SW Dev Process Community - S-CORE Security Team - Meeting Minutes

[masc2023]

Meetings Minutes of S-CORE Security Team.

[masc2023]

Nov-28, 11-12 o'clock

Agenda:
Introduction
Check participants
Align on Agenda for today

Scope Definition
Status of ISO/SAE 21434 compliance

Participants:
Werner Schreiber (Schaeffler), @schreibw-sag
@thilo-schmitt (MB)
Athul Mallappallil (ETAS), @ChansAlive
@odra
Martin Mager
@pahmann (ETAS)
@NarasipurRohini (MB)
Sunil (ETAS), @sunildevda
@PandaeDo
@masc2023

Meeting Minutes:
Short introduction of the Community, Structure, Hint to https://eclipse-score.github.io/process_description/main/workproducts/index.html#wp__policies

Record new participants, Short introduction round

Define Scope of the working group

1. Technical aspects security related, Features, Module, (Requirements, Architecture, Analysis, Verification/Tests) ->Security Engineer
2. Process, Compliance topics
3. Tools, Infrastructure, Evaluation, Vulnerability Monitoring, SBOM
4. Driving Awareness, Following-up Security Issues -> Security Manager

Put on the next agenda: #1889

Status of ISO/SAE 21434 compliance, explained

[masc2023]

Dec-05, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Short overview over Planning
Discuss Security Analysis, levels, who can propose methods, starting asset definition?
Put on the next agenda: #1889

Participants:
@sunildevda
@odra
@NarasipurRohini
@PandaeDo
@CryptoNutcase
@ChansAlive

Meeting Minutes:
Short explanation of the planning strategy
Went through the questions of Sunil, will be continued in another meeting

[sunildevda]

@masc2023 For today's sync meeting we would like to discuss following points.

Point 1: Clarification regarding technical requirements.
We would like to get some information on the following requirements. Basically to understand the use case and motivation. 0

1. General understanding of the scope of these requirements. are all these requirements only for cryptography? some looks to be generic and system wide.
2. Side-Channel Attack Mitigation: In our understanding side channel attacks are more relevant for HSM/TEE implementation. How and what shall be done in the middleware? Moreover, we need to break this requirement into more clear requirement, in the current form it is not testable. (how can we be sure that we have the necessary measures that is expected for the side channel attacks?)
3. Security concept: are these requirements only for Cryptography or overall security of the middle-ware.
4. Crypto Algorithm Update Strategy: Use case and motivation please.
5. Reverse Engineering Protection: More details please. what exactly needs to be done?
6. Software Fallback: What is meant by Fallback? in our understanding, we should have the possibility to support both hardware and software cryptography. and the application can choose which one to use based on the system architect and use case. the word Fallback is confusing.
7. Trusted Time Source: Who maintains and provides trusted time source? Why should Crypto access this time source? The time source should be directly be set in the system and Crypto directly accesses the system time.
8. Initial Production Key Handling: More details please. does this mean we have to functionalities like importing/exporting/updating crypto material via crypto stack or is it that they materials are already provisioned by other means and the crypto stack has to use these materials?
9. Denial-of-Service (DoS) Mitigation: Use case please. is this for secure communication use case? or other use cases like a malicious application directly using cartography services and giving large data and blocking the access to other applications?

Point 2: Update tool verification report template #432

1. Some background please. Which tools are to be considered here? all tools that is used for development purpose?
2. Is it for the evaluation of other open source tools and/or tools that are developed in score project? example, some configuration tool also in scope?

