[Starlingx-discuss] Vulnerability Management guidelines - improving visibility
Hi StarlingX Community, The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around. Related to the above, I wanted to bring up the project’s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find. Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project’s homepage, the docs homepage, etc? Best Regards, Ildikó [1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation
We do have a high level view of 'CVE Maintenance' in docs.starlingx.io . https://docs.starlingx.io/security/kubernetes/cve-maintenance-723cd9dd54b3.h... We could provide a reference/link here to the more detailed page in the wiki . Greg. -----Original Message----- From: Ildiko Vancsa <ildiko@openinfra.dev> Sent: Tuesday, July 11, 2023 4:51 PM To: StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi StarlingX Community, The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around. Related to the above, I wanted to bring up the project’s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find. Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project’s homepage, the docs homepage, etc? Best Regards, Ildikó [1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io
Hi Greg, Thank you for sharing that pointer. There are multiple aspects to security and vulnerability related features, activities and actions. The documentation website mainly covers the features in the platform. In addition, the page that you shared also talks about the CVE scan process and briefly mentions the security team. I think it is great to have documentation available about the CVE scans. At the same time, the placement of the link to the page makes it a little hidden in the list of related features in the platform. The page also says that “the master development branch of StarlingX is scanned for CVEs” and does not say anything about Kubernetes in particular, however, it is listed under a Kubernetes section. Is there a specific reason for that? I think it would be great to separate the features from the activities, including what users can do if they identify a vulnerability issue. And make that information much more visible and easy to find. We can also add the CVE scan related information there. What do you think? Thanks, Ildikó ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation
On Jul 12, 2023, at 04:49, Waines, Greg <Greg.Waines@windriver.com> wrote:
We do have a high level view of 'CVE Maintenance' in docs.starlingx.io . https://docs.starlingx.io/security/kubernetes/cve-maintenance-723cd9dd54b3.h... We could provide a reference/link here to the more detailed page in the wiki .
Greg.
-----Original Message----- From: Ildiko Vancsa <ildiko@openinfra.dev> Sent: Tuesday, July 11, 2023 4:51 PM To: StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
Hi StarlingX Community,
The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around.
Related to the above, I wanted to bring up the project’s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find.
Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project’s homepage, the docs homepage, etc?
Best Regards, Ildikó
[1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management
———
Ildikó Váncsa Director of Community Open Infrastructure Foundation
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io
Are you thinking of keeping the security 'activities/actions' in the wiki and the security 'features' in the doc site ? ... i'm fine with that. Wrt your question about 'Kubernetes' ... - you'll notice that MANY of the top-level sections in the doc site have 2x major sub-sections: Kubernetes and OpenStack - this was done to split the topics related to * the Kubernetes Platform and * the OpenStack Application - So the 'Kubernetes' reference is really a reference to the Platform Wrt to making this info (i.e. https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ) more visible. Currently it requires you to navigate as follows: - StarlingX WIKI https://wiki.openstack.org/wiki/StarlingX - StarlingX sub-projects > Security project https://wiki.openstack.org/wiki/StarlingX/Security - Select 'Vulnerability Management Process' https://wiki.openstack.org/wiki/StarlingX/Security#Vulnerability_Management_... - Select ' See https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ' We could put an additional direct link to it higher in the WIKI - maybe under 'Planning & Processes' Thoughts ? Greg. -----Original Message----- From: Ildiko Vancsa <ildiko@openinfra.dev> Sent: Wednesday, July 12, 2023 6:35 PM To: Waines, Greg <Greg.Waines@windriver.com> Cc: StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe. Hi Greg, Thank you for sharing that pointer. There are multiple aspects to security and vulnerability related features, activities and actions. The documentation website mainly covers the features in the platform. In addition, the page that you shared also talks about the CVE scan process and briefly mentions the security team. I think it is great to have documentation available about the CVE scans. At the same time, the placement of the link to the page makes it a little hidden in the list of related features in the platform. The page also says that “the master development branch of StarlingX is scanned for CVEs” and does not say anything about Kubernetes in particular, however, it is listed under a Kubernetes section. Is there a specific reason for that? I think it would be great to separate the features from the activities, including what users can do if they identify a vulnerability issue. And make that information much more visible and easy to find. We can also add the CVE scan related information there. What do you think? Thanks, Ildikó ——— Ildikó Váncsa Director of Community Open Infrastructure Foundation
On Jul 12, 2023, at 04:49, Waines, Greg <Greg.Waines@windriver.com> wrote:
We do have a high level view of 'CVE Maintenance' in docs.starlingx.io . https://docs.starlingx.io/security/kubernetes/cve-maintenance-723cd9dd 54b3.html We could provide a reference/link here to the more detailed page in the wiki .
Greg.
-----Original Message----- From: Ildiko Vancsa <ildiko@openinfra.dev> Sent: Tuesday, July 11, 2023 4:51 PM To: StarlingX ML <starlingx-discuss@lists.starlingx.io> Subject: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility
CAUTION: This email comes from a non Wind River email account! Do not click links or open attachments unless you recognize the sender and know the content is safe.
