1# Security response team guidelines
2
3These are the guidelines for the security response team members
4including OpenBMC community members who are responding to problems
5reported by the [security vulnerability reporting process](./obmc-security-response-team.md).
6
7The security response team coordinates activity to address privately
8disclosed security vulnerabilities, engages resources to address them,
9and creates security advisories.
10
11Here are the primary expectations:
12 - Keep problems private until announce
13 - Work with diligence
14 - Keep stakeholders informed
15
16Workflow highlights:
17
181. Handle new problem reports
19    - Within a day, acknowledge you received the report.
20      Note that reports are archived in the mailing list.
21    - Communicate within the security response team, typically be
22      cc'ing the openbmc-security email list.
23
242. Analyze the problem
25    - Determine if the problem is new or known.
26    - Determine if the problem is in OpenBMC.
27       - If the problem is in a project that OpenBMC uses, re-route
28         the problem to that upstream project.
29       - Note that the problem may be in a customized version of
30         OpenBMC but not in OpenBMC itself.
31    - Determine which OpenBMC areas should address the problem.
32    - Draft a CVE-like report which includes only:
33       * the vulnerability description: omit OpenBMC specifics
34       * [CVSS metrics](https://www.first.org/cvss/calculator/3.0)
35       * CVE identifiers, if known
36    - Gather data for the security advisory (see template below).
37
383. Bring in contributors as needed (upstream, downstream, and OpenBMC)
39    - Use private channels, e.g., email.
40    - Inform contacts this is private work as part of the OpenBMC
41      security response team.  For example, link these guidelines.
42    - Coordinate with all stakeholders and keep them informed.
43
444. For OpenBMC problems:
45    1. Determine if this is a high severity problem.  Example using
46       CVSS metrics: a remotely exploitable or low complexity attack that has
47       high impact to the BMC's confidentiality, integrity, or availability.
48    2. Avoid pre-announcing problems.  Be especially careful with high
49       severity problems.  When fixing the problem, use the contribution
50       process but limit the details in the issue or use a
51       private channel to discuss.
52    3. Negotiate how the code review will proceed.
53        - Consider [contributing](https://github.com/openbmc/docs/blob/master/CONTRIBUTING.md#submitting-changes-via-gerrit-server)
54          using a Gerrit [private change](https://gerrit-review.googlesource.com/Documentation/intro-user.html#private-changes) if everyone has access to Gerrit.
55        - Consider using [Patch set](https://en.wikipedia.org/wiki/Patch_(Unix))
56          emails to make reviews accessible to all stakeholders.
57    4. When agreed, publish a security advisory to
58       https://github.com/openbmc/openbmc/issues and email list
59       openbmc@lists.ozlabs.org.
60       Make the Gerrit review publicly viewable.
61    5. Improve OpenBMC processes to avoid future problems.
62
63## DRAFT Template: Initial response to the problem submitter
64The OpenBMC security response team has received the problem.
65- Thank you for reporting this.
66- Share preliminary results of the analysis.
67- Share preliminary OpenBMC plans or that we are analyzing the problem.
68- Set expectations for follow-up communications.
69
70## DRAFT Template: OpenBMC Security Advisory
71```
72OpenBMC Security Advisory
73Title: ...
74
75...summary: include CVEs, releases affected, etc....
76
77The CVSS score for these vulnerabilities is "...", with temporal score
78"...", with the following notes:
79https://www.first.org/cvss/calculator/3.0
80- AV:
81- AC:
82- PR:
83- UI:
84- S:
85- C/I/A:
86- E:
87- RC:
88
89The fix is in the https://github.com/openbmc/... repository as git
90commit ID ....
91
92For more information, see OpenBMC contact information at
93https://github.com/openbmc/openbmc file README.md.
94
95Credit for finding these problems: ...
96```
97
98## Reference
99Some of these guidelines were collected from:
100 - https://bestpractices.coreinfrastructure.org/en/projects/34
101 - https://www.kernel.org/doc/html/v4.16/admin-guide/security-bugs.html
102 - https://oss-security.openwall.org/wiki/mailing-lists/distros
103
104## Team composition and email maintenance
105
106The security response team is controlled by the OpenBMC Technical
107Steering Committee.  Membership is restricted to a core group, with
108selection based upon their community role(s), experience, and
109expertise responding to security incidents.
110
111The security response team uses the `openbmc-security at
112lists.ozlabs.org` private email list as a channel for confidential
113communication, so its membership reflects the composition of the
114security response team.  The list membership should be reviewed
115periodically and can be managed from
116`https://lists.ozlabs.org/listinfo/openbmc-security`.
117
118The email list subscribers should be reminded periodically to protect
119access to the emails from the list because of the sensitive
120information they contain.
121
122The email list membership is not intended to be secret. For example,
123we can discuss it a public forum. However, no effort is made to make
124the list public.
125
126The email list identification could be `for privately reporting
127OpenBMC security vulnerabilities` and its description could be: This
128email list is for privately reporting OpenBMC security
129vulnerabilities.  List membership is limited to the OpenBMC security
130response team.  For more information, see
131https://github.com/openbmc/docs/blob/master/security/how-to-report-a-security-vulnerability.md
132
133Sample response for denying list membership:
134```
135Thanks for your interest in OpenBMC security.  Subscriptions to the
136openbmc-security@lists.ozlabs.org email list are by invitation only
137and are typically extended only to security response team members.
138For more information, see https://github.com/openbmc/docs/security or
139attend a security working group meeting:
140https://github.com/openbmc/openbmc/wiki/Security-working-group.
141
142Yours truly,
143OpenBMC security response team
144```
145