From 1e96d4a4633598f0f2e677db1a69865d1508ca90 Mon Sep 17 00:00:00 2001 From: Ben Joyce Date: Tue, 20 Feb 2024 18:21:55 +0000 Subject: [PATCH 001/370] Fixed typo. --- src/assets/YAML/default/CultureAndOrganization/Design.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/Design.yaml b/src/assets/YAML/default/CultureAndOrganization/Design.yaml index 22ec238..efa66cd 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Design.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Design.yaml @@ -273,7 +273,7 @@ Culture and Organization: Information security targets are communicated: uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 risk: - Employees don't known their organizations security targets. Therefore + Employees don't know their organizations security targets. Therefore security is not considered during development and administration as much as it should be. measure: From cc5993af74492966498ba9a64ba3c8c2fe0bb580 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 19 Jul 2024 09:01:26 +0200 Subject: [PATCH 002/370] fix braking formatting --- .../YAML/default/BuildAndDeployment/Build.yaml | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index cad1b5c..5b11b62 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -158,16 +158,14 @@ Build and Deployment: measure: Digitally signing artifacts for all steps during the build and especially docker images, helps to ensure their integrity and authenticity. - description: | - ### GitHub Authentication and Commit Signing - To perform a push to a GitHub repository, you must be authenticated. It's important to note that GitHub does not verify if the authenticated user's email address matches the one in the commit. - To clearly identify the author of a commit for reviewers, commit signing is recommended. - - GitHub actions such as [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) do not automatically sign commits and may encounter issues as a result. - - To address this, you can refer to a working configuration example in the [workflow folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) of DSOMM, which demonstrates how to use semantic release action in conjunction with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action). - For added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) provided by your organization for a specific repository. Store the Personal Access Token (PAT) as a secret in your project. + description: |- + To perform a push to a GitHub repository, you must be authenticated. It's important to note that GitHub does not verify if the authenticated user's email address matches the one in the commit. + To clearly identify the author of a commit for reviewers, commit signing is recommended. + + GitHub actions such as [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) do not automatically sign commits and may encounter issues as a result. + To address this, you can refer to a working configuration example in the [workflow folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) of DSOMM, which demonstrates how to use semantic release action in conjunction with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action). + For added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) provided by your organization for a specific repository. Store the Personal Access Token (PAT) as a secret in your project. difficultyOfImplementation: knowledge: 2 time: 2 From ee09a55ef271cb13b6ef3ca33e529ec68598b5c2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 19 Jul 2024 09:06:51 +0200 Subject: [PATCH 003/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 11 + src/assets/YAML/generated/generated.yaml | 1332 +++++++++++++++++++--- 2 files changed, 1168 insertions(+), 175 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 23d1c69..f5e9a1b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,14 @@ +# [1.11.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.10.1...v1.11.0) (2024-07-19) + + +### Features + +* add auto merge of PRs ([8f9ea61](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/8f9ea61b80c2dab6aea733e35da0ad665618ff44)) +* Add dep track to visualization ([162da73](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/162da7338f4e1ad690637122516fd1873147a9e0)) +* add patching ([7233396](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/7233396cfc8e8a72cc75f53bbe9067101178fdd2)) +* move SCA to level 2 ([11dafa2](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/11dafa271acff38c9c8ae2cca7c3a72022e9df7a)) +* move SCA to level 2 ([51b8cd1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/51b8cd13daec712acee77ec3710557da95453dda)) + ## [1.10.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.10.0...v1.10.1) (2023-11-15) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 8e6fc29..de5e7a1 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -41,11 +41,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/a340f46b-6360-4cb8-847b-a0d3483d09d3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b risk: Performing builds without a defined process is error prone; for example, @@ -88,11 +93,16 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f6f7737f-25a9-4317-8de2-09bf59f29b5b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Pinning of artifacts: uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 risk: Unauthorized manipulation of artifacts might be difficult to spot. For @@ -128,11 +138,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false SBOM of components: uuid: 2858ac12-0179-40d9-9acf-1b839c030473 description: |- @@ -162,31 +177,35 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/2858ac12-0179-40d9-9acf-1b839c030473 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Signing of artifacts: uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 risk: Execution or usage of malicious code or data e.g. via executables, libraries or container images. measure: Digitally signing artifacts for all steps during the build and especially docker images, helps to ensure their integrity and authenticity. - description: "### GitHub Authentication and Commit Signing \n To perform a - push to a GitHub repository, you must be authenticated. It's important to - note that GitHub does not verify if the authenticated user's email address - matches the one in the commit.