diff options
Diffstat (limited to 'security-blueprint/part-6')
| -rw-r--r-- | security-blueprint/part-6/0_Abstract.md | 32 | ||||
| -rw-r--r-- | security-blueprint/part-6/1-Installation.md | 29 | ||||
| -rw-r--r-- | security-blueprint/part-6/2-PrivilegeManagement.md | 7 | ||||
| -rw-r--r-- | security-blueprint/part-6/3-Signature.md | 9 | ||||
| -rw-r--r-- | security-blueprint/part-6/4-Services.md | 10 |
5 files changed, 87 insertions, 0 deletions
diff --git a/security-blueprint/part-6/0_Abstract.md b/security-blueprint/part-6/0_Abstract.md new file mode 100644 index 0000000..b8aabb6 --- /dev/null +++ b/security-blueprint/part-6/0_Abstract.md @@ -0,0 +1,32 @@ +# Part 6 - Application + +## Abstract + +**Application Hardening**: Best practices to apply to the build and release of +user space applications, in order to reduce the number of attack surfaces used +by potential attackers. + +The term of Application (App) has a very wide definition in **AGL**. Almost +anything which is not in the core Operating System (OS) is an Application. +Applications can be included in the base software package (image) or can be +added at run-time. + +-------------------------------------------------------------------------------- + +## Acronyms and Abbreviations + +The following table lists the terms utilized within this part of the document. + +Acronyms or Abbreviations | Description +------------------------- | ---------------------------------------------------- +_3GPP_ | **3**rd **G**eneration **P**artnership **P**roject +_CASB_ | **C**loud **A**ccess **S**ecurity **B**roker +_DAST_ | **D**ynamic **A**pplication **S**ecurity **T**esting +_DPI_ | **D**eep **P**acket **I**nspection +_IDS_ | **I**ntrusion **D**etection **S**ystems +_IPS_ | **I**ntrusion **P**revention **S**ystems +_IPSec_ | **I**nternet **P**rotocol **Sec**urity +_LSM_ | **L**inux **S**ecurity **M**odule +_MITM_ | **M**an **I**n **T**he **M**iddle +_OSI_ | **O**pen **S**ystems **I**nterconnection +_SATS_ | **S**tatic **A**pplication **S**ecurity **T**esting diff --git a/security-blueprint/part-6/1-Installation.md b/security-blueprint/part-6/1-Installation.md new file mode 100644 index 0000000..f9ea74d --- /dev/null +++ b/security-blueprint/part-6/1-Installation.md @@ -0,0 +1,29 @@ +# Local + +<!-- todo --> + +Domain | Improvement +-------------------------- | ------------------------------ +Application-Installation-1 | Talk about AppFw offline mode. + +<!-- endtodo --> + +## Installation + +Applications can be delivered and installed with the base image using a special +offline-mode provided by the **AppFw**. Apps can also be installed at run time. + +<!-- note --> + +During early release, default Apps are installed on the image at first boot. + +<!-- endnote --> + +<!-- config --> + +Domain | Object | Recommendations +-------------------------- | --------- | ----------------------------------------------------------------------- +Application-Installation-1 | AppFw | Provide offline-mode in order to install app with the base image. +Application-Installation-2 | Integrity | Allow the installation of applications only if their integrity is good. + +<!-- endconfig --> diff --git a/security-blueprint/part-6/2-PrivilegeManagement.md b/security-blueprint/part-6/2-PrivilegeManagement.md new file mode 100644 index 0000000..2f2455a --- /dev/null +++ b/security-blueprint/part-6/2-PrivilegeManagement.md @@ -0,0 +1,7 @@ +# Local + +## Privilege Management + +Application privileges are managed by **Cynara** and the security manager in +the **AppFw**. For more details, please refer to the **AppFw** documentation +in Platform part. diff --git a/security-blueprint/part-6/3-Signature.md b/security-blueprint/part-6/3-Signature.md new file mode 100644 index 0000000..782eb10 --- /dev/null +++ b/security-blueprint/part-6/3-Signature.md @@ -0,0 +1,9 @@ +# App Signature + +<!-- todo --> + +Domain | Improvement +----------------------- | ---------------------------------------------------------- +Application-Signature-1 | Add content (see secure build in Secure development part). + +<!-- endtodo --> diff --git a/security-blueprint/part-6/4-Services.md b/security-blueprint/part-6/4-Services.md new file mode 100644 index 0000000..4ef9afc --- /dev/null +++ b/security-blueprint/part-6/4-Services.md @@ -0,0 +1,10 @@ +# Services + +<!-- todo --> + +Domain | Improvement +---------------------- | ------------ +Application-Services-1 | Add content (Which services?). +Application-Services-2 | Add Binder. + +<!-- endtodo --> |