Review and refine top-level pages of site to put more context to assist with project selection

[GeauxJD]

From discussion in the 7/28 Security Architecture meeting (with additional comments from Evan):

1. The Personas page for individual roles is sort of a project-dump rather than providing some guidance about what problems that role may be looking to solve.  I'm not sure if this is a new YAML file or fits in one of the existing files, but I don't see this data in the source content today.
2. Feedback we heard from a few people was the personas don't necessarily intuitively identify the value of the problem solutions.  We probably need to back up a little bit and do a better job explaining the risks that the problem solutions address.  e.g. talking with Scala devs, they didn't understand the intrinsic value of signing & verification, but were willing to trust an expert from the OpenSSF because they were already working together.  Explaining the risks could help bridge that credibility gap.
3. I see we have some threats enumerated already (and @CRob has opinions here), but maybe a higher-level risk-focused version could be helpful, particularly if we don't end up with a dense matrix of every risk, every persona, every project.

[evankanderson]

Since this says it's addressing the top-level, I'm going to talk about https://ossf.github.io/community/ and the following pages:

• https://ossf.github.io/community/personas/
• https://ossf.github.io/community/problems/
• https://ossf.github.io/community/projects/
• https://ossf.github.io/community/artifacts/
• https://ossf.github.io/community/architecture/

Top-level page

This could use a visual, possibly derived from the SLSA visual, that explains the software supply chain, and highlights where each role engages with the supply chain. Here's a gnarly quick version:

This could also help serve as a "map" for the persona pages to highlight the responsibilities and problems / threats that each persona (e.g. #36) is interested / responsible for.

The "browse by problem" mostly presents a list of solutions (e.g. build integrity, rather than "attacker subverts artifacts"). That is helpful for practitioners who already know what they are doing, but may not be useful to a novice. (This may be an audience definition problem -- what level of practitioner are we targeting?) This section could probably use an introduction to supply chain security -- e.g. trot out the old supply chain tracing for food/medicine analogies, and then explain the equivalent problems / attacks in software.

Additionally, it might be helpful to order the "browse by problem" to roughly match the chronology of the top-level visual. At a quick pass, I might order this as:

1. Secure Repository Configuration
2. Dependency and SPOM Visibility
3. Vulnerability Management
4. Build and Provenance Integrity
5. Artifact Signing and Verification
6. Secrets Management
7. Policy and Compliance Enforcement
8. Measuring Security Posture

(though there are several other reasonable chronologies)

Personas

This page is mostly fine, though a repeat of the proposed diagram from the front page might be helpful. Looking at the personas / roles in order, it's not clear whether there's a reason for the ordering -- for example, I'd suspect that the total population of "package & repository manager" role is smaller than the population of "executive / end-user consumer" role.

Problems

As mentioned in the discussion of the overview, the page lists solutions, rather than problems. It would be helpful to step back and include some aspirational guidance "consuming software should be as safe as buying products from a store shelf", and then specific discussion as to the threats / problems that can make consuming software unsafe. Given these risks, we can then lead to the solutions (possibly using a larger card format). One-line headlines showing real-world examples of the threat might help make these cards compelling:

Projects

Seems fine for the catalog that it is, except that there seem to be some duplicates:

• SLSA / slsa-github-generator / slsa-verifier
• Gemara (4th) / Gemara (22nd)
• gittuf (5th) / gittuf (23rd)

Artifacts

I think this might be better be called "formats" given the use of "artifacts" elsewhere. Having this page (with a possible tag for "standards-track") does seem helpful, so I'd keep it.

Architecture

Given the "Security Engineer / Architect" persona, I expected this to be something different. I'm not sure whether this belongs in the top nav, or maybe something buried in the bottom nav. If we do need it in the top nav, maybe bundle it into "About"?