Google Releases Source Code of Security Assessment Questionnaire
Google announced on Monday that it has decided to open source its Vendor Security Assessment Questionnaire (VSAQ) framework to help companies improve their security programs.
While it’s owned by Google, the VSAQ is not an official product of the search giant. The interactive questionnaire application was developed to support security reviews by facilitating the collection of information and allowing users to display it in a template form.
Google uses such questionnaires to evaluate third-party vendors’ security and privacy posture, but the company pointed out that they can also be used for self-assessment or for becoming familiar with security issues. The decision to release VSAQ as open source comes after some of the vendors who completed the questionnaires expressed interest in using them to assess their own suppliers.
“We hope it will help companies spin up, or further improve their own vendor security programs. We also hope the base questionnaires can serve as a self-assessment tool for security-conscious companies and developers looking to improve their security posture,” Lukas Weichselbaum and Daniel Fabian of Google Security explained in a joint blog post.
The VSAQ framework released by Google as open source includes four questionnaire templates for web app security, security and privacy programs, physical and data center security, and infrastructure security. These base templates can be modified to include questions specific to the company using the VSAQ.
“The VSAQ Framework comes with a simple client-side-only reference implementation that’s suitable for self-assessments, for vendor security programs with a moderate throughput, and for just trying out the framework,” said Weichselbaum and Fabian. “For a high-throughput vendor security program, we recommend using the VSAQ Framework with a custom server-side component that fits your needs.”
Instructions on how to set up, build and deploy the VSAQ framework are available on Google’s GitHub page.
Related: Password Cracking Tool Hashcat Goes Open Source
Related: Amazon Releases New Open Source Implementation of TLS Protocol
Eduard Kovacs (@EduardKovacs) is a contributing editor at SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.
More from Eduard Kovacs
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- VMware ESXi Servers Targeted in Ransomware Attack via Old Vulnerability
- High-Severity Privilege Escalation Vulnerability Patched in VMware Workstation
- GoAnywhere MFT Users Warned of Zero-Day Exploit
- UK Car Retailer Arnold Clark Hit by Ransomware
- EV Charging Management System Vulnerabilities Allow Disruption, Energy Theft
- Unpatched Econolite Traffic Controller Vulnerabilities Allow Remote Hacking
Latest News
- Comcast Wants a Slice of the Enterprise Cybersecurity Business
- Critical Baicells Device Vulnerability Can Expose Telecoms Networks to Snooping
- New York Attorney General Fines Vendor for Illegally Promoting Spyware
- SecurityWeek Analysis: Over 450 Cybersecurity M&A Deals Announced in 2022
- 20 Million Users Impacted by Data Breach at Instant Checkmate, TruthFinder
- Cyber Insights 2023 | Zero Trust and Identity and Access Management
- Cyber Insights 2023 | The Coming of Web3
- European Police Arrest 42 After Cracking Covert App
