)]}'
{"security-guide/ch_identity.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"e5d1e2892450612a242ea91e9fd2f833b439aa0e","unresolved":false,"context_lines":[{"line_number":25,"context_line":"  \u003cxi:include href\u003d\"section_identity-future.xml\"/\u003e"},{"line_number":26,"context_line":"  \u003cxi:include href\u003d\"section_identity-federated-keystone.xml\"/\u003e"},{"line_number":27,"context_line":"  \u003cxi:include href\u003d\"section_identity-checklist.xml\"/\u003e"},{"line_number":28,"context_line":"  \u003cxi:include href\u003d\"section_identity-checklist.xml\"/\u003e"},{"line_number":29,"context_line":""},{"line_number":30,"context_line":"\u003c/chapter\u003e"}],"source_content_type":"application/xml","patch_set":2,"id":"fa32b979_2c02a30a","line":28,"updated":"2015-06-18 15:59:52.000000000","message":"duplicated line, this change should not be part of the patch","commit_id":"f1c774468cec2b2d54a5c5904b776627c339e50e"}],"security-guide/section_case-studies-dashboard.xml":[{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"0b53f0081ae6f1c2a9cf33b2d7803bf69489ac5b","unresolved":false,"context_lines":[{"line_number":28,"context_line":"    \u003cpara\u003eAlice disables image uploading in Horizon as application users"},{"line_number":29,"context_line":"      will not need this feature, and management users will be uploading"},{"line_number":30,"context_line":"      purpose-built images. As these images will be sufficiently large,"},{"line_number":31,"context_line":"      using the Glance upload features directly will be more efficient"},{"line_number":32,"context_line":"      than doing so through Horizon, and her team has the required"},{"line_number":33,"context_line":"      access to Glance. She uploads her divisions logo into the"},{"line_number":34,"context_line":"      dashboard page, but leaves the rest of the dashboard default"}],"source_content_type":"application/xml","patch_set":3,"id":"fa32b979_acd1d324","line":31,"updated":"2015-06-18 16:05:26.000000000","message":"Glance -\u003e Image service","commit_id":"1c1838ffbd21d19ff81395277cb496e021ea1583"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"d4c6f10ed3b96aa1f9824ae66696c026472e5ced","unresolved":false,"context_lines":[{"line_number":28,"context_line":"    \u003cpara\u003eAlice disables image uploading in Horizon as application users"},{"line_number":29,"context_line":"      will not need this feature, and management users will be uploading"},{"line_number":30,"context_line":"      purpose-built images. As these images will be sufficiently large,"},{"line_number":31,"context_line":"      using the Glance upload features directly will be more efficient"},{"line_number":32,"context_line":"      than doing so through Horizon, and her team has the required"},{"line_number":33,"context_line":"      access to Glance. She uploads her divisions logo into the"},{"line_number":34,"context_line":"      dashboard page, but leaves the rest of the dashboard default"}],"source_content_type":"application/xml","patch_set":3,"id":"fa32b979_ccf6978e","line":31,"in_reply_to":"fa32b979_acd1d324","updated":"2015-06-18 16:08:48.000000000","message":"Done","commit_id":"1c1838ffbd21d19ff81395277cb496e021ea1583"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"0b53f0081ae6f1c2a9cf33b2d7803bf69489ac5b","unresolved":false,"context_lines":[{"line_number":29,"context_line":"      will not need this feature, and management users will be uploading"},{"line_number":30,"context_line":"      purpose-built images. As these images will be sufficiently large,"},{"line_number":31,"context_line":"      using the Glance upload features directly will be more efficient"},{"line_number":32,"context_line":"      than doing so through Horizon, and her team has the required"},{"line_number":33,"context_line":"      access to Glance. She uploads her divisions logo into the"},{"line_number":34,"context_line":"      dashboard page, but leaves the rest of the dashboard default"},{"line_number":35,"context_line":"      taking care not to add additional programs or features that may"}],"source_content_type":"application/xml","patch_set":3,"id":"fa32b979_8cc2cf51","line":32,"updated":"2015-06-18 16:05:26.000000000","message":"Horizon -\u003e OpenStack dashbaord.","commit_id":"1c1838ffbd21d19ff81395277cb496e021ea1583"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"d4c6f10ed3b96aa1f9824ae66696c026472e5ced","unresolved":false,"context_lines":[{"line_number":29,"context_line":"      will not need