Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add load testing, and generally improve #2569

Open
wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Add load testing, and generally improve #2569

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
be8e825
Add load testing, and generally improve
pburkholder Nov 21, 2024
e2bf143
Remove liaison, fix capital Cs
pburkholder Nov 21, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
46 changes: 32 additions & 14 deletions _docs/compliance/pentest.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,33 +5,50 @@ sidenav: true
title: Penetration and load test notification
---

If you, or a third party acting on your behalf, plan to perform a penetration test or significant load testing on your cloud.gov Platform applications, or cloud.gov Pages sites, please send the following information to [cloud.gov support]({{ site.baseurl }}/docs/help/) ahead of your planned test:
If you, or an authorized third party, plan to perform a penetration test or load test of your system on Cloud.gov, please send the following to [Cloud.gov support]({{ site.baseurl }}/docs/help/):

```text
* Web applications or website under test: Examples would include:
* System under test:
(Examples would include:
_webapp_.agency.gov or _webapp_.app.cloud.gov
_site_.agency.gov or preview_url.pages.cloud.gov
* Testing organization and contact/liaison information:
_site_.agency.gov or preview_url.pages.cloud.gov)
* Testing organization and contact information:
* Source IPs or IP ranges (for testers and their tools):
* Expected start date, (or "starting immediately"):
* Expected end date:
* Expected maximum load requests per minute (for load testing only):
* Acknowledgement that you are abiding by the terms at https://cloud.gov/docs/compliance/pentest/
```

This notification is only necessary for in-depth security testing or significant load-testing, which is a common step in agency ATO processes for customer systems and in the software development lifecycle. You don't need an approval, and cloud.gov doesn't provide approvals. Simply sending the notification is sufficient. You can always run routine automated vulnerability scans on your own applications without special notification.
The "system under test" is one of:

When arranging a security assessment or penetration test, the system under test is one of:
* Cloud.gov Platform: _your_ application at _application-name_.app.cloud.gov, or your external domain (e.g. https://agency.gov)
* Cloud.gov Pages: _your_ website at your preview URL (at `sites.pages.cloud.gov`), or your external domain (e.g. `_site_.agency.gov`)

* cloud.gov Platform: _your_ application at _application-name_.app.cloud.gov, or your external domain (e.g. https://agency.gov)
* cloud.gov Pages: _your_ website at your preview URL (at `sites.pages.cloud.gov`), or your external domain (e.g. `_site_.agency.gov`)
"Maximum load" must be limited to maximum reasonably expected load, e.g.,
"What might we expect the hour before filing deadline?" or "What if 'major pop star'
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we have this reference? Are we allowed to?

links to us and 5% of her followers click through?"[^1].

For cloud.gov Platform systems, you can also conduct testing of:
You don't need an approval, and Cloud.gov doesn't provide approvals. Simply sending the notification is sufficient.

You can always run routine automated vulnerability scans on your own applications without special notification.

## Testing considerations

**Pentesting**: When testing Cloud.gov Platform systems, you can also conduct testing of:
* Your application instance via `cf ssh`
* Your [brokered services]( {{ site.baseurl }}/docs/services/intro/) either directly or via `cf ssh` or `ssh` proxy.

**Infrastructure changes**: We do NOT make infrastructure changes to accommodate any tests, since you're to test under realistic conditions. Load testing from a single IP instance will likely be rate-limited, and not reflect performance under realistic conditions.

## Exclusions

All Cloud.gov products are under regular testing by our team, and by third-party assessors, as part of our Continuous Monitoring plan. FedRAMP® [makes the results available]({{ site.baseurl }}/docs/overview/fedramp-tracker/#start-the-ato-process) to authorized users.
**Additional testing by your team is not warranted nor authorized.**

You are not permitted to attempt any scanning or reconnaissance from your instances or brokered services.

You are not permitted to test the cloud.gov infrastructure, which comprises
You are not permitted to test the Cloud.gov infrastructure, which comprises
the following sites and web applications:

```text
Expand All @@ -41,10 +58,11 @@ the following sites and web applications:
https://*.fr.cloud.gov
```

(If you have a legacy application in the `.fr.cloud.gov` subdomain, please contact [support]( {{ site.baseur }}/contact/#support-for-people-who-use-cloudgov).)
Your assessment must not target other Cloud.gov customers, nor perform or simulate denial of service attacks or otherwise violate the [Amazon AWS testing policy](https://aws.amazon.com/security/penetration-testing/).

## Notifications

Your assessment must not target other cloud.gov customers, nor perform or simulate denial of service attacks or otherwise violate the [Amazon AWS testing policy](https://aws.amazon.com/security/penetration-testing/).
If you suspect that you have uncovered a vulnerability in any of Cloud.gov's products, please reference our [security.txt](https://cloud.gov/.well-known/security.txt)

If you suspect that you have uncovered a vulnerability in any of cloud.gov's products, please reference our [security.txt](https://cloud.gov/.well-known/security.txt)

All cloud.gov products are under regular testing by our team, and by third-party assessors, as part of our Continuous Monitoring plan. FedRAMP® [makes the results available]({{ site.baseurl }}/docs/overview/fedramp-tracker/#start-the-ato-process) to authorized users.
[^1]: This has happened with Cloud.gov applications, and it was fine. Tip: use [our CDN service]({{ site.base_url }}/docs/services/external-domain-service/#domain-with-cdn-plan).
Loading