Skip to content

Commit 52e468a

Browse files
wurstbrotwurstbrot
committed
current state
1 parent 58e67b7 commit 52e468a

7 files changed

Lines changed: 1785 additions & 311 deletions

File tree

‎README.md‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,3 +8,13 @@ docker run -ti -v $(pwd)/src/assets/YAML/:/var/www/html/src/assets/YAML wurstbro
88
# Afterwards, you can use the generated.yaml in a container
99
docker run -v $(pwd)/src/assets/YAML/generated/generated.yaml:/usr/share/nginx/html/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm
1010
```
11+
12+
## Credits
13+
14+
* The dimension _Test and Verification_ is based on Christian Schneiders [Security DevOps Maturity Model (SDOMM)](https://www.christian-schneider.net/SecurityDevOpsMaturityModel.html). _Application tests_ and _Infrastructure tests_ are added by Timo Pagel. Also, the sub-dimension _Static depth_ has been evaluated by security experts at [OWASP Stammtisch Hamburg](https://www.owasp.org/index.php/OWASP_German_Chapter_Stammtisch_Initiative/Hamburg).
15+
* The sub-dimension <i>Process</i> has been added after a discussion with [Francois Raynaud](https://www.linkedin.com/in/francoisraynaud/) that reactive activities are missing.
16+
* Enhancement of my basic translation is performed by [Claud Camerino](https://github.com/clazba).
17+
* Adding ISO 27001:2017 mapping, [Andre Baumeier](https://github.com/AndreBaumeier).
18+
* [OWASP Project Integration Project Writeup](https://github.com/OWASP/www-project-integration-standards/blob/master/writeups/owasp_in_sdlc/index.md) for providing documentation on different DevSecOps practices which are copied&pasted/ (and adopted) (https://github.com/northdpole, https://github.com/ThunderSon)
19+
* The requirements from [level 0](https://github.com/AppSecure-nrw/security-belts/blob/master/white/) are based on/copied from [AppSecure NRW](https://appsecure.nrw/)
20+
* The sub dimension _Test KPI_, _Triage_, _Dynamic depth for app/infra_, _Static depth for app/infra_ and some other vulnerability management activities are based/inspired by [Vulnerability Managment Maturity Model - Cheat Sheet V1.6](TODO FRANCESCO LINK)

‎src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml‎

Lines changed: 0 additions & 60 deletions
This file was deleted.

‎src/assets/YAML/default/InformationGathering/TestKPI.yaml‎

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
# yaml-language-server: $schema=../../schemas/dsomm-schema-information-gathering.json
2+
---
3+
Information Gathering:
4+
Test KPI:
5+
#Number of vulnerabilities - appsec - vuln management ?
6+
# Fix Rate?
7+
Number of vulnerabilities/severity:
8+
uuid: bc548cba-cb82-4f76-bd4b-325d9d256279
9+
risk: |-
10+
Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings.
11+
measure: |-
12+
Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly.
13+
description: |-
14+
Communication can be performed in a simple way, e.g. text based during the build process.
15+
This activity depends on at least one security testing implementation.
16+
difficultyOfImplementation:
17+
knowledge: 2
18+
time: 2
19+
resources: 2
20+
usefulness: 3
21+
level: 2
22+
dependsOn: []
23+
implementation: []
24+
references:
25+
samm2:
26+
- I-DM-3-B
27+
iso27001-2022:
28+
- 5.25
29+
- 5.12
30+
- 5.13
31+
- 5.10
32+
tags:
33+
- vulnerability-mgmt
34+
- metrics
35+
- vmm-measurement
36+
Patching mean time to resolution via PR:
37+
uuid: 86d490b9-d798-4a5b-a011-ab9688014c46
38+
risk: |-
39+
Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss.
40+
measure: |-
41+
Measurement and communication of patching Mean Time to Resolution (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis.
42+
This includes the measurement of the existence of a properly configured automated pull request (PR) tool (e.g., Dependabot or Renovate) in a repository.
43+
In addition, the measurement of the time from opening an automated PR to merging it.
44+
45+
Average time to patch is visualized per component/project/team.
46+
difficultyOfImplementation:
47+
knowledge: 1
48+
time: 1
49+
resources: 2
50+
usefulness: 3
51+
level: 2
52+
dependsOn:
53+
- uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches
54+
implementation: []
55+
references:
56+
samm2:
57+
- I-DM-3-B
58+
iso27001-2022:
59+
- 5.25
60+
- 5.12
61+
- 5.13
62+
- 5.10
63+
tags:
64+
- patching
65+
- metrics
66+
- vmm-measurements
67+
SLA per criticality: # is this the definition of SLAs or the measurement?
68+