this feature, and management users will be uploading"},{"line_number":30,"context_line":"      purpose-built images. As these images will be sufficiently large,"},{"line_number":31,"context_line":"      using the Glance upload features directly will be more efficient"},{"line_number":32,"context_line":"      than doing so through Horizon, and her team has the required"},{"line_number":33,"context_line":"      access to Glance. She uploads her divisions logo into the"},{"line_number":34,"context_line":"      dashboard page, but leaves the rest of the dashboard default"},{"line_number":35,"context_line":"      taking care not to add additional programs or features that may"}],"source_content_type":"application/xml","patch_set":3,"id":"fa32b979_6cf18b94","line":32,"in_reply_to":"fa32b979_8cc2cf51","updated":"2015-06-18 16:08:48.000000000","message":"Done","commit_id":"1c1838ffbd21d19ff81395277cb496e021ea1583"},{"author":{"_account_id":6547,"name":"Andreas Jaeger","email":"jaegerandi@gmail.com","username":"jaegerandi"},"change_message_id":"0b53f0081ae6f1c2a9cf33b2d7803bf69489ac5b","unresolved":false,"context_lines":[{"line_number":30,"context_line":"      purpose-built images. As these images will be sufficiently large,"},{"line_number":31,"context_line":"      using the Glance upload features directly will be more efficient"},{"line_number":32,"context_line":"      than doing so through Horizon, and her team has the required"},{"line_number":33,"context_line":"      access to Glance. She uploads her divisions logo into the"},{"line_number":34,"context_line":"      dashboard page, but leaves the rest of the dashboard default"},{"line_number":35,"context_line":"      taking care not to add additional programs or features that may"},{"line_number":36,"context_line":"      introduce additional vulnerabilities.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa32b979_eca91b91","line":33,"updated":"2015-06-18 16:05:26.000000000","message":"Glance -\u003e Image","commit_id":"1c1838ffbd21d19ff81395277cb496e021ea1583"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"d4c6f10ed3b96aa1f9824ae66696c026472e5ced","unresolved":false,"context_lines":[{"line_number":30,"context_line":"      purpose-built images. As these images will be sufficiently large,"},{"line_number":31,"context_line":"      using the Glance upload features directly will be more efficient"},{"line_number":32,"context_line":"      than doing so through Horizon, and her team has the required"},{"line_number":33,"context_line":"      access to Glance. She uploads her divisions logo into the"},{"line_number":34,"context_line":"      dashboard page, but leaves the rest of the dashboard default"},{"line_number":35,"context_line":"      taking care not to add additional programs or features that may"},{"line_number":36,"context_line":"      introduce additional vulnerabilities.\u003c/para\u003e"}],"source_content_type":"application/xml","patch_set":3,"id":"fa32b979_ec335b60","line":33,"in_reply_to":"fa32b979_eca91b91","updated":"2015-06-18 16:08:48.000000000","message":"Good catch on these - thanks!","commit_id":"1c1838ffbd21d19ff81395277cb496e021ea1583"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"b24e4a13051f1056842caa4c25597fc8122d2e98","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    with different security requirements. Here we discuss how Alice and"},{"line_number":12,"context_line":"    Bob would address dashboard configuration to secure their private and"},{"line_number":13,"context_line":"    public clouds. Alice\u0027s cloud is not publicly accessible, but she is"},{"line_number":14,"context_line":"    still concerned about securing the administrative dashboard against"},{"line_number":15,"context_line":"    improper use. Bob\u0027s cloud, being public, must take measures to"},{"line_number":16,"context_line":"    reduce the risk of attacks by external adversaries.\u003c/para\u003e"},{"line_number":17,"context_line":"  \u003csection xml:id\u003d\"case-studies-dashboard-alice\"\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_8cf64f5b","line":14,"updated":"2015-06-18 16:20:29.000000000","message":"Is this ambiguous - does it refers to global administration or Project / Tenant usage (administration)? Does it matter?","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"99d6269b56139557048c2bbb0b1eeaebb3a81fbd","unresolved":false,"context_lines":[{"line_number":11,"context_line":"    with different security requirements. Here we discuss how Alice and"},{"line_number":12,"context_line":"    Bob would address dashboard configuration to secure their private and"},{"line_number":13,"context_line":"    public clouds. Alice\u0027s cloud is not publicly accessible, but she is"},{"line_number":14,"context_line":"    still concerned about securing the administrative dashboard against"},{"line_number":15,"context_line":"    improper use. Bob\u0027s cloud, being public, must take measures to"},{"line_number":16,"context_line":"    reduce the risk of attacks by external adversaries.