1515171 - Security checklist for minions-managed

Status: NEW

(Infrastructure & Operations :: RelOps: General, task)

Description

[AJ Bahnken [:ajvb] (she/her)]

Hey all, here is a slimmed down version of SecOps's security checklist (https://wiki.mozilla.org/Security/FirefoxOperations#Security_Checklist).

Please let me know if you have any questions.



# Infrastructure

* [ ] Use Modern (https://wiki.mozilla.org/Security/Server_Side_TLS#Modern_compatibility) or Intermediate (https://wiki.mozilla.org/Security/Server_Side_TLS#Intermediate_compatibility) TLS
* [ ] Set HSTS to 31536000 (1 year)
  * `strict-transport-security: max-age=31536000`


# Development

* [ ] enable security scanning of 3rd-party libraries and dependencies
  * For node.js, use npm audit (https://docs.npmjs.com/cli/audit) with audit-filter (https://github.com/mozilla-services/audit-filter) to review and handle exceptions (see example in speech-proxy (https://github.com/mozilla/speech-proxy/pull/77/files#diff-b9cfc7f2cdf78a7f4b91a753d10865a2))
* [ ] Keep 3rd-party libraries up to date (in addition to the security updates)
  * For NodeJS applications, use dependabot (https://dependabot.com/), renovate (https://renovateapp.com/), or GreenKeeper (https://greenkeeper.io/)


# Web Applications

* [ ] Must have a CSP with
  * [ ] a report-uri pointing to the service's own `/__cspreport__` endpoint
  * [ ] web API responses should return `default-src 'none'; frame-ancestors 'none'; base-uri 'none'; report-uri /__cspreport__` to disallowing all content rendering, framing, and report violations
  * [ ] if default-src is not `none`, frame-src, and object-src should be `none` or only allow specific origins
  * [ ] no use of unsafe-inline or unsafe-eval in script-src, style-src, and img-src
* [ ] Third-party javascript must be pinned to specific versions using Subresource Integrity (SRI) (https://infosec.mozilla.org/guidelines/web_security#subresource-integrity)
* [ ] Web APIs must set a non-HTML content-type on all responses, including 300s, 400s and 500s
* [ ] Make sure your application gets an A+ on the Mozilla Observatory (https://observatory.mozilla.org/)


# Databases

* [ ] All SQL queries must be parameterized, not concatenated
* [ ] Applications must use accounts with limited GRANTS when connecting to databases
  * In particular, applications **must not use admin or owner accounts**, to decrease the impact of a sql injection vulnerability.


# Common issues

* [ ] User data must be escaped for the right context (https://www.owasp.org/index.php/XSS_(Cross_Site_Scripting)_Prevention_Cheat_Sheet#XSS_Prevention_Rules_Summary) prior to reflecting it
  * When inserting user generated html into an html context:
    * Javascript applications should use [DOMPurify](https://github.com/cure53/DOMPurify/)
* [ ] Apply sensible limits to user inputs, see input validation (https://wiki.mozilla.org/WebAppSec/Secure_Coding_Guidelines#Input_Validation)
  * POST body size should be small (<500kB) unless explicitly needed
* [ ] Do not use `target="_blank"` in external links unless you also use `rel="noopener noreferrer"` (to prevent Reverse Tabnabbing (https://www.owasp.org/index.php/Reverse_Tabnabbing))

Comment 1

[ablew]

Does this still run? If not please close.