Confirmed users
529
edits
Security/FirefoxOperations: Difference between revisions
Jump to navigation
Jump to search
no edit summary
No edit summary |
No edit summary |
||
| Line 15: | Line 15: | ||
The table below summarizes the open issues assigned to the FoxSec team, sorted by area of focus. | The table below summarizes the open issues assigned to the FoxSec team, sorted by area of focus. | ||
=== Operational Security === | |||
=== Operational Security === | === Operational Security === | ||
{| class="wikitable" | {| class="wikitable" | ||
| Line 29: | Line 30: | ||
Threat monitoring | Threat monitoring | ||
|- | |- | ||
| style="background-color: #ffd351;"| | |||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.1+TDS" <span style="color:black;">'''3 MEDIUM'''<br />'''5 LOW'''<br /></span>] | |||
| style="background-color: #d04437;"| | | style="background-color: #d04437;"| | ||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.2+fraud+detection" <span style="color:white;">'''2 HIGH'''<br />'''2 MEDIUM'''<br />'''3 LOW'''<br /></span>] | |||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.2+fraud+detection" <span style="color:white;">'''2 HIGH'''<br />''' | |||
| style="background-color: #ffd351;"| | | style="background-color: #ffd351;"| | ||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.3+identity+management" <span style="color:black;">'''1 HIGH'''<br />''' | [https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.3+identity+management" <span style="color:black;">'''1 HIGH'''<br />'''1 MEDIUM'''<br /></span>] | ||
| style="background-color: #d04437;"| | | style="background-color: #d04437;"| | ||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.4+infra+hardening" <span style="color:white;">''' | [https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.4+infra+hardening" <span style="color:white;">'''4 MEDIUM'''<br />'''5 LOW'''<br /></span>] | ||
| style="background-color: # | | style="background-color: #cccccc;"|no pending task | ||
|} | |} | ||
| Line 57: | Line 57: | ||
External audits | External audits | ||
|- | |- | ||
| style="background-color: #d04437;"| | | style="background-color: #d04437;"| | ||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.2+appsec+baseline" <span style="color:white;">'''2 HIGH'''<br />''' | [https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.1+risk+assessment" <span style="color:white;">'''2 HIGH'''<br />'''4 MEDIUM'''<br />'''3 LOW'''<br /></span>] | ||
| style="background-color: #d04437;"| | |||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.2+appsec+baseline" <span style="color:white;">'''2 HIGH'''<br />'''10 MEDIUM'''<br />'''7 LOW'''<br /></span>] | |||
| style="background-color: #ffd351;"| | | style="background-color: #ffd351;"| | ||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"3.1+signature" <span style="color:black;">''' | [https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"3.1+signature" <span style="color:black;">'''1 HIGH'''<br />'''1 MEDIUM'''<br />'''1 LOW'''<br /></span>] | ||
| style="background-color: #ffd351;"| | | style="background-color: #ffd351;"| | ||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.3+security+communication" <span style="color:black;">'''1 MEDIUM'''<br />'''6 LOW'''<br /></span>] | [https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.3+security+communication" <span style="color:black;">'''1 MEDIUM'''<br />'''6 LOW'''<br /></span>] | ||
| Line 68: | Line 68: | ||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.4+bug+bounty" <span style="color:white;">'''2 LOW'''<br /></span>] | [https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.4+bug+bounty" <span style="color:white;">'''2 LOW'''<br /></span>] | ||
| style="background-color: #ffd351;"| | | style="background-color: #ffd351;"| | ||
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"3.3+external+audits" <span style="color:black;">'''1 HIGH'''<br />'''1 MEDIUM | [https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"3.3+external+audits" <span style="color:black;">'''1 HIGH'''<br />'''1 MEDIUM'''<br /></span>] | ||
|} | |} | ||
| Line 174: | Line 174: | ||
* [ ] Use [NSP](https://nodesecurity.io/) or [GreenKeeper](https://greenkeeper.io/ Greenkeeper) for NodeJS applications | * [ ] Use [NSP](https://nodesecurity.io/) or [GreenKeeper](https://greenkeeper.io/ Greenkeeper) for NodeJS applications | ||
* [ ] Use pip --outdated or [requires.io](https://requires.io/) for Python applications | * [ ] Use pip --outdated or [requires.io](https://requires.io/) for Python applications | ||
* [ ] If handling cryptographic keys, must have a mechanism to handle | * [ ] If handling cryptographic keys, must have a mechanism to handle quarterly key rotations (**APP-KEYROT**) | ||
* Keys used to sign sessions don't need a rotation mechanism if destroying all sessions is acceptable in case of emergency. | |||
* Keys used to sign sessions don't need a rotation mechanism if destroying all sessions is acceptable | * [ ] Applications must use accounts with limited GRANTS when connecting to databases (**APP-DBPRIV**) | ||
* In particular, applications **must not use admin or owner accounts**, to decrease the impact of a sql injection vulnerability. | |||
### Additional websites requirements | ### Additional websites requirements | ||