Write up how Federalist defends against malicious code in submitted sites

[wslack]

User Story

As a person considering using Federalist, I want to know that malicious outside code can't bring down my build container.

Background (Optional)

This is a common question.

Acceptance Criteria

• We've looked up the documentation about this and recorded a list of links.
• We've written down what happens if someone submits malicious code that "takes over" a process to run a cryptominer.
• We've written down what happens if someone submits malicious code that "takes over" a process to seek to steal the S3 keys that Federalist uses.

After evaluating, edit this part:

Level of effort - medium

Implementation outline (if higher than "low" effort):

[jseppi]

Will create a google doc

[wslack]

@el-mapache interested in this one?

[jseppi]

Is this even necessary? Has it come up during the pre-ATO work?

[wslack]

Its more a thing for customer conversations. It comes up in sales meetings and we don't clearly explain it anywhere.

[amirbey]

Slack thread with cg-support
https://gsa-tts.slack.com/archives/C09CR1Q9Z/p1529605421000647

[amirbey]

https://drive.google.com/open?id=1jd7wnIMT9gb643WnTIUMhD7VE3viRsDwb_FkJf-hn-c

[jmhooper]

✅