Open edzillion opened 5 years ago
master
branchesJust want to clarify that this is a security checklist for our aws infrastructure, right? And smart contract security will be elsewhere/a bit later?
yes.
from here: https://medium.com/@jsoverson/exploiting-developer-infrastructure-is-insanely-easy-9849937e81d4 Open source is incredibly broken
Let’s count all the things that went wrong.
An application (Copay) was be built by consuming dependencies over the network without the entire tree’s dependencies locked.
Even without locked versions, those dependencies aren’t cached and are pulled on every build.
Thousands of other projects are dependent on event-stream with the same or similar configurations.
The maintainer stopped caring about a library that thousands of projects depended on.
Thousands of projects consume this library for free and expect it to be maintained without any compensation.
The maintainer gave full control to an unknown entity just because they asked for it.
There was no notification that control had changed, thousands of projects were just expected to consume the package with no warning.
There’s really no end, this list could go on and on.
I'd be happy to go through this with you, share my experiences/opinions, and help tighten security. Want to schedule a video chat?
^ I'd like to join, if/when this happens.
I'd be happy to go through this with you, share my experiences/opinions, and help tighten security. Want to schedule a video chat?
Sounds good, although I think that we are still in the 'building out' phase and I wonder would this be better left to a 'consolidation phase' ?
It is highly recommended to create a sub-user that only has the rights to use SNS and a logging ability to use CloudWatch. CloudWatch is a logging mechanism which will greatly help in seeing if a message has been delivered or not.
from https://keyholesoftware.com/2019/01/07/aws-sns-push-notifications/
List the elements required for a proper security audit: