Define a Standard for the security of the Operation System Layer

[josephineSei]

In #749 we are standardizing the security of the software of the IaaS Layer.

But integrating security patches and updates are not solely done on one layer, but need to be accomplished by CSPs on all Layers.

This issue should investigate which measures should be done on the Operating System layer to prevent and deal with security issues.
This Layer includes all software above the hardware layer and beneath the IaaS Layer. So this would also include Kubernetes or Docker that is used to contain the services of the IaaS Layer.
It should be included, how CSPs could get information about potential security issues.
How fast they should respond according to the severity? (see C5 criteria catalog with timeframes for responses on page 75. )

Definition of Done:

Please refer to scs-0001-v1 for details.

• Proposal has been written with name of the form scs-xxxx-v1-slug.md (only substitute slug)
• Proposal has the fields status, type, track set
• Proposal has been voted upon in the corresponding team
• Status has been changed into Draft, file renamed: xxxx replaced by document number
• If applicable: test script has been written (this item may be moved into a separate issue so long as the state is Draft)