Comments (3)
@konklone Can you elaborate a bit on what sort of configuration changes you'd like to make?
from concourse-compliance-testing.
For all of our sites, I'm not a fan of us using a threat model that tries to mitigate users' computers which have been owned. That's what the browser cache-related flags are about.
For static sites that have no capacity to receive or act upon user input, we should consider de-scoping some of the "security headers" flags. I think it will require more conversation than this thread to consider whether or not X-XSS-Protection
can possibly be relevant to a static site, but if it's going to come up in scans for sites which may have no way to easily remediate them (e.g. S3/CloudFront combo sites), we should try to be thoughtful.
I also requested that dap.digitalgov.gov
be given special treatment in some way when flagging third party services, since government sites are encouraged to use it and it's not as much of a "third" party as the other services it detects. Same for search.usa.gov
. It looks like the scanner already doesn't bring up Google Analytics. We should confirm that that's deliberate and that we agree with it (I do).
For some common third parties, like Google Fonts, it would be helpful to link to specific remediation examples, like this one.
In general, I think the success of these scanning efforts will be tied closely to how high-signal they are to development teams. Those doing the scanning should try to make each flagged item as relevant, justified, and easy to fix as possible.
from concourse-compliance-testing.
consider whether or not
X-XSS-Protection
can possibly be relevant to a static site
Cool, that's the kind of stuff I was looking for.
I also requested that
dap.digitalgov.gov
be given special treatment in some way when flagging third party services
👉 #76
from concourse-compliance-testing.
Related Issues (20)
- remove dependence on Team API
- add bundle install instruction to CONTRIBUTING.md
- As a user, I want my site to be automatically scanned for 508 compliance HOT 1
- consider integrating TLS/header scanning tools
- rename repository?
- As a user, I want to know the results of static analysis HOT 1
- simplify targets configuration
- shrink the pipeline HOT 1
- Move to a new CI/CD system
- Add a mechanism to support badges for projects scanned via the compliance pipeline. HOT 1
- As a user, I should be able to get email notifications instead of/in addition to slack notifications HOT 1
- Implement a continuous deployment pipeline for the compliance toolkit pipelines.
- Investigate running CodeClimate VMs via the Concourse.CI environment. HOT 2
- Add cloud.gov sites to scheduled scans HOT 1
- reduce the number of notifications to the central channel
- look into failing builds for new projects HOT 1
- coordinate with the domain-scan team
- Bug: No such file or directory - project-data/project.json
- As a user, I want to scan sites that have authentication HOT 10
- investigate using alternate scanner HOT 4
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from concourse-compliance-testing.