Skip to content

Commit c888a69

Browse files
wurstbrotwurstbrot
authored
Merge pull request #170 from par-tec/ioggstream-162-bis
Editorial suggestions.
2 parents 1f50e85 + ff338f1 commit c888a69

7 files changed

Lines changed: 2116 additions & 241 deletions

File tree

‎src/assets/YAML/default/BuildAndDeployment/Build.yaml‎

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -119,10 +119,9 @@ Build and Deployment:
119119
evidence: ""
120120
comments: ""
121121
Signing of artifacts:
122-
risk: Unauthorized manipulation of artifacts might be difficult to spot. For
123-
example, this may result in images with malicious code in the Docker registry.
122+
risk: &execution-maliciuous Execution or usage of malicious code or data e.g. via executables, libraries or container images.
124123
measure: Digitally signing artifacts for all steps during the build and especially
125-
docker images, helps to ensure their integrity.
124+
docker images, helps to ensure their integrity and autenticity.
126125
difficultyOfImplementation:
127126
knowledge: 2
128127
time: 2
@@ -144,7 +143,7 @@ Build and Deployment:
144143
evidence: ""
145144
comments: ""
146145
Signing of code:
147-
risk: Unauthorized manipulation of source code might be difficult to spot.
146+
risk: *execution-maliciuous
148147
measure: Digitally signing commits helps to prevent unauthorized manipulation
149148
of source code.
150149
difficultyOfImplementation:

‎src/assets/YAML/default/BuildAndDeployment/Deployment.yaml‎

Lines changed: 35 additions & 26 deletions
Original file line numberDiff line numberDiff line change
@@ -2,10 +2,10 @@
22
Build and Deployment:
33
Deployment:
44
Blue/Green Deployment:
5-
risk: A new artifacts version can have unknown defects.
6-
measure: By having multiple production environments, a deployment can be performant
7-
on the first environment to spot possible defects before it is deployment
8-
in the production environment(s)
5+
risk: A new artifact's version can have unknown defects.
6+
measure: |-
7+
Using a blue/green deployment strategy increases application availability
8+
and reduces deployment risk by simplifying the rollback process if a deployment fails.
99
difficultyOfImplementation:
1010
knowledge: 1
1111
time: 2
@@ -20,21 +20,21 @@ Build and Deployment:
2020
samm2:
2121
- TODO
2222
iso27001-2017:
23-
- 17.2.1
24-
- 12.1.1
25-
- 12.1.2
26-
- 12.1.4
23+
- 17.2.1 # Availability of information processing facilities
24+
- 12.1.1 # Documented operational procedures
25+
- 12.1.2 # Change management
26+
- 12.1.4 # Separation of development,testing and operational environments
2727
- 12.5.1
2828
- 14.2.9
2929
isImplemented: false
3030
evidence: ""
3131
comments: ""
3232
Defined decommissioning process:
33-
risk: Not used applications erode and are not maintained. As an evil actor,
34-
I exploit known vulnerabilities in the not maintained applicaitons to perform
35-
latteral movement within the organization.
36-
measure: By having a clear decommissioning process, applicaitons not used are
37-
not running anymore and can therefore not be explointed.
33+
risk: >-
34+
Unused applications are not maintained and may contain vulnerabilities.
35+
Once exploited they can be used to attack other applications or
36+
to perform lateral movements within the organization.
37+
measure: A clear decommissioning process ensures the removal of unused applications.
3838
difficultyOfImplementation:
3939
knowledge: 1
4040
time: 2
@@ -50,10 +50,13 @@ Build and Deployment:
5050
evidence: ""
5151
comments: ""
5252
Defined deployment process:
53-
risk: Deployments without a defined process are error prone thus allowing old
54-
or untested artifact to be deployed.
55-
measure: A defined deployment process significantly lowers the likelihood of
56-
errors during the deployment phase.
53+
risk: >-
54+
Deployment of insecure or malfunctioning artifacts.
55+
measure: >-
56+
Defining a deployment process ensures that there are
57+
established criteria in terms of functionalities,
58+
security, compliance, and performance,
59+
and that the artifacts meet them.
5760
difficultyOfImplementation:
5861
knowledge: 2
5962
time: 2
@@ -75,19 +78,23 @@ Build and Deployment:
7578
evidence: ""
7679
comments: ""
7780
Environment depending configuration parameters (secrets):
78-
risk: '- Parameters are often used to set credentials, for example by starting
79-
containers or applications; these parameters can often be seen by any one
80-
listing running processes on the target system.'
81-
measure: |
82-
Configuration parameters are set for each environment not in the source code.
83-
By using encryption, it is harder to read credentials , e.g. from the file system. Also, the usage of a credential management system can help protect credentials.
81+
risk: >-
82+
Unauthorized access to secrets stored in source code
83+
or in artifacts (e.g. container images)
84+
through process listing (e.g. ps -ef).
85+
measure: >-
86+
Set configuration parameters via environment variables
87+
stored using specific platform functionalities
88+
or secrets management systems
89+
(e.g. Kubernetes secrets or Hashicorp Vault).
8490
difficultyOfImplementation:
8591
knowledge: 2
8692
time: 2
8793
resources: 1
8894
usefulness: 4
8995
level: 2
90-
implementation: []
96+
implementation:
97+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/hasicorp-vault
9198
references:
9299
samm2:
93100
- I-SD-1-B
@@ -101,8 +108,10 @@ Build and Deployment:
101108
risk: '- Parameters are often used to set credentials, for example by starting
102109
containers or applications; these parameters can often be seen by any one
103110
listing running processes on the target system.'
104-
measure: By using encryption, it is harder to read credentials , e.g. from the
105-
file system. Also, the usage of a credential management system can help protect
111+
measure: >-
112+
Encryption ensures confidentiality of credentials
113+
e.g. from unauthorized access on the file system.
114+
Also, the usage of a credential management system can help protect
106115
credentials.
107116
difficultyOfImplementation:
108117
knowledge: 2

