)]}'
{"security-guide/source/introduction/security-boundaries-and-threats.rst":[{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":61,"context_line":"instance use or allow unrestricted internet access to VMs should consider this"},{"line_number":62,"context_line":"domain to be *untrusted*. Private cloud providers may want to consider this"},{"line_number":63,"context_line":"network as internal and *trusted* only if the proper controls are"},{"line_number":64,"context_line":"implemented, to assert that the instances and all associated tenants are to"},{"line_number":65,"context_line":"be trusted."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Management"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_be55a7c7","line":64,"range":{"start_line":64,"start_character":11,"end_line":64,"end_character":12},"updated":"2016-02-15 07:02:04.000000000","message":"Not sure about this one. I agree the original comma is incorrectly placed, but not sure moving it here is better. Maybe removing it or breaking this up?","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":86,"context_line":"The data security domain is concerned primarily with information pertaining to"},{"line_number":87,"context_line":"the storage services within OpenStack. Most of the data transmitted across this"},{"line_number":88,"context_line":"network requires high levels of integrity and confidentiality. In some cases,"},{"line_number":89,"context_line":"depending on the type of deployment, there may also be strong availability"},{"line_number":90,"context_line":"requirements."},{"line_number":91,"context_line":""},{"line_number":92,"context_line":"The trust level of this network is heavily dependent on deployment decisions"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_fe5d6fed","line":89,"range":{"start_line":89,"start_character":35,"end_line":89,"end_character":36},"updated":"2016-02-15 07:02:04.000000000","message":"Eh, I don\u0027t believe the additional comma adds to this. In fact, I personally think it detracts, but I\u0027ll defer to the doc cores if this is proper punctuation.","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":108,"context_line":".. image:: ../figures/bridging_security_domains_1.png"},{"line_number":109,"context_line":""},{"line_number":110,"context_line":"The diagram above shows a compute node bridging the data and management"},{"line_number":111,"context_line":"domains. As such, the compute node should be configured to meet the security"},{"line_number":112,"context_line":"requirements of the management domain. Similarly, the API Endpoint in this"},{"line_number":113,"context_line":"diagram is bridging the untrusted public domain and the management domain,"},{"line_number":114,"context_line":"which should be configured to protect against attacks from the public domain"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_be6c879d","line":111,"range":{"start_line":111,"start_character":16,"end_line":111,"end_character":17},"updated":"2016-02-15 07:02:04.000000000","message":"Again, not a huge fan of this update as I think the ideas are in a single sentence to link them together.","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":123,"context_line":"to the management domain."},{"line_number":124,"context_line":""},{"line_number":125,"context_line":"The design of OpenStack is such that separation of security domains is"},{"line_number":126,"context_line":"difficult. Because core services will usually bridge at least two domains,"},{"line_number":127,"context_line":"special consideration must be given when applying security controls to them."},{"line_number":128,"context_line":""},{"line_number":129,"context_line":"Threat classification, actors and attack vectors"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_de098bdf","line":126,"range":{"start_line":126,"start_character":11,"end_line":126,"end_character":18},"updated":"2016-02-15 07:02:04.000000000","message":"+1 to this one","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":142,"context_line":"prevention. Security is a tradeoff between cost, usability and defense. In some"},{"line_number":143,"context_line":"cases it will not be possible to secure a cloud deployment against all of the"},{"line_number":144,"context_line":"threat actors we describe here. Those deploying an OpenStack cloud will have"},{"line_number":145,"context_line":"to decide where the balance lies for their deployment/usage."},{"line_number":146,"context_line":""},{"line_number":147,"context_line":"Intelligence services"},{"line_number":148,"context_line":"   Considered by this guide as the most capable"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_5ef61bd8","line":145,"range":{"start_line":145,"start_character":53,"end_line":145,"end_character":54},"updated":"2016-02-15 07:02:04.000000000","message":"+1 to this one as well.","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":155,"context_line":"  Highly capable and financially driven groups"},{"line_number":156,"context_line":"  of attackers. Able to fund in-house exploit development and target research."