{"action":"created","issue":{"url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/50","repository_url":"https://api.github.com/repos/mozilla/wikimo_opsec","labels_url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/50/labels{/name}","comments_url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/50/comments","events_url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/50/events","html_url":"https://github.com/mozilla/wikimo_opsec/issues/50","id":166816388,"number":50,"title":"Unified scoring levels","user":{"login":"gdestuynder","id":956866,"avatar_url":"https://avatars.githubusercontent.com/u/956866?v=3","gravatar_id":"","url":"https://api.github.com/users/gdestuynder","html_url":"https://github.com/gdestuynder","followers_url":"https://api.github.com/users/gdestuynder/followers","following_url":"https://api.github.com/users/gdestuynder/following{/other_user}","gists_url":"https://api.github.com/users/gdestuynder/gists{/gist_id}","starred_url":"https://api.github.com/users/gdestuynder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdestuynder/subscriptions","organizations_url":"https://api.github.com/users/gdestuynder/orgs","repos_url":"https://api.github.com/users/gdestuynder/repos","events_url":"https://api.github.com/users/gdestuynder/events{/privacy}","received_events_url":"https://api.github.com/users/gdestuynder/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/mozilla/wikimo_opsec/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":{"login":"gdestuynder","id":956866,"avatar_url":"https://avatars.githubusercontent.com/u/956866?v=3","gravatar_id":"","url":"https://api.github.com/users/gdestuynder","html_url":"https://github.com/gdestuynder","followers_url":"https://api.github.com/users/gdestuynder/followers","following_url":"https://api.github.com/users/gdestuynder/following{/other_user}","gists_url":"https://api.github.com/users/gdestuynder/gists{/gist_id}","starred_url":"https://api.github.com/users/gdestuynder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdestuynder/subscriptions","organizations_url":"https://api.github.com/users/gdestuynder/orgs","repos_url":"https://api.github.com/users/gdestuynder/repos","events_url":"https://api.github.com/users/gdestuynder/events{/privacy}","received_events_url":"https://api.github.com/users/gdestuynder/received_events","type":"User","site_admin":false},"assignees":[{"login":"gdestuynder","id":956866,"avatar_url":"https://avatars.githubusercontent.com/u/956866?v=3","gravatar_id":"","url":"https://api.github.com/users/gdestuynder","html_url":"https://github.com/gdestuynder","followers_url":"https://api.github.com/users/gdestuynder/followers","following_url":"https://api.github.com/users/gdestuynder/following{/other_user}","gists_url":"https://api.github.com/users/gdestuynder/gists{/gist_id}","starred_url":"https://api.github.com/users/gdestuynder/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/gdestuynder/subscriptions","organizations_url":"https://api.github.com/users/gdestuynder/orgs","repos_url":"https://api.github.com/users/gdestuynder/repos","events_url":"https://api.github.com/users/gdestuynder/events{/privacy}","received_events_url":"https://api.github.com/users/gdestuynder/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2016-07-21T13:15:56Z","updated_at":"2016-07-22T18:06:38Z","closed_at":null,"body":"Current standard: https://wiki.mozilla.org/Security/Standard_Levels#Scoring_levels\r\n\r\nThe standard levels are not used consistently which recently started to cause confusion among teams and reduces our communication efficiency. It is important to have expectations regarding our levels and scores - which ideally never (or very rarely) need to change.