{"action":"created","issue":{"url":"https://api.github.com/repos/18F/nsf/issues/124","repository_url":"https://api.github.com/repos/18F/nsf","labels_url":"https://api.github.com/repos/18F/nsf/issues/124/labels{/name}","comments_url":"https://api.github.com/repos/18F/nsf/issues/124/comments","events_url":"https://api.github.com/repos/18F/nsf/issues/124/events","html_url":"https://github.com/18F/nsf/issues/124","id":292868587,"number":124,"title":"Complete the SSR for the ATO.","user":{"login":"OpenGlobe","id":5495118,"avatar_url":"https://avatars0.githubusercontent.com/u/5495118?v=4","gravatar_id":"","url":"https://api.github.com/users/OpenGlobe","html_url":"https://github.com/OpenGlobe","followers_url":"https://api.github.com/users/OpenGlobe/followers","following_url":"https://api.github.com/users/OpenGlobe/following{/other_user}","gists_url":"https://api.github.com/users/OpenGlobe/gists{/gist_id}","starred_url":"https://api.github.com/users/OpenGlobe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OpenGlobe/subscriptions","organizations_url":"https://api.github.com/users/OpenGlobe/orgs","repos_url":"https://api.github.com/users/OpenGlobe/repos","events_url":"https://api.github.com/users/OpenGlobe/events{/privacy}","received_events_url":"https://api.github.com/users/OpenGlobe/received_events","type":"User","site_admin":false},"labels":[{"id":807941149,"url":"https://api.github.com/repos/18F/nsf/labels/Sprint%2014:%20Beta","name":"Sprint 14: Beta","color":"70566D","default":false},{"id":654856694,"url":"https://api.github.com/repos/18F/nsf/labels/product","name":"product","color":"92a8d1","default":false}],"state":"open","locked":false,"assignee":{"login":"cmc333333","id":326918,"avatar_url":"https://avatars2.githubusercontent.com/u/326918?v=4","gravatar_id":"","url":"https://api.github.com/users/cmc333333","html_url":"https://github.com/cmc333333","followers_url":"https://api.github.com/users/cmc333333/followers","following_url":"https://api.github.com/users/cmc333333/following{/other_user}","gists_url":"https://api.github.com/users/cmc333333/gists{/gist_id}","starred_url":"https://api.github.com/users/cmc333333/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmc333333/subscriptions","organizations_url":"https://api.github.com/users/cmc333333/orgs","repos_url":"https://api.github.com/users/cmc333333/repos","events_url":"https://api.github.com/users/cmc333333/events{/privacy}","received_events_url":"https://api.github.com/users/cmc333333/received_events","type":"User","site_admin":false},"assignees":[{"login":"cmc333333","id":326918,"avatar_url":"https://avatars2.githubusercontent.com/u/326918?v=4","gravatar_id":"","url":"https://api.github.com/users/cmc333333","html_url":"https://github.com/cmc333333","followers_url":"https://api.github.com/users/cmc333333/followers","following_url":"https://api.github.com/users/cmc333333/following{/other_user}","gists_url":"https://api.github.com/users/cmc333333/gists{/gist_id}","starred_url":"https://api.github.com/users/cmc333333/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmc333333/subscriptions","organizations_url":"https://api.github.com/users/cmc333333/orgs","repos_url":"https://api.github.com/users/cmc333333/repos","events_url":"https://api.github.com/users/cmc333333/events{/privacy}","received_events_url":"https://api.github.com/users/cmc333333/received_events","type":"User","site_admin":false},{"login":"fureigh","id":1244599,"avatar_url":"https://avatars2.githubusercontent.com/u/1244599?v=4","gravatar_id":"","url":"https://api.github.com/users/fureigh","html_url":"https://github.com/fureigh","followers_url":"https://api.github.com/users/fureigh/followers","following_url":"https://api.github.com/users/fureigh/following{/other_user}","gists_url":"https://api.github.com/users/fureigh/gists{/gist_id}","starred_url":"https://api.github.com/users/fureigh/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/fureigh/subscriptions","organizations_url":"https://api.github.com/users/fureigh/orgs","repos_url":"https://api.github.com/users/fureigh/repos","events_url":"https://api.github.com/users/fureigh/events{/privacy}","received_events_url":"https://api.github.com/users/fureigh/received_events","type":"User","site_admin":false},{"login":"OpenGlobe","id":5495118,"avatar_url":"https://avatars0.githubusercontent.com/u/5495118?v=4","gravatar_id":"","url":"https://api.github.com/users/OpenGlobe","html_url":"https://github.com/OpenGlobe","followers_url":"https://api.github.com/users/OpenGlobe/followers","following_url":"https://api.github.com/users/OpenGlobe/following{/other_user}","gists_url":"https