Open mmccool opened 4 years ago
The following may be relevant (note that it was updated in 2019): https://www.w3.org/TR/security-privacy-questionnaire/
We should update the HTML version now with "blank" security and privacy considerations sections... (McCool to make a PR)
Should just create issues for particular use cases over in the use case repo. Then we can track which use cases have considered privacy and security and which ones have not. For example:
We should start this by having a set of questions to be asked for each use case, such as "does this handle PII"? "Is access control needed?" "Are there safety considerations for access?" "Are there different classes of users?" etc. See https://github.com/w3c/wot-usecases/issues/84 Some bullet points should be added to the template as well.
Note that when we did the CR last time we had to answer a long set of questions about security, and we can look back to the answers to those. Most of them were not actually relevant to IoT, but some were.
Brainstorm from security TF call May 10. We also looked at the Self-Review Questionnaire and tried to extract anything useful (there was surprisingly not much, since it is very browser-focused and spends a lot of time on same-origin constraints, etc).
Security:
Privacy:
Probably should add:
In https://github.com/w3c/wot-architecture/tree/master/USE-CASES a number of use cases have been assembled. For each one we should consider the security and privacy requirements and document them. This could also go into "requirements", but then "Security and Privacy Considerations" should be added to the requirements template at https://github.com/w3c/wot-architecture/blob/master/REQUIREMENTS/requirements-template.md