Cwa-documentation: Publish security audits

[rugk]

Your Question

• Documentation File: overview-security.md
• Line / Paragraph: security testing
• Question: Am I missing the obvious or did not you publish your security audits there, yet?

As far as I read the doc there, you seem to acknowledge to do (external?) security audits of your code etc.

• Did you do so?
• If so, could you publish the results? (with all vulnerabilities that are fixed, of course)

I'm talking about technical security audits (code audits/blackbox or whitebox-like etc.), not GDPR/privacy analyses/statements etc.

[Ein-Tim]

https://www.coronawarn.app/en/#privacy under the point "Security" also says:

"Security assurance of application development through Secure Software Development Lifecycle, which includes among other things threat modeling and end-to-end risk assessment, security planning, security testing and penetration testing."

I didn't find a link to these threat modelings, etc. there neither.

[dsarkar]

@rugk @Ein-Tim You will find some documents on risk analysis on the main webpage under the section Data Privacy document and the annexes:

https://www.coronawarn.app/assets/documents/cwa-datenschutz-folgenabschaetzung-anlage1a.pdf
https://www.coronawarn.app/assets/documents/cwa-datenschutz-folgenabschaetzung-anlage1b.pdf
https://www.coronawarn.app/assets/documents/cwa-datenschutz-folgenabschaetzung-anlage2.pdf
https://www.coronawarn.app/assets/documents/cwa-datenschutz-folgenabschaetzung-anlage3.pdf
https://www.coronawarn.app/assets/documents/cwa-datenschutz-folgenabschaetzung-anlage5.pdf
https://www.coronawarn.app/assets/documents/cwa-datenschutz-folgenabschaetzung-anlage6.pdf
https://www.coronawarn.app/assets/documents/cwa-datenschutz-folgenabschaetzung-anlage7.pdf

[rugk]

That's great and interesting, but not really a security audit from an external company...

[dsarkar]

@rugk I will try to get some info. Internal Tracking ID: EXPOSUREAPP-5956

[Ein-Tim]

Penetration test were also mentioned in https://dbtg.tv/cvid/7519454 at around minute 12.