Security/SOP/Application Security Reviews

Review Required by: 12th February 2020

Purpose
The purpose of this Standard Operation Procedure (hereinafter referred to as SOP) is to document the requirements for individuals in need of a pre-deployment security code review.

Procedure
PROCESS

Before a security-critical feature, extension, service, or library is deployed by the WMF, it needs a security review by the Security Team. Additionally, third-party systems where confidential data is stored should have a security review as well.

Typically, WMF teams or individual MediaWiki developers embarking on a new project should plan to have 2 or 3 check ins with the Security Team.

Concept review (optional)

When considering a new project, if there is any doubt that the feature might not be a good idea for security, or might negatively impact user privacy, you can optionally consult with the Security Team during the Concept phase of your project. Typically emailing the description of your project to the Security Team (security-team@wikimedia.org), or a 30 minute meeting with a team member, is enough to identify any potentially serious issues.

As an example, consider an extension that would allow users to include 's in wikipages, to embed content from other sites. This would be a concept that would be inappropriate for Wikimedia, as it would allow leaking user IP addresses to third parties, in violation of our Privacy Policy. Having a concept review before any work is done on the extension would prevent wasted effort on an idea that is not-workable in the context of Wikimedia.

Design review (optional)

When you have completed enough planning for your project to know broadly which systems will be involved, what data will be handled by your project, and what new services or endpoints users will interact with, then you should have a design review with the Security Team. This review is to ensure that you have controls in place to address specific threats, based on your architecture. During this review (or the optional Concept review), the Security Team can also suggest way to reduce the attack surface for your project, which will reduce the security requirements for your project.

Typically, this is a 60 minutes meeting between the technical or architectural leads for the project, and a member of the Security Team.

Although this review is optional, doing it allows issues to be identified early in the project, instead of at the end of the project.

 Security review for deployment (mandatory) 

Projects must have a "Security Readiness Review" task in Phabricator documenting that they have performed a pre-deployment security code review, and addressed any blockers, before they can deploy a new extension or major feature.

This review will ensure that controls identified in the design review have been implemented. Additionally, the Security Team will attempt to ensure that the project avoids common implementation flaws.

There are three possible results of this review:


 * 1) No issues found, extension can be deployed (provided other requirements at Review queue are met). (Example: T148583)
 * 2) Only minor issues found, or any major issues found are straightforward fixes. Extension can be deployed once the found issues are fixed. (Example: T149808)
 * 3) Major or complex security issues found. Once the identified issues are fixed, the extension will have to be re-reviewed. (Example: T133408)

Expectations

 * All code should avoid the top 25 CWEs, and comply with the requirements of Security for developers/Architecture.


 * Libraries should encourage safe practices by the developers who use them, or clearly document when misuse can result in a security flaw.
 * Services should use a standard framework or service template.
 * External applications (services, or applications such as media conversion utilities) used by the code should not have known, open security issues. The application should be supported by a competent security program.
 * For external application or libraries, a WMF team must be committed to being alerted about and fixing any security issues that are fixed by the upstream developers.
 * The people developing the code have already reviewed it, and believe it to be secure. See also Wikimedia Security Team/Security reviews/What we are looking for

REVIEW PROCESS


 * 1) At least 30 days prior to the estimated deployment date, the requester creates a Phabricator Task using the Security Readiness Review request form.
 * 2) Weekly, the Security Coordinator reviews Requests.
 * 3) The Security Readiness Review request MUST include the following information (as templated within the request form):
 * 4) Name of tool/project
 * 5) Description of the tool/project
 * 6) Description of how the tool will be used at WMF
 * 7) Name of individual/group requesting review and primary contact
 * 8) Name of individual/group responsible for tool/project after deployment and primary contact
 * 9) Target date for deployment (or approximate date deployed if already in production or labs)
 * 10) Information from any review of the tool that has already been conducted
 * 11) Working test environment
 * 12) Programming language(s) used
 * 13) Source code repository location
 * 14) Upstream project home page (if applicable)
 * 15) WMF project home page (if applicable)
 * 16) Related Phabricator tickets
 * 17) Related patch set(s)
 * 18) Security Coordinator checks that the task is at least 30 days prior to deployment date or declines the Task.
 * 19) Security Coordinator checks that Task has ALL required information or holds the Task for 3 days awaiting information.
 * 20) If the task meets the requirements within items (4) and (5), then the Security Coordinator approves the Task, assigns it to a Security Team Engineer and places the the task within the “In Progress” queue.
 * 21) See the #Security-Teams Readiness Reviews workboard for currently planned reviews.
 * 22) The “In Progress” queue reflects all active Security Readiness Reviews.  These tasks typically have target completion dates of two to four weeks.
 * 23) A Security Team Engineer will review the task and if approved, will comment on the task and update the task as resolved, if neccessary.
 * 24) If your project is not on the schedule and you believe it should be, or if you have any questions about the Security Teams Readiness Review process, please ([mailto:security-team@wikimedia.org contact the Security Team]) as soon as possible.
 * 25) If your task is reviewed by the Security Team Engineer and requires action on your part, the task will be placed in the Waiting on Response/Mitigation queue.  The task may reside there for no more than 30 days.
 * 26) If the Security Team Engineer has not received a response within 30 days for the above, the task will be moved to the Frozen column.
 * 27) Tasks that have been on the Frozen column for more than 180 days will be removed from the Security-Team-Reviews project.

ESCALATIONS

If the task is not submitted at least 30 days in advance of the deployment date, and the User requests escalation, the Director of Security will review.