\n To clearly identify the author of a commit - for reviewers, commit signing is recommended.\n\n GitHub actions such as - [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) - do not automatically sign commits and may encounter issues as a result. \n\n - \ To address this, you can refer to a working configuration example in the - [workflow folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) + description: "To perform a push to a GitHub repository, you must be authenticated. + It's important to note that GitHub does not verify if the authenticated user's + email address matches the one in the commit.\nTo clearly identify the author + of a commit for reviewers, commit signing is recommended.\n\nGitHub actions + such as [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) + do not automatically sign commits and may encounter issues as a result. \n\nTo + address this, you can refer to a working configuration example in the [workflow + folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) of DSOMM, which demonstrates how to use semantic release action in conjunction - with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action).\n - \ For added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) + with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action).\nFor + added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) provided by your organization for a specific repository. Store the Personal - Access Token (PAT) as a secret in your project.\n" + Access Token (PAT) as a secret in your project." difficultyOfImplementation: knowledge: 2 time: 2 @@ -212,11 +231,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/5786959d-0c6f-46a6-8e1c-a32ff1a50222 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Signing of code: uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -251,11 +275,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/9f107927-61e9-4574-85ad-3f2b4bca8665 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deployment: Blue/Green Deployment: uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 @@ -293,11 +322,16 @@ Build and Deployment: - 8.32 - 8.19 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0cb2626b-fb0d-4a0f-9688-57f787310d97 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined decommissioning process: uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 description: |- @@ -322,11 +356,16 @@ Build and Deployment: - 11.2.7 iso27001-2022: - 7.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/da4ff665-dcb9-4e93-9d20-48cdedc50fc2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a risk: Deployment of insecure or malfunctioning artifacts. @@ -361,11 +400,16 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Environment depending configuration parameters (secrets): uuid: df428c9d-efa0-4226-9f47-a15bb53f822b risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. @@ -1463,11 +1507,16 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/df428c9d-efa0-4226-9f47-a15bb53f822b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Evaluation of the trust of used components: uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba risk: Application and system components like Open Source libraries or images @@ -1511,11 +1560,16 @@ Build and Deployment: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0de465a6-55a7-4343-af79-948bb5ff10ba isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Handover of confidential parameters: uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a risk: Parameters are often used to set credentials, for example by starting @@ -1550,11 +1604,16 @@ Build and Deployment: - 8.24 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/94a96f79-8bd6-4904-97c0-994ff88f176a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Inventory of dependencies: uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 risk: In case a vulnerability of severity high or critical is known by the organization, @@ -1593,11 +1652,16 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/13e9757e-58e2-4277-bc0f-eadc674891e6 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Inventory of running artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs @@ -1622,11 +1686,16 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/83057028-0b77-4d2e-8135-40969768ae88 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. @@ -1662,11 +1731,16 @@ Build and Deployment: - 8.19 - 8.32 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/85d52588-f542-4225-a338-20dc22a5508d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Same artifact for environments: uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f risk: Building of an artifact for different environments means that an untested @@ -1697,11 +1771,16 @@ Build and Deployment: - 8.33 - 8.29 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a854b48d-83bd-4f8d-8621-a0bdd470837f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of feature toggles: uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad risk: Using environment variables to enable or disable features can lead to @@ -1743,11 +1822,16 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a511799b-045e-4b96-9843-7d63d8c1e2ad isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d @@ -1772,11 +1856,17 @@ Build and Deployment: - 8.8 - 8.19 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/99415139-6b50-441b-89e1-0aa59accd43d isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 risk: Components with known (or unknown) vulnerabilities might stay for long @@ -1825,9 +1915,16 @@ Build and Deployment: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Automated merge of automated PRs: uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: Automated merges of automated created PRs for outdated dependencies. @@ -1862,9 +1959,16 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/f2594f8f-1cd6-45f9-af29-eaf3315698eb comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Nightly build of images (base images): uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 description: |- @@ -1893,11 +1997,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/34869eaf-f2e1-4926-b0bd-28c43402f057 isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Reduction of the attack surface: uuid: 16e39c8f-5336-4001-88ed-a552d2447531 description: |- @@ -1937,10 +2047,17 @@ Build and Deployment: - 14.2.1 iso27001-2022: - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/16e39c8f-5336-4001-88ed-a552d2447531 evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of a maximum lifetime for images: uuid: 485a3383-7f2e-4dba-bb84-479377070904 description: |- @@ -1974,10 +2091,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/485a3383-7f2e-4dba-bb84-479377070904 evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of a short maximum lifetime for images: uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e description: |- @@ -2021,11 +2145,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/6b96e5a0-ce34-4ea4-a88f-469d3b84546e isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Culture and Organization: Design: Conduction of advanced threat modeling: @@ -2120,11 +2250,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of simple threat modeling on business level: uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 risk: Business related threats are discovered too late in the development and @@ -2151,11 +2286,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/48f97f31-931c-46eb-9b3e-e2fec0cd0426 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e risk: Technical related threats are discovered too late in the development and @@ -2271,11 +2411,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/47419324-e263-415b-815d-e7161b6b905e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of advanced abuse stories: uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e risk: Simple user stories are not going deep enough. Relevant security considerations @@ -2313,11 +2458,16 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/0a929c3e-ab9a-4206-8761-adf84b74622e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of simple abuse stories: uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 risk: User stories mostly don't consider security implications. Security flaws @@ -2355,11 +2505,16 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/bacf85b6-5bc0-405d-b5ba-a5d971467cc1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of threat modeling processes and standards: uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e risk: Inadequate identification of business and technical risks. @@ -2404,16 +2559,21 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Information security targets are communicated: uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 - risk: Employees don't known their organizations security targets. Therefore - security is not considered during development and administration as much as - it should be. + risk: Employees don't know their organizations security targets. Therefore security + is not considered during development and administration as much as it should + be. measure: Transparent and timely communication of the security targets by senior management is essential to ensure teams' buy-in and support. difficultyOfImplementation: @@ -2431,11 +2591,16 @@ Culture and Organization: iso27001-2022: - 5.1 - 5.4 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/1b9281b9-48e2-4c01-9ac6-9db9931c4885 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 @@ -2470,11 +2635,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Aligning security in teams: uuid: f994a55d-71bb-45a4-a887-0a213d72c504 risk: The concept of Security Champions might suggest that only he/she is responsible @@ -2501,11 +2672,17 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f994a55d-71bb-45a4-a887-0a213d72c504 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of build-it, break-it, fix-it contests: uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 risk: Understanding security is hard, even for security champions and the conduction @@ -2532,11 +2709,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/bfdb576e-a416-4ec6-96fe-a078d58b2ff8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of collaborative security checks with developers and system administrators: uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 risk: Security checks by external companies do not increase the understanding @@ -2566,11 +2749,17 @@ Culture and Organization: - 6.3 - 8.8 - 8.34 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/95caef96-36ed-458c-a087-5c35d4f9dec2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of collaborative team security checks: uuid: 35446784-7610-40d9-af9e-d43f3173bf8c risk: Development teams limited insight over security practices. @@ -2593,11 +2782,17 @@ Culture and Organization: iso27001-2022: - Mutual security testing is not explicitly required in ISO 27001 may be - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/35446784-7610-40d9-af9e-d43f3173bf8c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of war games: uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 risk: Understanding incident response plans during an incident is hard and ineffective. @@ -2624,11 +2819,17 @@ Culture and Organization: - 6.3 - 5.24 - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/534f60bf-0995-4314-bb9c-f0f2bf204694 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Each team has a security champion: uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 risk: No one feels directly responsible for security and the security champion @@ -2678,11 +2879,17 @@ Culture and Organization: - Security champions are missing in ISO 27001 most likely - 5.4 - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for all: uuid: 9768f154-357a-4c06-af6f-d66570677c9b risk: Understanding security is hard. @@ -2722,11 +2929,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/9768f154-357a-4c06-af6f-d66570677c9b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for