docs: add security response process by moolen · Pull Request #3037 · external-secrets/external-secrets

moolen · 2024-01-18T23:06:56Z

This PR proposes a security incident response process / guideline just to have it in case.

This is taken from the CNC/tag-security Project Resources. Minor adaptations have been made.

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

sonarqubecloud · 2024-01-18T23:07:22Z

Quality Gate passed

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

Skarlso · 2024-01-20T06:20:26Z

SECURITY_RESPONSE.md

+Triaging problems allows maintainers to focus resources on the most critically
+impacting problems. Potential security problems should be evaluated against the
+following information:


Suggested change

Triaging problems allows maintainers to focus resources on the most critically

impacting problems. Potential security problems should be evaluated against the

following information:

Triaging issues allows maintainers to focus resources on the most critically

impacting problems. Potential security risks should be evaluated against the

following information:

Skarlso · 2024-01-20T06:22:11Z

SECURITY_RESPONSE.md

+Any potential problem that has an exploit, permits privilege escalation, is
+simple, and does not require user interaction should be evaluated immediately.
+[CVSS Version 3.1](https://nvd.nist.gov/vuln-metrics/cvss/v3-calculator) can be
+a helpful tool in evaluating the criticality of reported problems.


Suggested change

a helpful tool in evaluating the criticality of reported problems.

a helpful tool in evaluating the criticality of reported issues.

Skarlso · 2024-01-20T06:23:38Z

SECURITY_RESPONSE.md

+Respond to the reporter and notify them you have received the problem and have
+begun reviewing it. Remind them of the [embargo policy](https://github.com/cncf/tag-security/blob/231b87f371274b2d68def2c6a35a719210836191/project-resources/templates/embargo-policy.md), and provide them
+information on who to contact/follow-up with if they have questions. Estimate a
+time frame that they can expect to receive an update on the problem. Create a
+calendar reminder to contact them again by that date to provide an update.


Suggested change

Respond to the reporter and notify them you have received the problem and have

begun reviewing it. Remind them of the [embargo policy](https://github.com/cncf/tag-security/blob/231b87f371274b2d68def2c6a35a719210836191/project-resources/templates/embargo-policy.md), and provide them

information on who to contact/follow-up with if they have questions. Estimate a

time frame that they can expect to receive an update on the problem. Create a

calendar reminder to contact them again by that date to provide an update.

Respond to the reporter and notify them that you have received and begun reviewing the problem. Remind them of the [embargo policy](https://github.com/cncf/tag-security/blob/231b87f371274b2d68def2c6a35a719210836191/project-resources/templates/embargo-policy.md), and provide them

information on who to contact/follow-up with if they have questions. Estimate when they can expect to receive an update. Create a calendar reminder to contact them again by that date to provide an update.

uh I think I messed up the linebreaks a bit here...

Skarlso

LGTM, just have a couple of suggestions for removing duplicate words and adding a bit of clarity.

moolen · 2024-01-20T21:33:12Z

Thanks! I've opened #3056 to get your suggestions in!

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Sai Charan Godasi <saicharangodasi@Sais-MacBook-Air.local>

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com> Signed-off-by: Mike Serchenia <michael_serchenia@epam.com>

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

docs: add security response process

d116137

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

moolen requested a review from a team as a code owner January 18, 2024 23:06

moolen requested a review from rogertuma January 18, 2024 23:06

moolen enabled auto-merge (squash) January 18, 2024 23:09

Skarlso reviewed Jan 20, 2024

View reviewed changes

Skarlso approved these changes Jan 20, 2024

View reviewed changes

moolen merged commit 21191dc into main Jan 20, 2024

moolen deleted the mj-security-response branch January 20, 2024 06:25

moolen mentioned this pull request Jan 20, 2024

chore: fixup security response suggestions #3056

Merged

SubrotoRoy pushed a commit to cloudant/external-secrets that referenced this pull request Feb 6, 2024

docs: add security response process (external-secrets#3037)

36e30f0

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

vardhanreddy13 pushed a commit to cloudant/external-secrets that referenced this pull request Feb 6, 2024

docs: add security response process (external-secrets#3037)

a007a25

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

sourav977 pushed a commit to cloudant/external-secrets that referenced this pull request Feb 6, 2024

docs: add security response process (external-secrets#3037)

9c2eec0

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

SubrotoRoy pushed a commit to cloudant/external-secrets that referenced this pull request Feb 6, 2024

docs: add security response process (external-secrets#3037)

82db4a5

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

sourav977 pushed a commit to cloudant/external-secrets that referenced this pull request Feb 6, 2024

docs: add security response process (external-secrets#3037)

a640fb5

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

SubrotoRoy pushed a commit to cloudant/external-secrets that referenced this pull request Feb 6, 2024

docs: add security response process (external-secrets#3037)

10ad036

Signed-off-by: Moritz Johner <beller.moritz@googlemail.com>

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

docs: add security response process#3037

docs: add security response process#3037
moolen merged 1 commit intomainfrom
mj-security-response

moolen commented Jan 18, 2024

Uh oh!

sonarqubecloud bot commented Jan 18, 2024

Uh oh!

Skarlso Jan 20, 2024

Uh oh!

Skarlso Jan 20, 2024

Uh oh!

Skarlso Jan 20, 2024

Uh oh!

Skarlso Jan 20, 2024

Uh oh!

Skarlso left a comment

Uh oh!

moolen commented Jan 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	a helpful tool in evaluating the criticality of reported problems.
	a helpful tool in evaluating the criticality of reported issues.

Uh oh!

Conversation

moolen commented Jan 18, 2024

Uh oh!

sonarqubecloud bot commented Jan 18, 2024

Quality Gate passed

Uh oh!

Skarlso Jan 20, 2024

Choose a reason for hiding this comment

Uh oh!

Skarlso Jan 20, 2024

Choose a reason for hiding this comment

Uh oh!

Skarlso Jan 20, 2024

Choose a reason for hiding this comment

Uh oh!

Skarlso Jan 20, 2024

Choose a reason for hiding this comment

Uh oh!

Skarlso left a comment

Choose a reason for hiding this comment

Uh oh!

moolen commented Jan 20, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants