Versions Compared

Old Version 1

changes.mady.by.user Craig McNally

Saved on

compared with

New Version Current

changes.mady.by.user Craig McNally

Saved on

Key

  • This line was added.
  • This line was removed.
  • Formatting was changed.

Date

...

Discussion items

Team
  • Fixes have been implemented and releases have been made for Orihid and Nolana.
  • Notifications have been sent to SysOps mailing list and #sys-ops slack channel
  • Is there any way to tell if there was unauthorized access?
    • OKAPI logs the user id for all proxied calls.  It may be possible to look for unusual activity associated with these system users
    • Load balancer or reverse proxy logs may provide some insight. 
      • Especially if the X-Forwarded-For header is logged... 
      • Other information may not be logged though, e.g. the username/id.
    • Craig McNally will respond to Jason in #sys-ops
  • What does the timing look like for full disclosure?
    • Probably at least a day or two.
    • At least give them the weekend so there's a good window for downtime, etc.
    • Craig McNally will ask the sys-ops community.
  • Still need to draft a statement for full disclosure
  • Where does the full disclosure statement get sent?  #sys-ops, #folio-general?  multiple channels?  an email distro?
    • Try to consolidate the conversation in a single place (#folio-general)
  • We will need to adjust the Security Level on the related JIRAs once we fully disclose this
  • GitHub advisories will need to be published when we fully disclose this

Today:

  • All seem to be set

TimeItemWhoNotes
5 minEmbargoed Vulnerability Process RetroTeam

When do we want to schedule this?

  • Before, during or after WOLFcon
  • Vacations may be an issue before or after WOLFcon
  • 5 of us will be at WOLFcon
  • Craig McNally  to try to find a good time slot for a shoulder session at WOLFcon which doesn't conflict with TC shoulder session, then ask Jessie to set aside a room at that time.
  • Reminder that we have a document with pain points and thoughts ... link TBD
0 minOWASP/SNYKTeam
  • Epic:
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyFOLIO-3582
  • Feature:
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyFOLIO-3583
  • User Story:
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyFOLIO-3584
  • User Story: 
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyFOLIO-3709
  • Sonar ( https://sonarcloud.io/organizations/folio-org/quality_profiles):
    • Java: All 38 security hotspots rules and all 53 vulnerabilities rules are enabled (2 deprecated vulnerabilities rules are disabled).
    • JavaScript: 53 security hotspots rules and all 27 vulnerabilities rules are enabled.
      • John Coburn will check whether the remaining 2 security hostspots rules should be enabled.
  • Snyk: Skott Klebe to take a closer look and add ignore where applicable
Today:
  • Group reviewed inactive rules 
  • decided to enable the two inactive but not deprecated Hotspot Security rules → Julian to activate them 

Today:

  • Should we look at re-running OWASP ZAP scans on a more regular basis?
  • Create a spike to investigate how we can improve static code analysis to detect things like hardcoded passwords, etc.
  • Can we be more proactive about catching these things?
  • At a higher (architectural) level, should we even be using passwords for system users?  Can we adopt something like client credentetial flow, etc.
    • Oauth/OIDC/etc.?
    • This is more work and requires a lot more time... RFC/proposal/development/etc.
    • Craig McNally to create a placeholder spike/story for this too
1 minNCT group (Pen. testing)

Axel Dörrer 

Progress is slow... at most expect monthly updates.

  • Pre work has been completed (Python)
  • Next step is to parse the RAML for all endpoints/module and run the tests

Today:

  • Nothing new to report this week.
  • Let's take a closer look at these pen tests and how they overlap with ZAP... are they complimentary?  is there significant overlap?
    • Wait for a week when Axel is on the call to discuss.
    • Who is leading this NCT group?


