{"action":"closed","issue":{"url":"https://api.github.com/repos/18F/cg-product/issues/261","repository_url":"https://api.github.com/repos/18F/cg-product","labels_url":"https://api.github.com/repos/18F/cg-product/issues/261/labels{/name}","comments_url":"https://api.github.com/repos/18F/cg-product/issues/261/comments","events_url":"https://api.github.com/repos/18F/cg-product/issues/261/events","html_url":"https://github.com/18F/cg-product/issues/261","id":174397644,"number":261,"title":"Adequately document IA controls in SSP","user":{"login":"mogul","id":47762,"avatar_url":"https://avatars.githubusercontent.com/u/47762?v=3","gravatar_id":"","url":"https://api.github.com/users/mogul","html_url":"https://github.com/mogul","followers_url":"https://api.github.com/users/mogul/followers","following_url":"https://api.github.com/users/mogul/following{/other_user}","gists_url":"https://api.github.com/users/mogul/gists{/gist_id}","starred_url":"https://api.github.com/users/mogul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mogul/subscriptions","organizations_url":"https://api.github.com/users/mogul/orgs","repos_url":"https://api.github.com/users/mogul/repos","events_url":"https://api.github.com/users/mogul/events{/privacy}","received_events_url":"https://api.github.com/users/mogul/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/18F/cg-product/labels/HighBar","name":"HighBar","color":"006b75"}],"state":"closed","locked":false,"assignee":{"login":"NoahKunin","id":565071,"avatar_url":"https://avatars.githubusercontent.com/u/565071?v=3","gravatar_id":"","url":"https://api.github.com/users/NoahKunin","html_url":"https://github.com/NoahKunin","followers_url":"https://api.github.com/users/NoahKunin/followers","following_url":"https://api.github.com/users/NoahKunin/following{/other_user}","gists_url":"https://api.github.com/users/NoahKunin/gists{/gist_id}","starred_url":"https://api.github.com/users/NoahKunin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NoahKunin/subscriptions","organizations_url":"https://api.github.com/users/NoahKunin/orgs","repos_url":"https://api.github.com/users/NoahKunin/repos","events_url":"https://api.github.com/users/NoahKunin/events{/privacy}","received_events_url":"https://api.github.com/users/NoahKunin/received_events","type":"User","site_admin":false},"assignees":[{"login":"NoahKunin","id":565071,"avatar_url":"https://avatars.githubusercontent.com/u/565071?v=3","gravatar_id":"","url":"https://api.github.com/users/NoahKunin","html_url":"https://github.com/NoahKunin","followers_url":"https://api.github.com/users/NoahKunin/followers","following_url":"https://api.github.com/users/NoahKunin/following{/other_user}","gists_url":"https://api.github.com/users/NoahKunin/gists{/gist_id}","starred_url":"https://api.github.com/users/NoahKunin/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/NoahKunin/subscriptions","organizations_url":"https://api.github.com/users/NoahKunin/orgs","repos_url":"https://api.github.com/users/NoahKunin/repos","events_url":"https://api.github.com/users/NoahKunin/events{/privacy}","received_events_url":"https://api.github.com/users/NoahKunin/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/18F/cg-product/milestones/5","html_url":"https://github.com/18F/cg-product/milestones/FedRAMP%20JAB%20review%20remediations","labels_url":"https://api.github.com/repos/18F/cg-product/milestones/5/labels","id":1989888,"number":5,"title":"FedRAMP JAB review remediations","description":"This is the set of issues to be addressed before the JAB Technical Reviewers are content for cloud.gov to enter the Review phase. \r\n\r\nFeatures included:\r\nInstall [ZenHub](https://www.zenhub.com/) and look at [the burndown view](https://github.com/18F/cg-product/milestone/5#burndown?milestoneId=5) to get a sense of how stories are progressing. We also provide a [view of this work as it progresses across our kanban