jcavell / security-guide-for-developers Goto Github PK

Here:
https://github.com/jcavell/security-guide-for-developers/wiki/At-the-Home-Office#before-you-start

    engage early with the Technical Assurance team
    ensure the service goes through a Technical Design Workshop at various milestones from the start of alpha
    each service should feed into a Technical Design Authority (TDA)

Who is the Technical Assurance team? How does one engage with them? What is included in a technical design workshop? Who do I contact about setting one up? Who needs to be invited? What is it trying to achieve? What is a TDA, who is the contact, how do I get one, how many are there, how do they relate?

https://github.com/jcavell/security-guide-for-developers/wiki/At-the-Home-Office#before-you-start
"make sure your computer adheres to CESG end user device guidance"

I think we will need to give some brief, clear, guidance about exactly what we expect from people. The CESG guidance doesn't give much guidance on how to do things, just what needs to be achieved

https://github.com/jcavell/security-guide-for-developers/wiki/At-the-Home-Office#before-you-start
"you may use password management software but must contact HOD Technical Assurance team for more information first"
Please can we provide their email address?

I think there are times when a GET request on a form is more appropriate. For example when completing a search form you may want to share what you have searched on with a colleague via a link

"consider using strongly typed languages e.g. Scala, Java, TypeScript"

I think we should give clearer guidance about what we expect and when in terms of language choices. Do we really want to encourage TypeScript? I'm not aware of any projects that use it. Plus Javascript knowledge is more common.