Burial | Readiness Review Info

[steele-lm]

Issue Description

As part of the VA.gov Platform and Governance Collaboration Cycle, we need to complete and submit a readiness review.

---

Questions

• [x] Please describe a plan to monitor this code base after deployment, including the following scenarios (NOTE: If you don't (yet) have such a plan, or don't know how to get started with one, the Platform Security Team can work on this with you!).
  • The code base is compromised at source- or run-time.
    • How does the code base get disabled in the product? We left the NoFormPage component in the code base in the event we ever needed to fully disable the form at any point.
    • How would you detect a compromise? DataDog dashboard
    • What process and privilege does the code base execute under? Unknown -- The code is part of VA.gov
      • If so, what additional credentials are available to that process?
    • The code base is infiltrated or ex-filtrated.
  • Links to dashboards that help identify and debug application issues
    • Burial 21P-530EZ Form Dashboard
    • Burial 21P-530EZ Form Monitor
• [x] Provide your Release Plan with the "Planning" sections completed (in each section: Phase I, Phase II, Go Live)
• [x] Are there any new application endpoints, front- or back-end? If so, please give examples of how any of the endpoints could be abused by unauthorized parties, as well as a plan to mitigate such threats. A: No new application endpoints
• [x] Is there any new logging data being captured? DataDog Dashboard | Burial Benefits 530 errors DataDog Dashboard | Benefits - Form 530 Burial Claims
• [x] Is Personal Health Information/PHI, Personal Identifiable Information/PII, or any other Personal Information/PI being captured? If so, please answer the following questions:
  • Is the PHI strongly encrypted? A: No PHI
  • Is the PII encrypted? A: Yes PII is encypted via vets-api
  • Can the sensitive information be scrubbed? A: Sensitive information is scrubbed via vets-api
• [x] Are there any new, modified, or existing Cookies being used? A: No
• [x] Is this feature authenticated or unauthenticated? The form can be completed authenticated or unauthenticated
• [x] Are there any other specific subjects that you want to highlight or focus additional attention on? A: N/A

Artifacts

Please provide the following documentation as attachments.

• [x] Architecture Diagram
  • No Security/Dependency changes in this epic
• [x] Incident Response Plan, including Points of Contact for your system and dependent VA back-ends.
  • Incidents are posted in slack channel: #benefits-non-disability-notifications
  • If a security vulnerability is discovered or reported in this code base, what is the plan and timeline for rolling out the fix? Timeline and plan will be determined based on severity of incident.
• [x] Sequence Diagram: Form flow Mural
• [x] Data Flow Diagram: (need to create - see #80423 ) This diagram must illustrate the following specifics.
  • What data is collected or used, and where, including information such as credentials used by this system?
  • Where is the data is stored and how, including information such as any encryption used?
  • How is the data transferred, including information such as any encryption used?
  • Who accesses the data and in what capacity (read or read-write)?
  • What is the audit trail of data access and manipulation?
• [x] API Endpoint Documentation:
  • v0/burial_claims
  • v0/in_progress_forms
  • v0/claim_attachments (Need to create Swagger Documentation - see #88054 )

Acceptance Criteria

• [x] Questions above have been answered

• [x] Links to documentation/diagrams have been provided

[Midge-dev]

@steele-lm I've gathered everything that I have. We will need input from the backend and possibly design to gather the rest.

[steele-lm]

RR ticket submitted: https://github.com/department-of-veterans-affairs/va.gov-team-sensitive/issues/1805