security and monitoring

[nickabs]

Goals

Assumption some of the orgs that operate an ISN will not have large IT teams in support

• aim to make the live service as robust as possible, requiring minimal support

• migrate to slog

• improve logging and error handling

• migrate to Authorized Code Flow for logged in users

• risk assessment and pen tests - https://www.gov.uk/service-manual/technology/securing-your-information

• patching strategy

• metrics, monitoring and tracing

• DDOS protection (production - configure protection in load balancer)

• backup and recovery (db vendor dependent - plan to configure Neon for initial production versions)

• explore neon database branches to see if it can improve developer experience

• https://www.gov.uk/service-manual/technology/uptime-and-availability-keeping-your-service-online