Skip to content

Commit 8cd0cf9

Browse files
committed
Review Build & Deployment, level 1
1 parent 057778a commit 8cd0cf9

4 files changed

Lines changed: 66 additions & 34 deletions

File tree

src/assets/YAML/default/BuildAndDeployment/Build.yaml

Lines changed: 21 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ Build and Deployment:
2828
level: 2
2929
implementation:
3030
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools
31-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technologi
31+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology
3232
references:
3333
samm2:
3434
- I-SB-2-A
@@ -42,37 +42,42 @@ Build and Deployment:
4242
Defined build process:
4343
uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b
4444
description: |
45-
A *build process* include more than just compiling your source code.
46-
It also includes steps such as managing (third party) dependencies,
47-
environment configuration, running the unit tests, etc.
48-
49-
A *defined build process* has automated these steps to ensure consistency.
45+
A *build process* includes more than just compiling your source code. It also covers:
46+
- Managing (third party) dependencies
47+
- Environment configuration
48+
- Running unit and integration tests
49+
- Security scanning and compliance checks
50+
- Artifact creation and storage
51+
- Deployment preparation
5052
51-
This can be done with a Jenkinsfile, Maven, or similar tools.
53+
A *defined build process* automates these steps to ensure consistency, reproducibility, and security. Automation reduces human error and enforces security controls. Use tools such as Jenkins, GitHub Actions, GitLab CI, or Maven to codify the process.
5254
risk:
53-
Performing builds without a defined process is error prone; for example,
54-
as a result of incorrect security related configuration.
55+
Performing builds without a defined and automated process is error-prone and increases the risk of security misconfigurations, unauthorized changes, and supply chain attacks.
5556
measure:
56-
A well defined build process lowers the possibility of errors during
57-
the build process.
57+
A well-defined, automated, and auditable build process lowers the possibility of errors and unauthorized changes during the build process. It also enables traceability and rapid response to incidents.
58+
level: 1
5859
difficultyOfImplementation:
5960
knowledge: 2
6061
time: 3
6162
resources: 2
6263
usefulness: 4
63-
level: 1
6464
assessment: |
65-
- Show your build pipeline and an exemplary job (build + test).
66-
- Show that every team member has access.
67-
- Show that failed jobs are fixed.
65+
- Show your build pipeline configuration (e.g., Jenkinsfile, GitHub Actions workflow) and an exemplary job (build + test + security scan).
66+
- Demonstrate that every team member has appropriate access (least privilege).
67+
- Show that failed jobs are investigated and fixed promptly.
68+
- Provide audit logs or evidence of build runs and changes.
69+
- Document how security controls are enforced in the build process.
6870
6971
Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/)
7072
implementation:
7173
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools
72-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technologi
74+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology
7375
references:
7476
samm2:
7577
- I-SB-1-A
78+
nist-csf:
79+
- PR.IP-1
80+
- PR.DS-1
7681
iso27001-2017:
7782
- 12.1.1
7883
- 14.2.2

src/assets/YAML/default/BuildAndDeployment/Deployment.yaml

Lines changed: 19 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -69,19 +69,21 @@ Build and Deployment:
6969
comments: ""
7070
Defined deployment process:
7171
uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a
72+
description: |
73+
A defined deployment process is a documented and automated set of steps for releasing software into production. It ensures that deployments are consistent, secure, and auditable, reducing the risk of errors and unauthorized changes. This process should include validation, approval, and rollback mechanisms.
7274
risk: >-
73-
Deployment of insecure or malfunctioning artifacts.
75+
Deployment based human routines are error prone, and of insecure or malfunctioning artifacts.
7476
measure: >-
7577
Defining a deployment process ensures that there are
7678
established criteria in terms of functionalities,
7779
security, compliance, and performance,
7880
and that the artifacts meet them.
81+
level: 1
7982
difficultyOfImplementation:
8083
knowledge: 2
8184
time: 2
8285
resources: 1
8386
usefulness: 4
84-
level: 1
8587
dependsOn:
8688
- uuid:f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process
8789
implementation:
@@ -96,6 +98,12 @@ Build and Deployment:
9698
iso27001-2022:
9799
- 5.37
98100
- 8.32
101+
assessment: |
102+
- Deployment process is documented and available to relevant staff
103+
- All deployment steps are automated and version-controlled
104+
- Approvals and access controls are enforced for production deployments
105+
- Rollback procedures are defined and tested
106+
- Deployment logs and evidence are retained for audit purposes
99107
isImplemented: false
100108
evidence: ""
101109
comments: ""
@@ -211,19 +219,21 @@ Build and Deployment:
211219
- sbom
212220
Inventory of production components:
213221
uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f
222+
description: |
223+
An inventory of production components is a complete, up-to-date list of all applications and services running in production. This enables effective vulnerability management, incident response, and compliance. Without it, organizations risk running unmaintained or unauthorized software.
214224
risk: |-
215225
An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it.
216226
measure: |-
217227
A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production.
218228
In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track.
219229
dependsOn:
220230
- Defined deployment process
231+
level: 1
221232
difficultyOfImplementation:
222233
knowledge: 1
223234
time: 1
224235
resources: 1
225236
usefulness: 4
226-
level: 1
227237
implementation:
228238
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage
229239
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack
@@ -237,6 +247,12 @@ Build and Deployment:
237247
iso27001-2022:
238248
- 5.9
239249
- 5.12
250+
assessment: |
251+
- Inventory of all production components exists and is regularly updated
252+
- Inventory includes key metadata (e.g., version, owner, deployment date)
253+
- Inventory is accessible to security and operations teams
254+
- There is a process for adding, updating, and removing components
255+
- Inventory reviews are performed and documented
240256
tags:
241257
- inventory
242258
Inventory of production artifacts:

src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml

Lines changed: 25 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,23 @@ Build and Deployment:
44
Patch Management:
55
A patch policy is defined:
66
uuid: 99415139-6b50-441b-89e1-0aa59accd43d
7-
risk: Vulnerabilities in running artifacts stay for long and might get exploited.
7+
description: |
8+
A patch policy defines how and when software components, images, and dependencies are updated. A patch policy ensures that all these artifacts are regularly reviewed and updated, reducing the window of exposure to known threats. The policy should specify the frequency, responsibilities, and documentation requirements for patching.
9+
risk: Vulnerabilities in running artifacts may persist for a long time and might be exploited.
810
measure:
9-
A patch policy for all artifacts (e.g. in images) is defined. How often
11+
Define a patch policy for all artifacts (e.g. in images) is defined. How often
1012
is an image rebuilt?
13+
assessment: |
14+
- Patch policy is documented and accessible to relevant staff.
15+
- The policy defines patch frequency and responsible roles.
16+
- Patch actions and exceptions are logged and reviewed.
17+
- Evidence of regular patching and policy review is available.
18+
level: 1
1119
difficultyOfImplementation:
1220
knowledge: 3
1321
time: 1
1422
resources: 2
1523
usefulness: 4
16-
level: 1
1724
implementation: []
1825
references:
1926
samm2:
@@ -33,23 +40,27 @@ Build and Deployment:
3340
- patching
3441
Automated PRs for patches:
3542
uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488
36-
risk:
37-
Components with known (or unknown) vulnerabilities might stay for long and get exploited,
38-
even when a patch is available.
39-
measure:
40-
Fast patching of third party component is needed. The DevOps way is
41-
to have an automated pull request for new components. This includes
42-
43+
description: |
44+
Automated PRs for patches ensure that updates for outdated or vulnerable dependencies are created and proposed without manual intervention. Tools continuously monitor for new versions or security advisories and immediately generate pull requests to update affected components in code, container images, or infrastructure. This process ensures that available patches are quickly visible to developers and can be reviewed and merged with minimal delay, reducing the risk window for known vulnerabilities.
45+
risk: |
46+
Components with known (or unknown) vulnerabilities might persist for a long time and be exploited, even when a patch is available.
47+
measure: |
48+
Fast patching of third-party components is needed. The DevOps way is to have an automated pull request for new components. This includes:
4349
* Applications
44-
* Virtualized operating system components (e.g. container images)
45-
* Operating Systems
46-
* Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform)
50+
* Virtualized operating system components (e.g., container images)
51+
* Operating systems
52+
* Infrastructure as Code/GitOps (e.g., ArgoCD based on a git repository or Terraform)
53+
assessment: |
54+
- Automated PR tooling is enabled for all relevant repositories.
55+
- PRs are created automatically for outdated or vulnerable dependencies.
56+
- PRs are reviewed and merged in a timely manner.
57+
- Evidence of automated PRs and patching activity is available.
58+
level: 1
4759
difficultyOfImplementation:
4860
knowledge: 2
4961
time: 2
5062
resources: 2
5163
usefulness: 4
52-
level: 1
5364
implementation:
5465
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependabot
5566
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkins

src/assets/YAML/default/implementations.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@ implementations:
3737
name: API Security Maturity Model for Authorization
3838
tags: [api]
3939
url: https://curity.io/resources/learn/the-api-security-maturity-model/
40-
container-technologi:
40+
container-technology:
4141
uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11
4242
name: Container technologies and orchestration like Docker, Kubernetes
4343
tags: []

0 commit comments

Comments
 (0)