},{"line_number":157,"context_line":"  In recent years the rise of organizations such as the Russian Business"},{"line_number":158,"context_line":"  Network, a massive cyber-criminal enterprise, has demonstrated how cyber"},{"line_number":159,"context_line":"  attacks have become a commodity. Industrial espionage falls within the"},{"line_number":160,"context_line":"  serious organized crime group."},{"line_number":161,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_de306ba1","line":158,"range":{"start_line":158,"start_character":46,"end_line":158,"end_character":47},"updated":"2016-02-15 07:02:04.000000000","message":"+1 to this too.","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":185,"context_line":"different clouds for specific purposes. Users of a private cloud are typically"},{"line_number":186,"context_line":"employees of the organization that owns the cloud and are able to be held"},{"line_number":187,"context_line":"accountable for their actions. Employees often attend training sessions before"},{"line_number":188,"context_line":"accessing the cloud and will likely take part in regularly scheduled security"},{"line_number":189,"context_line":"awareness training. Public clouds by contrast cannot make any assertions about"},{"line_number":190,"context_line":"their users, cloud use-cases or user motivations. This immediately pushes the"},{"line_number":191,"context_line":"guest security domain into a completely *untrusted* state for public cloud"}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_3e26b768","line":188,"range":{"start_line":188,"start_character":49,"end_line":188,"end_character":58},"updated":"2016-02-15 07:02:04.000000000","message":"+1","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":227,"context_line":"Attack types"},{"line_number":228,"context_line":"------------"},{"line_number":229,"context_line":""},{"line_number":230,"context_line":"The diagram shows the types of attacks that may be expected from the actors"},{"line_number":231,"context_line":"described in the previous section. Note that there will always be exceptions to"},{"line_number":232,"context_line":"this diagram."},{"line_number":233,"context_line":""}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_7e203f4a","line":230,"range":{"start_line":230,"start_character":18,"end_line":230,"end_character":21},"updated":"2016-02-15 07:02:04.000000000","message":"I would move general or typical here, we want to underscore that they\u0027re some, or types, but not all.","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"93e8fa518dc4bb9d250391bb44ee3ace9bcbebd7","unresolved":false,"context_lines":[{"line_number":241,"context_line":"commercial public cloud deployments this might include prevention against"},{"line_number":242,"context_line":"serious crime. For those deploying private clouds for government use, more"},{"line_number":243,"context_line":"stringent protective mechanisms should be in place, including carefully"},{"line_number":244,"context_line":"protected facilities and supply chains. In contrast, those standing up basic"},{"line_number":245,"context_line":"development or test environments will likely require less restrictive controls"},{"line_number":246,"context_line":"(middle of the spectrum)."}],"source_content_type":"text/x-rst","patch_set":2,"id":"dae33548_5e1d7b0e","line":244,"range":{"start_line":244,"start_character":51,"end_line":244,"end_character":52},"updated":"2016-02-15 07:02:04.000000000","message":"+1","commit_id":"9834a732882245dbb2784140ada60e318ea8563b"},{"author":{"_account_id":12325,"name":"Nathaniel Dillon","email":"nathaniel.dillon@alumni.depaul.edu","username":"sicarie"},"change_message_id":"f05bf1ae266d4853a403f0f8f93dc9c8ee9185d9","unresolved":false,"context_lines":[{"line_number":61,"context_line":"instance use or allow unrestricted internet access to VMs should consider this"},{"line_number":62,"context_line":"domain to be *untrusted*. Private cloud providers may want to consider this"},{"line_number":63,"context_line":"network as internal and *trusted*, but only if the proper controls are"},{"line_number":64,"context_line":"implemented, to assert that the instances and all associated tenants are to"},{"line_number":65,"context_line":"be trusted."},{"line_number":66,"context_line":""},{"line_number":67,"context_line":"Management"}],"source_content_type":"text/x-rst","patch_set":4,"id":"dae33548_f1e8e67e","line":64,"range":{"start_line":64,"start_character":11,"end_line":64,"end_character":12},"updated":"2016-02-15 17:25:27.000000000","message":"I think it may be better to remove the \u0027, but\u0027 and this comma here, let it flow as a single, albeit long, sentence.","commit_id":"e40122f42720f60da18ed9fdb68ab0c0ce77a421"}]}