<html>
<head>
<meta http-equiv="content-type" content="text/html; charset=utf-8">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<tt>I am proposing a series of security show & tell sessions.
Each week's session would be focused on a single area such as
bmcweb, using LDAP, or secure code update and would bring together
</tt><tt><span style="font-size: 11pt; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;" id="docs-internal-guid-133c4a35-7fff-abc7-f49d-0ab1cf9082d5">developers and security pros to talk about that area's security considerations. I hope to distill baseline documentation f</span></tt><tt><span style="font-size: 11pt; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;" id="docs-internal-guid-133c4a35-7fff-abc7-f49d-0ab1cf9082d5">rom each discussion</span></tt><tt>.<br>
</tt><tt><span style="font-size: 11pt; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;" id="docs-internal-guid-133c4a35-7fff-abc7-f49d-0ab1cf9082d5"></span></tt><tt><br>
The discussion I have in mind is structured for a security
review. It begins by explaining the area to a software engineer
new to the area: what the area does, where the docs are, the main
sets of interfaces, etc. That helps to make implicit knowledge
explicit. Then we talk about interfaces,especially those that are
interesting to security. That helps provide a shared context to
discuss assets, threats, and security controls. The discussion is
over at the end of the hour; we can do followup sessions later.<br>
<br>
The cost to development leaders is half a day (for prep,
discussion, and review) </tt><tt><tt>for each area</tt>. </tt><tt><span style="font-size: 11pt; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;" id="docs-internal-guid-133c4a35-7fff-abc7-f49d-0ab1cf9082d5">The benefits to the project include a security review of each area, with documentation usable by new developers, to encourage peer review, and for security professionals as a starting point for more thorough analysis such as here: </span></tt><tt><span style="font-size: 11pt; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;" id="docs-internal-guid-133c4a35-7fff-abc7-f49d-0ab1cf9082d5"><a class="moz-txt-link-freetext" href="https://en.wikipedia.org/wiki/Information_security">https://en.wikipedia.org/wiki/Information_security</a>.</span></tt><tt><br>
</tt><tt><span style="font-size: 11pt; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;" id="docs-internal-guid-133c4a35-7fff-abc7-f49d-0ab1cf9082d5"></span></tt><tt><br>
</tt><tt>I plan to discuss details of the proposal in the </tt><tt><tt>OpenBMC
Security Working Group meeting (</tt>agenda:
<a class="moz-txt-link-freetext" href="https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI">https://docs.google.com/document/d/1b7x9BaxsfcukQDqbvZsU2ehMq4xoJRQvLxxsDUWmAOI</a>).
</tt><tt>The meeting is Wednesday 2018-09-12 at 10 PDT (noon CDT).
</tt><tt>Access information for the meeting is here:
<a class="moz-txt-link-freetext" href="https://github.com/openbmc/openbmc/wiki/Security-working-group">https://github.com/openbmc/openbmc/wiki/Security-working-group</a></tt><tt>.<br>
<br>
</tt><tt><span style="font-size: 11pt; color: rgb(0, 0, 0); background-color: transparent; font-weight: 400; font-style: normal; font-variant: normal; text-decoration: none; vertical-align: baseline; white-space: pre-wrap;" id="docs-internal-guid-133c4a35-7fff-abc7-f49d-0ab1cf9082d5"></span></tt>
</body>
</html>