GovReady Compliance Management Mockup Mar 2014

Early mockup study for GovReady Compliance Management

Transcript

1. “I want to build software for the government.” 1 Thursday, March 27, 14
2. “Okay. But is it secure ?” “I want to build software for the government.” 2 Thursday, March 27, 14
3. “Okay. But is it secure ?” “I want to build software for the government.” “How do you define ‘secure’?” 3 Thursday, March 27, 14
4. A good start: Start with a DHS-accepted “baseline” configuration. Diligently apply your patches. Document everything. 4 Thursday, March 27, 14
5. Using .NET or Oracle? You’re all set. 5 Thursday, March 27, 14
6. Using .NET or Oracle? You’re all set. Using an open source project? You’re on your own. 6 Thursday, March 27, 14
7. GovReady A compliance monitor and management layer for your entire stack. 7 Thursday, March 27, 14
8. domain.com/govready provides: •Push-button full-stack scanning against hundreds of individual DHS-standard settings. •Full-stack documentation: every library, module, etc, with version info and audit log. •Which items require patching. •Recent DHS alerts pertaining to packages in your stack. 8 Thursday, March 27, 14
9. govready.com/package provides: •Pre-configured baselines of package. •Code samples from in-use US Government instances. •Community-populated configuration guidelines. 9 Thursday, March 27, 14
10. GovReady govready.com/nodejs Find software Node.js Managed by: Joyent Project core Issue tracker Stable release: 0.10.26 Security advisories Commercial support: Yes Node.js is a software platform for scalable server-side and networking applications. Node.js applications are written in JavaScript, and can be run within the Node.js runtime on Windows, Mac OS X and Linux with no changes. Node.js internally uses the Google V8 JavaScript engine to execute code, and a large percentage of the basic modules are written in JavaScript. Node.js contains a built-in HTTP server library, making it possible to run a web server without Apache or Lighttpd. USG instances ec2mapper from cfpb design-manual from cfpb US-CERT notices 10/21/2013: The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response. see more see more 10 Thursday, March 27, 14
11. GovReady govready.com/nodejs (page 2) Find software Community notes edit Top overlooked security threats to Node.js web applications Node.js’s null terminator of death Node.js security--the good, the bad and ugly Managed by: Joyent Project core Issue tracker Stable release: 0.10.26 Security advisories Commercial support: Yes 11 Thursday, March 27, 14
12. GovReady compliance dashboard domain.com/govready Summary This application requires an immediate security update. More details. FISMA Patch dashboard SCAP This is the staging instance of Agency X’s public web site. It is a mirror of the production web site at agencyx.gov. It is based on the Drupal CMS and is powered by the Apache web server and MySQL database. Primary developer: Bill deBlasio ISSM: Sara Howard ISSO: Tom Jenkins Codebase Issue tracker Domain: AWS Build manager: Jenkins About this software edit LOW MODERATE MODERATE Confidentiality: Integrity: Availability: 12 Thursday, March 27, 14
13. GovReady compliance dashboard domain.com/govready Summary SCAP FISMA Patch dashboard This application requires an immediate security update. More details. Past Results 20140123-1224 20131114-0852 20131114-0837 20131114-0834 This is the staging instance of Agency X’s public web site. It is a mirror of the production web site at agencyx.gov. It is based on the Drupal CMS and is powered by the Apache web server and MySQL database. Primary developer: Bill deBlasio ISSM: Sara Howard ISSO: Tom Jenkins Codebase Issue tracker Domain: AWS Build manager: Jenkins About this software edit LOW MODERATE MODERATE Confidentiality: Integrity: Availability: 13 Thursday, March 27, 14
14. GovReady compliance dashboard domain.com/govready This is the staging instance of Agency X’s public web site. It is a mirror of the production web site at agencyx.gov. It is based on the Drupal CMS and is powered by the Apache web server and MySQL database. Primary developer: Bill deBlasio ISSM: Sara Howard ISSO: Tom Jenkins Codebase Issue tracker Domain: AWS Build manager: Jenkins About this software edit Summary FISMA Patch dashboard This application requires an immediate security update. More details. SCAP LOW MODERATE MODERATE Confidentiality: Integrity: Availability: ATO POAM Deviations from active ATO Current ATO (Uploaded 2014-02-12) Issue #323: Adding Optimize.ly library Issue #872: Update PHP version Issue #982: Adding Google Analytics scripts Add granular control of editing privileges (Github Issue #12) Add password expiration plugin to Drupal (Github Issue #14) Deactivate accounts of former employees (Github Issue #3) 14 Thursday, March 27, 14
15. GovReady compliance dashboard domain.com/govready Summary Update to 7.x-2.5 Module Installed Status Apache HTTP server CentOS PHP MySQL Drupal FISMA Jenkins Git 2.2.27 6.5 X86 64-bit 5.5.10 Community Server 5.6 7.x-1.0 1.546 1.9.0 Patch dashboard SCAP This is the staging instance of Agency X’s public web site. It is a mirror of the production web site at agencyx.gov. It is based on the Drupal CMS and is powered by the Apache web server and MySQL database. Primary developer: Bill deBlasio ISSM: Sara Howard ISSO: Tom Jenkins Codebase Issue tracker Domain: AWS Build manager: Jenkins About this software edit LOW MODERATE MODERATE Confidentiality: Integrity: Availability: 15 Thursday, March 27, 14