Skip to content

Self Assessment: Add Security Issue Resolution #102 #116

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
vasu1124 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Self Assessment: Add Security Issue Resolution #102 #116

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
33 changes: 23 additions & 10 deletions SELF_ASSESSMENT.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -160,18 +160,31 @@

## Security issue resolution

### Responsible Disclosures Process

Check failure on line 163 in SELF_ASSESSMENT.md

View workflow job for this annotation

GitHub Actions / markdown-lint

Headings should be surrounded by blank lines 

SELF_ASSESSMENT.md:163 MD022/blanks-around-headings Headings should be surrounded by blank lines [Expected: 1; Actual: 0; Below] [Context: "### Responsible Disclosures Process"] https://github.com/DavidAnson/markdownlint/blob/v0.35.0/doc/md022.md
<!--- A outline of the project's responsible
disclosures process should suspected security issues, incidents, or
vulnerabilities be discovered both external and internal to the project. The
outline should discuss communication methods/strategies.-->
An outline of the project's responsible disclosures process should suspected security issues, incidents, or vulnerabilities be discovered both external and internal to the project. The outline should discuss communication methods/strategies.

- Reporters should submit potential security issues via the [Security Advisory](https://github.com/oscal-compass/community/security/advisories) page.
- For external disclosures, the project encourages the use of responsible disclosure practices and expects reporters to provide adequate time for the project team to investigate and address the issue before public disclosure.
- The project team will acknowledge receipt of the report within a reasonable time frame and will communicate with the reporter throughout the process of investigating and mitigating the issue.

### Vulnerability Response Process

Check failure on line 170 in SELF_ASSESSMENT.md

View workflow job for this annotation

GitHub Actions / markdown-lint

Headings should be surrounded by blank lines 

SELF_ASSESSMENT.md:170 MD022/blanks-around-headings Headings should be surrounded by blank lines [Expected: 1; Actual: 0; Below] [Context: "### Vulnerability Response Process"] https://github.com/DavidAnson/markdownlint/blob/v0.35.0/doc/md022.md
<!---Who is responsible for responding to a
report. What is the reporting process? How would you respond?-->
Who is responsible for responding to a report. What is the reporting process? How would you respond?

- The project security team is responsible for responding to vulnerability reports.
- Upon receiving a report, the security team will:
1. Acknowledge the receipt of the report.
2. Confirm the vulnerability and assess its impact.
3. Develop a mitigation or patch for the issue.
4. Communicate with the reporter throughout the process.
5. Publish an advisory and release the patch once the issue is resolved.

### Incident Response

Check failure on line 181 in SELF_ASSESSMENT.md

View workflow job for this annotation

GitHub Actions / markdown-lint

Headings should be surrounded by blank lines 

SELF_ASSESSMENT.md:181 MD022/blanks-around-headings Headings should be surrounded by blank lines [Expected: 1; Actual: 0; Below] [Context: "### Incident Response"] https://github.com/DavidAnson/markdownlint/blob/v0.35.0/doc/md022.md
<!--A description of the defined procedures for triage,
confirmation, notification of vulnerability or security incident, and
patching/update availability.--->
A description of the defined procedures for triage, confirmation, notification of vulnerability or security incident, and patching/update availability.

- Triage: The security team will categorize the reported issue based on severity and impact.
- Confirmation: The team will verify the reported issue and gather necessary information to understand the scope.
- Notification: Affected parties, including users and stakeholders, will be notified of the confirmed issue and any interim mitigation steps.
- Patching/Update: The team will work to develop, test, and deploy a patch or update to resolve the issue. Once available, the update will be communicated to all users.

## Appendix

Expand All @@ -187,4 +200,4 @@
real-world use cases.
* Related Projects / Vendors. Reflect on times prospective users have asked
about the differences between your project and projectX. Reviewers will have
the same question.-->
the same question.-->
Loading