addressing issues 71, 68 and 69

w3c / wot-security

a repo exclusively for security to better manage issues and security considerations for WoT

https://w3c.github.io/wot-security/

18 stars 22 forks source link

addressing issues 71, 68 and 69 #90

Closed ereshetova closed 6 years ago

mmccool commented 6 years ago

From the April 30 meeting:

Thing Directory and Native Device threats being out of scope: necessary, since we don't have a specification we can refer to, but we should include some general comments and recommendations on how to mitigate these risks, referring to external references where appropriate.
We should also be clear about what we mean by "out of scope": it doesn't mean they aren't important; it's specifically with respect to the Threat Model

ereshetova commented 6 years ago

I have added a new column to the out-of-scope attack surfaces table, where I clarified why a certain attack surface is formally out of scope. I have also added there respective references to the new subsections in section 5, Recommended best practices, (empty for now), where we can collect and reference relevant high-level recommendations. I also fixed the "&" cases.