Confirm
529
edits
Changes
no edit summary
The table below summarizes the open issues assigned to the FoxSec team, sorted by area of focus.
=== Operational Security ===
=== Operational Security ===
{| class="wikitable"
Threat monitoring
|-
| style="background-color: #ffd351;"|
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.1+TDS" <span style="color:black;">'''3 MEDIUM'''<br />'''5 LOW'''<br /></span>]
| style="background-color: #d04437;"|
| style="background-color: #ffd351;"|
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.3+identity+management" <span style="color:black;">'''1 HIGH'''<br />'''2 1 MEDIUM'''<br /></span>]
| style="background-color: #d04437;"|
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"1.4+infra+hardening" <span style="color:white;">'''7 4 MEDIUM'''<br />'''8 5 LOW'''<br /></span>] | style="background-color: #4a6785cccccc;"|[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"3.2+monitor+external+threats" <span style="color:white;">'''1 LOW'''<br /></span>] no pending task
|}
External audits
|-
| style="background-color: #d04437;"|
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.1+risk+assessment" <span style="color:white;">'''2 HIGH'''<br />'''4 MEDIUM'''<br />'''3 LOW'''<br /></span>]| style="background-color: #d04437;"|[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.2+appsec+baseline" <span style="color:white;">'''2 HIGH'''<br />'''8 10 MEDIUM'''<br />'''6 7 LOW'''<br /></span>]
| style="background-color: #ffd351;"|
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"3.1+signature" <span style="color:black;">'''2 1 HIGH'''<br />'''1 MEDIUM'''<br />'''1 LOW'''<br /></span>]
| style="background-color: #ffd351;"|
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.3+security+communication" <span style="color:black;">'''1 MEDIUM'''<br />'''6 LOW'''<br /></span>]
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"2.4+bug+bounty" <span style="color:white;">'''2 LOW'''<br /></span>]
| style="background-color: #ffd351;"|
[https://github.com/mozilla-services/foxsec/issues?q=is%3Aopen+is%3Aissue+label%3A"3.3+external+audits" <span style="color:black;">'''1 HIGH'''<br />'''1 MEDIUM'''<br />'''1 LOW'''<br /></span>]
|}
* [ ] Use [NSP](https://nodesecurity.io/) or [GreenKeeper](https://greenkeeper.io/ Greenkeeper) for NodeJS applications
* [ ] Use pip --outdated or [requires.io](https://requires.io/) for Python applications
* [ ] If handling cryptographic keys, must have a mechanism to handle monthly quarterly key rotations (**APP-KEYROT**) * [ ] All keys must be rotated quarterly. * Keys used to sign sessions don't need a rotation mechanism if destroying all sessions is acceptable duringin case of emergency.* [ ] Applications must use accounts with limited GRANTS when connecting to databases (**APP-DBPRIV**) * In particular, applications **must not use admin or owner accounts**, to decrease the impact of a sql injection vulnerability.
### Additional websites requirements
