Security Assurance

Security Assurance

Security assurance should be tied to explicit controls and threat boundaries.

Evidence sources

Depending on the technology and release, security evidence can include:

threat models;
integrity models;
trust-boundary documentation;
dependency inventories;
software bills of materials;
signature or hashing tests;
backup and recovery tests;
penetration or external security assessments;
incident and support procedures.

Claim discipline

A successful integrity check does not prove that a system is secure against every threat.

Similarly, a threat model documents considered threats and assumptions; it does not prove that every control is perfectly implemented.

Use the narrowest claim supported by the available evidence.