Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Updates/privacy irp #4

Open
wants to merge 54 commits into
base: master
Choose a base branch
from
Open
Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
54 commits
Select commit Hold shift + click to select a range
cee8b2e
updating headers for these pages policies still apply
allgood2386 Dec 17, 2019
25596bf
Merge pull request #12 from Bixal/helpdesk_irp_changes
allgood2386 Dec 17, 2019
0e2eabc
updating headers for these pages policies still apply
allgood2386 Dec 17, 2019
5e58b20
more updates removing gitlab and replacing it with our information
allgood2386 Dec 17, 2019
5b983e6
Merge pull request #13 from Bixal/helpdesk_irp_changes
allgood2386 Dec 17, 2019
2ba4a15
This updates a single link to the correct cname
allgood2386 Dec 17, 2019
2127a30
Merge pull request #14 from Bixal/update_links_readme
allgood2386 Dec 17, 2019
6788afe
updating links, and offical communication channels
allgood2386 Dec 20, 2019
1c43290
Merge branch 'master' of github.com:Bixal/techbook into helpdesk_irp_…
allgood2386 Dec 20, 2019
50fd67f
Merge pull request #15 from Bixal/icrp_updates_andtodo_fixes
allgood2386 Dec 20, 2019
7cd0d95
More updates
allgood2386 Dec 20, 2019
88c9a78
Merge pull request #16 from Bixal/icrp_updates_andtodo_fixes
allgood2386 Dec 20, 2019
e750d66
lots of linting and channel name updates
allgood2386 Dec 20, 2019
aac779f
Merge pull request #17 from Bixal/linting
allgood2386 Dec 20, 2019
8859c73
more text fixes
allgood2386 Dec 20, 2019
fbc97e2
Merge pull request #18 from Bixal/linting
allgood2386 Dec 20, 2019
5186edb
removed ref to gitlab and renamed file to generic git
allgood2386 Dec 20, 2019
1ee5202
Merge pull request #19 from Bixal/gitlabfix
allgood2386 Dec 20, 2019
b4c5a27
updated email address
allgood2386 Dec 30, 2019
14f4fa7
Merge pull request #20 from Bixal/gitlabfix
allgood2386 Dec 30, 2019
532f1a5
breaking down standards to technology rather than drupal, moving drup…
allgood2386 Dec 30, 2019
7f6b3af
Inital infra documentation
allgood2386 Dec 30, 2019
195a673
init aws and general documentation
allgood2386 Dec 30, 2019
ef400b9
finishing the list of technologies for IAC
allgood2386 Dec 30, 2019
f66e076
Pushing changes made to this file thus far to make sure I'm on the ri…
jeffgreenberg Dec 30, 2019
a86b64c
Updated awareness.md with BitWarden option
g3r4 Dec 31, 2019
d75b936
aws configuration information
allgood2386 Dec 31, 2019
b357d78
aws configuration information
allgood2386 Dec 31, 2019
b47ab85
Merge pull request #23 from Bixal/g3r4-bitwarden
allgood2386 Dec 31, 2019
eae51b5
FedRAMP information
allgood2386 Dec 31, 2019
b9e9025
edited and provided an example of what needs to be changed for aws cl…
tyler-bixal Jan 9, 2020
edd04d5
Merge pull request #22 from Bixal/infrastructure-docs
allgood2386 Jan 9, 2020
61efc3d
Added reference links for VS Code and PhpStorm (with licensing info f…
paoga87 Jan 10, 2020
5ccfac7
Fixed my awful syntax on previous commit
paoga87 Jan 10, 2020
0d9ca3a
Adding addtional information on setting up the all hands meeting
allgood2386 Feb 6, 2020
37fdd07
Merge pull request #25 from Bixal/adding-all-hands-placeholder
allgood2386 Feb 6, 2020
2d779a3
add G Suite User Provisioning
Feb 13, 2020
63b988b
Merge pull request #26 from tylerwel/master
allgood2386 Feb 13, 2020
45e109f
Merge pull request #21 from Bixal/drupal_engineering_updates
allgood2386 Mar 13, 2020
bfca611
adding a software request form and process
allgood2386 Mar 13, 2020
f3f953a
Merge pull request #27 from Bixal/software_request_process
allgood2386 Apr 14, 2020
8a87003
init privacy incident response document
allgood2386 Apr 28, 2020
de40442
init privacy incident response document
allgood2386 Apr 28, 2020
c9a9de5
Risk Assement Addtions
allgood2386 Apr 28, 2020
1291b33
risk assement categorization and levels
allgood2386 Apr 28, 2020
24679a8
mitigations
allgood2386 Apr 28, 2020
a6b7c97
methods of notification
allgood2386 Apr 28, 2020
1e5d841
methods of notification
allgood2386 Apr 28, 2020
4b61d3e
replacing some language
allgood2386 Apr 28, 2020
76d0dde
Merge pull request #29 from Bixal/pii_response
allgood2386 Apr 29, 2020
4103b7e
Merge pull request #1 from Bixal/master
tylerwel May 27, 2020
d7278a2
add security@bixal.com to phishing section
May 27, 2020
21be3d7
Merge pull request #33 from tylerwel/master
allgood2386 May 28, 2020
5359c71
Minor updates to the Bixal Solutions Privacy Incident Response Plan, IRP
paoga87 May 28, 2020
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 4 additions & 6 deletions CODEOWNERS
Validating CODEOWNERS rules …
Original file line number Diff line number Diff line change
Expand Up @@ -2,10 +2,8 @@
# Each line is a file pattern followed by one or more owners.
# Order is important. The last matching pattern has the most precedence.

