Security Processes for FedRAMP
Key security responsibilities and processes customers must follow when deploying into Game Warden's FedRAMP-authorized environment.
This guide outlines key security responsibilities and processes customers must follow when deploying their applications into Game Warden's FedRAMP-authorized environment.
Incident response
While some Incident Response controls are limitedly inheritable, the responsibility of Incident Response falls on the customer.
If the customer has an incident, notify Second Front Security at security@secondfront.com. The Second Front Security Team will investigate following the Incident Response Plan.
If the incident requires intervention or communication with Second Front Security Team, the team will reach out to the customer via Slack or email to resolve the issue.
Application security requirements
The application security requirements outline the key security activities customers must complete and maintain to remain compliant with FedRAMP and agency expectations.
Common Vulnerabilities and Exposures (CVEs) remediation
The customer's sponsor reserves the right to approve any CVEs normally not accepted by Second Front. The customer must receive written approval from their sponsor.. Anything that is approved by the sponsor will need to be an operational requirement and a deviation request must be submitted to Agency Security and the 3PAO.
All CVEs must meet FedRAMP's Acceptance Baseline Criteria. You must remediate each CVE, or justify it for the Second Front Security Team to accept. For any CVE you cannot remediate, add it to your Plan of Action and Milestones (POA&M) documentation with real, actionable incremental milestones to reduce risk over time until you resolve it.
For any Critical or High CVE you cannot remediate (remove from the application before deployment), you must either submit a deviation request or create a POA&M with actionable milestones.
After you receive FedRAMP certification, the Second Front Security Team reviews each image's remediation and justifications before approving deployment to staging or production.
For any Critical or High CVE you cannot remediate (remove from the application before deployment), you must either submit a deviation request or create a POA&M with actionable milestones.
After you receive FedRAMP certification, the Second Front Security Team reviews each image's remediation and justifications before approving deployment to staging or production.
You must resolve or justify all Moderate and Low vulnerabilities that exceed FedRAMP remediation timelines before Production (PRD) deployment. Once Continuous Monitoring (ConMon) begins, these items move to a POA&M.
For Moderate and Low vulnerabilities still within their remediation window, customers must exercise due diligence to resolve or POA&M them before their respective deadlines.
For required timeframes to remediate or justify findings, see Tables A–C in the Acceptance Baseline Criteria.
External Data Connections (EDCs)
All customers must list all EDCs according to Agency Security's requirements for the Body of Evidence (BoE).
Authorization Boundary Diagram (ABD)
All customers must complete an ABD following the current FedRAMP processes found in the Authorization Boundary Diagram for Agency.
For any changes to the ABD, you must add a new diagram to your account and communicate the changes to Agency Security, 3PAO, and your sponsor.
Image hardening
You must harden all images using Game Warden's hardening script. Do not promote unhardened images to staging or production except for images without a shell, which do not require hardening.
Second Front's engineers will be responsible for applying hardening scripts to each image. Second Front Security Team will be responsible for ensuring engineers apply hardening scripts to images during the Security Review process.
Static Application Security Testing (SAST)
All customers must perform SAST scans on every codebase in images deployed to Game Warden. Customers must upload the SAST results to the Game Warden application for the initial deployment.
Dynamic Application Security Testing (DAST)
All customers are responsible for running DAST on their applications following FedRAMP ConMon requirements. Second Front offers an in-house DAST scanning service that you can use to meet these requirements.
ConMon
Once your application enters Game Warden's FedRAMP-authorized environment, it enters the FedRAMP ConMon process. FedRAMP requires ongoing security reporting and reviews to maintain platform and application security.
The sections below outline Second Front's responsibilities and yours during ConMon.
Game Warden's FedRAMP Certification ConMon
The Second Front Security Team submits Game Warden information once a month to meet FedRAMP requirements. This information covers the Game Warden Platform as a Service (PaaS) and does not include customer applications hosted on Game Warden. Second Front does not provide the platform ConMon reports to customers.
Second Front submits Asset Inventory Lists, Database Scans, Operating Systems Scans, and Web Application Scans (only for images that Second Front uses), and Second Front's POA&M. Second Front is not responsible for any of the customer's recurring submission requirements except for Database Scans.
Image scanning
The Game Warden application scans all production images for new CVEs/Vulnerabilities once a month. Agency Security will assist you in pulling down these scans so you can submit the images for ConMon.