board](https://github.com/18F/cg-product#boards?notFullScreen=false&epic=55727091,243&showPRs=false).","creator":{"login":"mogul","id":47762,"avatar_url":"https://avatars.githubusercontent.com/u/47762?v=3","gravatar_id":"","url":"https://api.github.com/users/mogul","html_url":"https://github.com/mogul","followers_url":"https://api.github.com/users/mogul/followers","following_url":"https://api.github.com/users/mogul/following{/other_user}","gists_url":"https://api.github.com/users/mogul/gists{/gist_id}","starred_url":"https://api.github.com/users/mogul/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mogul/subscriptions","organizations_url":"https://api.github.com/users/mogul/orgs","repos_url":"https://api.github.com/users/mogul/repos","events_url":"https://api.github.com/users/mogul/events{/privacy}","received_events_url":"https://api.github.com/users/mogul/received_events","type":"User","site_admin":false},"open_issues":18,"closed_issues":8,"state":"open","created_at":"2016-09-07T21:42:40Z","updated_at":"2016-09-26T02:59:35Z","due_on":"2016-09-30T00:00:00Z","closed_at":null},"comments":6,"created_at":"2016-08-31T22:49:30Z","updated_at":"2016-09-26T02:59:35Z","closed_at":"2016-09-26T02:59:35Z","body":"In order for compliance reviewers to understand our system, we need to update this family of control statements to explain our system (and policies and procedures) in more precise and thorough detail.\r\n\r\n**Setup**\r\n\r\nRead the guidance in [HOWTO update the SSP](https://docs.google.com/document/d/1ltS7Lh8tdWeaDyABEupvHQDCpdaDMNlerrMcvrR5bio/edit) before working on this.\r\n\r\n* [IA Google Doc](https://docs.google.com/document/d/14hcnX4JPlehBO3QjL56zyD3dwzvPERF9Kb4_wQ3gpqU/edit)\r\n\r\n**Acceptance criteria**\r\n\r\nOverall:\r\n- [x] \"Not applicable\" is changed to \"Implemented\" where suitable, including if our implementation is that we delegate auth to agency SSO. [PMO comments]\r\n- [x] We clearly mark and document Customer Responsibility in any control where that's part of how cloud.gov implements the control. Figure out whether \"cloud.gov PaaS access\" should be renamed to \"Customer Responsibility\" in most cases, or otherwise rephrased/reframed to explain what cloud.gov customer responsibilities are. [PMO comments]\r\n- [x] In general when appropriate, control statements talk about how we implement the requirements for all our major families of account types (AWS, cloud.gov PaaS, GitHub).\r\n\r\nIA-1:\r\n- [x] IA-1 control statements are updated to reflect 18F/cloud.gov policies and procedures. This depends on https://github.com/18F/cg-compliance/issues/179 [SRTM low (row 61, 64)]\r\n\r\nIA-2 (1)\r\n- [x] The sentence explaining \"18F implements the use of multifactor authentication (MFA) to add an extra layer of security for login access to its GitHub Repository and Slack communications channel account.\" is expanded to include details about how we do this (or reference other parts of the SSP where we explain this, such as in AC). [PMO comment]\r\n\r\nIA-2 (11):\r\n- [x] Empty parameter (Parameter IA-2(11)) is filled out with something that makes sense.\r\n- [x] Statement is updated to explain how we fulfill the requirement for our AWS and GitHub accounts (to reflect SRTM notes). (We can ask our ISSO or PMO for help interpreting what this requirement means.) [SRTM low (row 67)]\r\n\r\nIA-5 overall (find appropriate places within this control to add these details):\r\n\r\n- [x] We have detailed documentation about the ways that external and internal users authenticate with cloud.gov, and that this documentation discusses that, \"cloud.gov system doesn't autocomplete passwords after a user types a few characters (users need to type in their whole password, or use a password manager application on their computer (or the password manager feature of their browser) to input the whole password.)\" [JAB Comments]\r\n\r\n- [x] Our \"use of password managers is documented well.\" [JAB Comments]\r\n\r\n- [x] It provides an explanation (or link to an explanation on docs.cloud.gov) for when we use Fugacious, what kind of data should go through it, and what configuration should be used. Explain that Fugacious runs inside the cloud.gov security boundary. [JAB Comments]\r\n\r\n- [x] It explains that \"[p]er NIST guidance, at e-Auth level 3, in-person identity proofing is required. Identifying attributes must be verified by an authorized representative of the CSP through examination of physical documentation as described in SP 800-63A.\" [JAB Comments]\r\n\r\n- [x] It explains that \"managing the strength of authenticators for Cloud.gov platform access using agency credentials is the responsibility of the agency and not the organization.\" [SRTM]\r\n\r\n- [x] It provides artifacts that document our process of protecting authenticators from \"unauthorized disclosure and modification.