Create security_baseline.md

[Danajoyluck]

GitHub version of the security baseline for TAC review.

[lehors]

LGTM but I have a couple of nits and a comment/question:

• I don't think we should add a baseline folder, just add the file in the process folder.
• the file extension should be .md rather than .MD

If, as discussed, we create a SIG to work on this, are we expecting them to work on this document in the TAC repo? That doesn't seem really desirable. Maybe they could create a copy of this document to work on in another repo. The instance in the TAC repo would then be refreshed from time to time when the SIG produces a new version that the TAC agrees to adopt. So, the instance in the TAC repo would remain the governing version while another copy exists in some other repo for the SIG to work on. Does that sound like a workable process? Any other idea?

[mlieberman85]

LGTM but I have a couple of nits and a comment/question:

• I don't think we should add a baseline folder, just add the file in the process folder.
• the file extension should be .md rather than .MD

If, as discussed, we create a SIG to work on this, are we expecting them to work on this document in the TAC repo? That doesn't seem really desirable. Maybe they could create a copy of this document to work on in another repo. The instance in the TAC repo would then be refreshed from time to time when the SIG produces a new version that the TAC agrees to adopt. So, the instance in the TAC repo would remain the governing version while another copy exists in some other repo for the SIG to work on. Does that sound like a workable process? Any other idea?

I agree that we should have something external and only when read do we bring it into the TAC repo. I am making the assumption here that any material change to the baseline would require the TAC to approve.

[lehors]

I am making the assumption here that any material change to the baseline would require the TAC to approve.

Exactly. That's my assumption too. I don't think we want to delegate the responsibility of managing the baseline for the whole organization to the SIG.

[david-a-wheeler]

Is this baseline only for the OpenSSF, or is the intention for this be a baseline applicable to many foundations? Perhaps at one time this was OpenSSF-only, but I think the longer goal is to create a "security baseline" that's useful for many foundations.

It's fine to put in the TAC repo in the short term, but I think in the long term it should NOT be in the TAC repo. It should instead eventually have its own repo or be part of the Best Practices WG repo (the latter would probably be easiest). I think that location will provide a stronger indication that this baseline can be used by other foundations.

[Danajoyluck]

Is this baseline only for the OpenSSF, or is the intention for this be a baseline applicable to many foundations? Perhaps at one time this was OpenSSF-only, but I think the longer goal is to create a "security baseline" that's useful for many foundations.

It's fine to put in the TAC repo in the short term, but I think in the long term it should NOT be in the TAC repo. It should instead eventually have its own repo or be part of the Best Practices WG repo (the latter would probably be easiest). I think that location will provide a stronger indication that this baseline can be used by other foundations.

The baseline is for OpenSSF. Can we put it here for now so that we can start updating the life cycle document and get the adoption going?

[lehors]

@david-a-wheeler, that's what @mlieberman85 and I were talking about. My take is that this is only meant for OpenSSF for now. When a SIG is launched with a goal to create one for the larger community they can create their own. Then, the TAC can decide how/when to revise this one.

[david-a-wheeler]

@lehors said:

My take is that this is only meant for OpenSSF for now. When a SIG is launched with a goal to create one for the larger community they can create their own. Then, the TAC can decide how/when to revise this one.

Oh, I see. This PR is for an OpenSSF-specific baseline, and there will likely be a SIG created that starts with & builds on this material to create something for multiple foundations. Presumably, when that SIG is done, the TAC will decide if this PR's text will be replaced. That makes sense. Thanks so much for the clarification!

[marcelamelara]

Thanks for submitting this PR @Danajoyluck ! I've reviewed the first half of the document, and I like the direction this is going. I do have several comments around clarity and specificity that will hopefully help improve this document.

[SecurityCRob]

I approve

[mlieberman85]

LGTM, there's a few caveats but as mentioned in chat I think we are at the point where we can iterate in the SIG and among the pilot projects like GUAC, OpenVEX, protobom, etc.

[SecurityCRob]

I look forward to seeing how our pilot projects work through achieving the baseline!

[lehors]

LGTM

[torgo]

lgtm

[mlieberman85]

LGTM

[steiza]

I have a bunch of minor, nit-picky feedback. Great job synthesizing this complex topic, and I can't wait to get feedback from projects as we roll this out!

[torgo]

lgtm

[marcelamelara]

Thanks for the updates @Danajoyluck ! There are still some edits I'd like to see eventually, but I think this is ready for us and the SIG to begin iterating over.