\u003c/para\u003e"},{"line_number":17,"context_line":"  \u003csection xml:id\u003d\"case-studies-dashboard-alice\"\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_9a4f6133","line":14,"in_reply_to":"fa32b979_8cf64f5b","updated":"2015-06-18 16:51:43.000000000","message":"So Alice\u0027s cloud is hosting a public facing application while her dashboard is for internal use (global administration) - those managing the hardware and OpenStack deployment will be able to use it if they want.","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"b24e4a13051f1056842caa4c25597fc8122d2e98","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    public clouds. Alice\u0027s cloud is not publicly accessible, but she is"},{"line_number":14,"context_line":"    still concerned about securing the administrative dashboard against"},{"line_number":15,"context_line":"    improper use. Bob\u0027s cloud, being public, must take measures to"},{"line_number":16,"context_line":"    reduce the risk of attacks by external adversaries.\u003c/para\u003e"},{"line_number":17,"context_line":"  \u003csection xml:id\u003d\"case-studies-dashboard-alice\"\u003e"},{"line_number":18,"context_line":"    \u003ctitle\u003eAlice\u0027s cloud running a public application\u003c/title\u003e"},{"line_number":19,"context_line":"    \u003cpara\u003eOn the new installation, Alice deploys Apache as the Web"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_0f59d134","line":16,"updated":"2015-06-18 16:20:29.000000000","message":"This seems to suggest that for a government private cloud there is a lower barrier for expectation of acceptable risk.  Perhaps there should be some hint at referring to an ISMS exception policy?","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"99d6269b56139557048c2bbb0b1eeaebb3a81fbd","unresolved":false,"context_lines":[{"line_number":13,"context_line":"    public clouds. Alice\u0027s cloud is not publicly accessible, but she is"},{"line_number":14,"context_line":"    still concerned about securing the administrative dashboard against"},{"line_number":15,"context_line":"    improper use. Bob\u0027s cloud, being public, must take measures to"},{"line_number":16,"context_line":"    reduce the risk of attacks by external adversaries.\u003c/para\u003e"},{"line_number":17,"context_line":"  \u003csection xml:id\u003d\"case-studies-dashboard-alice\"\u003e"},{"line_number":18,"context_line":"    \u003ctitle\u003eAlice\u0027s cloud running a public application\u003c/title\u003e"},{"line_number":19,"context_line":"    \u003cpara\u003eOn the new installation, Alice deploys Apache as the Web"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_ba234555","line":16,"in_reply_to":"fa32b979_0f59d134","updated":"2015-06-18 16:51:43.000000000","message":"Moreso that Bob would be deploying a dashboard that was accessible to the public as he is a public cloud provider, while Alice\u0027s dashboard is not accessible to the public. I should probably call that out specifically.","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"b24e4a13051f1056842caa4c25597fc8122d2e98","unresolved":false,"context_lines":[{"line_number":22,"context_line":"      a homogeneous deployment in her environment. She modifies the"},{"line_number":23,"context_line":"      \u003cliteral\u003eSECURE_PROXY_SSL_HEADER\u003c/literal\u003e variable and disables"},{"line_number":24,"context_line":"      front end caching with with the session cookies set to httponly to"},{"line_number":25,"context_line":"      apply HSTS protections, which decreases X. As her application is"},{"line_number":26,"context_line":"      public facing, Alice creates an internal domain for the dashboard"},{"line_number":27,"context_line":"      access and issues internal PKI certificates.\u003c/para\u003e"},{"line_number":28,"context_line":"    \u003cpara\u003eAlice disables image uploading in Horizon as application users"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_efc82daa","line":25,"updated":"2015-06-18 16:20:29.000000000","message":"X?  