Security Playbooks – for Security WG members

Complete: You did work on the message, even if it was only investigation.
Duplicate: The message is entirely covered by another message.
- Google Groups will ask you for the URL of original message. Fill it in.
No Action Needed: The message is frivolous, spam, or frivolous spam.

What to say

Our tone: direct, professional, but kind.

Tip: Hover over the right end of the response block to see a “Copy as text” button:

The “Copy as text” button

See https://openedx.atlassian.net/wiki/spaces/COMM/pages/3624140816/Security+Working+Group+Private#Common-Issues & add to them!

Acknowledge the email quickly:
- Thank you for your email. We will investigate.
Common inquiries & template responses:
- Duplicates:
  - Thank you for your report. This is a duplicate of an earlier report that we are reviewing.
- No update yet:
  - Hello, We are continuing to investigate this report and will reach out to you when we have reached a resolution. Thank you.
- Need proof of concept:
  - Hello, Would you be able to provide a proof of concept for the vulnerability? Thank you.
- Confirm correct destination:
  - Hello, Thank you for reaching out. This e-mail address is the correct place to report any security issues you may have found. The Open edX project does not offer bug bounties for security vulnerability disclosures. See: https://github.com/openedx/edx-platform/security/policy#bug-bounty Thank you.
- Bug bounty:
  - The Open edX project does not offer bug bounties for security vulnerability disclosures. See: https://github.com/openedx/edx-platform/security/policy#bug-bounty
Inapplicable reports/inquires
- Intentionally open source:
  - Thank you for this report. Open edX is an open-source platform; many of our features are developed in the open and collaboratively with community developers. If you would be interested in contributing, you can learn more at https://open.edx.org/community/
Close out the email thread.
- Forwarded to an operator or Axim:
  - Thank you for your email. We have determined your report pertains to a specific Open edX operator and have forwarded your report to them. The operator will reach out to you if any further information is required.
  - Re-send this email if the reporter continues to inquire about the operator’s contact information.
  - See Forward a report to an operator or Axim, below.
- Not a security issue:
  - Thank you for the disclosure. We have investigated this and do not believe it is a security issue that needs to be addressed at this time.
- Verified vulnerability:
  - Hello, Thank you for your patience. We are resolving the security vulnerability reported by your disclosure. The Open edX Project does not offer monetary bug bounties for security disclosures. Thank you again for your disclosure.

What to do

status:under construction

Forward a report to an operator or Axim

If a report applies only to a particular operator or to Axim:

Find the operator’s contact information at https://openedx.atlassian.net/wiki/spaces/COMM/pages/3624140816/Security+Working+Group+Private#Contacts
“Forward” report to the operator from the Google Groups web interface
1. Click on “Reply all” at the bottom of the email thread.
2. Change sender to “security@openedx.org”
3. Clear Cc: field to remove reporter’s email(s)
4. Add operator’s email to Cc: field
5. Change the subject prefix from “Re:” to “Fwd:”
6. Check any relevant attachments are still included.
7. Include a blurb, like below:
  1. From: security@openedx.org Cc: <email of operator> Subject: Fwd: <original subject> We received the email below and believe it be a security report specific to your Open edX instance. We will inform the reporter that you will reach out to them if any additional information is required. Need help, or receive this email in error? Please let us know. Thanks, —Security WG
8. Post message
Reply all to the reporter’s original email so the email to the operator is not included in the thread.
1. The Reply all button should look like the above and is to the right of the header of the reporter’s original email.
2. Check the sender is still “security@openedx.org”
3. Click on the … at the bottom of the draft to check other emails are not included in the reply.
4. Include a blurb, like below:
  1. From: security@openedx.org Cc: <email of reporter> Subject: Re: <original subject> Thank you for your email. We have determined your report pertains to a specific Open edX operator and have forwarded your report to them. The operator will reach out to you if any further information is required.

For more information on why we provide this service, see For operators and “Guidance for Operators” in OEP-60 Open Source Security Working Group — Open edX Proposals 1.0 documentation.

Respond to a security disclosure

A security disclosure is someone emailing to report a security vulnerability in Open edX software.

Our job:

Verify a security vulnerability exists
Find who owns the code
- Playbook: 🔍 Identify the owner of a repo
Create a GitHub Security Advisory (GHSA) for the affected repositories
- Creating a repository security advisory - GitHub Docs
- Add: Title, Description, Ecosystem, and use CVSS Calculator
  - Ecosystem: npm or pip if applicable, otherwise None
- Add the owners/team of the repo to the GitHub Security Advisory:
  - Adding a collaborator to a repository security advisory - GitHub Docs
  - https://github.com/orgs/openedx/teams
Share link to draft security advisory to #wg-security-private & get a thumb
Email the maintainer:
- Send from Google Groups:
  - Click on “New conversation”:
  - You should see a box like this pop up:
- Include the severity rating (low, medium, high, or critical) provided by the CVSS calculator on the GitHub Security Advisory.
- Template:
  From: security@openedx.org Cc: <email of maintainers> Subject: New security vulnerability in <repository>: <name of GHSA> (<Low/Medium/High/Critical>) There is a new security vulnerability in <repository>: <URL to GHSA> It has a draft severity rating of "<Low/Medium/High/Critical>". Need help? Please let us know, or consult: https://openedx.atlassian.net/wiki/spaces/COMM/pages/3630923873/For+maintainers Thanks, —Security WG

Give security advice

status:under construction

Process suggestions for security improvements

In our GitHub Project:

Decide whether the suggestion is worth accepting.
- If in doubt, create a ticket titled “Discuss […]”
Consider whether the suggestion can be made public.
- If not, raise in #wg-security-private for next steps.
Search for existing, similar suggestions.
Create or comment on the issue for the suggestion.
- Add a link to the Google Groups message
- To add an issue:
  - Select “Convert to issue” and add the issue to the wg-security repo. [GitHub docs]
Reply to the reporter:
- We have added your suggestion to our project board: <URL to issue or comment> Thank you for helping keep Open edX secure.
If a new issue, notify #wg-security:
- [new issue] <URL to issue>

Map a Name to a Github Username

It’s generally useful to be able to either map real names to GitHub usernames or map GitHub user names from a catalog-info.yaml file to real names so that we can contact maintainers via other communication channels (Email, slack, Discourse, etc.)

As a security manager you will have access to this mapping of names to Github usernames.

This is privileged information and the full document should not be shared with others. You should only be using it to help triage or resolve security incidents. For all other issues, seek help from the Axim Engineering team.

Go to https://github.com/openedx/openedx-webhooks-data/blob/main/salesforce-export.csv
Look up the name or GitHub username.

Open edX Community

Security Playbooks – for Security WG members

Identify the owner of a repo

Onboard or offboard a working group member

Triage security@openedx.org emails

Reply as security@openedx.com

Assign emails to responders

Follow up

Close out