Feature: Assess presence and maintenance of a threat model

[lyndon160]

Is your feature request related to a problem? Please describe. The scorecard is a useful tool to 1) help maintainers follow best practice, but also 2) provide assurance for users of the software.

Currently threat modeling is not included as a check. The existence and maintenance of a threat model can be considered a best practice. It demonstrates the following:

• System has been designed with security in mind
• Helps contributors understand what the key threats are
• Users of the package are aware of what risks are being transferred

Describe the solution you'd like Threat model becomes a new scorecard check. This would assess both a threat model's presence, as well as how frequently it is reviewed/maintained.

Additional context Whilst I see the addition of threat modeling as a value add, I can see a number of challenges to get the check working smoothly:

• There's no key standard to follow for threat modeling
• There's not a common file name or extension that can be checked
• Difficult to automatically assess the scope of the threat model. Is it the whole project, or just a small component?
• No automated way to assess the quality of the model, it may exist, but does that mean it's any good? (possibly applies for other checks)

Despite these hurdles, I think there's value in agreeing on a file name, and assessing at least the presence of a model.

Happy to help with the implementation of this if it is deemed a worthy feature.

[lyndon160]

The security-insights-spec (OSSF) appears to specify a template for threat modelling, perhaps the scorecard could align to this.

https://github.com/ossf/security-insights-spec/blob/edf5a4fb071510b461f19f3cba38c7339c20e4ae/security-insights-schema-1.0.0.yaml#L185

[github-actions[bot]]

Stale issue message - this issue will be closed in 7 days

[github-actions[bot]]

This issue is stale because it has been open for 60 days with no activity.

[github-actions[bot]]

This issue has been marked stale because it has been open for 60 days with no activity.