://api.github.com/users/OpenGlobe/gists{/gist_id}","starred_url":"https://api.github.com/users/OpenGlobe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OpenGlobe/subscriptions","organizations_url":"https://api.github.com/users/OpenGlobe/orgs","repos_url":"https://api.github.com/users/OpenGlobe/repos","events_url":"https://api.github.com/users/OpenGlobe/events{/privacy}","received_events_url":"https://api.github.com/users/OpenGlobe/received_events","type":"User","site_admin":false},{"login":"mtboesch","id":31212633,"avatar_url":"https://avatars3.githubusercontent.com/u/31212633?v=4","gravatar_id":"","url":"https://api.github.com/users/mtboesch","html_url":"https://github.com/mtboesch","followers_url":"https://api.github.com/users/mtboesch/followers","following_url":"https://api.github.com/users/mtboesch/following{/other_user}","gists_url":"https://api.github.com/users/mtboesch/gists{/gist_id}","starred_url":"https://api.github.com/users/mtboesch/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mtboesch/subscriptions","organizations_url":"https://api.github.com/users/mtboesch/orgs","repos_url":"https://api.github.com/users/mtboesch/repos","events_url":"https://api.github.com/users/mtboesch/events{/privacy}","received_events_url":"https://api.github.com/users/mtboesch/received_events","type":"User","site_admin":false},{"login":"trinehar","id":31217327,"avatar_url":"https://avatars1.githubusercontent.com/u/31217327?v=4","gravatar_id":"","url":"https://api.github.com/users/trinehar","html_url":"https://github.com/trinehar","followers_url":"https://api.github.com/users/trinehar/followers","following_url":"https://api.github.com/users/trinehar/following{/other_user}","gists_url":"https://api.github.com/users/trinehar/gists{/gist_id}","starred_url":"https://api.github.com/users/trinehar/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/trinehar/subscriptions","organizations_url":"https://api.github.com/users/trinehar/orgs","repos_url":"https://api.github.com/users/trinehar/repos","events_url":"https://api.github.com/users/trinehar/events{/privacy}","received_events_url":"https://api.github.com/users/trinehar/received_events","type":"User","site_admin":false}],"milestone":{"url":"https://api.github.com/repos/18F/nsf/milestones/15","html_url":"https://github.com/18F/nsf/milestone/15","labels_url":"https://api.github.com/repos/18F/nsf/milestones/15/labels","id":3145123,"number":15,"title":"Sprint 14: Beta","description":"Sprint 14: Beta","creator":{"login":"OpenGlobe","id":5495118,"avatar_url":"https://avatars0.githubusercontent.com/u/5495118?v=4","gravatar_id":"","url":"https://api.github.com/users/OpenGlobe","html_url":"https://github.com/OpenGlobe","followers_url":"https://api.github.com/users/OpenGlobe/followers","following_url":"https://api.github.com/users/OpenGlobe/following{/other_user}","gists_url":"https://api.github.com/users/OpenGlobe/gists{/gist_id}","starred_url":"https://api.github.com/users/OpenGlobe/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/OpenGlobe/subscriptions","organizations_url":"https://api.github.com/users/OpenGlobe/orgs","repos_url":"https://api.github.com/users/OpenGlobe/repos","events_url":"https://api.github.com/users/OpenGlobe/events{/privacy}","received_events_url":"https://api.github.com/users/OpenGlobe/received_events","type":"User","site_admin":false},"open_issues":12,"closed_issues":0,"state":"open","created_at":"2018-02-26T20:03:28Z","updated_at":"2018-02-27T20:00:03Z","due_on":"2018-03-11T08:00:00Z","closed_at":null},"comments":8,"created_at":"2018-01-30T17:24:31Z","updated_at":"2018-03-07T19:50:20Z","closed_at":null,"author_association":"MEMBER","body":"We need to complete the System Security Review (SSR) document for the ATO.  The following are items to be included in the SSR along with tentative assignments (to be discussed further).\r\n\r\n- [ ] PIA updated (Theresa)\r\n- [ ] We need the review/approval workflow processes documented, as well as the process for assigning permissions to the workflow. - Fureigh/18F\r\n- [ ] We need the auditable events documented and understand where/how the events are recorded (what is recorded and where and how do we access the information if needed, and who can access that information).  - Fureigh/18F\r\n- [ ] We need the type of users and user privileges documented.  - Fureigh/18F, DAS\r\n- [ ] We need the data flow documented by describing the flow of data in and out of system boundaries and creating a data flow diagram. This should include protections implemented at all entry and exit points in the data flow as well as internal controls between different user types. - Matt, DIS - maybe some input from Fureigh\r\n- [ ] We need to detail how accounts are created in beta.nsf.gov.  