Wikimedia Technology/Annual Plans/FY2019/CDP1: Privacy, Security, and Data Management/CDP Budget Segment 2/Goals

Program Goals and Status for FY18/19

Segment 2 - Security

• Goal Owner: John Bennett
• Program Goals for FY18/19: Develop, maintain and mature our privacy, security, and data management practices in order to protect Wikimedia community member and donor information, comply with applicable privacy and data protection regulations, and ensure safe and secure connection to Wikimedia projects and sites in accordance with the values of the movement.
• Annual Plan: Segment 2 - Security
  • Primary Goal is Knowledge Equity: grow new contributors and content

Q1 Goals

Outcome 1 / Output 1

Ensure the high-quality protection and security of our infrastructure and data.

Review and update current security policies, standards and procedures

Goal(s)

• Review and mature our security policies and awareness functions:
  • Create or update 3 security policies
  • Provide Security Awareness training
  • Perform Phishing campaign

Status

 Note: July 2018

•  'Done' 1 of the 3 policies has been created
• ' Done' Define Awareness content

 Note: August 2018

• To do Define additional policies to update/create
• In progress Draft version of "Protecting your Digital Identity" created for Awareness Campaign
• To do On board vendor to support Phishing platform

 Note: September 12, 2018

• In progress Update/create identified password use policies and incident response policies
• Partially done Provide awareness training (will be presented in October)
• To do Perform phishing campaign, this will completed in Q2

Outcome 1 / Output 2

Ensure the high-quality protection and security of our infrastructure and data.

Reduce risk, improve application security practices, improve code quality, reduce vulnerabilities and attack surface and encourage a secure by design approach.

Goal(s)

• Testing campaigns:
  • Implement CSP in alert only mode
  • Penetration testing for English Wikipedia site
  • Security Release
  • Analytics Risk Assessment and Threat Model

Status

 Note: July 2018

•  'Done' initial test rollout of CSP on test wiki
•  'Done' Define scope and onboard vendor for pen testing
• In progress identify elements for security release
•  'Done' identify and scope Analytics assessment

 Note: August 2018

• In progress Expand CSP rollout
• In progress Select pen testing dates
• In progress Prepare security release
• In progress identify and scope Analytics assessment

 Note: September 12, 2018

• In progress Expand CSP rollout
• To do Complete pen testing--will start at end of September
• To do Prepare security release (currently stalled based on hiring)
• In progress Complete Analytics assessment

Outcome 1 / Output 3

Ensure the high-quality protection and security of our infrastructure and data.

Increase maturity and capabilities in the event of a security incident.

Goal(s)

• Perform 2 Incident Response table top exercises

Status

 Note: July 2018

' Done' Perform Incident response exercise

 Note: August 2018

' Done' Perform 2nd Incident response exercise

 Note: September 12, 2018

In progress Update Incident Response Plan

Q2 Goals

 Note: Due to major security incidents in October and November, all Security Resources were dedicated to working on them incidents and this negatively affected the ongoing scheduled work to be done by the team.

Outcome 1 / Output 1

Ensure the high-quality protection and security of our infrastructure and data.

Review and update current security policies, standards and procedures

Goal(s)

• Review and mature our security policies and awareness functions:
  • Create or update 3 security policies
  • Provide Security Awareness training
  • Perform Phishing campaign

Status

 Note: October 18, 2018

• On track to publish policy changes by the end of Oct
• Awareness content created and ready to deliver
• Phishing campaign will be delayed until Nov.

 Note: December 12, 2018

• This is now  Done — one training session for FR-Tech happened in November, and the new policy was used during that training. Blog will go out by end of December.
• Phishing campaign is N Stalled and hope to be done in early 2019

Outcome 1 / Output 2

Ensure the high-quality protection and security of our infrastructure and data.

Reduce risk, improve application security practices, improve code quality, reduce vulnerabilities and attack surface and encourage a secure by design approach.

