View source for Security/Standard Levels

<!-- Levels colors reference for copy pasting -->
<!--
Levels you can copy paste in HTML documents

<span style="background-color: #ffffff; border: solid 1px #aaaaaa; border-radius: .25em; color: #000000; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">UNKNOWN</span>
<span style="background-color: #cccccc; border-radius: .25em; color: #000000; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">LOW</span>
<span style="background-color: #4a6785; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">MEDIUM</span>
<span style="background-color: #ffd351; border-radius: .25em; color: #594300; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">HIGH</span>
<span style="background-color: #d04437; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">MAXIMUM</span>
 -->

<table>
  <tr>
    <td style="min-width: 25em;">__TOC__</td>
    <td style="vertical-align: top; padding-left: 1em;">
<span style="background-color: #14892c; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold;
margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">READY</span>

The goal of this document is to ensure consistency, coherence between security documents. All Mozilla
security documentation must follow the recommendations below.

'''If a risk level is not present in this document, it cannot be used to express security risk.'''

It establishes standard level conventions, in particular:

* Level color coding
* Name or name schemes
* Level expectation

The Enterprise Information Security (Infosec, formerly OpSec) team maintains this document as a reference guide for operational teams.

Updates to this page should be submitted to the [https://github.com/mozilla/wikimo_opsec/ source repository on github].
Changes are detailed in the [https://github.com/mozilla/wikimo_opsec/commits/master commit history].

<span style="float: right; padding-top: 3em;">[[File:OpSec.png|300px]]</span>
    </td>
  </tr>
</table>

= Standard Documentation Levels =

We strongly focus on presenting risk levels in all documents, pages, etc. It allows for a common representation of risk regardless of tools and other nomenclature used.
If you use a scoring system for example, and your score is F, you are at higher risk. If data is of higher level, you are at higher risk. Etc.
For this reason, the risk levels are the most important levels and '''must''' always be followed and present.

{| class="wikitable"
|-
! <span style="color:Gray;">'''Scoring, pass/fail, RFC2119, etc.'''</span>
|-
|
If you are looking for scoring, pass/fail, document readiness, etc. labels and levels, please check [[User:Security/Scoring_and_other_levels|Scoring and other levels]] instead.

Do note that all document '''must''' also express risk.
|}

== Standard risk levels definition and nomenclature ==
''The risk levels also represent a simplified ISO 31000 equivalent (and are non-compliant) .''
These levels are also used to display risk impact, risk probability and any risk related level.

{| class="wikitable"
|-
! Risk Level
! Expectations
! Rationale
|-
! <span style="background-color: #d04437; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">MAXIMUM Risk</span>
| ''This is the most important level, where the risk is especially great.''

* '''Attention''':  Full attention from all concerned parties required.
* '''Impact''': High or maximum impact.
* '''Effort''': All resources engaged on fixing issues. Following standard/guidelines is required.
* '''Risk acceptance''': Rarely accepted as residual risk, must be discussed, and must be mitigated or remediated.
* '''Exception time (SLA)''': Recommend fixing '''immediately'''.
|
* Red signifies "most important".
* Maximum is a level. Critical is not.
|-
! <span style="background-color: #ffd351; border-radius: .25em; color: #594300; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">HIGH Risk</span>
|
* '''Attention''': Full attention from all concerned parties required.
* '''Impact''': Medium, high or maximum impact.
* '''Effort''': Some key resources engaged on fixing the issue. Following standard/guidelines is required.
* '''Risk acceptance''': Risk must be discussed, and must at least be mitigated.
* '''Exception time (SLA)''': Recommend remediation within '''7 days'''.
|
* Yellow generally signifies "warning". In our case it correlates to "important".
|-
! <span style="background-color: #4a6785; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">MEDIUM Risk</span>
|
* '''Attention''': Attention from all concerned parties.
* '''Impact''': Low, medium or high impact.
* '''Effort''': ''Best effort''. Following standard/guidelines is required.
* '''Risk acceptance''': Risk should be discussed, and at least mitigated.
* '''Exception time (SLA)''': Recommend remediation within '''90 days'''.
|
* Blue is calm and neutral.
|-
! <span style="background-color: #cccccc; border-radius: .25em; color: #000000; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">LOW Risk</span>
|
* '''Attention''': Expected but not required.
* '''Impact''': Low or medium impact.
* '''Effort''': ''Best effort'' and '''best practices''' expected.
* '''Risk acceptance''': Risk may often be accepted as residual risk.
* '''Exception time (SLA)''': Indefinitely.
|
* Gray is a low contrast color, which signifies not too important. It's also less catchy.
* Green is not used as green means "ok to do", which is not a level.
|-
! <span style="background-color: #ffffff; border: solid 1px #aaaaaa; border-radius: .25em; color: #000000; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">UNKNOWN Risk</span>
|
* Data collection is expected.
* This level is expected to change to one of the other levels.
|
* White represent the emptiness/lack of data.
This is '''not a true level''', it is used when there to represent that we do not have enough data to correctly assess the level (i.e. data collection work is required).

Note: communicating the risk of not knowing is challenging and prone to failure, in particular when once data has been gathered, the risk appears to in fact be low.

This concept is also known as ''"trust, but verify"'' - i.e. unknown does not distrust (by assign it a higher risk) the service, user, etc. by default.
|-
|}

== Examples of usage  ==

{| class="wikitable"
|-
! Level
! Example
|-
! <span style="background-color: #cccccc; border-radius: .25em; color: #000000; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">LOW Risk</span>
|
* '''Attention''': Service owner or delivery team may look at it, through email or other means.
* '''Effort''': Flip a configuration switch, change a password, lookup a document, etc.
* '''Risk acceptance''': Accept risk of leaking non-sensitive data as peer-review process is light.
|-
! <span style="background-color: #4a6785; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">MEDIUM Risk</span>
|
* '''Attention''': Service owner or delivery team must be informed via bug, document, etc.
* '''Effort''': Take a group decision, create standards, lookup statistics, manual upgrades, etc.
* '''Risk acceptance''': Mitigate the risk of attackers accessing the admin panel by using SSO.
|-
! <span style="background-color: #ffd351; border-radius: .25em; color: #594300; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">HIGH Risk</span>
|
* '''Attention''': Ensure service, product owner is aware via bug and pings.
* '''Effort''': Implement a new security control, code a new feature, change all company user passwords, etc.
* '''Risk acceptance''': Hotfix to mitigate within the next few days, eventually turn off if it takes too long.
|-
! <span style="background-color: #d04437; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">MAXIMUM Risk</span>
|
* '''Attention''': Ensure service,product, capability owner is aware via bug and pings.
* '''Effort''': Implement a new security design/change product design, etc.
* '''Risk acceptance''': Turn service off/put it behind VPN until fixed/ASAP.
|-
|}

* You site scored <span style="background-color: #ffd351; border-radius: .25em; color: #594300; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">C</span> to the HTTP observatory tests, it is at <span style="background-color: #4a6785; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">MEDIUM Risk</span>.
* You have 1 immediately exploitable RCE vulnerability of maximum impact and are at <span style="background-color: #d04437; border-radius: .25em; color: #ffffff; display: inline-block; font-weight: bold; margin: .1em 0; min-width: 6em; padding: .05em .5em; text-transform: uppercase; text-align: center;">MAXIMUM Risk</span>.