Perform a risk analysis on the process for the new community roles

[GuySartorelli]

Perform a risk analysis on the process for the new community roles.

We are thinking of granting more users some write access to our repos. We need to put in place controls to avoid compromising our security standards

Acceptance criteria

• Risk identified
• Risk are evaluated
• Controls are identified

Epic

• EPIC: Empower community members to be more involved in Silverstripe CMS OSS #141

Helpful links

• Maintainer guidelines
• Original proposal for the new roles

Risk assessment

Note that due to the vague language in the supporting documentation for these evaluations, my impact and likelihood assessments are fairly arbitrary at this stage.

• https://docs.google.com/spreadsheets/d/1uxP2FYRKb-0uxac_o4EnGWcqXc4op1iF3OlR9aAQb4k/ (Silverstripe employees only)

[GuySartorelli]

Requested changes made - also added "Automated testing" as an existing control

[emteknetnz]

Looks good to me - assigning to @maxime-rainville to have a look

[michalkleiner]

Can I get read access to the doc, please?

[maxime-rainville]

@michalkleiner I just granted you access.

[maxime-rainville]

@GuySartorelli I'm happy with the outcome. I would bump down the impact of XXX-YYY-R01 and XXX-YYY-R02.

They are other controls that should be considered like:

• requiring 2FA
• security audit
• regression testing.

[maxime-rainville]

Looks good. Can you create cards for the new controls that have not been implemented and add links in the spreadsheet for future reference?

[GuySartorelli]

As far as I can tell only the one issue is required, which already exists - I've added the link, and a note about why the other controls don't need issues.

[maxime-rainville]

Me happy.