The security assessment process is designed to accelerate the adoption of cloud native technologies, based on the following goals and assumptions:

The primary goal is to reduce the risk from malicious attacks and accidental breaches of privacy. This process supports that goal in two ways:

• Clear and consistent process for communication increases detection & reduces time to resolve known or suspected vulnerability issues
• A collaborative evaluation process increases domain expertise within each participating project.

Security reviews are a necessary, yet time consuming process, where each company, organization and project must perform its own reviews to ensure that it meets its unique commitments to its own users and stakeholders. In open source, simply finding security-related information can be a very time consuming part of the the process. The process is designed to enable improved discovery of security information & streamlined security reviews in multiple ways:

• Consistent documentation reduces review time
• Established baseline of security-relevant information reduces Q&A
• Clear rubric for security profile enables organizations to align their risk profile with project’s risk profile and effectively allocate resources (for review and needed project contribution)
• Structured metadata allows for navigation, grouping and cross-linking

We expect that this process will raise awareness of how specific open source projects affect the security of a cloud native system; however, separate activities may be needed to achieve that purpose using materials generated by the assessements.

Each project assessment will:

1. ensure a clear description of the project's design goals with respect to security
2. uncover design flaws and document known limitations
3. document next steps toward increasing security of the project itself and/or increasing the applications of the project toward increasing security of the cloud native ecosystem

Due to the nature and timeframe for the analysis, this review is not meant to subsume the need for a professional security audit of the code. Audits of implementation vulnerabilities and similar issues at that level are not intended to be covered by this assessment. The purpose of this effort is to uncover design flaws and to obtain a clear articulation of what the project's design goals and security properties are intended to be.

The project assessment is intended to be a collaborative process for the benefit of the project and the community, where the primary content is generated by the project lead and revised based on feedback from security reviewers and other members of the working group (WG).

See security assessment guide for more details.