docs: add security assurance to security.md #294

New Issue

Open

opened 2022-05-31 14:36:27 +00:00 by SamWhited · 0 comments

SamWhited commented

2022-05-31 14:36:27 +00:00

Owner

The SECURITY.md file should contain an assurance that includes:

a description of the threat model,
clear identification of trust boundaries,
an argument that secure design principles have been applied,
and an argument that common implementation security weaknesses have been countered.

The `SECURITY.md` file should contain an assurance that includes: - a description of the threat model, - clear identification of trust boundaries, - an argument that secure design principles have been applied, - and an argument that common implementation security weaknesses have been countered. See also: [_"Software Assurance Using Structured Assurance Case Models"_, Thomas Rhodes et al, NIST Interagency Report 7608](https://www.nist.gov/publications/software-assurance-using-structured-assurance-case-models)