[I] [Proposal] Community Threat Model & OWASP TM-BOM Artifacts [incubator-pegasus]

["MatiasN (via GitHub)" <gi...@apache.org>]

MatiasN opened a new issue, #2415:
URL: https://github.com/apache/incubator-pegasus/issues/2415

   ## General Question
   
   As open-source security standards evolve—and with upcoming regulatory frameworks like the EU Cyber Resilience Act (CRA) emphasizing documented security risk assessments—having a formal, version-controlled threat model is increasingly valuable for distributed infrastructure like Pegasus.
   
   I would like to propose contributing community-driven threat models for key architectural components.
   
   ### What I Propose
   
   I plan to contribute security artifacts for one or two core components initially, delivered in two complementary formats:
   
   1. **Human-Readable Documentation:**
      - Architectural summary and trust boundary definitions.
      - Inline Data Flow Diagrams (DFDs) using Mermaid.js.
      - A threat matrix mapping potential vulnerabilities to existing or recommended mitigations.
   2. **Machine-Readable Standard (`TM-BOM` JSON):**
      - A JSON file structured according to the **OWASP Threat Model Bill of Materials (TM-BOM)** specification for automated compliance tracking and auditing.
   
   ### Proposed Initial Scope
   
   Given Pegasus's distributed architecture, I suggest starting with one of the following high-impact areas:
   * **Meta Server <-> Replica Server Communication** (Cluster topology updates & state management)
   * **Client <-> Server RPC Layer** (Authentication, authorization, and data ingestion)
   * **Data Replication Protocol** (Cross-replica synchronization and trust boundaries)
   
   ### Proposed File Structure
   
   Following best practices for "Threat Modeling as Code", artifacts would live alongside repository documentation:
   
   ```text
   docs/security/threat-models/
   ├── README.md
   └── components/
       ├── rpc-layer.md        # Human-readable Markdown + Mermaid DFD
       └── rpc-layer.tmbom.json # Machine-readable OWASP TM-BOM JSON
   ```
   
   ### Questions for Maintainers
   
   1. Does adding formal threat model documentation align with the current project roadmap?
   2. Which of the suggested initial scopes (or another component) would be most valuable to the core team right now?
   3. Is `docs/security/` the preferred directory for these artifacts, or is there another location you'd prefer?
   
   I welcome any feedback or guidance!


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: dev-unsubscribe@pegasus.apache.org.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org


---------------------------------------------------------------------
To unsubscribe, e-mail: dev-unsubscribe@pegasus.apache.org
For additional commands, e-mail: dev-help@pegasus.apache.org