# These owners will be the default owners for everything in the repo.
# * @Bixal/@todo-team

# These will automatically assign PRs that touch files in these directories to their respective teams for review.
docs/00-engineering/* @Bixal/@todo-team @Bixal/docs
docs/01-security/* @Bixal/@todo-team @Bixal/docs
docs/02-help-desk/* @Bixal/@todo-team @Bixal/docs
# @todo test ownership and mappings
# docs/00-engineering/* @Bixal/@Development @Bixal/docs
# docs/01-security/* @Bixal/@Security @Bixal/docs
# docs/02-help-desk/* @Bixal/@ITOperations @Bixal/docs
2 changes: 1 addition & 1 deletion README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@ This Techbook has been prepared to describe Bixal Soulutions philosophy, working

## This is not really the README you are looking for.

The main techbook README is located at [docs/README.md](docs/README.md), which gets synced to readthedocs at <https://bixal-techbook.bixal.com/en/latest/README/>
The main techbook README is located at [docs/README.md](docs/README.md), which gets synced to readthedocs at <https://techbook.bixal.com/en/latest/README/>

## Bixal Solutions, Inc.

Expand Down
Empty file.
7 changes: 7 additions & 0 deletions docs/00-engineering/Php/composer.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
# Composer

Composer is the depenency manager of choice for most Php projects at Bixal and in the general Php community. You can find general information on Composer and usage at their [documentation](https://getcomposer.org/doc/) page.

## Composer at Bixal

Most projects at Bixal will include some standardized way to manage php dependencies using composer, and ensuring you are installing the correct version of depenencies. Because projects recieve various levels of support, they may be running php 7.2, 7.3, or 7.4. If you install composer locally this leads to a lot of php shim usage, and version switching. While this is possible, it tends to lead to mistakes. Bixal usually provides some sort of [automated command](https://github.com/Bixal/drupal-project/blob/8.x/Makefile#L54), which uses a reference .env file to ensure all versions installed, or updated are using the correct version of php.
425 changes: 425 additions & 0 deletions docs/00-engineering/Php/drupal.md

Large diffs are not rendered by default.

20 changes: 2 additions & 18 deletions docs/00-engineering/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,22 +4,6 @@

## Biweekly Engineering Call

Every two weeks we hold a one hour meeting for the whole engineering team. We have a [git repository on our self-host GitLab](https://git.civicactions.net/civicactions/engineering-call) for documentation and notes about the calls.
Every two weeks we hold a one hour meeting for the whole engineering team.

Ordinarily, the facilitator for the meeting is rotated through the list of engineers alphabetically by first name. The tasks of the facilitator is described below:

### Facilitator: Before the Engineering Call

* Set the agenda for the call. Typically we have been doing a [festivus](https://en.wikipedia.org/wiki/Festivus) style agenda, which is simply: 1. One or more Feasts (a discussion, a demo, a presentation), 2. General time of sharing our *Feats of Strength*, and *Airing of Grievances*. Feel free to experiment with a different agenda entirely.
* Make sure that one or more persons is ready to lead us in a feast, or in some way make use of our time together. This can be done via slack emoji voting.
* Several minutes before the call, remind the team that the call is about to start.

