Skip to end of banner
Go to start of banner

2020-09-11 Meeting notes

Skip to end of metadata
Go to start of metadata

You are viewing an old version of this page. View the current version.

Compare with Current View Page History

Version 1 Current »

Date

Attendees

Discussion items

TimeItemWhoNotes

Review Open Actionsteam

Secret Storage

SNYK, including Java


Review Security JIRA issuesTeam

Review Kanban board - do we like this approach?

Or work through the list


 House keeping issues

 Security email setup - security@folio.org works!

Have sent Safe Harbor Statement/Acceptable Use Policy to Lawyer for review

Jira configuration actions:

  • Per Kanban review - suggested a new label - security-reviewed - Figure out a tagging/other system to note which items this team discussed
  • Prioritize:
    • Can the Security Project be setup so that new issues automatically set the Security Level to FOLIO Security Group? 
      • Confirmed how to get this done - need to coordinate changes to permissions scheme and security scheme for the Security project with JIRA admin (some dependencies with other settings/projects).
      • Expect to complete week of July 27 (MDG OOO next week).
    • Some issues appear to show Security Level but others don't. Investigate. Could be issue type (Epic vs Story vs Task vs Bug).
      • Still investigating. It won't show unless it's set. The field has to be configured to appear on the screen that the project uses (not so for UXPROD)
      • Able to set for task, bug and epic.
    • Clarify and/or propose how we set a security level that allows only those who might need to know (ie. the specific developers who might work on issues) 
      • Need to define who is part of the list. Currently an "external core contributors" group that has 178 members. The current Security Role of "Core FOLIO Team" points to this group.
      • Use the "Core FOLIO Team"
      • May not ever need a more restrictive group.


  • No labels