Add proposal for threat modeling/attack analysis - NEW - OSPS-DO-18

[SecurityCRob]

added proposal for Threat modeling, attack surface analysis, and/or data-flow analysis as part of process & docs

[evankanderson]

+1 on providing specific examples of how to locate the threat model. I think it's fine to grow more examples over time, but leaving this a blank slate makes it hard for tools and project owners to converge on a small set of solutions rather than balls of markdown.

[david-a-wheeler]

I'm thinking this could be clarified further, but having specific examples is a step forward.

I'm wavering on whether or not this should be level 2 or level 3. I can see an argument for level 3. However, a simple basic threat modeling analysis isn't that hard, especially since we don't specify the level of depth. So I'm just saying "yes" here.

[eddie-knight]

As much as I'm usually a proponent of threat models, I'm not a fan of the complexity here. Definitely not for level 2.

We don't want to hold small project teams to an overly rigorous standard, and even the simplest threat model processes can become very cumbersome. In contrast, the self-assessments we've discussed previously could accomplish most of our goals without the added rigor of a threat model.

The process we've been following already seems to cover 2/3 of the goals here:

• DO-03 covers the "scope and purpose of the system" (though perhaps this could be more direct)
• DO-07 and DO-09 cover actors, actions, inputs, and outputs— similar to "identifying its assets (which need protection), examining the architecture for threats"
• A gap still exists on documenting "threats, determining their likelihood and impact, and selecting mitigation strategies."

[mlieberman85]

I agree with Eddie. I still think we have something like a risk profile missing here. For example I can see us requiring this for Level 2 if Low Risk projects are excluded until Level 3 or something like that.

[SecurityCRob]

We will create a new category for "Security Assessments" and move this there. This will be OSPS-SA-02.