externals: uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 risk: Understanding security is hard. @@ -2759,11 +2972,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/31833d56-35af-4ef3-9300-f23d27646ce7 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training of security champions: uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 risk: Understanding security is hard, even for security champions. @@ -2795,11 +3014,17 @@ Culture and Organization: iso27001-2022: - Security champions are missing in ISO 27001 - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Reward of good communication: uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c risk: Employees are not getting excited about security. @@ -2837,11 +3062,17 @@ Culture and Organization: but nothing to promote good behavior. iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/91b6f75b-9f4a-4d77-95a2-af7ad3222c7c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security Coaching: uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 risk: Training does not change behaviour. Therefore, even if security practices @@ -2872,11 +3103,17 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security code review: uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 risk: Understanding security is hard. @@ -2917,11 +3154,17 @@ Culture and Organization: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/7121b0c7-6ace-4d6b-95d0-94535dbccb57 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 risk: Not asking a security expert when questions regarding security appear @@ -2953,11 +3196,17 @@ Culture and Organization: - 5.2 - 5.6 - 5.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/0b28367b-75a0-4bae-a926-3725c1bf9bb0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security-Lessoned-Learned: uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 risk: After an incident, a similar incident might reoccur. @@ -2978,11 +3227,17 @@ Culture and Organization: - 16.1.6 iso27001-2022: - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/58c46807-fee9-448b-b6dd-8050c464ab52 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple mob hacking: uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de risk: Understanding security is hard. @@ -3030,11 +3285,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/535f301a-e8e8-4eda-ad77-a08b035c92de isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Process: Approval by reviewing any new version: uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 @@ -3060,11 +3321,16 @@ Culture and Organization: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/3f63bdbc-c75f-4780-a941-e6ad42e894e1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Definition of a change management process: uuid: b4193d32-3948-47e2-a326-3748c48019a1 risk: The impact of a change is not controlled because these are not recorded @@ -3086,11 +3352,16 @@ Culture and Organization: iso27001-2022: - 8.32 - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/b4193d32-3948-47e2-a326-3748c48019a1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 risk: In case of an emergency, like a power outage, DR actions to perform are @@ -3113,11 +3384,16 @@ Culture and Organization: - 17.1.1 iso27001-2022: - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/c72da779-86cc-45b1-a339-190ce5093171 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Implementation: Application Hardening: App. Hardening Level 1: @@ -3178,9 +3454,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/cf819225-30cb-4702-8e32-60225eedc33d comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 1 (50%): uuid: b597928e-54d6-48a5-a806-8003dcd56aab risk: Using an insecure application might lead to a compromised application. @@ -3237,10 +3520,17 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/b597928e-54d6-48a5-a806-8003dcd56aab isImplemented: false comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 2: uuid: ffe86caf-2fec-4630-b514-2db83983984d risk: Using an insecure application might lead to a compromised application. @@ -3275,13 +3565,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/ffe86caf-2fec-4630-b514-2db83983984d isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 (75%) tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 2 (75%): uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 risk: Using an insecure application might lead to a compromised application. @@ -3316,13 +3612,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/03643ca2-03c2-472b-8e19-956bf02fe9b7 isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 1 tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 3: uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a risk: Using an insecure application might lead to a compromised application. @@ -3357,13 +3659,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 tags: - none + teamsImplemented: + Default: false + B: false + C: false Contextualized Encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 risk: The generation of interpreter directives from user-provided data poses @@ -3388,8 +3696,15 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/e1f37abb-d848-4a3a-b3df-65e91a89dcb7 tags: - none + teamsImplemented: + Default: false + B: false + C: false Development and Source Control: .gitignore: uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d @@ -3416,10 +3731,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/363a3eea-baf9-4010-88ca-bb8186a2989d evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false API design validation: uuid: 948a4d51-ceb5-4ebd-bdc7-d74ea25e171c risk: Creation of insecure or non-compliant API. @@ -3464,11 +3786,17 @@ Implementation: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/948a4d51-ceb5-4ebd-bdc7-d74ea25e171c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Local development linting & style checks performed: uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 risk: Insecure or unmaintainable code base. @@ -3500,11 +3828,17 @@ Implementation: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/517b0957-4981-4ac0-b4c7-0d8d1934c474 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Source Control Protection: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 risk: Intentional or accidental alterations in critical branches like master. @@ -3549,11 +3883,17 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Versioning: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f risk: Deployment of untracked artifacts. @@ -3581,11 +3921,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/066084c6-1135-4635-9cc5-9e75c7c5459f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Infrastructure Hardening: Applications are running in virtualized environments: uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 @@ -3608,11 +3954,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/3a94d55e-fd82-4996-9eb3-20d23ff2a873 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Backup: uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc risk: If errors are experienced during the deployment process you want to deploy @@ -3643,11 +3995,17 @@ Implementation: iso27001-2022: - 8.13 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5c61fd6b-8106-4c68-ac28-a8a42f1c67dc isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Baseline Hardening of the environment: uuid: 5992c38c-8597-4035-89db-d15820d81c3a risk: Using default configurations for a cluster environment leads to potential @@ -3709,11 +4067,17 @@ Implementation: - 13.1.3 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5992c38c-8597-4035-89db-d15820d81c3a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Filter outgoing traffic: uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d risk: A compromised infrastructure component might try to send out stolen data. @@ -3744,11 +4108,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/6df508ef-86fc-4c22-bd9f-646c3127ce7d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Hardening of the Environment: uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 risk: Using default configurations for a cluster environment leads to potential @@ -3811,11 +4181,17 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/dcf9601b-b4f2-4e25-9143-e39af75f7c33 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Immutable infrastructure: uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 risk: The availability of IT systems might be disturbed due to components failures @@ -3841,11 +4217,17 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/48e92bb1-fdba-40e8-b6c2-35de0d431833 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Infrastructure as Code: uuid: 8b994601-575e-4ea5-b228-accb18c8e514 risk: No tracking of changes in systems might lead to errors in the configuration. @@ -3891,11 +4273,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8b994601-575e-4ea5-b228-accb18c8e514 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Isolated networks for virtual environments: uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 risk: Virtual environments in default settings are able to access other virtual @@ -3932,11 +4320,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/4ce24abd-8ba6-494c-828d-4d193e28e4a1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Limitation of system events: uuid: e5386abf-9154-4752-a1a8-c3a8900f732d risk: System events (system calls) can lead to privilege escalation. @@ -3974,11 +4368,17 @@ Implementation: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e5386abf-9154-4752-a1a8-c3a8900f732d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false MFA: uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de risk: One factor authentication is more vulnerable to brute force attacks and @@ -4022,11 +4422,17 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/598e9f13-1ac8-4a01-b85e-8fab93ee81de isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false MFA for admins: uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 risk: One factor authentication is more vulnerable to brute force attacks and @@ -4068,11 +4474,17 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8098e416-e1ed-4ae4-a561-83efbe76bf57 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Microservice-architecture: uuid: 118b869b-3850-456e-98d9-1abdb85cbc5a risk: Monolithic applications are hard to test. @@ -4092,11 +4504,17 @@ Implementation: - Not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/118b869b-3850-456e-98d9-1abdb85cbc5a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Production near environments are used by developers: uuid: e14de741-94b3-447c-8b07-eea947d82e61 risk: In case an errors occurs in production, the developer need to be able @@ -4125,11 +4543,17 @@ Implementation: iso27001-2022: - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e14de741-94b3-447c-8b07-eea947d82e61 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Role based authentication and authorization: uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 risk: Everyone is able to get unauthorized access to information on systems @@ -4160,11 +4584,17 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/070bb14b-e04a-4f3d-896a-a08eba7a35f9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple access control for systems: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 risk: Attackers a gaining access to internal systems and application interfaces @@ -4193,11 +4623,17 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/82e499d1-f463-4a4b-be90-68812a874af6 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of a chaos monkey: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In @@ -4221,11 +4657,17 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f8e80f18-2503-4e3e-b3bc-7f67bb28defe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of an security account: uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 risk: Having security auditing in the same account as infrastructure and applications @@ -4246,11 +4688,17 @@ Implementation: - 10.1 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/746025a6-dbfb-4087-a000-e46acab64ee1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of