sec 4.2.4. component certification - Githubissues

International-Data-Spaces-Association / IDS-RAM_4_0

Focusing on the generalization of concepts, functionality, and overall processes involved in the creation of a secure 'network of trusted data' , the IDS-RAM resides at a higher abstraction level than common architecture models of concrete software solutions do. The document provides an overview and dedicated architecture specifications.

Creative Commons Attribution 4.0 International

43 stars 26 forks source link

sec 4.2.4. component certification #125

Closed mokamhuber closed 2 years ago

mokamhuber commented 2 years ago

For RAM 4.0, section 4.2.4. should contain the following parts:

short introduction to component certification
overview of the certification profiles with their new names: Connector Security Levels => now Trust Levels
- Trust Level 1: Data space interoperability
- Trust Level 2: Feature complete for data usage control
- Trust Level 3: Additional protection from internal attacks
Component Assurance Levels:
- Assurance Level 1: Checklist self-assessment and automated interoperability testing
- Assurance Level 2: External concept review including functional and security testing
- Assurance Level 3: External evaluation including concept review, testing and source code audit -> for this we should move the content from the security perspective to this chapter (https://github.com/International-Data-Spaces-Association/IDS-RAM_4_0/issues/94) and leave out the not-certified level of Base Free (https://github.com/International-Data-Spaces-Association/IDS-RAM_4_0/issues/95) to avoid confusion

Additional aspects such as certification for components other than a connector (https://github.com/International-Data-Spaces-Association/IDS-RAM_4_0/issues/105) or certification for connectors in different environments (https://github.com/International-Data-Spaces-Association/IDS-RAM_4_0/issues/104) should be addressed.

Responsible editor: @nadjamenz Reviewer: @gboege

mokamhuber commented 2 years ago

@gboege I have already added some thoughts/feedback from my side. Maybe you can take a look as well before @nadjamenz integrates both our feedback