Goal(s)

• Testing campaigns:
  • Implement CSP in alert only mode
  • Penetration testing for mobile apps
  • Security Release
  • OIT Risk Assessment and Threat Model
  • NIST CSF style assessment
  • Consider incorporation of Phan-taint-check into MW Core

Status

 Note: October 18, 2018

• CSP changes in progress
• 1st round of pen testing (on en wikipedia)will conclude by the end of Oct.
• OIT assessment will be pushed into at least Nov
• NIST CSF assessment on track to begin in Oct but will conclude likely in Nov.
• Initial discussion have begun to include Phan into MW core but will not be completed in Oct.

 Note: December 12, 2018

• CSP changes are now  Done
• 1st round of pen testing (on en wikipedia) is  Done
• OIT assessment is N Cancelled, might be picked up in 2019.
• NIST CSF assessment is N Stalled, should be picked up again in early 2019.
• Initial discussion is In progress to include Phan into MW core and should be completed by end of December.

Outcome 1 / Output 3

Ensure the high-quality protection and security of our infrastructure and data.

Increase maturity and capabilities in the event of a security incident.

Goal(s)

• Finalize and test our Incident Response documentation

Status

 Note: October 18, 2018

• Final tabletop with Legal will be held on Oct 30.

 Note: December 12, 2018

• This is In progress with writing the documentation and should get published on MediaWiki sometime in late December. This goal will probably finish up in Q3 (early January). It has been throughly tested and will be published in January 2019.

Q3 Goals

Outcome 1 / Output 1

Ensure the high-quality protection and security of our infrastructure and data. Review and update current security policies, standards and procedures

Goal(s)

Review and mature our security policies and awareness functions:

• Create or update 3 security policies
• Provide Security Awareness training
• Perform Phishing campaign
• Security Code Review process improvements completed and published
• Update/Consolidate security documentation

Status

 Note: January 9, 2019

• Security policy updates are In progress ('acceptable use' is first up)
• Training is In progress, working on revising content to be published later in January
• Phishing campaign will start after the awareness training is done (most likely in Feb 2019)
• Security code review improvements are In progress and hope to be published by end of quarter (in review now)
• Updating and consolidating security documentation is also In progress

 Note: February 13, 2019

• Security policy updates still In progress with incident responses, we're hoping for 3 to be published this quarter.
• Training is still In progress and recently published https://www.mediawiki.org/wiki/Protecting_your_digital_identity
• Phishing campaign will start in the next couple of weeks, going dept by dept to train folks.
• Security code review improvements are In progress and documentation is hoping to be released this week.
• Updating and consolidating security documentation is still In progress, we are inventorying all the docs we have now and consolidating (policy, SOP, standards, etc).

 Note: March 14, 2019

• Security code review improvements is  Done
• Updating and consolidating security documentation is Partially done but will finish up in Q4
• Security policy updates are Partially done right now, and will complete by EOQ
• Phishing campaign has been N Postponed for Q4
• Security code review improvements are In progress but hope to be done by EOQ

Outcome 1 / Output 2

Ensure the high-quality protection and security of our infrastructure and data. Reduce risk, improve application security practices, improve code quality, reduce vulnerabilities and attack surface and encourage a secure by design approach.

Goal(s)

• Expansion of CSP
• Security Release
• Analytics Risk Assessment and Threat Model
• Incorporation of Phan-taint-check into MW Core
• Evaluate dynamic scanners
• Routine penetration testing

Status

 Note: January 9, 2019

• Expansion of CSP (a long running goal) is In progress as well as security release.
• Risk assessment is also In progress and should be done by end of Feb 2019
• Incorporation of Phan-taint-check into MW Core is a bit slow to get going — adoption of getting it into Core is slow and might be delayed into Q4.
• Dynamic scanner work will be completed in March or April 2019
• Next round of penetration testing is In progress using info from latest incidents

 Note: February 13, 2019

• Expansion of CSP (a long running goal) is a bit N Stalled but still expected to be done this quarter.
• Security release is also N Stalled and will most likely be pushed to Q4.
• Risk assessment is also In progress and should be done by end of Feb 2019
• Incorporation of Phan-taint-check into MW Core is also N Stalled
• Dynamic scanner work will be most likely be completed in Q4, or pushed into next FY. We'd like to do some manual scanning first, rather than building an automatic version.
• Next round of penetration testing is still In progress but we're not totally happy with the results from enwiki, so the vendor did the work again and got a Javascript threat model. We think we can call this  Done for this quarter.