‎src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml‎

Lines changed: 64 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -2,9 +2,9 @@
22
Implementation:
33
Development and Source Control:
44
Local development linting & style checks performed:
5-
risk: Creating and developing code that contains code smells and quality issues.
6-
measure: "Integration of quality and linting plugins with interactive development
7-
environment (IDEs). \n"
5+
risk: Insecure or unmaintenable code base.
6+
measure: >-
7+
Integrate static code analysis tools in IDEs.
88
difficultyOfImplementation:
99
knowledge: 1
1010
time: 1
@@ -26,7 +26,7 @@ Implementation:
2626
risk: Using an insecure application might lead to a compromised application.
2727
This might lead to total data theft or data modification.
2828
measure: |
29-
Implement pre-commit validations to prevent secrets & other security issues being commit to source code.
29+
Implement pre-commit checks to prevent secrets & other security issues being commit to source code.
3030
difficultyOfImplementation:
3131
knowledge: 4
3232
time: 4
@@ -43,10 +43,39 @@ Implementation:
4343
isImplemented: false
4444
evidence: ""
4545
comments: ""
46+
API design validation:
47+
risk: Creation of insecure or non-compliant API.
48+
measure: |
49+
Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP
50+
and validate the specification using specific tools.
51+
Checks should be integrated in IDEs and CI/CD pipelines.
52+
difficultyOfImplementation:
53+
knowledge: 2
54+
time: 2
55+
resources: 2
56+
usefulness: 4
57+
level: 2
58+
implementation:
59+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/stoplight-spectral
60+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-oas-checker
61+
references:
62+
samm2:
63+
- V-ST-1-A
64+
iso27001-2017:
65+
- 8.25 # Secure development lifecycle
66+
- 8.27 # Secure system architecture and engineering principles
67+
- 8.28 # Secure coding
68+
isImplemented: false
69+
evidence: ""
70+
comments: ""
4671
Source Control Protection:
47-
risk: Unapproved code in important branches like master.
48-
measure: Enabled protections on the source code management system preventing
49-
committed directly to an important branch.
72+
risk: Intentional or accidental alterations in critical branches like master.
73+
measure: >-
74+
Define source code management system policies (e.g. branch protection rules,
75+
mandatory code reviews, ...)
76+
to ensure that changes to critical branches are only possible under defined conditions.
77+
These policies can be implemented at repository level or organization level,
78+
depending on the source code management system.
5079
difficultyOfImplementation:
5180
knowledge: 2
5281
time: 1
@@ -91,4 +120,32 @@ Implementation:
91120
isImplemented: false
92121
evidence: ""
93122
comments: ""
123+
MFA to SCM:
124+
risk: Unauthorized access to source code.
125+
measure: >-
126+
Enforce Multi-Factor authentication to source code management platforms.
127+
These policies can be implemented at repository level or organization level,
128+
depending on the source code management system.
129+
difficultyOfImplementation:
130+
knowledge: 2
131+
time: 1
132+
resources: 2
133+
usefulness: 4
134+
level: 1
135+
implementation:
136+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/yubikey
137+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/totp
138+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/smartcard
139+
references:
140+
samm2:
141+
- O-EM-1-A
142+
iso27001-2017:
143+
- 5.17 # Authentication information
144+
- 6.1.2 # Segregation of duties.
145+
- 14.2.1 # Secure development policies.
146+
d3f:
147+
- Multi-factorAuthentication
148+
isImplemented: false
149+
evidence: ""
150+
comments: ""
94151
...

