Skip to content

Commit 58e67b7

Browse files
committed
feat: add vuln
1 parent 125f5ee commit 58e67b7

6 files changed

Lines changed: 126 additions & 43 deletions

File tree

src/assets/YAML/default/BuildAndDeployment/Deployment.yaml

Lines changed: 43 additions & 31 deletions
Original file line numberDiff line numberDiff line change
@@ -49,7 +49,8 @@ Build and Deployment:
4949
Unused applications are not maintained and may contain vulnerabilities.
5050
Once exploited they can be used to attack other applications or
5151
to perform lateral movements within the organization.
52-
measure: A clear decommissioning process ensures the removal of unused applications.
52+
measure: |-
53+
A clear decommissioning process ensures the removal of unused applications from the `Inventory of production components` and if implemented from `Inventory of production artifacts`.
5354
difficultyOfImplementation:
5455
knowledge: 1
5556
time: 2
@@ -129,8 +130,8 @@ Build and Deployment:
129130
d3f:
130131
- ApplicationConfigurationHardening
131132
isImplemented: false
132-
evidence: ""
133-
comments: ""
133+
tags:
134+
- secret
134135
Handover of confidential parameters:
135136
uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a
136137
risk:
@@ -169,19 +170,19 @@ Build and Deployment:
169170
d3f:
170171
- ApplicationConfigurationHardening
171172
isImplemented: false
172-
evidence: ""
173-
comments: ""
174-
Inventory of dependencies:
173+
tags:
174+
- secret
175+
Inventory of production dependencies:
175176
uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6
176177
risk:
177-
In case a vulnerability of severity high or critical is known by the organization,
178-
it needs to be known where an artifacts with that vulnerability is deployed
178+
Delayed identification of components and their vulnerabilities in production.
179+
In case a vulnerability is known by the organization, it needs to be known where an artifacts with that vulnerability is deployed
179180
with which dependencies.
180181
measure:
181-
A documented inventory of dependencies used in images and containers
182+
A documented inventory of dependencies used in artifacts like container images and containers
182183
exists.
183184
dependsOn:
184-
- Defined deployment process
185+
- uuid:83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts
185186
- SBOM of components
186187
difficultyOfImplementation:
187188
knowledge: 2
@@ -190,7 +191,9 @@ Build and Deployment:
190191
usefulness: 3
191192
level: 3
192193
implementation:
194+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage
193195
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack
196+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector
194197
references:
195198
samm2:
196199
- I-SD-2-A
@@ -200,22 +203,29 @@ Build and Deployment:
200203
iso27001-2022:
201204
- 5.9
202205
- 5.12
203-
isImplemented: false
204-
evidence: ""
205206
comments: ""
206-
Inventory of production applications:
207+
tags:
208+
- inventory
209+
- sbom
210+
Inventory of production components:
207211
uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f
208-
risk:
209-
An organization is unaware of applications in production.
210-
measure: A documented inventory or applications exists (gathered manually or automatically)
212+
risk: |-
213+
An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it.
214+
measure: |-
215+
A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production.
216+
In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track.
211217
dependsOn:
218+
- Defined deployment process
212219
difficultyOfImplementation:
213-
knowledge: 2
214-
time: 2
215-
resources: 3
216-
usefulness: 3
217-
level: 3
218-
implementation: []
220+
knowledge: 1
221+
time: 1
222+
resources: 1
223+
usefulness: 4
224+
level: 1
225+
implementation:
226+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage
227+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack
228+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector
219229
references:
220230
samm2:
221231
- I-SD-2-A
@@ -225,25 +235,28 @@ Build and Deployment:
225235
iso27001-2022:
226236
- 5.9
227237
- 5.12
228-
isImplemented: false
229-
evidence: ""
230-
comments: ""
238+
tags:
239+
- inventory
231240
Inventory of production artifacts:
232241
uuid: 83057028-0b77-4d2e-8135-40969768ae88
233242
risk:
234243
In case a vulnerability of severity high or critical exists, it needs
235244
to be known where an artifacts (e.g. container image) with that vulnerability
236245
is deployed.
237-
measure: A documented inventory or a possibility to gather the needed information.
246+
measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically).
238247
dependsOn:
239248
- Defined deployment process
249+
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
240250
difficultyOfImplementation:
241251
knowledge: 2
242252
time: 2
243253
resources: 3
244254
usefulness: 3
245-
level: 3
246-
implementation: []
255+
level: 2
256+
implementation:
257+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage
258+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack
259+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector
247260
references:
248261
samm2:
249262
- I-SD-2-A
@@ -253,9 +266,8 @@ Build and Deployment:
253266
iso27001-2022:
254267
- 5.9
255268
- 5.12
256-
isImplemented: false
257-
evidence: ""
258-
comments: ""
269+
tags:
270+
- inventory
259271
Rolling update on deployment:
260272
uuid: 85d52588-f542-4225-a338-20dc22a5508d
261273
risk: While a deployment is performed, the application can not be reached.

