2024 Q3 Security Review June-Sept 2024: Atlas

[jennb33]

Issue Description

OCTO-DE teams are responsible for periodically reviewing access to systems and applications they manage to ensure that only authorized personnel have the required access and permissions.

OCTO-DE teams periodically review user access to ensure that access is limited to users who currently need to access the systems and applications and that those users have the appropriate permissions.

Platform Security initiates each review cycle and application owners are responsible for executing the process for each application that they own. Once complete, application owners document the results of the access review and send the artifacts to Platform Security to document in eMASS as evidence.

Tasks

• [x] Security review completed for Atlas
  • [x] Review the GitHub auth and who has access
  • [x] Complete a role audit
  • [x] Review ArgoCD terminal access for Atlas GitHub groups
  • [x] Review the publicly available subdomain

Success Metrics

• [x] All inventory for Platform Product team is reviewed for security issues as outlined in Security Access Review Process document and in the Security Access Review Inventory document
• [x] All dates are met as outlined in Security Access Review Rollout Plan
• [x] Security issues that are discovered are logged into the Access Review Template

Acceptance Criteria

• [x] Security review completed for Atlas

Timeline

Week of June 3, 2024

• Platform Security announces and describes access review process in Platform Team forums (Team of Teams, Product CoP). Week of June 10, 2024
• Platform Security to schedule meetings with each team that owns the applications that are subject to review to go over the process and artifacts.
• Platform Security will provide a template for applications owners to fill out for each application that requires an access review. June 17, 2024
• Platform Security announces that the access review cycle is beginning. Week of August 5, 2024
• Mid-cycle check-in: Platform Security will schedule a meeting with each team to see if they have questions or need help. September 3, 2024
• Platform Security reminds teams that they have two weeks to complete the review. September 9, 2024
• Platform Security reminds teams that they have one week to complete the review. September 13, 2024
• Platform Security reminds teams that they one business day to complete and submit the review. September 16, 2024
• Platform Security announces that the access review period is ending and, if required, follows up with any teams that have not yet submitted their artifacts to get a status update. Week of September 16, 2024
• Platform Security compiles artifacts
• Platform Security escalates any instances where reviews are still outstanding to PSEC POs.
• Platform Security will upload artifacts to eMASS. Week of September 23, 2024
• Platform Security to schedule retrospective with Platform Teams to gather feedback on the initial iteration of the access review process.
• Platform Security will add a ticket to the team’s backlog to make any adjustments to the Access Review Process based on feedback.

---

Validation

Assignee to add steps to this section. List the actions that need to be taken to confirm this issue is complete. Include any necessary links or context. State the expected outcome.

[jennb33]

Reach out to @kell-y or @kenmayo with questions or issues

[jennb33]

7/22 update: @rjohnson2011 reports that work is going smoothly and that this work should be complete by COB 7/23.

[rjohnson2011]

Atlas Access Review published in the Access Reviews folder -> https://vfs.atlassian.net/wiki/spaces/PSEC/pages/3311829048/Atlas+Access+Review

[jennb33]

7/24 update: There is a document ready for review, @LindseySaari will review it today!