‎src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
Test and Verification:
33
Dynamic depth for applications:
44
Coverage analysis:
5-
risk: Parts of the service are not still covered.
5+
risk: Parts of the service are not still covered by tests.
66
measure: Check that there are no missing paths in the application with coverage-tools.
77
difficultyOfImplementation:
88
knowledge: 4
@@ -12,6 +12,7 @@ Test and Verification:
1212
level: 4
1313
implementation:
1414
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-code-pulse
15+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/coveragepy
1516
references:
1617
samm2:
1718
- V-ST-2-A
@@ -58,6 +59,8 @@ Test and Verification:
5859
implementation:
5960
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/curl
6061
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/openapi
62+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-zap
63+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/schemathesis
6164
dependsOn:
6265
- Usage of different roles
6366
references:
@@ -185,6 +188,7 @@ Test and Verification:
185188
implementation:
186189
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/zest
187190
isImplemented: false
191+
assessment: "For REST APIs, multiple OAuth2 scopes are used."
188192
evidence: ""
189193
comments: ""
190194
Usage of multiple scanners:

‎src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml‎

Lines changed: 37 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,7 +1,7 @@
11
---
22
Test and Verification:
33
Static depth for applications:
4-
Exclusion of source code duplicates:
4+
Exclusion of source code duplicates: &Exclusion-of-source-code-duplicates
55
risk: Duplicates in source code might influence the stability of the application.
66
measure: Automatic Detection and manual removal of duplicates in source code.
77
difficultyOfImplementation:
@@ -24,6 +24,11 @@ Test and Verification:
2424
isImplemented: false
2525
evidence: ""
2626
comments: ""
27+
Dead code elimination:
28+
<<: *Exclusion-of-source-code-duplicates
29+
risk: Dead code increases the attack surface (use of hard coded credentials and
30+
variables, sensitive information)
31+
measure: Collection of unused code and then manual removal of unused code.
2732
Local development security checks performed:
2833
risk: Creating and developing code contains code smells and quality issues.
2934
measure: |
@@ -38,6 +43,7 @@ Test and Verification:
3843
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/fortify-vscode-extension
3944
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/checkmarx-vscode-extension
4045
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension
46+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/pre-commit
4147
references:
4248
samm2:
4349
- V-ST-1-A
@@ -47,6 +53,31 @@ Test and Verification:
4753
isImplemented: false
4854
evidence: ""
4955
comments: ""
56+
API design validation:
57+
risk: Creation of insecure or non-compliant API.
58+
measure: |
59+
Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP
60+
and validate the specification using specific tools.
61+
Checks should be integrated in IDEs and CI/CD pipelines.
62+
difficultyOfImplementation:
63+
knowledge: 2
64+
time: 2
65+
resources: 2
66+
usefulness: 4
67+
level: 2
68+
implementation:
69+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/stoplight-spectral
70+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-oas-checker
71+
references:
72+
samm2:
73+
- V-ST-1-A
74+
iso27001-2017:
75+
- 8.25 # Secure development lifecycle
76+
- 8.27 # Secure system architecture and engineering principles
77+
- 8.28 # Secure coding
78+
isImplemented: false
79+
evidence: ""
80+
comments: ""
5081
Static analysis for all components/libraries:
5182
risk: Used components like libraries and legacy applications might have vulnerabilities
5283
measure: Usage of a static analysis for all used components.
@@ -155,9 +186,9 @@ Test and Verification:
155186
evidence: ""
156187
comments: ""
157188
Stylistic analysis:
158-
risk: False source code indenting might lead to vulnerabilities.
189+
risk: Unclear or obfuscated code might have unexpected behavior.
159190
measure: Analysis of compliance to style guides of the source code ensures that
160-
source code indenting rules are met.
191+
source code formatting rules are met (e.g. indentation, loops, ...).
161192
difficultyOfImplementation:
162193
knowledge: 1
163194
time: 1
@@ -168,6 +199,7 @@ Test and Verification:
168199
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/pmd
169200
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/stylecop
170201
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/sonarqube
202+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-super-linter
171203
references:
172204
samm2:
173205
- V-ST-2-A
@@ -193,6 +225,7 @@ Test and Verification:
193225
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js
194226
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit
195227
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack
228+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-dependabot
196229
references:
197230
samm2:
198231
- V-ST-2-A
@@ -218,6 +251,7 @@ Test and Verification:
218251
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack
219252
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js
220253
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit
254+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-dependabot
221255
references:
222256
samm2:
223257
- V-ST-2-A

0 commit comments

Comments
 (0)