1 minSTCOR-395 "refactor login form to avoid using any form framework whatsoever"

All



Expand
titleBackground
  • Create a spike to investigate what's involved in divorcing the login page from the NPM ecosystem.  Will reach out to John and Ryan as needed. 
  • Reopen STCOR-395 and block on the spike. – Done.
  • Where does this stand?  Get an update from Ryan Berger / John Coburn
  • Waiting for the spike (
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keySTCOR-651
    ) to be completed. – currently in the Open state.
  • John to reach out to Skott to discuss what the level of risk associated with this.  – Still needs to happen.
  • John Coburn pulled together two PoCs.  See comments in
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keySTCOR-651
  • How do we want to move forward?
    • Solutions need to be reviewed and discussed.
    • Sounds like the iframe approach is a non-starter... actually a step in the wrong direction security-wise
  • John Coburn (and others) to read up on browser CSPs
  • John Coburn has made some progress on investing CSPs
    • Will share some draft guidance we may want to include into the installation documentation (via slack)
    • SG will review and provide feedback.  Skott Klebe please take a look too
  • Next up:  John to work on some spike work - focused on introducing CSPs on the folio-snapshot site
    • can serve as a reference impl of the guidance we'll be adding to the install docs
  • Not much progress since last week, but hopefully get some movement on this soon.
  • Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyFOLIO-3691
    Spike
  • John Coburn trying to get this lined up for next sprint
  • John Coburn to discuss with another developer (Maccabee) who is familiar with CSPs.  
  • John had the chance to look on it but only via metatag need to try out or examine http header configuration at the server side
  • Some things happen in stripes modularity too which might have impact too
  • John Coburn is making progress - has done some testing locally, but wants to exercise it in a more realistic env.
  •  John Coburn provided update on CSP effort.
    • Experimenting with express to provide CSP (for local dev purposes).  Production systems wouldn't use this, it would be formalized by the hosting provider.
    • This allows for local testing and experiments. 

Today:

  • Deferred to discuss this when John is aroundNo new progress on this.  Needs to be prioritized.
1 minDisable tenant checking to support multi tenant requests (MODAT-143).

Julian Ladisch / All

A few wiki pages have been shared on this... See Enhanced Consortia Support(ECS)

Julian Ladisch will discuss his concerns with Olamide, etc. and we can discuss here again if/when needed.

  • There's a need to allow for the user to easily switch between tenant contexts
  • Maybe making this opt-in is a reasonable approach
    • the restriction would remain unchanged by default, but you could relax this constraint by making an explicit configuration change
  • Julian Ladisch met with Thunderjet/Olamide
  • mod-consortia/ui-consortia have been submitted for TC review
    • This will probably be raised as part of those reviews
  • Added a comment to the
    Jira Legacy
    serverSystem JiraJIRA
    serverId01505d01-b853-3c2e-90f1-ee9b165564fc
    keyTCR-26
    :
    Security team disagree with breaking the tenant seperation on okapi token level. We would like to encourage an alternative solution on saml or openid techniques which would be less invasive to the current approach.
  • TC would like to split off the security/token concerns from the module acceptance, will be discussed next Wednesday TC's meeting
  • Craig McNally  to raise this with the TC again and get the ball rolling on discussing the larger topic (e.g. via a subgroup?  RFC?  something else?)
    • Will involve Axel and Julian to a subgroup
  • The TC approved mod-consortia, but also wanted to discuss the concerns raised about tenant isolation and relaxing tenant checks in certain circumstances.  The TC plans to discuss on Monday 6/5 11:00 AM ET. → Julian and Axel to join the meeting
  • TC discussed on 2023-06-26 - Consortia Tenant Checks
  • Raised this at the TC and the sentiment is that this group should work to resolve concerns with Olamide on its own.  Need to discuss next steps... 
    • Try to find a time for Olamide to discuss with us? 
    • Try to handle this "out of band" via slack, google doc, etc.?
    • Ask Olamide to join one of our Thursday meetings?
    • Something else?

