Pending Tasks for Production

[villanueval]

To do in DEV:

• Remediate issues detected by accessibility scan (Accessibility Scan #43)
• Remediate issues detected by device vulnerability scan (Nexpose)
• Remediate issues detected by web vulnerability scan (Qualys; Request RITM0135889)
• Update Tech Store

Setup Production:

• Deliver high-level diagram
• Setup Archer package (Request RITM0135942)
• Get and mount NFS share for image previews
• Request VM's
• Access VM's
• Request prod db
• Setup httpd, Python env, load balancer
• Install and run Osprey using PROD db
• Setup TLS 1.2 Cert

Finishing PROD of Internal Instance:

• Add to Web Site Listing table
• Setup DNS for URL

Finishing External (Public) Instance:

• Use stats of Internal to plan and tweak config
• Request VM's
• Access VM's
• Setup httpd, Python env, load balancer
• Install and run Osprey
• Setup TLS 1.2 Cert
• Add to Web Site Listing table
• Setup DNS for URL

[villanueval]

Updated since Archer is a binder of info, not a security scan.

[villanueval]

Had to create new VM requests, one per server. Fortunately, it was already approved by the CCB.

[villanueval]

Qualys found a level 2 issue:

• Cookie Does Not Contain The "secure" Attribute - https://cwe.mitre.org/data/definitions/614.html

Fixed in dfcffe2

[villanueval]

Vuln Scan found URL issues, I think mostly caused by the way Flask is handling arguments.

[villanueval]

No ETA provided yet for Archer package.