Should this be something like, \"reduces the risk of the communication being downgraded from SSL/TLS to plain HTTP to be intercepted by a third-party \"","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"99d6269b56139557048c2bbb0b1eeaebb3a81fbd","unresolved":false,"context_lines":[{"line_number":22,"context_line":"      a homogeneous deployment in her environment. She modifies the"},{"line_number":23,"context_line":"      \u003cliteral\u003eSECURE_PROXY_SSL_HEADER\u003c/literal\u003e variable and disables"},{"line_number":24,"context_line":"      front end caching with with the session cookies set to httponly to"},{"line_number":25,"context_line":"      apply HSTS protections, which decreases X. As her application is"},{"line_number":26,"context_line":"      public facing, Alice creates an internal domain for the dashboard"},{"line_number":27,"context_line":"      access and issues internal PKI certificates.\u003c/para\u003e"},{"line_number":28,"context_line":"    \u003cpara\u003eAlice disables image uploading in Horizon as application users"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_7a193d21","line":25,"in_reply_to":"fa32b979_efc82daa","updated":"2015-06-18 16:51:43.000000000","message":"Yep, you caught one of my placeholders - thanks!","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"b24e4a13051f1056842caa4c25597fc8122d2e98","unresolved":false,"context_lines":[{"line_number":25,"context_line":"      apply HSTS protections, which decreases X. As her application is"},{"line_number":26,"context_line":"      public facing, Alice creates an internal domain for the dashboard"},{"line_number":27,"context_line":"      access and issues internal PKI certificates.\u003c/para\u003e"},{"line_number":28,"context_line":"    \u003cpara\u003eAlice disables image uploading in Horizon as application users"},{"line_number":29,"context_line":"      will not need this feature, and management users will be uploading"},{"line_number":30,"context_line":"      purpose-built images. As these images will be sufficiently large,"},{"line_number":31,"context_line":"      using the OpenStack Image service (glance) upload features"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_2f3a9599","line":28,"updated":"2015-06-18 16:20:29.000000000","message":"Horizon -\u003e OpenStack Dashboard","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"},{"author":{"_account_id":979,"name":"Dave Walker","email":"email@daviey.com","username":"davewalker"},"change_message_id":"b24e4a13051f1056842caa4c25597fc8122d2e98","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  \u003csection xml:id\u003d\"case-studies-dashboard-bob\"\u003e"},{"line_number":40,"context_line":"    \u003ctitle\u003eBob\u0027s public cloud\u003c/title\u003e"},{"line_number":41,"context_line":"    \u003cpara\u003eIn this case Bob takes the same precautions Alice does, except"},{"line_number":42,"context_line":"      that Bob deploys his dashboard as public facing.\u003c/para\u003e"},{"line_number":43,"context_line":"  \u003c/section\u003e"},{"line_number":44,"context_line":"\u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_cf70c974","line":42,"updated":"2015-06-18 16:20:29.000000000","message":"Is there intent to expand this in the future?","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"99d6269b56139557048c2bbb0b1eeaebb3a81fbd","unresolved":false,"context_lines":[{"line_number":39,"context_line":"  \u003csection xml:id\u003d\"case-studies-dashboard-bob\"\u003e"},{"line_number":40,"context_line":"    \u003ctitle\u003eBob\u0027s public cloud\u003c/title\u003e"},{"line_number":41,"context_line":"    \u003cpara\u003eIn this case Bob takes the same precautions Alice does, except"},{"line_number":42,"context_line":"      that Bob deploys his dashboard as public facing.\u003c/para\u003e"},{"line_number":43,"context_line":"  \u003c/section\u003e"},{"line_number":44,"context_line":"\u003c/section\u003e"}],"source_content_type":"application/xml","patch_set":4,"id":"fa32b979_7ac7fd63","line":42,"in_reply_to":"fa32b979_cf70c974","updated":"2015-06-18 16:51:43.000000000","message":"Definitely - I\u0027m working through Alice\u0027s case studies right now, and have started outlining Bob\u0027s. If you click on the \u0027Closes-bug\" line in the commit message you\u0027ll be taken to the bug, and the etherpad where I\u0027m drafting these. Please feel free to comment or take a section!","commit_id":"3c08c14dc201a8c7fd1192f7c70ac1277365e6de"}]}