Repository navigation
Node.js Security Initiatives 2024 #1255
Description
Hey!
Since May 2023 the Security team has been working on the following initiatives:
- Permission Model (2 Phase) - (Done)
- Automate update dependencies (Done)
- Assessment against best practices (Done)
- Automate Security release process (In progress)
As always, I want to express my gratitude to everyone who contributed to our latest project. The work was exceptional. During today's meeting (#1245), we discussed the need to explore new initiatives to enhance the Node.js security ecosystem. Therefore, I would like to use this issue as a forum for brainstorming and sharing ideas. Please feel free to share any problems you've encountered and any potential solutions you may have. Even if you don't have a solution in mind, please share the problem anyway. All input is welcome. This thread will be reviewed and discussed through the Node.js Security team meetings (feel free to join).
@nodejs/security-wg
Activity
marco-ippolito commentedon Mar 14, 2024
I think SBOM should be an initiative for this year
Ref: #1115
mhdawson commentedon Mar 14, 2024
I think we should make the work to audit the build processes of the dependencies an initiative for 2024. It both aligns well with the emphasis on supply chain security and should also help the project to limit the risk of issues during security release.
Ref: #1037 #1236
mhdawson commentedon Mar 28, 2024
Proposal from discussion in the meeting today for 2024
UlisesGascon commentedon Apr 13, 2024
Given the recent discussions around the xz incident, I suggest including a new initiative dedicated to mitigating potential threats originating from similar vectors within the organization.
As an outcome of this initiative, I propose to:
ref: #1282
RafaelGSS commentedon Apr 17, 2024
RafaelGSS commentedon Apr 24, 2024
RafaelGSS commentedon Apr 25, 2024
Code Integrity feature for Node.js.
@rdw-msft can you provide more details on this?
RafaelGSS commentedon Apr 25, 2024
Include a "Defense in Depths" policy to Node.js Threat Model.
@mhdawson @rdw-msft can you include some context here? (Feel free to edit this comment)
RafaelGSS commentedon Apr 25, 2024
GeoffreyBooth commentedon Apr 29, 2024
Regarding this, there’s a WIP PR for import maps: nodejs/node#49443. Import maps could be used as a place to store the subresource integrity hashes for modules: https://github.com/guybedford/import-maps-extensions#integrity. This would require some coordination with standards bodies such as WICG and WinterCG. cc @guybedford
RafaelGSS commentedon Apr 29, 2024
Permission Model adoption on Package Managers: #1300
rdw-msft commentedon May 1, 2024
Here's the document we use to differentiate between "defense in depth" and "security boundary" features: https://www.microsoft.com/en-us/msrc/windows-security-servicing-criteria
RafaelGSS commentedon May 9, 2024
Improve CII Best Practices and reach silver badge.
RafaelGSS commentedon May 9, 2024
Defining scopes of the Security team
RafaelGSS commentedon May 23, 2024
Selected Initiatives for 2024:
Please note we have skipped item 3 (SBOM) as we don't have a volunteer for that. If you are interested in moving forward with this initiative, join us.
Refs: #1319