Re: Security testing: need for a security policy, and a security-critical package process

[Hal Murray]

[e-mail] said:
...
> A written description of the security policy is a must!

...

Is the idea of a single one-size-fits-all security policy reasonable?  I 
think Fedora has a broad range of users.

Security is a tradeoff.  If you make it impossible for the bad guys to get 
in, the good guys probably can't get any work done.  How secure do you need 
to be?  How much are you willing to pay for it?

I'd much rather have an overview document that explains the likely attacks 
and potential solutions, and their costs and benefits.  Additionally, I think 
it's much easier to follow a policy if I understand the reasonaing behind it.

I think sample policy documents with descriptions of their target audience 
and checklists for how to implement them would be helpful.

Security testing: need for a security policy, and a security-critical package process

[Gene Czarcinski]

On Monday 30 November 2009 22:40:07 Hal Murray wrote:
> [e-mail] said:
> ...
> > A written description of the security policy is a must!
>
> ...
>
> Is the idea of a single one-size-fits-all security policy reasonable?  I 
> think Fedora has a broad range of users.

No.  Initially, I recommend one security policy and one reference 
implementation to test against.  Each variation needs its own security policy 
and reference implementation definition.  Later ones are easier to create 
because they can use the early ones as "guidance".

So, why go through all of this paperwork and bureaucratic bullshit?  Well, 
those of us who have done this before believe that it is necessary.  I do not 
like the bureaucratic BS any more than anyone else but, if you do not do it, 
then you are not quite sure what you have when you say that something meets 
security requirements.

Gene

Security testing: need for a security policy, and a security-critical package process

[Eric Christensen]

On Mon, Nov 30, 2009 at 22:40, Hal Murray  wrote:
> [e-mail] said:
> ...
> > A written description of the security policy is a must!
>
> ...
>
> Is the idea of a single one-size-fits-all security policy reasonable?  I
> think Fedora has a broad range of users.

Probably not but there are some basics that should be implemented for
everyone.
> Security is a tradeoff.  If you make it impossible for the bad guys to get
> in, the good guys probably can't get any work done.  How secure do you need
> to be?  How much are you willing to pay for it?

How much are you willing to pay to clean up the aftermath?
> I'd much rather have an overview document that explains the likely attacks
> and potential solutions, and their costs and benefits.  Additionally, I
> think
> it's much easier to follow a policy if I understand the reasonaing behind
> it.

The Fedora Security Guide (found at docs.fedoraproject.org and in a friendly
repo near you) started out that way and has blossomed into that and a whole
lot more.  As always suggestions and patches are welcome.
> I think sample policy documents with descriptions of their target audience
> and checklists for how to implement them would be helpful.

+1

--Eric