Add proposal for new security blueprint

5 files changed, 87 insertions, 0 deletions

diff --git a/security-blueprint/part-6/0_Abstract.md b/security-blueprint/part-6/0_Abstract.md
new file mode 100644
index 0000000..b8aabb6
--- /dev/null
+++ b/security-blueprint/part-6/0_Abstract.md
@@ -0,0 +1,32 @@
+# Part 6 - Application
+
+## Abstract
+
+**Application Hardening**: Best practices to apply to the build and release of
+user space applications, in order to reduce the number of attack surfaces used
+by potential attackers.
+
+The term of Application (App) has a very wide definition in **AGL**. Almost
+anything which is not in the core Operating System (OS) is an Application.
+Applications can be included in the base software package (image) or can be
+added at run-time.
+
+--------------------------------------------------------------------------------
+
+## Acronyms and Abbreviations
+
+The following table lists the terms utilized within this part of the document.
+
+Acronyms or Abbreviations | Description
+------------------------- | ----------------------------------------------------
+_3GPP_                    | **3**rd **G**eneration **P**artnership **P**roject
+_CASB_                    | **C**loud **A**ccess **S**ecurity **B**roker
+_DAST_                    | **D**ynamic **A**pplication **S**ecurity **T**esting
+_DPI_                     | **D**eep **P**acket **I**nspection
+_IDS_                     | **I**ntrusion **D**etection **S**ystems
+_IPS_                     | **I**ntrusion **P**revention **S**ystems
+_IPSec_                   | **I**nternet **P**rotocol **Sec**urity
+_LSM_                     | **L**inux **S**ecurity **M**odule
+_MITM_                    | **M**an **I**n **T**he **M**iddle
+_OSI_                     | **O**pen **S**ystems **I**nterconnection
+_SATS_                    | **S**tatic **A**pplication **S**ecurity **T**esting
diff --git a/security-blueprint/part-6/1-Installation.md b/security-blueprint/part-6/1-Installation.md
new file mode 100644
index 0000000..f9ea74d
--- /dev/null
+++ b/security-blueprint/part-6/1-Installation.md
@@ -0,0 +1,29 @@
+# Local
+
+<!-- todo -->
+
+Domain                     | Improvement
+-------------------------- | ------------------------------
+Application-Installation-1 | Talk about AppFw offline mode.
+
+<!-- endtodo -->
+
+## Installation
+
+Applications can be delivered and installed with the base image using a special
+offline-mode provided by the **AppFw**. Apps can also be installed at run time.
+
+<!-- note -->
+
+During early release, default Apps are installed on the image at first boot.
+
+<!-- endnote -->
+
+<!-- config -->
+
+Domain                     | Object    | Recommendations
+-------------------------- | --------- | -----------------------------------------------------------------------
+Application-Installation-1 | AppFw     | Provide offline-mode in order to install app with the base image.
+Application-Installation-2 | Integrity | Allow the installation of applications only if their integrity is good.
+
+<!-- endconfig -->
diff --git a/security-blueprint/part-6/2-PrivilegeManagement.md b/security-blueprint/part-6/2-PrivilegeManagement.md
new file mode 100644
index 0000000..2f2455a
--- /dev/null
+++ b/security-blueprint/part-6/2-PrivilegeManagement.md
@@ -0,0 +1,7 @@
+# Local
+
+## Privilege Management
+
+Application privileges are managed by **Cynara** and the security manager in
+the **AppFw**. For more details, please refer to the **AppFw** documentation
+in Platform part.
diff --git a/security-blueprint/part-6/3-Signature.md b/security-blueprint/part-6/3-Signature.md
new file mode 100644
index 0000000..782eb10
--- /dev/null
+++ b/security-blueprint/part-6/3-Signature.md
@@ -0,0 +1,9 @@
+# App Signature
+
+<!-- todo -->
+
+Domain                  | Improvement
+----------------------- | ----------------------------------------------------------
+Application-Signature-1 | Add content (see secure build in Secure development part).
+
+<!-- endtodo -->
diff --git a/security-blueprint/part-6/4-Services.md b/security-blueprint/part-6/4-Services.md
new file mode 100644
index 0000000..4ef9afc
--- /dev/null
+++ b/security-blueprint/part-6/4-Services.md
@@ -0,0 +1,10 @@
+# Services
+
+<!-- todo -->
+
+Domain                 | Improvement
+---------------------- | ------------
+Application-Services-1 | Add content (Which services?).
+Application-Services-2 | Add Binder.
+
+<!-- endtodo -->