src/assets/YAML/default/InformationGathering/Logging.yaml

Lines changed: 0 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -30,9 +30,6 @@ Information Gathering:
3030
iso27001-2022:
3131
- Not explicitly covered by ISO 27001 - too specific
3232
- 8.15
33-
isImplemented: false
34-
evidence: ""
35-
comments: ""
3633
Centralized system logging:
3734
uuid: 4eced38a-7904-4c45-adb0-50b663065540
3835
risk:
Lines changed: 60 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
# yaml-language-server: $schema=../../schemas/dsomm-schema-information-gathering.json
2+
---
3+
Information Gathering:
4+
Test KPI:
5+
#Number of vulnerabilities - appsec - vuln management ?
6+
Number of vulnerabilities/severity:
7+
uuid: bc548cba-cb82-4f76-bd4b-325d9d256279
8+
risk: |-
9+
Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings.
10+
measure: |-
11+
Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly.
12+
description: |-
13+
Communication can be performed in a simple way, e.g. text based during the build process.
14+
This activity depends on at least one security testing implementation.
15+
difficultyOfImplementation:
16+
knowledge: 2
17+
time: 2
18+
resources: 2
19+
usefulness: 3
20+
level: 2
21+
dependsOn: []
22+
implementation: []
23+
references:
24+
samm2:
25+
- I-DM-3-B
26+
iso27001-2022:
27+
- 5.25
28+
- 5.12
29+
- 5.13
30+
- 5.10
31+
tags:
32+
- vulnerability-mgmt
33+
- metrics
34+
SLA per criticality:
35+
uuid: 123e4567-e89b-12d3-a456-426614174000
36+
risk: |-
37+
Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of
38+
critical security issues, increasing the risk of exploitation and potential damage to the organization.
39+
measure: |-
40+
Measurement and communication of how much vulnerabilities handling per severity for components like applications are aligned to SLAs.
41+
At least quarterly.
42+
difficultyOfImplementation:
43+
knowledge: 2
44+
time: 2
45+
resources: 2
46+
usefulness: 3
47+
level: 3
48+
dependsOn: []
49+
implementation: []
50+
references:
51+
samm2:
52+
- I-DM-3-B
53+
iso27001-2022:
54+
- 5.25
55+
- 5.12
56+
- 5.13
57+
- 5.10
58+
tags:
59+
- vulnerability-mgmt
60+
- metrics

src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -152,7 +152,7 @@ Test and Verification:
152152
- 8.28 # Secure coding
153153
isImplemented: false
154154
dependsOn:
155-
- Inventory of production applications
155+
- uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
156156
comments: ""
157157
Static analysis for all components/libraries:
158158
uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054
@@ -167,7 +167,7 @@ Test and Verification:
167167
dependsOn:
168168
- Static analysis for important client side components
169169
- Static analysis for important server side components
170-
- Inventory of production applications
170+
- uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
171171
implementation: []
172172
references:
173173
samm2:
@@ -202,7 +202,7 @@ Test and Verification:
202202
dependsOn:
203203
- Static analysis for important client side components
204204
- Static analysis for important server side components
205-
- Inventory of production applications
205+
- uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
206206
references:
207207
samm2:
208208
- V-ST-2-A
@@ -236,7 +236,7 @@ Test and Verification:
236236
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension
237237
dependsOn:
238238
- Defined build process
239-
- Inventory of production applications
239+
- uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
240240
references:
241241
samm2:
242242
- V-ST-2-A
@@ -269,7 +269,7 @@ Test and Verification:
269269
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension
270270
dependsOn:
271271
- Defined build process
272-
- Inventory of production applications
272+
- uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
273273
references:
274274
samm2:
275275
- V-ST-2-A
@@ -323,7 +323,7 @@ Test and Verification:
323323
level: 3
324324
dependsOn:
325325
- Defined build process
326-
- Inventory of production applications
326+
- uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
327327
implementation:
328328
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js
329329
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit
@@ -353,7 +353,7 @@ Test and Verification:
353353
level: 2
354354
dependsOn:
355355
- Defined build process
356-
- Inventory of production applications
356+
- uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
357357
implementation:
358358
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che
359359
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack

src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -121,7 +121,7 @@ Test and Verification:
121121
isImplemented: false
122122
evidence: ""
123123
comments: ""
124-
Regular tests:
124+
Regular automated tests:
125125
uuid: 598897a2-358e-441f-984c-e12ec4f6110a
126126
risk:
127127
After pushing source code to the version control system, any delay in

src/assets/YAML/default/implementations.yaml

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -788,7 +788,7 @@ implementations:
788788
uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9
789789
name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM).
790790
url: https://github.com/DependencyTrack/dependency-track
791-
tags: [sca, inventory, OpenSource, "Supply Chain", vulnerability]
791+
tags: [sca, inventory, OpenSource, "Supply Chain", vulnerability, inventory]
792792
juice-shop:
793793
uuid: c021aa72-c71c-43e4-9573-717b74d6c19d
794794
name: OWASP Juice Shop
@@ -928,3 +928,17 @@ implementations:
928928
url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html
929929
description: |
930930
There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business
931+
backstage:
932+
uuid: 2210e02b-a856-4da4-8732-5acd77e20fca
933+
name: Backstage
934+
tags: [documentation, inventory]
935+
url: https://github.com/backstage/backstage
936+
description: |
937+
Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure.
938+
image-metadata-collector:
939+
uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c
940+
name: Image Metadata Collector
941+
tags: [documentation, inventory, kubernetes]
942+
url: https://github.com/SDA-SE/image-metadata-collector/
943+
description: |
944+
Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API.

0 commit comments

Comments
 (0)