Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-23 17:08:53 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 83

Editor pass - Handbook: Security rituals update (#5374)

Browse source 
* Editor pass - Handbook: Security rituals update

Editor pass for:  https://github.com/fleetdm/fleet/pull/5317

* Update security.md
This commit is contained in:
Desmi-Dizney 2022-04-26 16:02:05 -05:00 committed by GitHub
parent ced15c2ee3
commit 899c4de2cf
No known key found for this signature in database
GPG key ID: 4AEE18F83AFDEB23
1 changed files with 8 additions and 6 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

14
handbook/security.md
View file

@ -792,20 +792,22 @@ We use [Dependabot](https://github.com/dependabot) to create pull requests to up
We ensure the fixes to vulnerable dependencies are also performed according to our remediation timeline. We fix as many dependencies as possible in a single release.
## Security Rituals
## Rituals
The following table lists the Security group's rituals, frequency, and Directly Responsible Individual (DRI).
| Ritual | Frequency | Description | DRI |
|:-----------------------------|:-----------------------------|:----------------------------------------------------|-------------------|
| Security notifications check | Daily | Check Slack, Google, Vanta and Fleet dogfood for security related notifications. | Guillaume Ross |
| Security notifications check | Daily | Check Slack, Google, Vanta, and Fleet dogfood for security-related notifications. | Guillaume Ross |
| GitHub check | Weekly | Check GitHub security issues for anything pending analysis or prioritization. | Guillaume Ross |
| Iteration planning | Every three weeks | Prioritize issues in GitHub security project for the next iteration. | Guillaume Ross |
| Iteration planning | Every three weeks | Prioritize issues in the GitHub security project for the next iteration. | Guillaume Ross |
| YubiKey adoption | Monthly | Track YubiKey adoption in Google workspace and follow up with those that aren't using it. | Guillaume Ross |
| Dogfood policy update | Monthly | Edit Fleet dogfood policies that check for version numbers of Chrome, Docker and macOS. | Guillaume Ross |
| Security blog post | Monthly | Publish a security related blog post to Fleet's blog. | Guillaume Ross |
| Dogfood policy update | Monthly | Edit Fleet dogfood policies that check for Chrome, Docker, and macOS version numbers. | Guillaume Ross |
| Security blog post | Monthly | Publish a security-related blog post to Fleet's blog. | Guillaume Ross |
| Security lunch & learn | Monthly | Educational live stream session on cybersecurity for Fleet employees, sessions are later shared for public consumption on YouTube. | Guillaume Ross |
| MDM device enrollment | Quarterly | Provide export of MDM enrolled devices to ops team. | Guillaume Ross |
| Access revalidation | Quarterly | Review critical access groups to make sure they contain only relevant people. | Guillaume Ross |
| Snyk scan | Quarterly | Scan Fleet repo with Snyk to identify important vulnerabilities that were not identified by GitHub. | Guillaume Ross |
| Snyk scan | Quarterly | Scan Fleet repo with Snyk to identify important vulnerabilities that GitHub did not identify. | Guillaume Ross |
| Security conference review | Quarterly | Look at upcoming security conferences and work with the growth team to determine whether Fleet should submit to attend. | Guillaume Ross |
| Security policy update | Annually | Update security policies and have them approved by the CEO. | Guillaume Ross |