edge encryption at transit: uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 risk: Evil actors might be able to perform a man in the middle attack and sniff @@ -4271,11 +4719,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ad23be9c-5661-4f1f-81a3-5a5dc7061629 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of encryption at rest: uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 risk: Evil actors might be able to access data and read information, e.g. from @@ -4296,11 +4750,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/0ff45fb8-7eef-46ed-9b3a-84c955cd7060 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of internal encryption at transit: uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 risk: Evil actors within the organization of traffic in transit might be able @@ -4322,11 +4782,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ecb0184c-6bc9-45da-bbbb-a983797ffc93 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of security by default for components: uuid: 11b3848e-e931-4146-a35d-35409ada24ee risk: Components (images, libraries, applications) are not hardened. @@ -4363,11 +4829,17 @@ Implementation: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/11b3848e-e931-4146-a35d-35409ada24ee isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of test and production environments: uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 risk: Security tests are not running regularly because test environments are @@ -4393,11 +4865,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/bfdacb52-1e3f-431d-ae72-d844a5e86415 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Virtual environments are limited: uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca risk: Denial of service (internally by an attacker or unintentionally by a bug) @@ -4426,11 +4904,17 @@ Implementation: - 8.6 - 8.22 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/760f1056-b0ee-4f22-a35b-f65446f944ca isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF Advanced: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced risk: The presence of sophisticated threats necessitates a robust defense strategy @@ -4459,9 +4943,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF baseline: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: Vulnerable input, such as exploits, can infiltrate the application via @@ -4490,9 +4981,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF medium: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: The threat from malicious inputs remains high, with exploits seeking to @@ -4521,9 +5019,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false Information Gathering: Logging: Centralized application logging: @@ -4552,11 +5057,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/fe875e17-ae4a-45f8-a359-244aa4fcbc04 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: Local stored system logs can be unauthorized manipulated by attackers @@ -4592,11 +5102,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/4eced38a-7904-4c45-adb0-50b663065540 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Correlation of security events: uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 risk: Detection of security related events with hints on different systems/tools/metrics @@ -4622,11 +5137,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccf4561d-253f-4762-adcb-bc4622fd6fc5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Logging of security events: uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb description: | @@ -4680,14 +5200,19 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccfdd0a8-991e-4269-ad77-c0a54ca655cb risk: |- * No track of security-relevant events makes it harder to analyze an incident. * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false PII logging concept: uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 risk: Personal identifiable information (PII) is logged and the privacy law @@ -4733,11 +5258,16 @@ Information Gathering: - Not explicitly covered by ISO 27001 - too specific - 8.15 - 5.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/613a73dc-4f60-49db-a6ce-4fb7bf8519f9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Visualized logging: uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 risk: System and application protocols are not visualized properly which leads @@ -4769,11 +5299,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/7c735089-6a83-419f-8b27-c1e676cedea1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Monitoring: Advanced app. metrics: uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf @@ -4797,11 +5332,16 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d03bc410-74a7-4e92-82cb-d01a020cb6bf isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Advanced availability and stability metrics: uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 risk: Trends and advanced attacks are not detected. @@ -4824,11 +5364,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ed715b38-c34b-40cd-83fd-ce807f306fc1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Alerting: uuid: 8a442d8e-0eb1-4793-a513-571aef982edd risk: Incidents are discovered after they happened. @@ -4854,11 +5399,16 @@ Information Gathering: - 6.8 - 5.25 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8a442d8e-0eb1-4793-a513-571aef982edd isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Audit of system events: uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 risk: System events (system calls) trends and attacks are not detected. @@ -4888,11 +5438,16 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/1cd5e4b8-be36-4726-adc7-d8f843f47ac8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage and control metrics: uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d risk: The effectiveness of configuration, patch and vulnerability management @@ -4924,11 +5479,16 @@ Information Gathering: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d0d681e7-d6de-4829-ac64-a9eb2546aa0d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deactivation