GovReady National Day of Civic Hacking Vision

A vision of supporting National Day of Civic Hacking with government-ready tools

Transcript

1. From zero to civic hero faster May 31 & June 1, 2014 Copyright GovReady, 2014. All Rights Reserved.
2. Sat Sun Mon Hack Hack Use Develop Saturday. Deploy Monday. VISION
3. 1. Look up ready-for-government versions of your favorite web technologies at GovReady.org.
4. GovReady govready.com/nodejs Find software Node.js Managed by: Joyent! Project core! Issue tracker! Stable release: 0.10.26! Security advisories! Commercial support: Yes Node.js is a software platform for scalable server-side and networking applications. Node.js applications are written in JavaScript, and can be run within the Node.js runtime on Windows, Mac OS X and Linux with no changes.! Node.js internally uses the Google V8 JavaScript engine to execute code, and a large percentage of the basic modules are written in JavaScript. Node.js contains a built-in HTTP server library, making it possible to run a web server without Apache or Lighttpd. USG instances ec2mapper from cfpb! design-manual from cfpb! US-CERT notices 10/21/2013: The HTTP server in Node.js 0.10.x before 0.10.21 and 0.8.x before 0.8.26 allows remote attackers to cause a denial of service (memory and CPU consumption) by sending a large number of pipelined requests without reading the response. ! see more see more
5. govready.com/nodejs (page 2) Find software Community notes edit Top overlooked security threats to Node.js web applications! ! Node.js’s null terminator of death! ! Node.js security--the good, the bad and ugly! Managed by: Joyent! Project core! Issue tracker! Stable release: 0.10.26! Security advisories! Commercial support: Yes GovReady
6. 1. Add GovReady to your project for DIY vulnerability scanning and prep'ing for government use.
7. GovReady compliance dashboard domain.com/govready Summary This application requires an immediate security update. More details. FISMA Patch dashboard SCAP This is the staging instance of Agency X’s public web site. It is a mirror of the production web site at agencyx.gov. It is based on the Drupal CMS and is powered by the Apache web server and MySQL database.! ! Primary developer: Bill deBlasio! ISSM: Sara Howard! ISSO: Tom Jenkins! ! Codebase! Issue tracker ! Domain: AWS! Build manager: Jenkins About this software edit LOW! MODERATE! MODERATE Confidentiality:! Integrity:! Availability:
8. GovReady compliance dashboard domain.com/govready Summary SCAP FISMA Patch dashboard This application requires an immediate security update. More details. Past Results 20140123-1224! 20131114-0852! 20131114-0837! 20131114-0834 This is the staging instance of Agency X’s public web site. It is a mirror of the production web site at agencyx.gov. It is based on the Drupal CMS and is powered by the Apache web server and MySQL database.! ! Primary developer: Bill deBlasio! ISSM: Sara Howard! ISSO: Tom Jenkins! ! Codebase! Issue tracker ! Domain: AWS! Build manager: Jenkins About this software edit LOW! MODERATE! MODERATE Confidentiality:! Integrity:! Availability:
9. GovReady compliance dashboard domain.com/govready This is the staging instance of Agency X’s public web site. It is a mirror of the production web site at agencyx.gov. It is based on the Drupal CMS and is powered by the Apache web server and MySQL database.! ! Primary developer: Bill deBlasio! ISSM: Sara Howard! ISSO: Tom Jenkins! ! Codebase! Issue tracker ! Domain: AWS! Build manager: Jenkins About this software edit Summary FISMA Patch dashboard This application requires an immediate security update. More details. SCAP LOW! MODERATE! MODERATE Confidentiality:! Integrity:! Availability: ATO POAM Deviations from active ATO Current ATO (Uploaded 2014-02-12) Issue #323: Adding Optimize.ly library! Issue #872: Update PHP version! Issue #982: Adding Google Analytics scripts! Add granular control of editing privileges (Github Issue #12)! Add password expiration plugin to Drupal (Github Issue #14)! Deactivate accounts of former employees (Github Issue #3)!
10. 1. Find fixes at GovReady's online database of community-shared code.
11. GovReady controls database govready.org/controls/accounts_maximum_age_login_defs ! ! ! AU-5 Control group! ! See related controls:! accounts minimum age...! accounts minimu characters...! CCE-26985-2 Required! Required! Required FISMA Low:! FISMA Med:! FISMA High: accounts_maximum_age_login_defs Guidance Noteworthy Exceptions Summary Other Fixes OS Fixes None.
12. GovReady controls database govready.org/controls/accounts_maximum_age_login_defs ! ! ! AU-13 Control group! ! See related controls:! accounts minimum age...! accounts minimu characters...! CCE-26985-2 Required! Required! Required FISMA Low:! FISMA Med:! FISMA High: accounts_maximum_age_login_defs Summary OS Fixes Other Fixes Ubuntu, more... | add... Centos, Fedora, RHEL Community notes
13. 1. Your app is government-ready!
14. GovReady! Innovator Yes! Yes! Administrator