uuid: 123e4567-e89b-12d3-a456-426614174000
69+
risk: |-
70+
Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of
71+
critical security issues, increasing the risk of exploitation and potential damage to the organization.
72+
measure: |-
73+
Measurement and communication of how many of the vulnerabilities handling per severity for components like applications are aligned to SLAs.
74+
This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application.
75+
At least quarterly.
76+
difficultyOfImplementation:
77+
knowledge: 2
78+
time: 2
79+
resources: 2
80+
usefulness: 3
81+
level: 3
82+
dependsOn: []
83+
implementation:
84+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo
85+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify
86+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics
87+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client
88+
references:
89+
samm2:
90+
- I-DM-3-B
91+
iso27001-2022:
92+
- 5.25
93+
- 5.12
94+
- 5.13
95+
- 5.10
96+
tags:
97+
- vulnerability-mgmt
98+
- metrics
99+
- vmm-measurements
100+
Patching mean time to resolution via production:
101+
uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f
102+
risk: |-
103+
Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss.
104+
measure: |-
105+
Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis.
106+
Average time to patch is visualized per component/project/team.
107+
difficultyOfImplementation:
108+
knowledge: 1
109+
time: 1
110+
resources: 2
111+
usefulness: 3
112+
level: 4
113+
dependsOn:
114+
- uuid:86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR
115+
- uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches
116+
implementation: []
117+
references:
118+
samm2:
119+
- I-DM-3-B
120+
iso27001-2017:
121+
- 16.1.4
122+
iso27001-2022:
123+
- 5.25
124+
tags:
125+
- patching
126+
- metrics
127+
- vmm-measurements
128+
Generation of response statistics:
129+
uuid: c922981b-65ed-40f3-a947-96fee9a0125f
130+
risk: No or delayed reaction to findings leads to potential exploitation of findings.
131+
measure: Creation and response statistics (e.g. Mean Time to Resolution) of findings. This is also referred to as _Mean Time to Resolve_.
132+
difficultyOfImplementation:
133+
knowledge: 2
134+
time: 2
135+
resources: 1
136+
usefulness: 3
137+
dependsOn:
138+
- Usage of a vulnerability management system
139+
level: 3
140+
implementation:
141+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo
142+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify
143+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics
144+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client
145+
references:
146+
samm2:
147+
- I-DM-2-B
148+
iso27001-2017:
149+
- 16.1.4
150+
- 8.2.3
151+
iso27001-2022:
152+
- 5.25
153+
- 5.10
154+
tags:
155+
- vulnerability-mgmt
156+
- metrics
157+
- vmm-measurements
158+
comments: "The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results)."
159+
Fix rate per repo/product:
160+
uuid: 123e4567-e89b-12d3-a456-426614174000
161+
risk: |-
162+
Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of
163+
critical security issues, increasing the risk of exploitation and potential damage to the organization.
164+
measure: |-
165+
Measurement and communication of the number of vulnerabilities handled per severity level for components such as applications, ensuring alignment with SLAs.
166+
The rate should be broken down by team, product, application, repository, and/or service. This analysis should be conducted at least quarterly.
167+
difficultyOfImplementation:
168+
knowledge: 2
169+
time: 2
170+
resources: 2
171+
usefulness: 3
172+
level: 3
173+
dependsOn:
174+
- uuid:123e4567-e89b-12d3-a456-426614174000
175+
implementation:
176+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo
177+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify
178+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics
179+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client
180+
references:
181+
samm2:
182+
- I-DM-3-B
183+
iso27001-2022:
184+
- 5.25
185+
- 5.12
186+
- 5.13
187+
- 5.10
188+
tags:
189+
- vulnerability-mgmt
190+
- metrics
191+
- vmm-measurements
192+

‎src/assets/YAML/default/InformationGathering/_meta.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,4 +2,4 @@ _meta:
22
label: Information Gathering
33
icon: Information Gathering.png
44
description: |-
5-
A markdown description of this dimension.
5+
Gathering of Information

0 commit comments

Comments
 (0)