Redis POAM: Compare Redis and Rails Analysis (Milestone 4)

User Story

As the Managers and developers of the Redis tool undergoing a POAM to remedy security issues, We need to compare the Rails and Redis applications after current state analysis has been completed, So that the analysis of both tools can be compared to determine the strengths and weaknesses of the tools.

Issue Description

Redis product-team level security risk was registered on 5/31/2024, due to not meeting encryption and password protection in the current Redis environment. The team needs to create a timeline and mitigation strategy, that includes current state of “at rest” and “in transit” settings, in order to understand the work that needs to be done to fix the security risks.

We need to take the discovered data points from the Redis and Rails and compare and document each tool's strengths

Tasks

[ ] Compare and document the data points from the Analysis tickets for Redis and Rails applications.
[ ] Discover around the configs that will need to be changed, the encrypted redis protocol (using TLS for in-transit), combine the rest of the findings
[ ] Extract the relevant steps from the analysis into a process document draft. Redis discovery documentation is here; Rails discovery documentation is here.

Success Metrics

There is solid understanding of the work required so that proper estimates can be applied to the timeframe.

Acceptance Criteria

[ ] Deliverable is the documentation of the strengths and weaknesses of each application.

Validation

Assignee to add steps to this section. List the actions that need to be taken to confirm this issue is complete. Include any necessary links or context. State the expected outcome.

department-of-veterans-affairs / va.gov-team