ITHC Testing Supplier Prep/Setup on DQ Prod

cassidti commented 6 years ago

[x] confirm prod is deployed
[x] ITHC Testing Supplier IAM Accounts created on Prod + mocks + ci
[x] ITHC Testing Supplier AMI instances deployed to Prod + mocks + ci

cassidti commented 6 years ago

@tomfitzherbert Please add other dependencies when you get a moment

tomfitzherbert commented 6 years ago

Core scope for ITHC 1:

Planning & Preparation and post assessment review consisting of:

[x] Preparation time to deploy and test custom AMI into environment (Remote);
[ ] Kick off meeting to review project, test plan, logistics and dependencies (on-site);
[ ] Post assessment review meeting (on-site).

Phase 1 – AWS Assessment

The first test phase will focus on testing the security of the AWS environments deployed, particularly:

[ ] That the perimeter defined by the VPCs, subnets, firewall rules, security groups and NAT gateways operates as intended;
[ ] Secure configuration of IAM permissions / MFA;
[ ] Measuring system configuration to AWS best practice;
[ ] That data is secured in transit and at rest;
[ ] That specific (mock instance) services are only accessible from the intended sources, on the intended ports;
[ ] That the monitoring and logging systems are functional and appropriate.

NB I suggest that we check off the above items to confirm that we are confident that these will pass test

tomfitzherbert commented 6 years ago

Dependencies:

General

[ ] A technical point of contact who will be familiar with the environment being assessed and able to resolve or escalate any access or performance problems with it.
[ ] All necessary change requests raised and approved for the nominated consultant(s) on the requested testing dates to enable access for testing.
[ ] Confirmation that any third parties (such as hosting providers) have been made aware of and consent to testing.
[ ] The full address of any site where on-site testing is to take place.
[ ] A technical contact to be available at site who: o Is aware of the environment. o Can inform us where the hardware is physically located. o Can inform us where connections can be made for testing, either side of the in-scope devices. o Can inform us the IP addresses of the in-scope devices. o Has an understanding of the project requirements.

Internal infrastructure assessment

[ ] Unfiltered network access on the same network segment as each device to be tested.
[ ] Any hosts to be excluded from testing.
[ ] If applicable, disabling of any host-based firewalls, or for the IP addresses assigned to the consultants to be allowed through the firewall for the duration of the assessment.
[ ] The IP addresses of all the devices in scope, to ensure that no mistakes are made through ambiguity.
[ ] Two free network ports to plug into for each of the VLANs, per consultant.
[ ] Two free IP addresses per VLAN for use by the consultant, per consultant.
[ ] Confirmation of site address.
[ ] Physical access to be prearranged, and if necessary an escort to be provided.
[ ] The VPN, if any, to remain online and accessible throughout testing. Any disruption of VPN connectivity may cause the assessment to require additional time.
[ ] Unless otherwise stated, the scope of the assessment will be confined to the URL(s) listed in this proposal.

NB There are further dependencies for web service and web application assessments that will be relevant for ITHC 2 and 3 - please refer to the ITHC document for further details

UKHomeOffice / dq-aws-transition