Security/FirefoxOperations: Difference between revisions

Security/FirefoxOperations (view source)

8 bytes added , 29 September 2016

no edit summary

Confirmed users

529

edits

@@ Line 129: / Line 129: @@
 <source lang:markdown>
+Risk Management
+---------------
 * [ ] The service must have performed a Rapid Risk Assessment and have a Risk Record bug (**SVC-RRA**).
@@ Line 137: / Line 139: @@
 * [ ] Set HSTS to 31536000 (1 year) (**INFRA-HSTS**)
 * [ ] Set HPKP to 5184000 (60 days) (**INFRA-HPKP**)
-   * `Public-Key-Pins: max-age=300; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E="; report-uri="/__hpkpreport__";`
+   * `Public-Key-Pins: max-age=300; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="r/mIkG3eEpVdm+u/ko/cwxzOMo1bk4TyHIlByibiA5E=";
      * Start with max-age set to 5 minutes and increase gradually
      * Pin to the EV and DV roots of Digicert
-    * Set a reporting endpoint `/__hpkpreport__` to catch violations in nginx ([example conf](https://github.com/mozilla-services/puppet-config/blob/HEAD/amo/modules/amo_proxy/templates/nginx.hpkpreport.conf.erb))
+  * [ ] If the service is not hosted under `services.mozilla.com`, it must be manually added to [Firefox's preloaded pins](https://dxr.mozilla.org/mozilla-central/source/security/manager/tools/PreloadedHPKPins.json#184).
 * If service has an admin panels, it must:
    * [ ] only be available behind Mozilla VPN (which provides MFA) (**INFRA-ADMINVPN**)