Today:

  • Not a ton of feedback on this today - Craig McNally  will reach out to Olamide to see how he'd like to proceed.
  • Next steps need to be discussed with Axel Dörrer and Julian Ladisch 
  • It seems that the conversation at this point is really between Olamide/the consortia team and the security team.
5 minFOLIO-3535 Upgrade bitnami/elasticsearch:7.10.2 in reference and vagrant development  boxes (folio-ansible)All
  • Jakub Skoczen to bring this to the devops team asking to  bump elasticsearch to a major version in this case
  • but there is the concern who should responsible to keep these environments up to date and maintain them in general
  • the devops team is greatly lacking on resources and can't take the task permanently
  • need to have a discussion in a wider group (TC?)
  • Craig McNally to touch base with Jakub Skoczen about this in slack.  Get it on the TC agenda if needed.
    • My guess is that if DevOps can't do this, it will likely fall on the Kitfox team.  It should be discussed with Oleksii P. and Mark V. 
    • I don't think the TC will be helpful here since they don't direct development resources/teams/etc. 

Today:

  • Craig McNally provided an update - last I heard Ingolf was going to bring this up at the SysOps SIG.  Ingolf may be on vacation.

Today:

  • Craig McNally will bump the thread with Ingolf to see if anybody has shown interest.
5-10 min

Jira Legacy
serverSystem JiraJIRA
serverId01505d01-b853-3c2e-90f1-ee9b165564fc
keyOKAPI-853

Craig/Jakub

The wording should be adjusted, it's a little misleading

Also need to determine if this is a must have for the Refresh token work.

See discussion in slack channel for additional details.

TODO:

  • Craig McNally to create a JIRA for using SameSite: Lax (or possibly Strict) instead of "None".  See refresh token PR in mod-login.
  • Craig McNally to fix up OKAPI-853 with clarifications

Ideas:

  • Lock down by default (to the hostname which OKAPI is using), but allow additional origins to be allowed via configuration
  • UI developers often need the ability to point a locally hosted UI to a backend hosted elsewhere

Today:

  • Deferred to discuss other important topics.

*

Critical Security Vulnerabilities

*

Review the Kanban board. Team
  • Reviewed tickets which haven't moved recently.  We made it up through EDGERTAC-72, then ran out of time.

Today:

Jira Legacy
serverSystem Jira
serverId01505d01-b853-3c2e-90f1-ee9b165564fc
keyMODHAADM-27
  • PO Charlotte Whitt  requested: "While we need to be careful about spending our available developer time wisely, it would be helpful if you could indicate whether this work is a must fix now, or something we can fix when/if we decide to build the FOLIO Harvester module."
  • https://github.com/indexdata/localindices/pull/90 "MODHAADM-27: Migrate log4j from 1 to 2#90". This pull request uses the Log4j 1.x bridge (log4j-1.2-api), no code change is needed. This fixes all known log4j security issues, including https://nvd.nist.gov/vuln/detail/CVE-2019-17571 .
    • What advice does the security team give? Fix now or postpone to 2024?

    Topic Backlog

    		Retiring issues which have been open for a long time w/o progressAll

    Discussed gathering a report for the TC to review/approve.  Need to work out details/logistics.

    Query so far:

    • labels = Security AND created < '-52w' AND status != closed AND status != completed AND status != Cancelled

    		Bot Detection/ControlAll
    • Not a huge problem due to needing to authenticate first, and the user has the required permissions to get the information sought after.
    • If using AWS, WAF bot control may provide some protection w/ little effort - Skott Klebe to investigate.
    • Craig McNally to check in with Skott on this

    		Time slotAllDo we need a better time slot for the security team meeting to allow more members to join?

    		Logging & Personal DataCraig/Team

    A developer recently reached to me asking if the security team or TC has guidance or rules in place for logging of personal data.  Some guidelines are documented on the wiki, but I'm wondering if it's worth making some clarifications and creating a draft decision record for the TC to formally endorse

    Is this even in our purview?  Should we seek input from the Privacy SIG?  Should I raise this with the TC first?

    Next steps:

    • For now, put this on hold.  See how the Draft DR approach works for the periodic dependency updates (see above).  If that goes smoothly, we'll take this on next.  Otherwise we'll consider other approaches.

    		Cyber Resilience ActTeam

    ...