docs/security/network-security-considerations.md

13   https://github.com/openbmc/docs/blob/master/security/how-to-report-a-security-vulnerability.md
27 [cia triad]: https://en.wikipedia.org/wiki/Information_security#Key_concepts
38 OpenBMC provides services on TCP and UDP ports. For example, the HTTPS protocol
52 the `https://github.com/openbmc/meta-aspeed` repository under
59 [cve 1999-0524]: https://nvd.nist.gov/vuln/detail/CVE-1999-0524
81   https://github.com/openbmc/docs/blob/master/architecture/user-management.md
89 - HTTPS for Web and REST APIs.
98   https://www.owasp.org/index.php/Blocking_Brute_Force_Attacks
116   https://redfish.dmtf.org/schemas/ManagerNetworkProtocol.v1_4_0.json
130   https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=201720180SB327
152 ### TCP port 443 - HTTPS REST APIs and Web application
168 BMCWeb controls which HTTPS transport layer security (TLS) ciphers it offers via
170 <https://github.com/openbmc/bmcweb> repository. The implementation is provided
175 the <https://github.com/openbmc/bmcweb> repository.
177 [bmcweb configuration]: https://github.com/openbmc/bmcweb#configuration
179   https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project
190    encoded like `https://user:pass@host/...`) in an "Authorization" request
202 <https://github.com/OWASP/CheatSheetSeries/blob/master/cheatsheets/REST_Security_Cheat_Sheet.md>
206 <https://www.dmtf.org/standards/redfish>.
215   https://www.owasp.org/index.php/Web_Application_Security_Guidance
225 [host serial console]: https://github.com/openbmc/docs/blob/master/console.md
236 described here: <https://attack.mitre.org/techniques/T1046/>
245 <https://github.com/openbmc/docs/blob/master/architecture/ipmi-architecture.md>
247 <https://github.com/openbmc/phosphor-net-ipmid>. Note that host IPMI is outside
251 <https://www.us-cert.gov/ncas/alerts/TA13-207A>