How a user authenticates to beta.nsf.gov (probably through NSF ADFS or OpenAM services).  How users are assigned roles and/or permissions in beta.nsf.gov.  How is it determined which users get which roles (approval process for granting roles). -  Fureigh/18F, Matt\r\n- [ ] We need to document the systems configuration management process, including the change management process, inventory control, baseline configuration, and unauthorized change detection.\r\n- [ ] We need to document the system’s contingency plan and disaster recovery plan, including the system backup and recovery procedures, as well as describing how backup information is stored, transmitted, and protected. - Fureigh/18F, cloud.gov\r\n- [ ] We need to document the system’s incident response plan and procedures. - Fureigh/18F, cloud.gov, Matt, DIS\r\n- [ ] We need to document the system’s communication protection mechanisms including any use of cryptography. - Fureigh/18F, Matt, DIS\r\n- [ ] We need to document the system’s patch and vulnerability management procedures. How fast do patches need to be implemented? - Fureigh/18F, Matt, DIS\r\n- [ ] We need to complete a network architecture diagram - Matt, DIS - maybe some input from Fureigh\r\n\r\n\r\n\r\nDocuments for reference include the **QA docs** and the **MVP scoping document**\r\n"},"comment":{"url":"https://api.github.com/repos/18F/nsf/issues/comments/371262420","html_url":"https://github.com/18F/nsf/issues/124#issuecomment-371262420","issue_url":"https://api.github.com/repos/18F/nsf/issues/124","id":371262420,"user":{"login":"cmc333333","id":326918,"avatar_url":"https://avatars2.githubusercontent.com/u/326918?v=4","gravatar_id":"","url":"https://api.github.com/users/cmc333333","html_url":"https://github.com/cmc333333","followers_url":"https://api.github.com/users/cmc333333/followers","following_url":"https://api.github.com/users/cmc333333/following{/other_user}","gists_url":"https://api.github.com/users/cmc333333/gists{/gist_id}","starred_url":"https://api.github.com/users/cmc333333/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/cmc333333/subscriptions","organizations_url":"https://api.github.com/users/cmc333333/orgs","repos_url":"https://api.github.com/users/cmc333333/repos","events_url":"https://api.github.com/users/cmc333333/events{/privacy}","received_events_url":"https://api.github.com/users/cmc333333/received_events","type":"User","site_admin":false},"created_at":"2018-03-07T19:50:20Z","updated_at":"2018-03-07T19:50:20Z","author_association":"MEMBER","body":"## Contingency Planning\r\nAs a first layer of defense, our system architecture requires a minimum of two running instances of the Drupal application. This aids load balancing, but also ensures that if one instance is down, traffic is routed to the second. Cloud.gov detects application crashes (as indicated by a dead primary process), and will automatically restart the crashed app. Combined, this significantly reduces the amount of downtime due to system errors. For a given deployment, application code and configuration are stored securely within cloud.gov, allowing these system restarts to be completely automated.\r\n\r\nThe codebase and system configuration (including change history) is stored within an authoritative GitHub repository, which ensures the application can be rebuilt from scratch if necessary. Due to the distributed nature of git, each site developer also maintains a copy of the repository's history, accounting for an additional safety net, should GitHub be unavailable. This source code is all publicly accessible, removing the need for additional protections.\r\n\r\nThe database (which stores content, users, their permissions) is an instance of Amazon Web Services' [Relational Database Service](https://aws.amazon.com/rds/) via cloud.gov. It is configured to store an encrypted, [daily snapshot](https://cloud.gov/docs/services/relational-database/#backups) retrievable by the cloud.gov team. So long as they're informed of a sudden, catastrophic error (e.g. accidentally dropping an important table), they can restore from the most recent backup. We do not currently have policies around long-term data retention.\r\n\r\n### Warnings (Internal)\r\n* Not having a long term backup strategy may be an issue. We might be able to mitigate it by describing how the content can be easily re-imported from other sources.\r\n\r\n### TODOs (Internal)\r\n* [ ] Ensure instance count is 2+"}}
{"actor":{"display_login":"cmc333333"}}