of unused metrics: uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 risk: High resources are used while gathering unused metrics. @@ -4951,11 +5511,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/7f36b9ba-bc05-4fd6-9a2a-73344c249722 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defense metrics: uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 risk: IDS/IPS systems like packet- or application-firewalls detect and prevent @@ -4982,11 +5547,16 @@ Information Gathering: iso27001-2022: - 8.15 - 8.2 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e808028c-351c-42f1-bcd9-fba738d1fc55 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Grouping of metrics: uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b risk: The analysis of metrics takes long. @@ -5007,11 +5577,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/42170a71-d4c8-47af-bd71-bf36875fd05b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Metrics are combined with tests: uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 risk: Changes might cause high load due to programming errors. @@ -5032,11 +5607,16 @@ Information Gathering: - not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/71699daf-b2a4-466b-a0b2-89f7dbb18506 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Monitoring of costs: uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e risk: Not monitoring costs might lead to unexpected high resource consumption @@ -5061,11 +5641,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/10e23a8c-22ff-4487-a706-87ccc9d0798e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Screens with metric visualization: uuid: 8746647c-638c-473f-8e17-82c068e4c311 risk: Security related information is discovered too late during an incident. @@ -5089,11 +5674,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8746647c-638c-473f-8e17-82c068e4c311 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 risk: Attacks on an application are not recognized. @@ -5117,11 +5707,16 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e9a6d403-a467-445e-b98a-74f0c29da0b1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 risk: Not getting notified about reaching the end of the budget (e.g. due to @@ -5145,11 +5740,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/f08a3219-6941-43ec-8762-4aff739f4664 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 risk: Without simple metrics analysis of incidents are hard. In case an application @@ -5176,11 +5776,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/3d1f4c3b-f713-46d9-933a-54a014a26c03 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Targeted alerting: uuid: d6f06ae8-401a-4f44-85df-1079247fa030 risk: People are bored (ignorant) of incident alarm messages, as they are not @@ -5205,11 +5810,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d6f06ae8-401a-4f44-85df-1079247fa030 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Visualized metrics: uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 risk: Not visualized metrics lead to restricted usage of metrics. @@ -5231,11 +5841,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ded39bcf-4eaa-4c5f-9c94-09acde0a4734 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test and Verification: Application tests: High coverage of security related module and integration tests: @@ -5260,11 +5875,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/67667c97-c33e-4306-a4e5-e7b1d8e10c5a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security integration tests for important components: uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 risk: Vulnerabilities are rising due to code changes in a complex microservice @@ -5286,11 +5907,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security unit tests for important components: uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 risk: Vulnerabilities are rising due to code changes. @@ -5324,10 +5951,16 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Smoke Test: uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a risk: During a deployment an error might happen which leads to non-availability @@ -5352,11 +5985,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/73aaae0b-5d68-4953-9fa4-fd25bf665f2a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Consolidation: Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 @@ -5405,11 +6044,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/7a82020c-94d1-471c-bbd3-5f7fe7df4876 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Generation of Patch Management Statistics: uuid: 785e34ef-40c6-487a-984c-3e7706c9bc1f risk: Delays in patch response lead to an increased attack surface through longer @@ -5454,11 +6098,16 @@ Test and Verification: - 16.1.4 iso27001-2022: - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/785e34ef-40c6-487a-984c-3e7706c9bc1f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Generation of Response Statistics: uuid: c922981b-65ed-40f3-a947-96fee9a0125f risk: No or delayed reaction to findings leads to potential exploitation of @@ -5513,13 +6162,18 @@ Test and Verification: iso27001-2022: - 5.25 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c922981b-65ed-40f3-a947-96fee9a0125f isImplemented: false - evidence: "" comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). tags: - none + teamsImplemented: + Default: false + B: false + C: false Integration of vulnerability issues into the development process: uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e risk: To read console output of the build server to search for vulnerabilities @@ -5559,11 +6213,16 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/ce970c9b-da94-41cf-bd78-8c15357b7e8e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Reproducible defect tickets: uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 risk: Vulnerability descriptions are hard to understand by staff from operations @@ -5591,11 +6250,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/27337442-e4b1-4e87-8dc9-ce86fbb79a39 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 risk: As false