[Starlingx-discuss] Vulnerability Management guidelines - improving visibility

[Ildiko Vancsa]

Hi,

Thanks Greg and Jeremy for your input.

@Greg: I don’t have a strong preference whether the information should live on the wiki or on the Docs webpage, if we make it visible. The processes to report a vulnerability as well as to process and address it, is quite static. In that sense, I think it would make sense to consider adding it to the rest of the project’s documentation, if there is a logical place to put it.

I think that we have most of the information in the different documents already, it is more the question of organizing and making it more visible. Currently it is much easier to find information about security related features that users care about. When it comes to vulnerabilities that most likely people who operate the platform will find, we need to make it easier for them to figure out how to deal with those issues, ie reporting them without doing any harm.

I like Jeremy’s suggestions with regards to utilizing the website and documentation page to give visibility to the process.

What do others think?

Thanks,
Ildikó


> On Jul 13, 2023, at 04:55, Jeremy Stanley <fungi at yuggoth.org> wrote:
> 
> On 2023-07-13 11:30:43 +0000 (+0000), Waines, Greg wrote:
> [...]
>> Wrt to making this info (i.e. https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management ) more visible.
>> Currently it requires you to navigate as follows:
>> - StarlingX WIKI  https://wiki.openstack.org/wiki/StarlingX
>>      - StarlingX sub-projects > Security project  https://wiki.openstack.org/wiki/StarlingX/Security
>>             - Select 'Vulnerability Management Process'  https://wiki.openstack.org/wiki/StarlingX/Security#Vulnerability_Management_Process
>>                      - Select ' See https://wiki.openstack.org/wiki/StarlingX/Security/Vulnerability_Management '
>> 
>> We could put an additional direct link to it higher in the WIKI
>> - maybe under 'Planning & Processes'
> [...]
> 
> I'm not sure your Vulnerability Management Process document is what
> needs increased visibility. Stepping back a bit, if I'm a StarlingX
> user who isn't well-connected with the contributor community and I
> find a misbehavior in the platform that I think might have security
> implications, I'll likely want to know how to safely report that to
> the StarlingX maintainers.
> 
> I'm going to go to https://starlingx.io/ and start looking for
> information on how to report security issues. I'll keyword search
> for "security" on the main page of that project site and find that
> it appears twice, but associated with a link to a video about tamper
> resistance features, so that's not it. I'll maybe try searching for
> "vu..." nope nothing. Okay maybe it's on the FAQs page? No, not
> there either. In the docs? Oh hey look, there's a security section.
> Never mind, it's about more security features of the platform.
> 
> I might eventually stumble on that kinda subtle link to the
> StarlingX wiki from the main documentation page and find the link
> there to the Security sub-project and then the
> https://wiki.openstack.org/wiki/StarlingX/Security#How_to_report_security_issues_to_StarlingX
> section therein, but it's also quite possible I will have given up
> before getting that far, or asked on a mailing list and naively
> disclosed some details of a vulnerability when doing so.
> 
> My suggestion is to get a link to that Security sub-team page in the
> footers of everything on the starlingx.io and docs.starlingx.io
> sites. Keeping https://wiki.openstack.org/wiki/StarlingX/Security in
> a wiki page is fine if you don't think it's suitable to move into
> your docs repository (or to have a separate repository the Security
> sub-team can use for their publications), but I also recommend
> moving the bug reporting instructions farther up that page. Ideally
> it would be about the first thing someone sees when landing there
> (perhaps after a brief intro paragraph).
> -- 
> Jeremy Stanley
> _______________________________________________
> Starlingx-discuss mailing list
> Starlingx-discuss at lists.starlingx.io