\r\n\r\nIssues\r\n======\r\n- Star rating only used in https://mana.mozilla.org/wiki/display/POLICIES/Standard%3A+Individual+Password+Managers (also used in past infosec reports, no longer used)\r\n\r\n- A-F rating (non-standard) rating used in https://mozilla.github.io/http-observatory-website/analyze.html?host=mozilla.com\r\n\r\n- Modern-intermediate-old compatibility levels non-standardized and misunderstood as scoring levels in https://mozilla.github.io/http-observatory-website/analyze.html?host=mozilla.com, https://wiki.mozilla.org/Security/Server_Side_TLS, https://wiki.mozilla.org/Security/Guidelines/OpenSSH, https://wiki.mozilla.org/Security/Guidelines/Web_Security, https://wiki.mozilla.org/Security/Guidelines/Key_Management (potentially more pages)\r\n\r\n- sec-other, sec-low, sec-moderate, sec-high, sec-critical flags rating levels used in bugzilla https://wiki.mozilla.org/WebAppSec/Filing_In_Bugzilla#Adding_Keywords and other keywords from https://wiki.mozilla.org/Security_Severity_Ratings\r\n\r\nProposals\r\n========\r\n\r\n1) Make usage of standard levels actually non-optional. While the page says so, it is not enforced (i.e. self-police within the team)\r\n\r\n2) Back-link all pages using the standard levels to https://wiki.mozilla.org/Security/Standard_Levels (just like some pages also link to RFC2119 for the same reasons)\r\n\r\n3) **Unify scoring levels**\r\n\r\n3.1) Remove the star rating. I believe it's a decent rating as per rationale - it also favors having 5 stars everywhere (no half measures), but it sadly did not see much adoption.\r\n\r\n3.2) Adopt A-F rating and officially document it. It is used by ssllabs and is well understood. Arguably, people are either A, B, or \"bad up to F\" (which is similar to star rating, which would be 1 star, 3 stars or 5 stars). A- A+ etc not allowed as it makes the rating unclear.\r\n\r\n3.3) Discuss modern-intermediate-old (also should it be Modern-legacy-deprecated?). In particular not using \"modern\" automatically means you're not getting a 5 star or \"A\" rating - thus it actually make sense, that people understood it as a scoring rating - it affects your score directly.\r\n\r\n3.4) Document bugzilla keywords directly in  https://wiki.mozilla.org/Security/Standard_Levels and discuss the current nomenclature (can we alias sec-critical to sec-maximum and use the normal levels?)\r\n\r\n3.5) Revamp https://wiki.mozilla.org/Security_Severity_Ratings and clearly deprecate all keywords that are no longer used (wsec, opsec for ex). Add rationale on how keywords are added and why it's a good idea to keep the list small.\r\n\r\nMulti-ping: @jeffbryner  @amuntner @Phrozyn  @claudijd @tristanweir\r\n\r\n_Please refer to the above by using the numbered point for conciseness (or add points after 3.5 if anything is missing. Something like \"I agree with 1, 2, 3 but would do 3.2 differently: here's why\" would be good). This issue is meant as a general discussion - if necessary each point might become its own issue. For now, I saw value in keeping context together._  "},"comment":{"url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/comments/234614640","html_url":"https://github.com/mozilla/wikimo_opsec/issues/50#issuecomment-234614640","issue_url":"https://api.github.com/repos/mozilla/wikimo_opsec/issues/50","id":234614640,"user":{"login":"jeffbryner","id":566889,"avatar_url":"https://avatars.githubusercontent.com/u/566889?v=3","gravatar_id":"","url":"https://api.github.com/users/jeffbryner","html_url":"https://github.com/jeffbryner","followers_url":"https://api.github.com/users/jeffbryner/followers","following_url":"https://api.github.com/users/jeffbryner/following{/other_user}","gists_url":"https://api.github.com/users/jeffbryner/gists{/gist_id}","starred_url":"https://api.github.com/users/jeffbryner/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jeffbryner/subscriptions","organizations_url":"https://api.github.com/users/jeffbryner/orgs","repos_url":"https://api.github.com/users/jeffbryner/repos","events_url":"https://api.github.com/users/jeffbryner/events{/privacy}","received_events_url":"https://api.github.com/users/jeffbryner/received_events","type":"User","site_admin":false},"created_at":"2016-07-22T18:06:38Z","updated_at":"2016-07-22T18:06:38Z","body":"I'd be in favor of adopting the A-F rating in 3.2 since it's familiar, widely understood and easily referenced by execs. The use case would be rating adherence to a configuration standard like the observatory or even the TLS config guidelines. \r\n\r\nI also believe we should unify the wsec- ratings in bugzilla to match these standard levels (i.e. wsec-critical becomes wsec-maximum) mentioned in 3.4 and 3.5"}}
{"actor":{"display_login":"jeffbryner"}}