[Starlingx-discuss] Vulnerability Management guidelines - improving visibility

[Waines, Greg]

Are you thinking of keeping the security 'activities/actions' in the wiki and the security 'features' in the doc site ?  ... i'm fine with that.

Wrt your question about 'Kubernetes' ... 
- you'll notice that MANY of the top-level sections in the doc site have 2x major sub-sections: Kubernetes and OpenStack
- this was done to split the topics related to
       * the Kubernetes Platform 
       and
       * the OpenStack Application
- So the 'Kubernetes' reference is really a reference to the Platform

Wrt to making this info (i.e. https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ) more visible.
Currently it requires you to navigate as follows:
- StarlingX WIKI  https://wiki.openstack.org/wiki/StarlingX
      - StarlingX sub-projects > Security project  https://wiki.openstack.org/wiki/StarlingX/Security
             - Select 'Vulnerability Management Process'  https://wiki.openstack.org/wiki/StarlingX/Security#Vulnerability_Management_Process
                      - Select ' See https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management '

We could put an additional direct link to it higher in the WIKI
- maybe under 'Planning & Processes'

Thoughts ?
Greg.
           

-----Original Message-----
From: Ildiko Vancsa <ildiko at openinfra.dev> 
Sent: Wednesday, July 12, 2023 6:35 PM
To: Waines, Greg <Greg.Waines at windriver.com>
Cc: StarlingX ML <starlingx-discuss at lists.starlingx.io>
Subject: Re: [Starlingx-discuss] Vulnerability Management guidelines - improving visibility

CAUTION: This email comes from a non Wind River email account!
Do not click links or open attachments unless you recognize the sender and know the content is safe.

Hi Greg,

Thank you for sharing that pointer.

There are multiple aspects to security and vulnerability related features, activities and actions. The documentation website mainly covers the features in the platform. In addition, the page that you shared also talks about the CVE scan process and briefly mentions the security team.

I think it is great to have documentation available about the CVE scans. At the same time, the placement of the link to the page makes it a little hidden in the list of related features in the platform. The page also says that “the master development branch of StarlingX is scanned for CVEs” and does not say anything about Kubernetes in particular, however, it is listed under a Kubernetes section. Is there a specific reason for that?

I think it would be great to separate the features from the activities, including what users can do if they identify a vulnerability issue. And make that information much more visible and easy to find. We can also add the CVE scan related information there. What do you think?

Thanks,
Ildikó

———

Ildikó Váncsa
Director of Community
Open Infrastructure Foundation





> On Jul 12, 2023, at 04:49, Waines, Greg <Greg.Waines at windriver.com> wrote:
>
> We do have a high level view of 'CVE Maintenance' in docs.starlingx.io .
> https://docs.starlingx.io/security/kubernetes/cve-maintenance-723cd9dd
> 54b3.html We could provide a reference/link here to the more detailed 
> page in the wiki .
>
> Greg.
>
> -----Original Message-----
> From: Ildiko Vancsa <ildiko at openinfra.dev>
> Sent: Tuesday, July 11, 2023 4:51 PM
> To: StarlingX ML <starlingx-discuss at lists.starlingx.io>
> Subject: [Starlingx-discuss] Vulnerability Management guidelines - 
> improving visibility
>
> CAUTION: This email comes from a non Wind River email account!
> Do not click links or open attachments unless you recognize the sender and know the content is safe.
>
> Hi StarlingX Community,
>
> The StarlingX project has been gaining new users and contributors lately, and the community already started to look into providing more on-boarding related materials and help people to find their ways around.
>
> Related to the above, I wanted to bring up the project’s Vulnerability Management guidelines. While there is some documentation available on the StarlingX wiki[1] currently, it is not the easiest to find. As this is a crucial area, I think it would be a good time to both make sure that the information there is up to date, as well as to make the documentation easier to find.
>
> Would it make sense to move the content of the aforementioned wiki over to the Documentation website? Regardless of where the information lives, where do you think would be good to add pointers to it, ie. the project’s homepage, the docs homepage, etc?
>
> Best Regards,
> Ildikó
>
> [1] 
> https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Manag
> ement
>
> ———
>
> Ildikó Váncsa
> Director of Community
> Open Infrastructure Foundation
>
>
>
>
>
>
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io