[Starlingx-discuss] Vulnerability Management guidelines - improving visibility

[Jeremy Stanley]

On 2023-07-13 11:30:43 +0000 (+0000), Waines, Greg wrote:
[...]
> Wrt to making this info (i.e. https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ) more visible.
> Currently it requires you to navigate as follows:
> - StarlingX WIKI  https://wiki.openstack.org/wiki/StarlingX
>       - StarlingX sub-projects > Security project  https://wiki.openstack.org/wiki/StarlingX/Security
>              - Select 'Vulnerability Management Process'  https://wiki.openstack.org/wiki/StarlingX/Security#Vulnerability_Management_Process
>                       - Select ' See https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management '
> 
> We could put an additional direct link to it higher in the WIKI
> - maybe under 'Planning & Processes'
[...]

I'm not sure your Vulnerability Management Process document is what
needs increased visibility. Stepping back a bit, if I'm a StarlingX
user who isn't well-connected with the contributor community and I
find a misbehavior in the platform that I think might have security
implications, I'll likely want to know how to safely report that to
the StarlingX maintainers.

I'm going to go to https://starlingx.io/ and start looking for
information on how to report security issues. I'll keyword search
for "security" on the main page of that project site and find that
it appears twice, but associated with a link to a video about tamper
resistance features, so that's not it. I'll maybe try searching for
"vu..." nope nothing. Okay maybe it's on the FAQs page? No, not
there either. In the docs? Oh hey look, there's a security section.
Never mind, it's about more security features of the platform.

I might eventually stumble on that kinda subtle link to the
StarlingX wiki from the main documentation page and find the link
there to the Security sub-project and then the
https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_issues_to_StarlingX
section therein, but it's also quite possible I will have given up
before getting that far, or asked on a mailing list and naively
disclosed some details of a vulnerability when doing so.

My suggestion is to get a link to that Security sub-team page in the
footers of everything on the starlingx.io and docs.starlingx.io
sites. Keeping https://wiki.openstack.org/wiki/StarlingX/Security in
a wiki page is fine if you don't think it's suitable to move into
your docs repository (or to have a separate repository the Security
sub-team can use for their publications), but I also recommend
moving the bug reporting instructions farther up that page. Ideally
it would be about the first thing someone sees when landing there
(perhaps after a brief intro paragraph).
-- 
Jeremy Stanley
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 963 bytes
Desc: not available
URL: <https://lists.starlingx.io/pipermail/starlingx-discuss/attachments/20230713/09fd60f3/attachment.sig>