[
https://issues.apache.org/jira/browse/RANGER-5652?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18132036#comment-18132036
]
Abhishek Kumar commented on RANGER-5652:
----------------------------------------
Threat model update v1.1:
[https://github.com/apache/ranger/commit/327a722ccc2df803397fd2532920891a90723606]
Threat model update v1.2:
[https://github.com/apache/ranger/commit/587ccb701f7b45d676ab927e0ecdfb2f773f8a25]
> Add THREAT_MODEL.md + SECURITY.md/AGENTS.md security-model discoverability
> --------------------------------------------------------------------------
>
> Key: RANGER-5652
> URL: https://issues.apache.org/jira/browse/RANGER-5652
> Project: Ranger
> Issue Type: Task
> Components: documentation
> Reporter: Jarek Potiuk
> Assignee: Jarek Potiuk
> Priority: Major
> Fix For: 3.0.0
>
> Time Spent: 20m
> Remaining Estimate: 0h
>
> Apache Ranger had no in-repo security-model document or the conventional
> AGENTS.md -> SECURITY.md -> THREAT_MODEL.md discoverability chain that lets
> automated security scanners (and human reviewers) mechanically locate the
> project's threat model.
> PR apache/ranger#994 (merged) adds:
> - THREAT_MODEL.md — a threat model for Ranger's high-value boundaries (policy
> decision/distribution path, admin REST API, per-service plugin trust, KMS),
> reviewed and answered by the Ranger PMC.
> - SECURITY.md — ASF security-process pointer.
> - AGENTS.md -> SECURITY.md -> THREAT_MODEL.md discoverability wiring.
> This issue is filed retroactively to track that change in JIRA per project
> convention, at the PMC's request. The work was drafted by the ASF Security
> team and reviewed/owned by the Ranger PMC.
> PR: https://github.com/apache/ranger/pull/994
--
This message was sent by Atlassian Jira
(v10.3.26#10030026)