 Note: March 14, 2019

• Expansion of CSP (a long running goal) is still N Stalled for now - will be revised for Q4 work, and might take about a year to complete
• Security release is also N Stalled, but looking to do a release in Q4
• Risk assessment is Partially done and will be completed by EOQ
• Incorporation of Phan-taint-check into MW Core (another long running goal), will transition the work within the team this quarter; it might take another 6 months to be fully incorportated into MediaWiki core.
• Dynamic scanner work has been N Postponed to Q4
• Penetration testing is  Done for this FY

Outcome 1 / Output 3

Ensure the high-quality protection and security of our infrastructure and data.

Increase maturity and capabilities in the event of a security incident.

Goal(s)

• Perform tooling and process retro
• Finalize and test our Incident Response documentation
• Create incident play by play dashboard
• Perform 1 large scale tabletop exercise

Status

 Note: January 9, 2019

• Tooling and process retro will take place in Feb 2019
• Response documentation finalization will be most likely completed in March 2019
• play by play dashboard is In progress
• Large scale tabletop exercise will happen in March

 Note: February 13,, 2019

• Tooling and process retro is Partially done during our All Hands offsite, but we'll need to do a bit more. This will become a longer running goal in the future.
• Response documentation finalization has started, In progress and will have a working version by EOQ.
• Play by play dashboard is N Stalled for now, we hope to get back to it.
• Large scale tabletop exercise will happen in sometime in March, but the work might be moved into Q4.

 Note: March 14, 2019

• Tooling and process retro was  Done earlier in the quarter and we are still building out the incident response documentation from the last incident; this process will run into Q4 (mostly for alerting)
• Incident Response documentation playbooks are still In progress and will go into next FY
• Incident play by play dashboard is now a stretch goal to be tackled in Q4
• Large scale tabletop exercise has been N Postponed to Q4

Q4 Goals

Outcome 1 / Output 1

Ensure the high-quality protection and security of our infrastructure and data. Review and update current security policies, standards and procedures

Goal(s)

Review and mature our security policies and awareness functions:

• Create or update 3 security policies (ongoing goal)
• Provide Security Awareness training (ongoing goal)
• Perform Phishing campaign
• Form Security Council
• Form strategy and begin initial steps toward building a data governance platform
• Form strategy and begin initial steps toward building a vulnerability management program
• Assess current security logging capabilities (stretch goal)

Status

 Note: April 2019

• Policy - In progress updates and review of new Security Readiness Review SOP
• Policy - In progress SOP for creating new security policy has been drafted, and is in review
• Policy - In progress Acceptable Use Policy has been drafted, is in review, and scheduled to go effective in 10 June 2019
• Policy - In progress Security Incident Response policy is being drafted, due by end of 4Q 2019
• In progress Security Awareness/Phishing - Once the Acceptable Use Policy is approved, awareness sessions will be held
• In progress Data governance platform review and construction in progress
• In progress Vuln mgmt
• In progress Logging - needs update

 Note: May 30, 2019

• In progress Policy - reconcile and polish the Data Classification and Data Protection policies
•  Done Membership for Security Council selected, planning on 1st meeting in June
• Policy - In progress updates and review of new Security Readiness Review SOP
• Policy - In progress SOP for creating new security policy has been drafted, and is in review
• Policy - In progress Acceptable Use Policy has been drafted, is in review, and scheduled to go effective in June 2019
• Policy -  Done Security Incident Response policy is being drafted, due by end of 4Q 2019
• In progress Vuln mgmt -- Initial scans performed, evaluating scanning solutions and results.
• In progress Logging - Updates to alerting capabilities.
• N Stalled Perform Phishing campaign. Maybe catch up on some pieces next month.
• Policy - In progress update Data Classification policy.

