Mozilla Security Policy

Mozilla Security Policy
Name	Mozilla Security Policy
Established	2004
Owner	Mozilla Corporation
Scope	Software, services, infrastructure
Website	Mozilla Security

Mozilla Security Policy

The Mozilla Security Policy articulates standards and controls used by Mozilla Corporation, Mozilla Foundation, Firefox, Thunderbird, Rust, and related projects to protect users, contributors, and infrastructure. It aligns with expectations from Internet Engineering Task Force, World Wide Web Consortium, European Union Agency for Cybersecurity, and stakeholder communities including Common Vulnerabilities and Exposures and Open Source Initiative contributors. The policy integrates practices drawn from incidents involving Heartbleed, Equifax data breach, SolarWinds attack, and lessons from vendors such as Microsoft, Google, Apple Inc., and Red Hat.

Overview

The policy defines security principles applied across products like Firefox for Android, Firefox for iOS, Mozilla VPN, and services maintained by Mozilla Corporation and Mozilla Foundation teams. It references standards and frameworks championed by National Institute of Standards and Technology, Center for Internet Security, ISO/IEC 27001, and collaborative efforts from OpenSSL Project and Let's Encrypt. Design considerations take into account risk scenarios informed by high-profile events such as Stuxnet, WannaCry, NotPetya, and vulnerabilities reported through CVE and Bugzilla reports. The policy also intersects with legal and policy instruments including General Data Protection Regulation and cooperation with law enforcement bodies like FBI and Europol where disclosure rules apply.

Scope and Objectives

The policy covers source code repositories in GitHub, Mercurial, and GitLab, build systems such as Taskcluster, release processes for Firefox ESR, and cryptographic controls tied to projects including Network Security Services and NSS. Objectives include protecting user privacy for features like Firefox Sync, ensuring supply chain integrity as discussed after SolarWinds attack, and hardening against exploitation methods exemplified in Spectre and Meltdown. It aims to meet compliance and assurance goals relevant to programs run by Mozilla Developer Network, collaborations with Electronic Frontier Foundation, and requirements arising from participation in initiatives like Let's Encrypt and Open Source Security Foundation. The scope extends to partnerships with vendors such as ARM Holdings, Intel, and cloud providers like Amazon Web Services, Google Cloud Platform, and Microsoft Azure used for telemetry, updates, and infrastructure.

Key Requirements and Controls

Controls include secure coding standards informed by CERT Coordination Center guidance, code review mandates that reference methodologies from Linux Kernel development and practices used at Google Chrome and Chromium, and cryptographic policies aligning with recommendations from Internet Engineering Task Force working groups. Authentication and access management draw on models used by OAuth, OpenID Connect, and multi-factor approaches exemplified in deployments by GitHub and Okta. Patch management and vulnerability remediation mirror timelines discussed by Zero Day Initiative and Project Zero, with automated testing using frameworks like Mozilla's mochitest and continuous integration influenced by Travis CI and Jenkins. Supply chain protections reference proposals from SLSA and mitigation patterns used after SolarWinds attack and CCleaner breach.

Implementation and Compliance

Implementation assigns responsibilities to teams within Mozilla Corporation such as product security, infrastructure, and release engineering, and coordinates with community contributors on platforms like Mozilla Add-ons and MDN Web Docs. Compliance auditing leverages external assessments from organizations like KPMG, Deloitte, and accreditation frameworks similar to SOC 2 and ISO/IEC 27001 certification processes. Training and awareness are informed by materials from SANS Institute and initiatives by Open Web Application Security Project, with secure development lifecycles referencing models used by Microsoft SDL and OWASP. Third-party code and dependency management follow practices established by npm, PyPI, and Maven Central ecosystems to reduce risks seen in supply chain incidents such as those involving event-stream and SolarWinds.

Incident Response and Reporting

The policy mandates coordinated incident response processes drawing on playbooks from CERT/CC, US-CERT, and national Computer Emergency Response Teams like NCA (United Kingdom) and CNCERT. Disclosure practices align with community norms from Bugzilla reporting, coordinated vulnerability disclosure backed by ISO/IEC 29147 and ISO/IEC 30111, and partnerships with vulnerability brokers like HackerOne and Bugcrowd. For significant compromises, the response strategy invokes communication patterns used in past incidents such as Heartbleed and Equifax data breach, and includes legal coordination with authorities like Department of Justice (United States) and European Data Protection Board where required. Post-incident reviews use root cause analysis methods similar to those in NIST SP 800-61 and lessons learned are incorporated into future releases like Firefox ESR and service updates.

Governance and Updates

Oversight is provided through governance structures within Mozilla Corporation, advisory input from external stakeholders including Electronic Frontier Foundation and academic partners like University of California, Berkeley and MIT, and community review via repositories and mailing lists used by Mozilla Developer Network. Updates to the policy follow versioning and change control patterns similar to software releases such as Firefox release cycle and coordination models exemplified by Linux Foundation projects. Strategic security roadmaps are informed by threat intelligence from entities like Mandiant, FireEye, CrowdStrike, and collaboration with industry bodies including Internet Society and Open Source Security Foundation.

Category:Mozilla