Create List of Security Team Members

[pablosec]

Providing a list of all security team members could be helpful for developers and other Tractus-X participants:

Pros:

• Transparency: during security assessments and any other form of contact between dev/release/... teams and security team it’s easy to lookup who you are talking to and who may also be involved
• Trust: being open about the team may help with the trust given to the sec team
• Efficiency: While the main contact point should be the Issues-tab, such a list could help for example when one is on vacation/sick leave, and you quickly need an alternative person of contact

Cons:

• Direct contact: The probability of people skipping creating an issue and just contacting someone directly is higher
• Maintenance: More maintenance is necessary
• Privacy: Public listing of real names

Further information:

• Examples:
  • https://github.com/eclipse-tractusx/sig-release/blob/main/AUTHORS.md
  • https://github.com/eclipse-tractusx/sldt-digital-twin-registry/blob/main/AUTHORS.md
• TRG 7.01 mentioning optional AUTHORS file: https://eclipse-tractusx.github.io/docs/release/trg-7/trg-7-01/#authors-file-optional

Open questions:

1. Did I miss any relevant pros and cons?
2. What should the naming be like? (AUTHORS.md (as suggested by TRG 7.01), CONTACT.md, SECURITYTEAM.md, TEAM.md)
3. What information should be included? E.g.:
   • Real name
   • optional: Company person is working at
   • GitHub handle
   • Knowledge areas (e.g., Security Assessments, SAST, DAST, specific tools, GitHub tooling, ...)
   • Special roles (e.g., committer)
4. Finally: Should we create such a list?

[RoKrish14]

@pablosec I like the idea.
From your q's,

1. I would also assume you thought about on-boarding and off-boarding and keeping the list of actual Authors working at the time.
2. Lets follow as per TRG 7.01
3. Real name with GH handle and Role (this would be enough)
4. I would say yes, why not ? :)