Security Management Workflows#
For a detailed explanation of workflows and their role within the process model, please refer to the Introduction.
Create/Maintain Security Plan
|
status: valid
|
||||
The Security Manager is responsible for the planning and coordination of the security activities for the platform/module.
The Security Manager creates and maintains the security plan.
For this a template exists to guide the creator of the security plan.
|
|||||
Create/Maintain Security Package
|
status: valid
|
||||
The Security Manager is NOT responsible to provide the argument for the achievement of security.
But the Security Manager creates and maintains the security package in the sense of a collection of security related work products.
The generation and the maintenance of this draft security package shall be automated as much as possible.
It does not contain the final argumentation of the security of the product.
As the security package is only a collection of work products, the security plan (template) can be used for documentation.
|
|||||
Perform Security Audit
|
status: valid
|
||||
The external auditor is responsible to perform a security audit.
The Security Manager and the process community shall support the external auditor during this.
The Project Manager and and the Security Manager shall approve the audit report.
This is currently tailored out (needs discussion).
|
|||||
Perform Formal Security Reviews
|
status: valid
|
||||
The external auditor is responsible to perform the formal reviews on Security plan and Security Analysis.
The Security Manager shall support the external auditor during the reviews.
The Project Lead and and the Security Manager shall approve the formal reviews.
Therefore a checklists exist to guide the creator of the relevant security documents.
This is currently tailored out (needs discussion).
|
|||||
Create/Maintain Security Manual
|
status: valid
|
||||
The Security Engineer collects the necessary input for the security manuals on
platform and module level and documents it.
He makes sure all items are in valid state for a release of the security manual.
Also for the security manual a template exists as a guidance.
|
|||||
Create/Maintain SBOM
|
status: valid
|
||||
The Committer is responsible to create and the maintain the SBOM for the platform/module.
The Committer makes sure all components and dependencies are identified and made available.
|
|||||
Monitor/Verify Security
|
status: valid
|
||||
The Security Manager is responsible for the monitoring of the security activities against the security plan.
The Security Manager is responsible to verify, that the preconditions for the “release for production”, which are part of the release notes, are fulfilled.
The Security Manager is responsible to verify the correctness, completeness and consistency of the release notes.
The Security Manager is responsible for the monitoring of security information as defined in the security plan.
The Security Manager is responsible to identify weaknesses and vulnerabilities based on received information, and to analyse and manage the vulnerabilities until closure.
Beside reporting vulnerabilities in the Issue tracking system (wp__issue_track_system), also Eclipse general vulnerability tracker may be used.
|
|||||
Consult and Execute Security Trainings
|
status: valid
|
||||
The security manager Security Manager (rl__security_manager) consults all project/platform stakeholder as defined in Concept Description (doc_concept__security_management_process) for security topics and executes regularly security trainings.
|
|||||
RAS(IC) for Security Management:#
Activity |
Responsible |
Approver |
Supporter |
|---|---|---|---|
rl__security_manager; rl__security_engineer; rl__project_lead |
rl__infrastructure_tooling_community; rl__process_community; rl__security_team; rl__contributor |
||
rl__security_engineer; rl__safety_manager; rl__quality_manager |