To do June 2019

•  Done Create or update 3 security policies (ongoing goal)
• In progress Provide Security Awareness training (ongoing goal)
• N Stalled Perform Phishing campaign
•  Done Form Security Council
• In progress Form strategy and begin initial steps toward building a data governance platform
• In progressForm strategy and begin initial steps toward building a vulnerability management program
• In progress Assess current security logging capabilities (stretch goal)

Outcome 1 / Output 2

Ensure the high-quality protection and security of our infrastructure and data. Reduce risk, improve application security practices, improve code quality, reduce vulnerabilities and attack surface and encourage a secure by design approach.

Goal(s)

• Expansion of CSP (ongoing goal)
• Security Release (ongoing goal)
• Analytics Risk Assessment and Threat Model
• Incorporation of Phan-taint-check into MW Core (stretch goal)
• Phan 2.x development and release (stretch goal)
• Evaluate dynamic scanners
• Routine penetration testing
• Polish and demo appsec docker “toolboxes” (PHP, Python)
• Improve security tooling for Phab/Gerrit monitoring
• Formalized process and SOP for concept/design reviews.
• Generate initial security metrics/measurements

Status

 Note: April 2019

• In progress Routine penetration testing - Scoping
• In progress Phan 2.x development and release - 2.x branch created, updates cherry-picked, older patches reviewed and cherry-picked
• In progress Evaluate dynamic scanners - new task created T219567, tool review, meeting w/ ZAP lead dev (Simon @ Mozilla)
• In progress See: T221477, hopefully some WIP patches soon
• In progress Formalized process and SOP for concept/design reviews - still reviewing, see also related Output 1 goal
•  Done Improve security tooling for Phab/Gerrit monitoring - calling this done for this quarter

 Note: May 30, 2019

• In progress Routine penetration testing - Scoping completed, awaiting scheduling
• In progress Phan 2.x development and release - 2.x branch created, updates cherry-picked, older patches reviewed and cherry-picked
• In progress Evaluate dynamic scanners - new task created T219567, tool review, meeting w/ ZAP lead dev (Simon @ Mozilla)
• In progress See: T221477, hopefully some WIP patches soon
• In progress Formalized process and SOP for concept/design reviews - still reviewing, see also related Output 1 goal
• N Stalled Metrics generation, maybe catch-up next month.
•  Done Improve security tooling for Phab/Gerrit monitoring - calling this done for this quarter
•  Done Analytics Risk Assessment and Threat Model
• In progress Security release on track and scheduled for next month.

To do June 2019

• In progress Expansion of CSP (ongoing goal)
•  Done Security Release (ongoing goal)
•  Done Analytics Risk Assessment and Threat Model
• In progress Incorporation of Phan-taint-check into MW Core (stretch goal)
• In progress Phan 2.x development and release (stretch goal)
• In progress Evaluate dynamic scanners
• In progress Routine penetration testing
• In progress Polish and demo appsec docker “toolboxes” (PHP, Python)
• In progress Improve security tooling for Phab/Gerrit monitoring
•  Done Formalized process and SOP for concept/design reviews.
• N Stalled Generate initial security metrics/measurements

Outcome 1 / Output 3

Ensure the high-quality protection and security of our infrastructure and data.

Increase maturity and capabilities in the event of a security incident.

Goal(s)

• Perform tooling and process retro
• Finalize and test our Security Incident Response documentation
• Create incident play by play dashboard
• Perform 1 large scale tabletop exercise

Status

 Note: April 2019

•  Done Security incident scale proposals drafted, now in review
• In progress Security Incident Response policy and supporting incident response playbooks are being drafted

 Note: May 30, 2019

• In progress Security incident scale proposals drafted, now in review
• In progress Security Incident Response policy and supporting incident response playbooks are being drafted
• N Stalled Create incident play by play dashboard and likely delayed until next quarter.

To do June 2019

•  Done Perform tooling and process retro
• In progress Finalize and test our Security Incident Response documentation
• N Stalled Create incident play by play dashboard
•  Done Perform 1 large scale tabletop exercise