Product Lead
Engineering Leads | |
Contributors |
Objective
Due date |
| ||||||||||||||||||||||||||||||||||
Objective | More robust out-of-the-box security for the O3 RefApp. | ||||||||||||||||||||||||||||||||||
Key outcomes |
|
\uD83E\uDD14 Problem Statement
Whereas CyberSecurity audits and authentication details have historically been handled by implementations one-by-one;
We want to be sure that the O3 RefApp has had a robust central effort to review and enhance it’s security
So that this out-of-the-box offering when globally scaled has no substantial weaknesses - especially in the context of a rise in cloud hosting.
\uD83D\uDEA9 Milestones and deadlines
\uD83D\uDEA9 Milestones and deadlines
...
Milestone
...
Owner
...
Deadline
...
Status
...
Milestone | Owner | Deadline | Status | Notes and Links | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
|
| Provided by UnderDefense (after public RFA and extensive vendor review). Preliminary report received. Grade was a “C”, OWASP 7/10. | ||||||||
|
|
| Only for approved OpenMRS Security Group/squad members. https://docs.google.com/spreadsheets/d/12os55e_sDzzCmwm_lJWt7atqPABqq94LCwLOrApr8v4/edit?usp=sharing | |||||||
|
(Aug 14 for UnderDefense to complete remediation testing) |
| Update as of July 31: High and Medium issues almost completed. Most of what remains are Low. | |||||||
|
|
|
|
Unresolved vulnerabilities available through Security Group on Talk + publicly reported on GitHub | ||||||
| IntelliSOFT Consulting Ltd. |
|
|
|
\uD83E\uDD14 Problem Statement
🎯 Scope
...
Must have:
...
Nice to have:
...
Not in scope:
\uD83D\uDDD3 Timeline
...
| See sample guides listed under: https://openmrs.atlassian.net/wiki/x/Sr2EAQ |