Security readiness review - intake ticket

department-of-veterans-affairs / va.gov-team

Public resources for building on and in support of VA.gov. Visit complete Knowledge Hub:

https://depo-platform-documentation.scrollhelp.site/index.html

281 stars 201 forks source link

Security readiness review - intake ticket #78216

Closed marywang2 closed 3 months ago

marywang2 commented 6 months ago

Placeholder for security work that may be needed. Here is what is needed for the collab cycle:

Ensure Product Outline contains Incident Response info, including:
- Points of contact for your system and dependent VA backends
- Links to dashboards that help identify and debug application issues
Links to technical diagrams (checked into GitHub alongside your product documentation), including:
- An architecture diagram, showing involved systems and how they connect.
- For non-trivial flows (i.e. more than a single round-trip call from frontend → vets-api → VA Backend), a sequence diagram showing the ordered flow of data and operations between systems.
Describe any new publicly-exposed endpoints (vets-api or otherwise):
Describe any new interactions with dependent VA backends
Describe any other security hotspots you're concerned about / want extra attention on
Link to Release Plan with the "Planning" sections completed (in each section: Phase I, Phase II, Go Live)

balexandr commented 4 months ago

Project Module: https://github.com/department-of-veterans-affairs/vets-api/tree/master/modules/ivc_champva Project README: https://github.com/department-of-veterans-affairs/vets-api/blob/master/modules/ivc_champva/README.rdoc Project MarkDowns: https://github.com/department-of-veterans-affairs/va.gov-team/tree/master/products/health-care/champva IVC ChampVA Forms DD: https://vagov.ddog-gov.com/dashboard/zsa-453-at7/ivc-champva-forms Pega Callback API ADR: https://github.com/department-of-veterans-affairs/va.gov-team/blob/master/products/health-care/champva/ADR-callback-api-to-receive-status-from-pega.md Pega Callback API Implementation Plan: https://github.com/department-of-veterans-affairs/va.gov-team/blob/master/products/health-care/champva/callback-api-technical-spec.md

marywang2 commented 4 months ago

We have to fill out this ticket - I added a GH page here - when it's ready, let's copy it over into the intake ticket.

baltes commented 3 months ago

@balexandr Can you create the intake ticket Mary mentioned above? Engineering should own that one.

Ticket

balexandr commented 3 months ago

@baltes We have to get all the answers in the markdown file first before we create the ticket for them to look at it.

baltes commented 3 months ago

@balexandr 10-4. I'll add it to the agenda for tomorrow's production readiness meeting.

balexandr commented 3 months ago

@baltes @marywang2 @cloudmagic80 I added everything to my ability. I leftBO OR MARY CHANGE URL where you guys should help add some things. Also if anything I wrote could be expanded on outside of my knowledge please edit where you see fit.

balexandr commented 3 months ago

https://github.com/department-of-veterans-affairs/va.gov-team-sensitive/issues/1762