\r\n\r\nSpecific parts of IA-5:\r\n\r\n- [x] IA-5.c explains our authenticator requirements and how we ensure that administrator passwords are strong. [SRTM moderate (row 20)]\r\n\r\n- [x] IA-5 (d) includes specific details for \"GSA has policies and procedures for appropriately handling situations where GSA smartphones are lost or stolen.\" such as the name of the policy/procedure or where to find it. [PMO comment]\r\n\r\n- [x] IA-5.d.1 documents that we've developed, documented, and implemented administrative procedures for initial authenticator distribution. [SRTM low (row 80)]\r\n\r\n- [x] IA-5.d.2 documents our administrative procedures for lost/compromised or damaged authenticators. [SRTM low (row 81)]\r\n\r\n- [x] IA-5.d.3 documents our administrative procedures for revoking authenticators. [SRTM low (row 82)]\r\n\r\n- [x] IA-5.h documents our process to protect authenticators from unauthorized disclosure and modification. [SRTM moderate (row 21)] \r\n\r\n- [x] IA-5.i.2 documents our process to protect authenticators using device specific security safeguards. [SRTM moderate (row 23)]\r\n\r\nIA-5 (3)\r\n\r\n- [x] IA-5(3).1 documents which authenticators require authenticators that need to be received in person/by trusted 3rd party. [SRTM moderate (row 40)]\r\n\r\n- [x] IA-5(3).1 documents how we ensure strong passwords for administrator accounts: a list of mandatory criteria for passwords is listed in SRTM, row 40 (see https://docs.google.com/spreadsheets/d/1R4B0IM3PMUgxvUywYwSq5aSFifQGrD7bYe9qGJJ4iho/edit#gid=2114760911). [SRTM moderate]\r\n\r\n- [x] IA-5(3).2 documents where we've defined the registration authority with oversight of the authenticator registration process. [SRTM moderate (row 41)]\r\n\r\n- [x] IA-5(3).3: documents where we've defined personnel/roles responsible for authorizing organizational-defined registration authority? [SRTM moderate (row 42)]\r\n\r\n- [x] IA-5(3).4 documents that we've defined whether registration must happen in person or by trusted 3rd party. [SRTM moderate (row 43)]\r\n\r\n- [x] IA-5(3).5 says that the registration process must be conducted in person or by trusted 3rd party w auth by defined personnel or roles. [SRTM moderate (row 46)]\r\n\r\nIA-5 (6):\r\n\r\n- [x] IA-5(6).1 documents our process to protect authenticators, including showing how it is commensurate with the security category. [SRTM moderate (row 51)]\r\n\r\nIA-5 (11):\r\n\r\n- [x] IA-5(11).1, defines how the token quality requirements are satisfied. [SRTM low (row 90)]\r\n\r\nIA-8 (3):\r\n- [x] \"GitHub and AWS: Non-organizational users do not have privileged access to GitHub or AWS.\" is updated to make more sense. [PMO comment]\r\n\r\n**Implementation guidance**\r\n\r\nDuring grooming, take items from the following and list them as specific tasks above.\r\n\r\n- [x] [Required JAB reviewer items](https://docs.google.com/spreadsheets/d/1DrijIZDu0tltgKR8q36dnk00Z86b2yoQ_wO0kSIq1sM/edit#gid=622192705) ([additional notes here](https://docs.google.com/document/d/1xIt84KHrmcOvymfoK-Tzz-_uahIgfL6tGGVdHnAESuo/edit))\r\n- [x] [SRTM](https://docs.google.com/spreadsheets/d/1R4B0IM3PMUgxvUywYwSq5aSFifQGrD7bYe9qGJJ4iho/edit#gid=31728390) items identified by our 3PAO as \"moderate\" differential (if not already marked green there).\r\n- [x] [SRTM](https://docs.google.com/spreadsheets/d/1R4B0IM3PMUgxvUywYwSq5aSFifQGrD7bYe9qGJJ4iho/edit#gid=31728390) items identified by our 3PAO as \"low\" differential (if not already marked done there).\r\n- [x] Word doc comments ([in Google Drive](https://drive.google.com/drive/u/0/folders/0B6fPl5s12igNX3JwR2xFZVpmek0)) from our ISSO (which provide a helpful reader perspective on confusing bits). They don't all need to be addressed, but useful as guidance.\r\n- [ ] ~Word doc comments ([in Google Drive](https://drive.google.com/drive/u/0/folders/0B6fPl5s12igNX3JwR2xFZVpmek0)) from our PMO (which provide a helpful reader perspective on confusing bits). They don't all need to be addressed, but useful as guidance.~ **Noah:** I read their comments, I'll pick this up as I do final edit and review.\r\n- [x] Any relevant notes in the [SSP check working space](https://docs.google.com/document/d/1k-qiOF66o4ssBr6kEO_akaGNsku2zt2jrcawZGg7ZsA/edit#)\r\n- [x] Check that control origination statements make sense (look for [notes here](https://docs.google.com/spreadsheets/d/1Yxt1mMZAdSyKt2OGY1qdkkfZhBiKV6ZuD7sZPKxikuQ/edit#gid=600210940) and look through the controls); if you change a checkbox, make a note in that spreadsheet."}}
{"actor":{"display_login":"NoahKunin"}}