Added SECURITY.md file.
Migrate security policy content that is currently buried in
the security working group wiki to the github security tab.
Allowing the security policies to be more readlily available.
Signed-off-by: James Mihm <James.Mihm@Intel.com>
Change-Id: Ic2e92a70d02b3f007d7448a39e1da40a7045de22
diff --git a/SECURITY.md b/SECURITY.md
new file mode 100644
index 0000000..54e473c
--- /dev/null
+++ b/SECURITY.md
@@ -0,0 +1,55 @@
+# Security Policy
+
+
+## How to report a security vulnerability
+
+This describes how you can report an OpenBMC security vulnerability
+privately to give the project time to address the problem before
+public disclosure.
+
+The main ideas are:
+ - You have information about a security problem which is not yet
+ publicly available.
+ - You want the problem fixed before public disclosure and
+ you are willing to help make that happen.
+ - You understand the problem will eventually be publicly disclosed.
+
+To begin the process:
+ - Send an email to `openbmc-security at lists.ozlabs.org` with details
+ about the security problem such as:
+ - the version and configuration of OpenBMC the problem appears in
+ - how to reproduce the problem
+ - what are the symptoms
+ - As the problem reporter, you will be included in the email thread
+ for the problem.
+
+The OpenBMC security response team (SRT) will respond to you and work to
+address the problem. Activities may include:
+ - Privately engage community members to understand and address the
+ problem. Anyone brought onboard should be given a link to the
+ OpenBMC [security response team guidelines][].
+ - Work to determine the scope and severity of the problem,
+ such as [CVSS metrics][].
+ - Work to create or identify an existing [CVE][].
+ - Coordinate workarounds and fixes with you and the community.
+ - Coordinate announcement details with you, such as timing or
+ how you want to be credited.
+ - Create an OpenBMC security advisory.
+
+Please refer to the [CERT Guide to Coordinated Vulnerability Disclosure][],
+(SPECIAL REPORT CMU/SEI-2017-SR-022) for additional considerations.
+
+Alternatives to this process:
+ - If the problem is not severe, please write an issue to the affected
+ repository or email the list.
+ - Join the OpenBMC community and fix the problem yourself.
+ - If you are unsure if the error is in OpenBMC (contrasted with
+ upstream projects such as the Linux kernel or downstream projects
+ such as a customized version of OpenBMC), please report it and we
+ will help you route it to the correct area.
+ - Discuss your topic in other [OpenBMC communication channels](https://github.com/openbmc/openbmc).
+
+[security response team guidelines]: ./obmc-security-response-team-guidelines.md
+[CVSS metrics]: https://www.first.org/cvss/calculator/3.0
+[CVE]: http://cve.mitre.org/about/index.html
+[CERT Guide to Coordinated Vulnerability Disclosure]: https://resources.sei.cmu.edu/asset_files/SpecialReport/2017_003_001_503340.pdf