourserver]/vsaq.html?qpath=questionnaires/test_template.json

Example: https://vsaq-demo.withgoogle.com/vsaq.html?qpath=questionnaires/test_template.json

Reference Implementation

The reference implementation in the client_side_only_impl folder requires no code to run on a back end. All operations are performed by vsaq_main.js in the browser.

Although this makes deployment very easy, you may want to run a custom server-side component for storing answers and mapping questionnaires to users. vsaq_main.js provides example code for submitting and loading questionnaire answers to/from a back end:

• submitQuestionnaireToServer_ Submits questionnaire answers to a back end.
• loadAnswersFromServer_ Loads questionnaire answers from a back end.

Notes

JS-Files in static/ are compiled by the Closure Compiler and placed in build/vsaq_binary.js.

Closure Templates are compiled by the Closure Template Compiler and placed in build/templates/vsaq/static/questionnaire/templates.soy.js.

The /questionnaires directory and parts of the /static directories are replicated in build/.

Changes to the JSON /questionnaires do not require redeployment of the application code, and can be done on the server if required.

from https://github.com/google/vsaq