Hi StarlingX Community,
The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around.
Related to the above, I wanted to bring up the project’s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find.
Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project’s homepage, the docs homepage, etc?
Best Regards, Ildikó
[1] https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Manag ement
———
Ildikó Váncsa Director of Community Open Infrastructure Foundation
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io
On 2023-07-13 11:30:43 +0000 (+0000), Waines, Greg wrote: [...]
Wrt to making this info (i.e. https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ) more visible. Currently it requires you to navigate as follows: - StarlingX WIKI https://wiki.openstack.org/wiki/StarlingX - StarlingX sub-projects > Security project https://wiki.openstack.org/wiki/StarlingX/Security - Select 'Vulnerability Management Process' https://wiki.openstack.org/wiki/StarlingX/Security#Vulnerability_Management_... - Select ' See https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management '
We could put an additional direct link to it higher in the WIKI - maybe under 'Planning & Processes' [...]
I'm not sure your Vulnerability Management Process document is what needs increased visibility. Stepping back a bit, if I'm a StarlingX user who isn't well-connected with the contributor community and I find a misbehavior in the platform that I think might have security implications, I'll likely want to know how to safely report that to the StarlingX maintainers. I'm going to go to https://starlingx.io/ and start looking for information on how to report security issues. I'll keyword search for "security" on the main page of that project site and find that it appears twice, but associated with a link to a video about tamper resistance features, so that's not it. I'll maybe try searching for "vu..." nope nothing. Okay maybe it's on the FAQs page? No, not there either. In the docs? Oh hey look, there's a security section. Never mind, it's about more security features of the platform. I might eventually stumble on that kinda subtle link to the StarlingX wiki from the main documentation page and find the link there to the Security sub-project and then the https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... section therein, but it's also quite possible I will have given up before getting that far, or asked on a mailing list and naively disclosed some details of a vulnerability when doing so. My suggestion is to get a link to that Security sub-team page in the footers of everything on the starlingx.io and docs.starlingx.io sites. Keeping https://wiki.openstack.org/wiki/StarlingX/Security in a wiki page is fine if you don't think it's suitable to move into your docs repository (or to have a separate repository the Security sub-team can use for their publications), but I also recommend moving the bug reporting instructions farther up that page. Ideally it would be about the first thing someone sees when landing there (perhaps after a brief intro paragraph). -- Jeremy Stanley
Hi, Thanks Greg and Jeremy for your input. @Greg: I don’t have a strong preference whether the information should live on the wiki or on the Docs webpage, if we make it visible. The processes to report a vulnerability as well as to process and address it, is quite static. In that sense, I think it would make sense to consider adding it to the rest of the project’s documentation, if there is a logical place to put it. I think that we have most of the information in the different documents already, it is more the question of organizing and making it more visible. Currently it is much easier to find information about security related features that users care about. When it comes to vulnerabilities that most likely people who operate the platform will find, we need to make it easier for them to figure out how to deal with those issues, ie reporting them without doing any harm. I like Jeremy’s suggestions with regards to utilizing the website and documentation page to give visibility to the process. What do others think? Thanks, Ildikó
On Jul 13, 2023, at 04:55, Jeremy Stanley <fungi@yuggoth.org> wrote:
On 2023-07-13 11:30:43 +0000 (+0000), Waines, Greg wrote: [...]
Wrt to making this info (i.e. https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ) more visible. Currently it requires you to navigate as follows: - StarlingX WIKI https://wiki.openstack.org/wiki/StarlingX - StarlingX sub-projects > Security project https://wiki.openstack.org/wiki/StarlingX/Security - Select 'Vulnerability Management Process' https://wiki.openstack.org/wiki/StarlingX/Security#Vulnerability_Management_... - Select ' See https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management '
We could put an additional direct link to it higher in the WIKI - maybe under 'Planning & Processes' [...]
I'm not sure your Vulnerability Management Process document is what needs increased visibility. Stepping back a bit, if I'm a StarlingX user who isn't well-connected with the contributor community and I find a misbehavior in the platform that I think might have security implications, I'll likely want to know how to safely report that to the StarlingX maintainers.
I'm going to go to https://starlingx.io/ and start looking for information on how to report security issues. I'll keyword search for "security" on the main page of that project site and find that it appears twice, but associated with a link to a video about tamper resistance features, so that's not it. I'll maybe try searching for "vu..." nope nothing. Okay maybe it's on the FAQs page? No, not there either. In the docs? Oh hey look, there's a security section. Never mind, it's about more security features of the platform.
I might eventually stumble on that kinda subtle link to the StarlingX wiki from the main documentation page and find the link there to the Security sub-project and then the https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is... section therein, but it's also quite possible I will have given up before getting that far, or asked on a mailing list and naively disclosed some details of a vulnerability when doing so.
