Page MenuHomePhabricator

Investigate whether we can automatically share incident status docs with WMDE
Closed, ResolvedPublic

Description

Can we automatically share incident docs with WMDE?

This could be done with the sharing settings on the Incident Reports folder in Google Drive, where the status docs are created.

@JAufrecht notes:

You can share to a list of accounts (emails). I don't think there's any definition of a group that we could use, and sharing by url seems inadequately secure.

I've asked @Addshore and @Ladsgroup to help us figure out who that should be, given they were the ones involved in working this incident.

In parallel, is it a good idea to broaden the access on the entire folder? I think so, but I want to make sure -- for example, are there any categories of incident that need to be kept to strictly WMF staff, not even WMDE? My instinct is no, it's fine -- after all, WMDE folks are present in the IRC channel where security-sensitive issues are discussed -- but let's decide out loud.

Event Timeline

RLazarus triaged this task as Medium priority.Feb 5 2020, 7:24 PM
RLazarus created this task.

Usually and in large incident it's me and Adam that help with the incident from WMDE and I don't remember anyone else from WMDE helping in any large incidents. OTOH most of the devs have prod access and would be able to help if needed. I think @Lucas_Werkmeister_WMDE would be a great help too. I think, Adam, Lucas, and I can be given automatically and we will added any people if needed, if it happens too often, we let you know to add more people as a default.

Thanks! I'll bring this up in the SRE meeting on Monday and go ahead if no one objects.

"On Monday" turned out to be two weeks later -- sorry about that. Conclusions from today's SRE meeting, documented for posterity:

  • Yes, in principle we should do this.
  • Incident docs contain PII and other sensitive matter, so this requires an NDA on file for anyone we add, and a reminder that the contents of an incident status doc are confidential and can't be shared more broadly, even e.g. within WMDE.
  • We should also add a "confidential" label to the status doc template.
  • There's consensus among SRE to add the three specific folks named in this ticket, but we'll bring any future proposed additions back to the SRE meeting, rather than establishing a general rule.

I have a pending email to Legal to make sure I have all the details straight with respect to confidentiality policy. Assuming I get the thumbs up from them, I'll make the changes as described. Thanks WMDE friends for your patience.

"On Monday" turned out to be two weeks later -- sorry about that. Conclusions from today's SRE meeting, documented for posterity:

  • Yes, in principle we should do this.
  • Incident docs contain PII and other sensitive matter, so this requires an NDA on file for anyone we add, and a reminder that the contents of an incident status doc are confidential and can't be shared more broadly, even e.g. within WMDE.
  • We should also add a "confidential" label to the status doc template.
  • There's consensus among SRE to add the three specific folks named in this ticket, but we'll bring any future proposed additions back to the SRE meeting, rather than establishing a general rule.

I have a pending email to Legal to make sure I have all the details straight with respect to confidentiality policy. Assuming I get the thumbs up from them, I'll make the changes as described. Thanks WMDE friends for your patience.

Thank you for the update @RLazarus, greatly appreciated and thank you for trusting me :)

Sorry for the delay, but this is still in progress -- I've checked in with Legal and they're still working on it. Thanks for your patience, still.

This should be done! Thanks one last time for your patience.

@Addshore @Ladsgroup @Lucas_Werkmeister_WMDE You should see a "Status Documents" folder now shared with your @wikimedia.de accounts, and you'll automatically have access to new status docs for ongoing incidents as they're created there. You already know, but a reminder that those docs are confidential: please do not share them or discuss their contents with anyone else, even at WMDE.

Ping me if you have trouble getting in, or have any other questions.

Works for me, thanks! I added a description to the folder so we (in WMDE) hopefully don’t forget it’s confidential.