[masc2023]

Dec-12, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Planning

Participants:
@PandaeDo
@CryptoNutcase
@masc2023
@sunildevda
@thilo-schmitt
@NarasipurRohini

Meeting Minutes:

Last Meeting for this year 19.12.2025, will restart 09.01.2026

Planning discussion

1. Security Analysis, Platform Analysis, @NarasipurRohini, @masc2023 prepare detailed planning, Security Analysis: WF: Analyze Platform process_description#454
2. Roll-out of Platform Analysis, @masc2023 defines planning topic, Security Analysis: Create S-CORE Platform Security Analysis process_description#455
3. Security Analysis, Feature Analysis, Component Analysis, @CryptoNutcase, @masc2023 prepare detailed planning, Security Analysis: WFs: Analyse Feature/Component Architecture process_description#453
4. Roll-out of Feature Analysis, Component Analysis, @masc2023 defines planning topic, Security Analysis: Piloting Create Feature/Component Security Analysis process_description#456
5. Security Management, Create/Maintain Security Plan, @sunildevda, @masc2023 prepare detailed planning, Security Management: WF: Create/Maintain Security Plan process_description#451
6. Roll-out of Security Management Plan in score, @sunildevda, @masc2023 defines planning topic, Update Security Plan and Security Management Plan process_description#452
7. Rework Security Feature Request, compare comments above, @sunildevda, Change: Security & Cryptography #2334
8. Rework high level tailoring for work products, @masc2023, Process Management: Update Tailoring Work Products for Securits process_description#458

@FScholPer , @masc2023 raise again the topic of findings by dependable-bot, bus issue should be resolved, planned, especially for up-coming release, Raise it on next FT/CT Meeting, 15.12.2025

[masc2023]

Dec-19, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Planning

Q&A
Questions for the tickets created?
eclipse-score/process_description#466

Participants:

Meeting Minutes:

Last Meeting for this year 19.12.2025, will restart 09.01.2026

[masc2023]

Jan-09, 11-12 o'clock

Agenda:
Happy new year
Check participants
Align on Agenda for today
Planning

eclipse-score/process_description#454
eclipse-score/process_description#455
eclipse-score/process_description#453
eclipse-score/process_description#456
eclipse-score/process_description#451
eclipse-score/process_description#452
#2334
eclipse-score/process_description#458

Participants:
@CryptoNutcase
@masc2023
Martin Mager
@PandaeDo

Meeting Minutes:
Discussed
eclipse-score/process_description#451, started on eclipse-score/process_description#473 (link it to eclipse-score/process_description#452),
This is about Security Plan in process_description, Definition Part, check for safety as comparison
eclipse-score/process_description#452, this about implementation in score

[sunildevda]

@masc2023 Happy New Year. I have another meeting today that ends at 11:30, so will join this meeting after that. short update about my task. i am currently working on eclipse-score/process_description#451. plan is to create a PR by next week for this.

[masc2023]

@masc2023 Happy New Year. I have another meeting today that ends at 11:30, so will join this meeting after that. short update about my task. i am currently working on eclipse-score/process_description#451. plan is to create a PR by next week for this.

After discussion with @CryptoNutcase , you may work on eclipse-score/process_description#452, may re-check

[masc2023]

Jan-16, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Planning

#2402
eclipse-score/persistency#211

eclipse-score/process_description#454
eclipse-score/process_description#455
eclipse-score/process_description#453
eclipse-score/process_description#456
eclipse-score/process_description#451
eclipse-score/process_description#452
#2334

Participants:
@CryptoNutcase
@NarasipurRohini
@sunildevda
Martin Mager
Kamal (BMW)

Meeting Minutes:

1. First version of persistency feature security plan #2402 and First version of persistency security plan persistency#211
   First version of the security plans available for feature and module level. Currently only the template is in place, actual artifacts are not yet created ex. persistence security analysis, SBOM report and so on..

2. In the building block model following points are missing or inconsistent: https://eclipse-score.github.io/process_description/main/general_concepts/score_building_blocks_concept.html
   2.1 Why is that we have plan at the feature level i.e., "security feature plan" and "safety feature plan"? Isn't it enough to have plan at "Platform" and "Module" level?
   2.2 Platform security plan and module security plan is not depicted in this picture.
   2.3 Instead of "Assumption of Use" we should use the name "Safety/Security Package"
   2.4 In general, shouldn't this building block also show the different work products that should be available at different levels?

