Org Web Adapter

Editing journals/2022_01_13.org

:PROPERTIES:
:ID:       5eca1070-5f77-49cd-9b46-6bde7ba798e1
:END:
#+title: 2022-01-13 - Thursday

* 15Five
** DONE [[id:4ac33fca-9389-4fee-9ab2-d7337628c7da][ENG-17655 - Add Compright as new partner app in production]] :15five:engineering:
CLOSED: [2022-01-14 Fri 01:29]

https://15five-dev.atlassian.net/browse/ENG-17655

** DONE Security tech interview with [[id:9123ac00-7101-4dd6-9b94-595b73fc125b][Piotr Siemieniak]] [0/3]
CLOSED: [2022-01-14 Fri 01:29]

First exercise is the Secure Code Review:

- [ ] Primary problem? No data validation
  - No validation, iterate over key value pairs of any data passed in
  - What are requirements for this endpoint?
  - One type of cookie to iterate, multiple?
  - Use a whitelist to define which of those should be editable
  - Need that type of validation in the first place
  - Secondly, what are you updating the session key and value with?
  - Risk we can over-write value sessions with random values
  - Big, big issue cause we can delete keys as well
  - Could take over someones session using this endpoint
  - Django, set_session function may be usable
  - Safest solution is not to write this at all, do it in JS
  - Described situation with Joao where auto-file removal after specific time
  - Setup script running and removing files, problematic b/c it could fail in many scnearios
  - Files are stored in S3, S3 api can be removed using expiry dates
- [ ] Possible solutions?
- [ ] General feedback?
  - No permissions
  - Assumed DRF, could consider a PATCH/PUT
  - Not as important from security view point
  - Second permission decorator, not enough validation, only checking for auth
  - No ownership of specific session, would require adding something like IsSessionOwner

Second exercise on security architecture:

- Simple web app, but constructed with both customer and support engineer with easy access
  - Most problematic risk is directly quering the primary database
  - Need to ensure that DB is read-only, limited permission
  - Put limitations on tables as well
  - Worked with FTSE companies, disclosing financial data before public announcement could be criminal
  - Second issue, everything under one subnet
  - No network separation between web app and admin web app can use same network
  - Access same database as well
  - Consider splitting two services into different subnets
  - So we can reduce the risk of sharing vulnerability of the web app and database
  - If a service is forgotten and not updated, bugs could be shared and that creates a bridge to other environment
  - Single EC2 instance, load balancer should be working with multiple EC2s so we can keep stability
  - High load could be something that causes instability in a shared subnet
  - Third, need read-replicas for database to handle admin access, limited write-access
  - This could use a completely different database
  - Support engineer should not access web app in same way as custoemr
  - Setup limited VPC connection so admin app would be in safe subnet
  - Customers can access via specific addresses
  - For many years, instagram had open admin panel (django) to the public
  - Fourth: Worker system processes freshly updated imports
  - Have a clear pipeline of various workers
  - Keep a data management pipeline so it's not easy to break the chain of file processing
  - Worker overload, different queues for different type of tasks
  - Allow clear failure with automated recovery or notification to avoid needing deep knowledge of data and process to debug
  - AWS has rich permissions for S3, use access permission
  - Client to collect logs and put them via encrypted connection to storage
  - SIM or log aggregation which gateways should be allowed to send logs to the receiver
  - Define internal gateways to narrow scope of where data can be sent
  - We need to define how much we expect to generate and what sort of data
  - TTL for document access
  - Could consider situation where financial data could be protected even more
  - Links could be asccessible only after logging in to the web app with 2FA
  - Link should go through the web app panel to click again to get the limited TTL encrypted links to validate user access
  - Customer set file passwords to limit internal employee visibility
  - Microsoft offers Azure information protection, encrypt file
  - No info about managing secrets or certificates from diagram, may need to add automated cert rotation, generating and establishment
  - Could add different types of auditing and alerting systems
  - Love the call out about potentially criminal liability for failure to secure financial data
  - DDOS solutiosn like cloudflare or AWS Sheild are missing as well
  - Automated anti-virus for malicious files?
  - Consider requiring SSO for support engineers and/or customers for better auth security
  - Scale and budget limits how secure you can make it
  - Scale brings ddifferent threats
<2022-01-13 Thu>

* Personal
* Timeline