🔐 Assess Security Posture of `Maintenance Pages` App

ministryofjustice / operations-engineering

This repository is home to the Operations Engineering's tools and utilities for managing, monitoring, and optimising software development processes at the Ministry of Justice. • This repository is defined and managed in Terraform

https://user-guide.operations-engineering.service.justice.gov.uk/

MIT License

15 stars 5 forks source link

🔐 Assess Security Posture of `Maintenance Pages` App #4792

Closed connormaglynn closed 2 months ago

connormaglynn commented 2 months ago

👀 Purpose

Ensure the application follows best practices for security

✅ Definition of Done

[x] Application security posture has been assessed
[x] Identified security risks have been documented in the teams' Risk Register, resolved and/or have a ticket raised to address them

📓 Notes

Initial conversation that triggered this ticket here
Repository: https://github.com/ministryofjustice/cloud-platform-maintenance-pages/tree/main
Cloud Platform Namespace: https://github.com/ministryofjustice/cloud-platform-environments/tree/main/namespaces/live.cloud-platform.service.justice.gov.uk/maintenance-pages

connormaglynn commented 2 months ago

🆙 Update

High-Level Application Architecture 👇
Application does not contain any sensitive information or communicate with any sensitive systems
Application does have Google Analytics configured (but not sure if we have access to it)
A PR has been raised to set the application environment to production from the default development which should set some sensible default configurations for SinatraRb

👀 Remaining Work

[x] Go through the default configurations for the SinatraRb framework and ensure a secure configuration for the web application
[x] Remove maintenance-page.cloud-platform.service.justice.gov.uk Ingress - this does not have an associated view and is currently unusable

connormaglynn commented 2 months ago

🆙 Update

The web application has now been configured to follow a baseline of security best practices listed below:
- Using a restrictive Content Security Policy - to prevent the loading of unknown resources (the current policy could be made more restrictive, but in light of this app being decommissioned, the current policy will suffice)
- Several other HTTP Headers configured to prevent well-known web application vulnerabilities
- Server configured to run as a production environment which comes with sensible defaults such as not propagating detailed errors to clients
Production dependencies have been pinned to a fix version, updated and locked, preventing issues of re-deploying the application with potentially different versions of dependencies being resolved

👀 Remaining Work

I will create a separate ticket to create an ADR to address why we want to decommission the app and concerns that surround it such as security, maintenance and value
None for this ticket, will close now 🥳