Document developer security guidelines

[dfarrell07]

Document the security guidelines Submariner developers are expected to follow. The guidelines for Members, Committers, and Owners may be more strict, and may be requirements.

This is part of the preparation for applying for CNCF Incubation and earning CII Gold.

This should cover:

• [ ] 2FA
  • CII Gold https://bestpractices.coreinfrastructure.org/en/criteria
  • The project MUST require two-factor authentication (2FA) for developers for changing a central repository or accessing sensitive data (such as private vulnerability reports). This 2FA mechanism MAY use mechanisms without cryptographic mechanisms such as SMS, though that is not recommended.
  • The project's two-factor authentication (2FA) SHOULD use cryptographic mechanisms to prevent impersonation. Short Message Service (SMS) based 2FA, by itself, does NOT meet this criterion, since it is not encrypted.
• [ ] Storing SSH keys for git interaction with GH on hardware token.
• [ ] Should we document basic recommendations, like using a password manager, VPN, and keeping everything updated?

[stale[bot]]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[stale[bot]]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.

[dfarrell07]

Relevant: https://docs.google.com/document/d/1un5eMd3WHA3kUe2znB9xHoKzDmhPd-ogWB2sVW0AMmk/

[stale[bot]]

This issue has been automatically marked as stale because it has not had activity for 60 days. It will be closed if no further activity occurs. Please make a comment if this issue/pr is still valid. Thank you for your contributions.