Security/SOP/Security Preview

Review Required by: 7th January 2021

Purpose
When considering a new project, if there is any doubt that the feature might not be a good idea for security, or might negatively impact user privacy, you can optionally consult with the Security Team during the Concept phase of your project.

Document the requirements for individuals/teams in need of a planning, external product security capability, or otherwise conceptual or product use in the conceptual and planning phase.

Examples:
 * We want to use AWS Mechanical Turk and want the Security Team's input on our plan
 * We want to use a third party product key management solution and need assistance understanding how it works and what the implications are for data leakage/confidentiality
 * We

Process
Please create a Security Concept Review request within Phabricator.

As an example, consider an extension that would allow users to include 's in wiki pages, to embed content from other sites. This would be a concept that would be inappropriate for Wikimedia, as it would allow leaking user IP addresses to third parties, in violation of our Privacy Policy. Having a Concept Review before any work is done on the extension would prevent wasted effort on an idea that is not workable within the context of Wikimedia.

Towards the conclusion of the Concept Review, the Security Team will work to ensure that you will have sufficient controls in place to address specific threats based upon your architecture. The Security Team may also suggest additional ways to reduce the attack surface for your project.

Finally, although the Concept Review is optional, performing one allows issues to be identified early on in a project's lifecycle, which is vastly preferable to discovering serious issues mere days or hours before (or after) a scheduled deployment.

Review process

 * 1) See the #Security-Concept-Review workboard for currently planned reviews.
 * 2) The “In Progress” queue reflects all active Security Concept Reviews.
 * 3) If your request is not on the schedule and you believe it should be, or if you have any questions about the Security Teams Concept Review process, please (contact the Security Team) as soon as possible.