(blue star) Identify the owner of a repo

(blue star) Onboard or offboard a working group member

Add/remove in:

Add in (no removal necessary):

(blue star) Triage security@openedx.org emails

When you’re on-call, you must reply to emails sent to security@openedx.org.

Reply as security@openedx.com

You should receive all emails sent to security@openedx.org in your work email.

Use the Google Groups web interface to reply as

Always change the “From:” field to security@openedx.org every time.

Assign emails to responders

Assign yourself to emails:

In https://groups.google.com/a/openedx.org/g/security, click on a message, then click on the “Assign to someone” button:

Follow up

Please follow up periodically to all emails assigned to you. Why:

If you need to, handoff the email to another working group member. Don’t forget to re-assign it to them.

Close out

If the email requires no further follow up, use one of these buttons to close out a message:

What to say

Our tone: direct, professional, but kind.

Tip: Hover over the right end of the response block to see a “Copy as text” button:

See https://openedx.atlassian.net/wiki/spaces/COMM/pages/3624140816/Security+Working+Group+Private#Common-Issues & add to them!

What to do

(blue star) Forward a report to an operator or Axim

If a report applies only to a particular operator or to Axim:

  1. Find the operator’s contact information at https://openedx.atlassian.net/wiki/spaces/COMM/pages/3624140816/Security+Working+Group+Private#Contacts

  2. “Forward” report to the operator from the Google Groups web interface

    1. Click on “Reply all” at the bottom of the email thread.

    2. Change sender to “security@openedx.org”

    3. Clear Cc: field to remove reporter’s email(s)

    4. Add operator’s email to Cc: field

    5. Change the subject prefix from “Re:” to “Fwd:”

    6. Check any relevant attachments are still included.

    7. Include a blurb, like below:

      1. From: security@openedx.org
Cc: <email of operator>
Subject: Fwd: <original subject>

We received the email below and believe it be a security report specific to your Open edX instance.

We will inform the reporter that you will reach out to them if any additional information is required.

Need help, or receive this email in error? Please let us know.

Thanks,
—Security WG

    8. Post message

  3. Reply all to the reporter’s original email so the email to the operator is not included in the thread.

    1. The Reply all button should look like the above and is to the right of the header of the reporter’s original email.

    2. Check the sender is still “security@openedx.org”

    3. Click on the … at the bottom of the draft to check other emails are not included in the reply.

    4. Include a blurb, like below:

      1. From: security@openedx.org
Cc: <email of reporter>
Subject: Re: <original subject>

Thank you for your email. We have determined your report pertains to a specific Open edX operator and have forwarded your report to them. The operator will reach out to you if any further information is required.

For more information on why we provide this service, see For operators and “Guidance for Operators” in https://open-edx-proposals.readthedocs.io/en/latest/processes/oep-0060-proc-sec-group.html#guidance-for-operators.

(blue star) Respond to a security disclosure

A security disclosure is someone emailing to report a security vulnerability in Open edX software.

Our job:

(blue star) Give security advice

(blue star) Process suggestions for security improvements

In our GitHub Project:

  1. Decide whether the suggestion is worth accepting.

  2. Consider whether the suggestion can be made public.

  3. Search for existing, similar suggestions.

  4. Create or comment on the issue for the suggestion.

  5. Reply to the reporter:

  6. If a new issue, notify #wg-security:

(blue star) Map a Name to a Github Username

It’s generally useful to be able to either map real names to GitHub usernames or map GitHub user names from a catalog-info.yaml file to real names so that we can contact maintainers via other communication channels (Email, slack, Discourse, etc.)

As a security manager you will have access to this mapping of names to Github usernames.

This is privileged information and the full document should not be shared with others. You should only be using it to help triage or resolve security incidents. For all other issues, seek help from the Axim Engineering team.

  1. Go to https://github.com/openedx/openedx-webhooks-data/blob/main/salesforce-export.csv

  2. Look up the name or GitHub username.