SRTool User Page

From Yocto Project
Jump to navigationJump to search


This page summarizes the Security Response Tool (SRTool) user documentation.


Goals

  • A common system to track and share security issues, combining community CVEs
  • A simple yet flexible interface for reporting and exploring the security issues
  • A place to upload and share attachments, including patches, fixes, emails, and documents
  • The ability to generate accurate and up-to-date reports and exports
    • Status on a given CVE and its defects, for a specific product or for all affect products
    • Compliance reports on sensitive CVEs, for example the chain of events and who-knew-what-when
    • Status of each product, for the related CVE defects Compliance reports on sensitive CVE's, for example the chain of events and who-knew-what-when
    • Ability to easily export that data to spreadsheets and to the public CVE database
  • The ability to securely store embargoed CVEs and data, complete with user protection and data encryption
  • Tools to help manage the ongoing influx of CVEs (around 1000 per month) so that expert time is not wasted and crucial CVE's are not lost
  • In general, a managed and automated tool set based on open source to replace splintered email threads and brittle manual systems


Basic introduction to the interface

  • Initial data set: This initial data set contains the integrated CVE, Defect, and Sustaining data for 'CVE-2015-*' to 'CVE-2018-*'
  • Home page: The title bar "SRTool:Security Response Tool" will always link you back to the home page
  • Tables: In tables there are three ways to adjust the data set, and they can be used separately and/or together to get the best results
    • The search bar: most of the text fields are searchable. Enter a value (like 'meltdown'), all records that have that string in those fields will appear
    • The column sort: all column titles that appear in blue can be used to sort using that column. Click a second time to reverse the sort
    • The column filter: when you click on the 'cone' symbol in a column title you can select a filter based on that column's data
    • At the bottom of each table you can set the page size and jump to diff pages
  • User Model: The SRTool uses the Django User Access Model


SRTool Record Types

CVE Record

  • A CVE record is the representation of an upstream CVE that comes from MITRE, NIST, or other sources
  • The data in a CVE record is intended to be pristine, however you can superimpose local edits to the CVE records to fix upstream errors
  • You can create "local" CVEs for issues that do not yet have a formal CVE number

Vulnerability Record

  • A "Vulnerability" is a SRTool record that tracks a given issue across the orgainzation's products and releases
  • It normally tracks a single CVE, but it can also attach to multiple CVEs that may be duplicates or overlaps
  • Pertinate data like patches, reproducers, or documents can be attached and thus shared
  • A Vulnerability can be created without a CVE, in case the CVE does not yet exist or is currently embargoed

Investigation Record

  • An "Investigation" is a SRTool record that tracks a given Vulnerability to a specific product and defect
  • It normally attaches to a single defect, but it can also be attached to multiple defects in case (for example) the vulnerability is broken across several functional teams (e.g. kernel, user space, hardward, ...)
  • Pertinate data like patches, reproducers, or documents can be attached and thus shared
  • An Investigation can be created without a defect, in case the issue is still being investigated or is currently embargoed from the public defect database

Defect Record

  • A "Defect" is the representation of the organization’s defect (Jira, Bugzilla)
  • It connects to a CVE via the parent Investigation record and Vulnerability record

Overview of the SRTool Records

Here is a picture of the high level SRTool record structure:




Usage Guide

Working with CVEs

  • The CVE page is based on the NIST public page, and includes the V3 and V2 severities information, download links, and CPEs
  • There are tabs to see (a) the original NIST source data, (b) alternate CVE sources, and (c) SRTool edits (if added)
  • At the top is a place for the internal tags to help lookups and track status
  • At the top is a place to see the publishing state. It can include future dates, plus a "Publish Now" button
  • The "New CVE" link createa a new custom local CVE record
  • The "Fetch alt data" link adds Mitre, Debian, and other data to this CVE
  • The "Export" link provides CVE specific reports

Working with Vulnerabilities

  • Vulnerability records track the overall status of CVE (or a group of tightly related CVEs)
  • Multiple related CVE's can be attached
  • Multiple Investigations can be attached, one per product
  • Comments and attachments can be added by logged-in users (for traceability)
  • Users can sign up for change notification emails
  • Vulnerabilities can be public, or locked to an invitation-only list of users
  • The "Edit Status ..." button allow changes to the fields like the status, priority, comments
  • The "Create Notification..." button is for notifying owners of status changes for the record
  • The "Delete" button is for deleting this record
  • The "Add product ..." button is for attaching a product and creating a respective Investigation record
  • The "New Vulnerabilities" link createa a new vulnerability record
  • The "Export" link provides Vulnerability specific reports

Working with Investigations

  • Investigation records track the status of a CVE for a given product
  • Multiple defect links can be attached
  • Comments and attachments can be added by logged-in users
  • Users can sign up for change notification emails
  • Investigation can be public, or locked to a controlled list of users
  • The "Edit Status ..." button allow changes to the fields like the status, priority, comments
  • The "Create Notification..." button is for notifying owners of status changes for the record
  • The "Delete" button is for deleting this record
  • The "Export" link provides Investigation specific reports

Working with Defects

  • This table lists all of the defects being tracked by the Vulnerabilities and Investigations
  • A quick status overview of the defects is provided
  • A quick summary page per defect is provided, with a link to the actual defect

Working with Products

  • The Products page shows the organization's products that are attached to the SRTool
  • Links are provided to view the product's Vulnerabilities, Investigations, and Defects

Working with User Accounts

  • By default you will be logged in as an anonymous "Guest"
  • Click log-in in the top bar:
    • Select to log in with your credentials
    • Select to create your own Guest account
  • When logged in, click your user name in the top bar to:
    • Select to log out. This will return you to the anonymous 'Guest' account
    • Select to edit your account settings
    • Select to edit your password