### Facilitator: During the Engineering Call

Describe the agenda and start the meeting. Keep track of the time and try to either encourage more discussion or wrap things up depending on the time remaining.

### Facilitator: After the Engineering Call

* Inform the next person in the [schedule](https://git.civicactions.net/civicactions/engineering-call/blob/master/schedule.md) that they are responsible to be the facilitator for the next engineering call. If that person is unable to lead the next call, then they are responsible to ask the next person on the list. If that person is not responding (on vacation, etc) then you are responsible to ask the next person on the list.
* Record the topic in our engineering-call git repository README.md file under "Past Feasts" (ask @daven for help if needed): <https://git.civicactions.net/civicactions/engineering-call>
* Add any other things to the git repo as you feel is appropriate.
An agenda is laid out each week along with time to bring up technology related items.
42 changes: 21 additions & 21 deletions docs/00-engineering/accessibility.md
Original file line number Diff line number Diff line change
Expand Up @@ -25,35 +25,35 @@ We implement 508 and WCAG compliant websites so that people with all types of di
* Form buttons should have descriptive values.
* Color should not be used as the sole method of conveying content or distinguishing visual elements.
* Color alone is not used to distinguish links from surrounding text unless the luminance contrast between the link and the surrounding text is at least 3:1 and an additional differentiation (e.g., it becomes underlined) is provided when the link is hovered over or receives focus.
* The page should be readable and functional when the text size is doubled. We need to use rem font-sizing to make the text scales as expected when the web-page is zoomed-in. Also provides reliable text-resizing in smaller browser widths.
* Need to have adequate line spacing (at least 1/2 the height of the text) and paragraph spacing (1.5 times line spacing).
* The page should be readable and functional when the text size is doubled. We need to use rem font-sizing to make the text scales as expected when the web-page is zoomed-in. Also provides reliable text-resizing in smaller browser widths.
* Need to have adequate line spacing (at least 1/2 the height of the text) and paragraph spacing (1.5 times line spacing).

## Making Accessible Links

* Don't use the word "link" in your links or the term "click here".
* Don't capitalize links: Some screenreaders read capitalized text letter by letter.
* Avoid ASCII characters. Text alternatives are recommended for ASCII smiley faces. If a link involves dashes (17 - 18 years), it is better to replace the hyphen with "to". Screen-readers do not read ASCII characters.
* Avoid using URLs as link text. Screenreaders read URL's letter by letter. Use descriptive link text.
* Keep link text concise.
* Generally, restrict the number of text links on a page. An exception to this rule is pagination/alphabetized links and these should include further contextual information/link text.
* Be aware of pagination and alphabetized links: To make pagination links accessible, add text like "Go to page 1 | 2 | 3 .." before the pagination links. For alphabetized links (eg. glossary links), add a descriptive title before the links. See attached screenshot.
* Always alert the user when opening new windows. It is important to alert visually-challenged users that a new window has been opened. The best way to indicate that a link opens in a new window is to add text to the link, such as "(opens in new window)".
* Be mindful when using anchor links. Adding descriptive text like Jump to.. or On this page will help indicate that the link is within the same page.
* Further reading: <https://www.sitepoint.com/15-rules-making-accessible-links/>
* Don't use the word "link" in your links or the term "click here".
* Don't capitalize links: Some screenreaders read capitalized text letter by letter.
* Avoid ASCII characters. Text alternatives are recommended for ASCII smiley faces. If a link involves dashes (17 - 18 years), it is better to replace the hyphen with "to". Screen-readers do not read ASCII characters.
* Avoid using URLs as link text. Screenreaders read URL's letter by letter. Use descriptive link text.
* Keep link text concise.
* Generally, restrict the number of text links on a page. An exception to this rule is pagination/alphabetized links and these should include further contextual information/link text.
* Be aware of pagination and alphabetized links: To make pagination links accessible, add text like "Go to page 1 | 2 | 3 .." before the pagination links. For alphabetized links (eg. glossary links), add a descriptive title before the links. See attached screenshot.
* Always alert the user when opening new windows. It is important to alert visually-challenged users that a new window has been opened. The best way to indicate that a link opens in a new window is to add text to the link, such as "(opens in new window)".
* Be mindful when using anchor links. Adding descriptive text like Jump to.. or On this page will help indicate that the link is within the same page.
* Further reading: <https://www.sitepoint.com/15-rules-making-accessible-links/>

## Accessibility Tools

Extensions for testing accessibility:

* [WAVE Evaluation Tool](https://chrome.google.com/webstore/detail/wave-evaluation-tool/jbbplnpkjmmeebjpijfedlgcdilocofh)
* [Color Contrast Analyzer](https://chrome.google.com/webstore/detail/color-contrast-analyzer/dagdlcijhfbmgkjokkjicnnfimlebcll)
* [Luminosity ratio analyzer](https://chrome.google.com/webstore/detail/wcag-luminosity-contrast/lllpnmpooomecmbmijbmbikaacgfdagi)
* [WAVE Evaluation Tool](https://chrome.google.com/webstore/detail/wave-evaluation-tool/jbbplnpkjmmeebjpijfedlgcdilocofh)
* [Color Contrast Analyzer](https://chrome.google.com/webstore/detail/color-contrast-analyzer/dagdlcijhfbmgkjokkjicnnfimlebcll)
* [Luminosity ratio analyzer](https://chrome.google.com/webstore/detail/wcag-luminosity-contrast/lllpnmpooomecmbmijbmbikaacgfdagi)

## Resources

* [Drupal Accessibility Guidelines](https://drupal.org/node/1637990)
* [WCAG](http://www.w3.org/WAI/intro/wcag)
* [WAVE toolbar](http://wave.webaim.org/toolbar/)
* [Color Contrast Analyzer Chrome Extension](https://chrome.google.com/webstore/detail/color-contrast-analyzer/dagdlcijhfbmgkjokkjicnnfimlebcll)
* [Luminosity ratio analyzer Chrome Extension](https://chrome.google.com/webstore/detail/wcag-luminosity-contrast/lllpnmpooomecmbmijbmbikaacgfdagi)
* [Comprehensive guide for making Accessible Links](https://www.sitepoint.com/15-rules-making-accessible-links/)
* [Drupal Accessibility Guidelines](https://drupal.org/node/1637990)
* [WCAG](http://www.w3.org/WAI/intro/wcag)
* [WAVE toolbar](http://wave.webaim.org/toolbar/)
* [Color Contrast Analyzer Chrome Extension](https://chrome.google.com/webstore/detail/color-contrast-analyzer/dagdlcijhfbmgkjokkjicnnfimlebcll)
* [Luminosity ratio analyzer Chrome Extension](https://chrome.google.com/webstore/detail/wcag-luminosity-contrast/lllpnmpooomecmbmijbmbikaacgfdagi)
* [Comprehensive guide for making Accessible Links](https://www.sitepoint.com/15-rules-making-accessible-links/)
32 changes: 32 additions & 0 deletions docs/00-engineering/application-standards.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,32 @@
# Application Standards

## 12 Factor Application

Tldr; An application which can **EASILY** be run in a ephemeral (cattle, not pets) manner.

* Use declarative formats for setup automation, to minimize time and cost for new developers joining the project.
* Have a clean contract with the underlying operating system, offering maximum portability between execution environments.
* Are suitable for deployment on modern cloud platforms, obviating the need for servers and systems administration.
* Minimize divergence between development and production, enabling continuous deployment for maximum agility.
* And can scale up without significant changes to tooling, architecture, or development practices.

The entirety of the document can and should be read at [https://12factor.net/](12factor.net)

## Coding Standards

* We follow established best practices so we can easily work with each others code, and contribute back.
* We don't hard code
* We stand behind the YAGNI (You ain't gonna need it) philosophy and avoid "gold plating."
* When writing code, our code should solve ONLY and EXACTLY the use case that we are trying to support. In many instances we have a desired to make things MORE FLEXIBLE for the FUTURE but that is code we will have to support without knowing whether any of those use cases will ever come up.
Another big reason for wanting to be FLEXIBLE is that refactoring is hard, and feels easier to have flexibility at front, but that is why we write automattests, so refactoring will not be as painful.

## Debugging

* When debugging, we double check for false positives. We alway cross check a positive result in case that positive result is the ONLY result, instead of one of many possible results.
* We validate assumptions, so that we work on the right thing.
* Am I assuming this is a browser/presentation issue?
* Am I assuming this is a network issue?
* Am I assuming this is a Header Iss
* Am I assuming this is an issue with a specific module?
* When we get 400 or 500 responses, we check the logs under Docker Compose logs.
* We use browser like Chrome dev console or Firebug tools to identify JS and server issues so that we don't miss issues between the browser and Drupal.
Loading