You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: src/assets/YAML/default/BuildAndDeployment/Deployment.yaml
+43-31Lines changed: 43 additions & 31 deletions
Original file line number
Diff line number
Diff line change
@@ -49,7 +49,8 @@ Build and Deployment:
49
49
Unused applications are not maintained and may contain vulnerabilities.
50
50
Once exploited they can be used to attack other applications or
51
51
to perform lateral movements within the organization.
52
-
measure: A clear decommissioning process ensures the removal of unused applications.
52
+
measure: |-
53
+
A clear decommissioning process ensures the removal of unused applications from the `Inventory of production components` and if implemented from `Inventory of production artifacts`.
53
54
difficultyOfImplementation:
54
55
knowledge: 1
55
56
time: 2
@@ -129,8 +130,8 @@ Build and Deployment:
129
130
d3f:
130
131
- ApplicationConfigurationHardening
131
132
isImplemented: false
132
-
evidence: ""
133
-
comments: ""
133
+
tags:
134
+
- secret
134
135
Handover of confidential parameters:
135
136
uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a
136
137
risk:
@@ -169,19 +170,19 @@ Build and Deployment:
169
170
d3f:
170
171
- ApplicationConfigurationHardening
171
172
isImplemented: false
172
-
evidence: ""
173
-
comments: ""
174
-
Inventory of dependencies:
173
+
tags:
174
+
- secret
175
+
Inventory of production dependencies:
175
176
uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6
176
177
risk:
177
-
In case a vulnerability of severity high or critical is known by the organization,
178
-
it needs to be known where an artifacts with that vulnerability is deployed
178
+
Delayed identification of components and their vulnerabilities in production.
179
+
In case a vulnerability is known by the organization, it needs to be known where an artifacts with that vulnerability is deployed
179
180
with which dependencies.
180
181
measure:
181
-
A documented inventory of dependencies used in images and containers
182
+
A documented inventory of dependencies used in artifacts like container images and containers
182
183
exists.
183
184
dependsOn:
184
-
- Defined deployment process
185
+
- uuid:83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts
An organization is unaware of applications in production.
210
-
measure: A documented inventory or applications exists (gathered manually or automatically)
212
+
risk: |-
213
+
An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it.
214
+
measure: |-
215
+
A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production.
216
+
In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track.
#Number of vulnerabilities - appsec - vuln management ?
6
+
Number of vulnerabilities/severity:
7
+
uuid: bc548cba-cb82-4f76-bd4b-325d9d256279
8
+
risk: |-
9
+
Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings.
10
+
measure: |-
11
+
Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly.
12
+
description: |-
13
+
Communication can be performed in a simple way, e.g. text based during the build process.
14
+
This activity depends on at least one security testing implementation.
15
+
difficultyOfImplementation:
16
+
knowledge: 2
17
+
time: 2
18
+
resources: 2
19
+
usefulness: 3
20
+
level: 2
21
+
dependsOn: []
22
+
implementation: []
23
+
references:
24
+
samm2:
25
+
- I-DM-3-B
26
+
iso27001-2022:
27
+
- 5.25
28
+
- 5.12
29
+
- 5.13
30
+
- 5.10
31
+
tags:
32
+
- vulnerability-mgmt
33
+
- metrics
34
+
SLA per criticality:
35
+
uuid: 123e4567-e89b-12d3-a456-426614174000
36
+
risk: |-
37
+
Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of
38
+
critical security issues, increasing the risk of exploitation and potential damage to the organization.
39
+
measure: |-
40
+
Measurement and communication of how much vulnerabilities handling per severity for components like applications are aligned to SLAs.
Copy file name to clipboardExpand all lines: src/assets/YAML/default/implementations.yaml
+15-1Lines changed: 15 additions & 1 deletion
Original file line number
Diff line number
Diff line change
@@ -788,7 +788,7 @@ implementations:
788
788
uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9
789
789
name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business
931
+
backstage:
932
+
uuid: 2210e02b-a856-4da4-8732-5acd77e20fca
933
+
name: Backstage
934
+
tags: [documentation, inventory]
935
+
url: https://github.com/backstage/backstage
936
+
description: |
937
+
Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure.
Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API.
0 commit comments