Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update SECURITY.md #3440

Merged
merged 2 commits into from
Mar 21, 2024
+3 −7
Merged

Update SECURITY.md #3440

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
5c3a5d8
Update SECURITY.md
achalker Mar 21, 2024
d5e0aeb
Update SECURITY.md
achalker Mar 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 3 additions & 7 deletions SECURITY.md
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
# Security Policy

This document outlines security procedures and general policies for the `OnDemand`
This document outlines security procedures and general policies for the `Open OnDemand`
project.

## Reporting a Vulnerability
Expand All @@ -26,12 +26,8 @@ involving the following steps:
## Comments on this Policy

If you have suggestions on how this process could be improved please submit
a ticket, open a [Discorse](https://discourse.osc.edu/) topic or open a pull request.
a ticket, open a [Discourse](https://discourse.openondemand.org/) topic or open a pull request.

## Security Audits

[Trusted CI](https://trustedci.org/), the NSF Cybersecurity Center of
Excellence, conducted an in-depth vulnerability assessment of Open OnDemand, completing
it in December 2018. This assessment included a careful review of the code, increasing
our confidence in its security. The Ohio Supercomputing Center addressed the implementation
issues (bugs) that were found during this review, producing a more robust revision of Open OnDemand.
The Open OnDemand core development team has had several engagements with [Trusted CI](https://trustedci.org/), the NSF Cybersecurity Center of Excellence. The first engagement was in 2018, during which Trusted CI conducted an in-depth vulnerability assessment and identified a few implementation issues that the Open OnDemand developers subsequently addressed. [A report of that 2018 engagement is available here.](https://openondemand.org/trustedci-2018) The next engagement was in early 2021 and had three objectives: (1) integrate security automation into DevOps flows; (2) transfer skills for vulnerability assessments; and (3) develop needed security policies, practices, and procedures. [A report of that 2021 engagement is available here.](https://openondemand.org/trustedci)
Loading