5 ms·
This was already started by 18F. If you haven't heard of them, they are the first U.S. federal gov digital consultancy, and the primary force behind a lot of se
by alaithea 10y ago
This was already started by 18F. If you haven't heard of them, they are the first U.S. federal gov digital consultancy, and the primary force behind a lot of security/certification improvements already.
https://github.com/opencontrol/ https://github.com/opencontrol/
https://github.com/opencontrol/compliance-masonry https://github.com/opencontrol/compliance-masonry
- tptacek 10y agoThis stuff is neat, but it's more of a formal methods approach to security management than it is to reducing software vulnerabilities. To apply formal methods to software development, you do one of two things: * You transform code in conventional programming languages into machine-readable formats understood by model checkers * You write your code in a language that itself admits to being model checked. I appreciate this link, though; I was unaware of what 18F was doing here.
- alaithea 10y agoI'm pretty sure what you're talking about exists in the OpenControl repos somewhere-- I'm just not sure which one (sorry). My former 18F colleague was recently talking about translating controls about password specifications into actual automated tests on the codebase and/or app. The reason all that "formal methods" stuff is in there as well (and indeed it's what the more prominent repos in there are about) is so that we can eventually connect the dots between effective security practices in code and the management of the security controls on the administrative side, and at least until the former catches up to the software methods, take the manual work of generating the copious documentation regarding all of this out of the developers' hands. Case in point: https://compliance.cloud.gov/ https://compliance.cloud.gov/ (<- all auto-gen, AFAIK)