alphagov/government-service-design-manual — pull request #64 by nickstenning (2013-03-29 17:47:15+00:00)
Title: Add a shallower on-ramp to information security

The existing information security documentation launched somewhat abruptly
into the sea of jargon and acronyms that is information assurance in
government. I've tried to provide a slightly more user-friendly lead-up,
explaining first what information security is and how it's practiced,
before getting to the government-specific bits.

I've tried to keep it as concise as possible without getting overly dense. Let
me know if you think I haven't got the balance right.

I also think we should provide a short set of technical guidance on security
best practices in web application development, which should probably be linked
from here. Do people agree that this is currently lacking from the manual? I'm
thinking of basic introductions to:

- threat modelling
- defense in depth
- the dangers of proprietary cryptographic systems
- existing security standards and commonly employed cryptosystems