05/25/2022 SAR Security Review

Date	25 May 2022
Time	10.30 am
Duration	30 mts
Location	Zoom
Zoom
Attendees	Ashish Pandit Unknown User (mkgill) Daniel Quach Achraf Adenane Nathalie Gholmieh
Project/Program	Security Assessment remediation - SAR
Project Board	ITS PMO
Log Time
OTL
Objective(s)	Implement SAR Remediations

Notes:

Speaker	Description	Notes
SAR	Review the remediations that are ready for Security review	Ashish Pandit did send the items under security review to Achraf Adenane and Daniel Quach at least 1 day before the meeting, Thanks! Below remediations are under review: https://collab.ucsd.edu/display/SAR/RA-21+-+Ensure+developers+can+not+connect+to+iPaaS+System Currently, there are different ways for administrators, developers to connect to the ipaas system (UI, api, dev console etc). We need to decide which one is applicable for this risk. Current assumption is that admin and developer UI is in scope but machine to machine to interaction is excluded Decide possible changes actions based on the scope RA-104, 4 and 5 https://collab.ucsd.edu/display/SAR/SAR+29+-+Review+third-party+remote+access+to+ensure+access+is+still+required https://collab.ucsd.edu/display/SAR/Data+and+Data+flow+Classification https://collab.ucsd.edu/display/SAR/RA-5+Production+data+usage
	Next Steps	These remediations status will be updated as "Complete" by Achraf Adenane Unknown User (mkgill) to add the status "Out Of Scope" to list : Not Started Analysis - In Progress Analysis - Reviewed Solution - In Process Solution - Reviewed Out of Scope