Workshop notes

[meekrosoft]

SDLC Workshop

Risk descriptions

• Summary (one sentence)
• Map to controls which mitigate the risk
• Description
• Consequences
• Examples & Commentary

Scope guide:

• What it is not:
  • Not implementation details or control descriptions
  • Scoring criterial (likelyhood, impact)
• What it is:
  • Just the problem descriptions

Control descriptions

• Summary (one sentence)
• Map to related risks
• Description
• Requirements (Expectations)
• Examples & Commentary
• Links to external standards for controls

[aaronsearle]

#21

[AlexKantor87]

List of controls that were agreed on

• Version control (Aaron)
• Artefact binary provenance (split into two)
  • Content addressable binaries
  • Where did this come from?
• Secret Management (Vidhu)
• Vulnerability scanning (split into three) (Alex)
  • SAST
  • DAST
  • dependency
• Dependency management for how you ingest (provenance vs integrity)
• Software composition analysis (Victoria)