Linkerd Project Security Self-Assessment - Security Pals

[amanda-gonzalez]

Contributors:

• Amanda Gonzalez
• Dwireph Kamleshkumar Parmar
• Kaya Erol
• Thaison Le

[netlify]

✅ Deploy Preview for tag-security canceled.

Name	Link
🔨 Latest commit	ab8ac5e
🔍 Latest deploy log	https://app.netlify.com/sites/tag-security/deploys/65a96b24d22db00008c86d62

[eddie-knight]

Hi there! I'm just getting started looking at your pull request, and I noticed the DCO check is failing.

You can look at the checks section of the PR (I believe it should always be below the last comment) and look for a red X highlighting the failed check. In this case, you can click Details for more information about how to get that check passing.

[eddie-knight]

I noticed that you included an SBOM along with the self assessment. There are two reasons that jump to the front of my mind for why this isn't needed...

SBOMs should be associated with releases, as the bill of materials is only accurate and useful if it is created at build time and associated to a particular point in the code history.
If you need to link to an SBOM for some reason in the self-assessment, you can just provide a link out to the latest build artifacts that contain an SBOM.
We still have plenty more to review, but as a starter— could you please remove the SBOM from this PR?

[ragashreeshekar]

Thanks for the PR @amanda-gonzalez and team, appreciate the efforts.
I have completed first pass of review and comments on sections that need your attention. Please feel free to reach out here or on slack for any questions and clarifications.

Along with addressing the comments, kindly update the PR branch with the latest content in the repo as this branch is out-of-date with the base branch.

[amanda-gonzalez]

changes made after ragashreeshekar's review:

• fixed formatting
• provided relevant links
• clarified vulnerabilities section
• removed appendix
• reworked CII section

[amanda-gonzalez]

Thank you @eddie-knight and @ragashreeshekar. We have resolved all reviews/requests. Most recently updated are:

• table of contents
• self-assessment use statement

[JustinCappos]

A nice assessment. Some really minor writing issues (kubernetes vs Kubernetes, minor grammar, etc.) but it's clear and ready to merge.