3. List of workproducts at module level: https://eclipse-score.github.io/process_description/main/process_areas/security_management/guidance/security_management_module_security_plan_template.html
   3.1 Why is that we need a table with so many artifacts? We should limit it to the artifacts that is generated at the module level which are: Module plan, Module package, Module Analysis + review reports for all of these + SBOM report. it is confusing why the following items are listed here: Process Security Audit Report (wp__audit_report_security), Module Release Notes (wp__module_sw_release_note), Module Verification Report (wp__verification_module_ver_report), Module Release Notes (wp__module_sw_release_note)

4. Security Management: WF: Create/Maintain Security Plan process_description#451
   Changes ongoing. There are few questions that could not be discussed today. will continue the discussion next week.

[masc2023]

Jan-23, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Planning, Update from PM, new Planning, Roadmap
Feedback from Safety Audit,State, Plan

Participants:
@masc2023
@odra
@CryptoNutcase
@sunildevda
@NarasipurRohini
@PandaeDo

Meeting Minutes:
Updated on latest PMP discussion, PR here for review #2481
Roadmap: Have security audit like doing in safety, latest begin of next year, 2027

Discussed Planning, @masc2023 , update according PMP, plan for Milestone Release v0.7

Discussed eclipse-score/process_description#451, PR is not available yet, after it is visible, review can start

[masc2023]

Jan-30, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Planning

• Updates on Security Management Security Management: WF: Create/Maintain Security Plan process_description#451, PR available?
  Update Security Management process process_description#542

• Process Update Architecure/meta Modell: add component to requirement for future fix of meta model process_description#524

• Cyclic dependency process / docs-as-code repo: add design decision for break cyclic dependency between docs-as-code and process repository  #2499 (link to DR https://eclipse-score.github.io/score/pr-2499/design_decisions/DR-007-infra.html)

Participants:
@odra
@masc2023
@CryptoNutcase
@NarasipurRohini
@sunildevda

Meeting Minutes:

Please review the PR eclipse-score/process_description#542, @aschemmel-tech , can you have a look, we should harmonize safety and security work products naming, e.g. when to use Module, Platform e.g. Module Safety Plan, Platform Safety Plan? Or should we even no rethink the naming as we revising the Meta model Module -> Dependable Element, eclipse-score/process_description#524

[masc2023]

Feb-06, 11-12 o'clock

Agenda:
Check participants
Align on Agenda for today
Planning

General Info from PJs

• Updates on Security Management Security Management: WF: Create/Maintain Security Plan process_description#451,
  Update Security Management process process_description#542

Discuss Improvement: SBOM: #2232 (comment)
eclipse-score/tooling#106

Discuss: #1941

Participants:
@masc2023
@aschemmel-tech
@sunildevda
Vamsi Krishna Pattabhi (ETAS)
Martin Mager
@NarasipurRohini
Lukasz Juranek

Meeting Minutes:
Discussed eclipse-score/process_description#542
Propose at least for the Module folder, to remove all "Module" in the tree.
Propose to add Platform in the tree, beside Stakeholder Requirements
Propose for the Feature Folder to remove "Feature" in the three.
Propose for the Component Folder to remove "Component" in the three.

@NarasipurRohini presented concept for Security Analysis on Platform level, @NarasipurRohini will invite @CryptoNutcase and @sunildevda for follow-up, but common understanding, that we need a Trust Boundary Diagram for the platform as starter for further details of SCORE

Discussed SBOM, @masc2023 will bring it to CT/FT round to get the opinion form the communities how to get it further, Lukasz Juranek want tho have guidance, if the approach is in the right direct, @AlexanderLanin , @MaximilianSoerenPollak
https://www.ntia.gov/files/ntia/publications/sbom_minimum_elements_report.pdf, or https://www.cisa.gov/sites/default/files/2025-08/2025_CISA_SBOM_Minimum_Elements.pdf or https://www.bsi.bund.de/DE/Themen/Unternehmen-und-Organisationen/Standards-und-Zertifizierung/Technische-Richtlinien/TR-nach-Thema-sortiert/tr03183/TR-03183_node.html
SBOM Minimum Elements, request also to add the tools used