Security Audit on all DCP components

HumanCellAtlas / dcp

Data Coordination Platform manifest and integration tests.

3 stars 1 forks source link

Security Audit on all DCP components #71

Open rhiananthony opened 6 years ago

rhiananthony commented 6 years ago

This Epic involves a number of steps which will indicate the current state of the DCP with regards to security practices.

Components whose security review is complete:

[ ] Metadata
[ ] Ingest
[x] Upload
[ ] Data Store
[ ] Analysis
[ ] Matrix
[ ] Azul
[ ] Browser
[ ] Portal
[ ] Logs
[ ] Metrics

Items to include, which will be broken out into individual tickets for each application are:

[ ] Deliver Tech stack documentation for each service to Albano
[ ] Assessment of the test cases which are run and especially with regards to testing secure coding
[ ] Static Code Analysis
[ ] Ready teams for security audit
[ ] Permissions are removed so that individuals access are based on the principle of least privilege
[ ] Pen tests are run against both API as well as UI components
[ ] Results of the Audit are shared with the team and action items are created

rhiananthony commented 6 years ago

This Epic involves a number of steps which will indicate the current state of the DCP with regards to security practices.

Items to include, which will be broken out into individual tickets for each application are:

[ ] Deliver Tech stack documentation for each service to Albano
[ ] Assessment of the test cases which are run and especially with regards to testing secure coding
[ ] Static Code Analysis
[ ] Ready teams for security audit
[ ] Permissions are removed so that individuals access are based on the principle of least privilege
[ ] Pen tests are run against both API as well as UI components
[ ] Results of the Audit are shared with the team and action items are created

kbergin commented 6 years ago

@rhiananthony I can't tag Albano, but can both of you update this ticket to be up to date? It's already an 'epic' so you could make other tickets to connect to it and track this in the epic column instead, if that's helpful.

sampierson commented 5 years ago

@adrazhi @stahiri @rhiananthony please can you indicate in the checkboxes at the top of this ticket which components have completed security review. When you have done that I will create tickets for the other components in their respective repos.

Also can we assign this epic to someone please. Albano or Sarah?

stahiri commented 5 years ago

This ticket is being iceboxed and will be prioritized in the future.