|
| 1 | +# SIG Security External Audit Subproject |
| 2 | + |
| 3 | +## Overview |
| 4 | + |
| 5 | +The SIG Security External Audit subproject (subproject, henceforth) is responsible for coordinating regular, |
| 6 | +comprehensive, third-party security audits. |
| 7 | +The subproject publishes the deliverables of the audit after abiding to the |
| 8 | +[Security Release Process](https://github.com/kubernetes/committee-security-response/blob/main/security-release-process.md) and |
| 9 | +[embargo policy](https://github.com/kubernetes/committee-security-response/blob/main/private-distributors-list.md#embargo-policy). |
| 10 | + |
| 11 | + - [Request for Proposal (RFP)](#rfp) |
| 12 | + - [Security Audit Scope](#security-audit-scope) |
| 13 | + - [Vendor and Community Questions](#vendor-and-community-questions) |
| 14 | + - [Review of Proposals](#review-of-proposals) |
| 15 | + - [Vendor Selection](#vendor-selection) |
| 16 | + - [Deliverables](#deliverables) |
| 17 | + |
| 18 | +## RFP |
| 19 | + |
| 20 | +The subproject produces a RFP for a third-party, comprehensive security audit. The subproject publishes the RFP in the |
| 21 | +`sig-security` folder in the `kubernetes/community` repository. The subproject defines the scope, schedule, |
| 22 | +methodology, selection criteria, and deliverables in the RFP. |
| 23 | + |
| 24 | +Previous RFPs: |
| 25 | + - [2019](https://github.com/kubernetes/community/blob/master/sig-security/security-audit-2019/RFP.md) |
| 26 | + - [2021](https://github.com/kubernetes/community/blob/master/sig-security/security-audit-2021/RFP.md) |
| 27 | + |
| 28 | +As efforts begin for the year's security audit, create a tracking issue for the security audit in |
| 29 | +`kubernetes/community` with the `/sig security` label. |
| 30 | + |
| 31 | +### Security Audit Scope |
| 32 | + |
| 33 | +The scope of an audit is the most recent release at commencement of audit of the core |
| 34 | +[Kubernetes project](https://github.com/kubernetes/kubernetes) and certain other code maintained by |
| 35 | +[Kubernetes SIGs](https://github.com/kubernetes-sigs/). |
| 36 | + |
| 37 | +Core Kubernetes components remain as focus areas of regular audits. Additional focus areas are finalized by the |
| 38 | +subproject. |
| 39 | + |
| 40 | +### Vendor and Community Questions |
| 41 | + |
| 42 | +Potential vendors and the community can submit questions regarding the RFP through a Google form. The Google form is |
| 43 | +linked in the RFP. |
| 44 | +[Example from the 2021 audit](https://docs.google.com/forms/d/e/1FAIpQLScjApMDAJ5o5pIBFKpJ3mUhdY9w5s9VYd_TffcMSvYH_O7-og/viewform). |
| 45 | + |
| 46 | +The subproject answers questions publicly on the RFP with pull requests to update the RFP. |
| 47 | +[Example from the 2021 audit](https://github.com/kubernetes/community/pull/5813). |
| 48 | + |
| 49 | +The question period is typically open between the RFP's opening date and closing date. |
| 50 | + |
| 51 | +## Review of Proposals |
| 52 | + |
| 53 | +Proposals are reviewed by the subproject proposal reviewers after the RFP closing date. An understanding of security audits is required to be a proposal reviewer. |
| 54 | + |
| 55 | +All proposal reviewers must agree to abide by the |
| 56 | +**[Security Release Process](https://github.com/kubernetes/committee-security-response/blob/main/security-release-process.md)**, |
| 57 | +**[embargo policy](https://github.com/kubernetes/committee-security-response/blob/main/private-distributors-list.md#embargo-policy)**, |
| 58 | +and have no [conflict of interest](#conflict-of-interest) the tracking issue. |
| 59 | +This is done by placing a comment on the issue associated with the security audit. |
| 60 | +e.g. `I agree to abide by the guidelines set forth in the Security Release Process, specifically the embargo on CVE |
| 61 | +communications and have no conflict of interest` |
| 62 | + |
| 63 | +Proposal reviewers are members of a private Google group and private Slack channel to exchange sensitive, confidential information and to share artifacts. |
| 64 | + |
| 65 | +### Conflict of Interest |
| 66 | + |
| 67 | +There is a possibility of a conflict of interest between a proposal reviewer and a vendor. Proposal reviewers should not have a conflict of interest. Examples of conflict of interest: |
| 68 | + - Proposal reviewer is employed by a vendor who submitted a proposal |
| 69 | + - Proposal reviewer has financial interest directly tied to the audit |
| 70 | + |
| 71 | +Should a conflict arise during the proposal review, reviewers should notify the subproject owner and SIG Security chairs when they become aware of the conflict. |
| 72 | + |
| 73 | +> The _Conflict of Interest_ section is inspired by the |
| 74 | +[CNCF Security TAG security reviewer process](https://github.com/cncf/tag-security/blob/main/assessments/guide/security-reviewer.md#conflict-of-interest). |
| 75 | + |
| 76 | +## Vendor Selection |
| 77 | + |
| 78 | +On the vendor selection date, the subproject will publish a the selected vendor in the 'sig-security' folder in the `kubernetes/community` repository. |
| 79 | +[Example from the 2019 audit](https://github.com/kubernetes/community/blob/master/sig-security/security-audit-2019/RFP_Decision.md). |
| 80 | + |
| 81 | +## Deliverables |
| 82 | + |
| 83 | +The deliverables of the audit are defined in the RFP e.g. findings report, threat model, white paper, audited reference architecture spec (with yaml manifests) and published in the 'sig-security' folder in the `kubernetes/community` repository. |
| 84 | +[Example from the 2019 audit](https://github.com/kubernetes/community/tree/master/sig-security/security-audit-2019/findings). |
| 85 | + |
| 86 | +**All information gathered and deliverables created as a part of the audit must not be shared outside the vendor or the subproject without the explicit consent of the subproject and SIG Security chairs.** |
0 commit comments