My suggestion is to get a link to that Security sub-team page in the footers of everything on the starlingx.io and docs.starlingx.io sites. Keeping https://wiki.openstack.org/wiki/StarlingX/Security in a wiki page is fine if you don't think it's suitable to move into your docs repository (or to have a separate repository the Security sub-team can use for their publications), but I also recommend moving the bug reporting instructions farther up that page. Ideally it would be about the first thing someone sees when landing there (perhaps after a brief intro paragraph). -- Jeremy Stanley _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io
I think Jeremy's suggestion of a central security page, with links in the footer of most StarlingX content is an excellent idea. I completely agree that looking at this from the perspective of people that aren't yet well connected to the community is the right way to approach the question, for all of the reasons Jeremy gave. -- Mason On Thu, Jul 13, 2023 at 8:45 AM Ildiko Vancsa <ildiko.vancsa@gmail.com> wrote:
Hi,
Thanks Greg and Jeremy for your input.
@Greg: I don’t have a strong preference whether the information should live on the wiki or on the Docs webpage, if we make it visible. The processes to report a vulnerability as well as to process and address it, is quite static. In that sense, I think it would make sense to consider adding it to the rest of the project’s documentation, if there is a logical place to put it.
I think that we have most of the information in the different documents already, it is more the question of organizing and making it more visible. Currently it is much easier to find information about security related features that users care about. When it comes to vulnerabilities that most likely people who operate the platform will find, we need to make it easier for them to figure out how to deal with those issues, ie reporting them without doing any harm.
I like Jeremy’s suggestions with regards to utilizing the website and documentation page to give visibility to the process.
What do others think?
Thanks, Ildikó
On Jul 13, 2023, at 04:55, Jeremy Stanley <fungi@yuggoth.org> wrote:
On 2023-07-13 11:30:43 +0000 (+0000), Waines, Greg wrote: [...]
Wrt to making this info (i.e. https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ) more visible. Currently it requires you to navigate as follows: - StarlingX WIKI https://wiki.openstack.org/wiki/StarlingX - StarlingX sub-projects > Security project https://wiki.openstack.org/wiki/StarlingX/Security - Select 'Vulnerability Management Process' https://wiki.openstack.org/wiki/StarlingX/Security#Vulnerability_Management_... - Select ' See https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management '
We could put an additional direct link to it higher in the WIKI - maybe under 'Planning & Processes' [...]
I'm not sure your Vulnerability Management Process document is what needs increased visibility. Stepping back a bit, if I'm a StarlingX user who isn't well-connected with the contributor community and I find a misbehavior in the platform that I think might have security implications, I'll likely want to know how to safely report that to the StarlingX maintainers.
I'm going to go to https://starlingx.io/ and start looking for information on how to report security issues. I'll keyword search for "security" on the main page of that project site and find that it appears twice, but associated with a link to a video about tamper resistance features, so that's not it. I'll maybe try searching for "vu..." nope nothing. Okay maybe it's on the FAQs page? No, not there either. In the docs? Oh hey look, there's a security section. Never mind, it's about more security features of the platform.
I might eventually stumble on that kinda subtle link to the StarlingX wiki from the main documentation page and find the link there to the Security sub-project and then the
https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_is...
section therein, but it's also quite possible I will have given up before getting that far, or asked on a mailing list and naively disclosed some details of a vulnerability when doing so.
My suggestion is to get a link to that Security sub-team page in the footers of everything on the starlingx.io and docs.starlingx.io sites. Keeping https://wiki.openstack.org/wiki/StarlingX/Security in a wiki page is fine if you don't think it's suitable to move into your docs repository (or to have a separate repository the Security sub-team can use for their publications), but I also recommend moving the bug reporting instructions farther up that page. Ideally it would be about the first thing someone sees when landing there (perhaps after a brief intro paragraph). -- Jeremy Stanley _______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io
_______________________________________________ Starlingx-discuss mailing list Starlingx-discuss@lists.starlingx.io
On 2023-07-11 13:51:02 -0700 (-0700), Ildiko Vancsa wrote: [...]
Related to the above, I wanted to bring up the project’s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find. [...]
The main thing I worry about is users not being able to easily find instructions for how the StarlingX maintainers want them to report suspected security vulnerabilities. Some may guess, and may guess poorly, others may give up looking and just disclose it in public. This could result in a (preventable) scramble for everyone trying to deal with the results of those choices. Taking OpenStack as an example, in the footer of every page on openstack.org and related sites there's a "Security" link which goes to a dedicated documentation page about security topics (it uses a different subdomain than the project or docs sites but that's more of a historical implementation detail, if I were redoing it today I'd want to merge all the sites into one). At the very top of that security page is a section[*] which describes in detail how users should safely notify the maintainers of suspected vulnerabilities. Zuul has a similar page[**], linked from the main project documentation TOC (linking to it from more places would probably be a good idea as a future improvement). Once you have a security page, it can also become a convenient place to list your recent security advisories/patches, link to existing vulnerability management process documents, and potentially talk about security-specific features of StarlingX or security-relevant efforts within the StarlingX community as a sort of rallying point. [*] https://security.openstack.org/#how-to-report-security-issues-to-openstack [**] https://zuul-ci.org/docs/zuul/latest/vulnerabilities.html -- Jeremy Stanley
participants (5)
-
Ildiko Vancsa
-
Ildiko Vancsa
-
Jeremy Stanley
-
Mason Schmitt
-
Waines, Greg