positive occur during each test, all vulnerabilities might be @@ -5630,11 +6294,16 @@ Test and Verification: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c1acc8af-312e-4503-a817-a26220c993a0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: The security level of a component is not visible. Therefore, the motivation @@ -5697,11 +6366,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/55f4c916-3a34-474d-ad96-9a9f7a4f6a83 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of all defects: uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d risk: Vulnerabilities with severity low are not visible. @@ -5722,11 +6396,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 risk: Vulnerabilities with severity high or higher are not visible. @@ -5748,11 +6427,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 implementation: [] isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of defects with severity middle: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. @@ -5773,11 +6457,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 implementation: [] isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: Maintenance of false positives in each tool enforces a high workload. @@ -5822,11 +6511,16 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/85ba5623-84be-4219-8892-808837be582d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dynamic depth for applications: Coverage analysis: uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 @@ -5859,11 +6553,17 @@ Test and Verification: - part of periodic review, PDCA iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/d0ba0be5-c573-405f-b905-b7a8f87a9cc7 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of client side dynamic components: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript @@ -5887,16 +6587,22 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/9711f871-f79d-4573-8d4f-d2c98fd0d18e implementation: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb name: Ajax Spider tags: [] url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of hidden endpoints: uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 risk: Hidden endpoints of the service are not getting tracked. @@ -5943,11 +6649,17 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/6a9cb303-0f98-48a8-bdcd-56d41c0012b8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of more input vectors: uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc risk: Parts of the service are not covered. For example specially formatted @@ -5970,6 +6682,9 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5e0ff85b-ec89-4ef0-96b1-5695fa0025dc implementation: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b name: Schemathesis @@ -5981,10 +6696,13 @@ Test and Verification: description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of sequential operations: uuid: 845f06ec-148c-4c67-9755-7041911dcca5 risk: Sequential operations like workflows (e.g. login -> put products in the @@ -6013,11 +6731,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/845f06ec-148c-4c67-9755-7041911dcca5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of service to service communication: uuid: 22aab0ef-76ce-4b8c-979c-3699784330db risk: Service to service communication is not covered. @@ -6039,6 +6763,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/22aab0ef-76ce-4b8c-979c-3699784330db implementation: - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 @@ -8185,10 +8912,13 @@ Test and Verification: description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple Scan: uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 risk: Deficient security tests are performed. Simple vulnerabilities are not @@ -8226,11 +8956,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/07796811-37f9-467c-9ff2-48f346e77ff3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of different roles: uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 risk: Parts of the service are not covered during the scan, because a login @@ -8254,6 +8990,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/65a2d7d9-5441-46bf-a4e3-f76919857750 implementation: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 name: Zest @@ -8264,10 +9003,13 @@ Test and Verification: Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. isImplemented: false assessment: For REST APIs, multiple OAuth2 scopes are used. - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of multiple scanners: uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea risk: Each vulnerability scanner has different opportunities. By using just @@ -8300,11 +9042,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dynamic depth for infrastructure: Load tests: uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd @@ -8330,11 +9078,17 @@ Test and Verification: - 8.6 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/ab5725aa-4d53-47b9-96df-c14b3fa93bcd isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for exposed services: uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 risk: Standard network segmentation and firewalling has not been performed, @@ -8371,11 +9125,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for unauthorized installation: uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a risk: Unapproved components are used. @@ -8403,12 +9163,18 @@ Test and Verification: iso27001-2022: - 8.19 - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/dccf1949-b9a8-4ce8-b992-6a4a7f3a623a isImplemented: false - evidence: "" dependsOn: - Evaluation of the trust of used components tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for unused Resources: uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 risk: Unused resources, specially secrets, might be still valid, but are exposing @@ -8443,11 +9209,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6532c1fe-9d23-4228-8722-558ddabca7d4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test network segmentation: uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 risk: Wrong or no network segmentation of pods makes it easier for an attacker @@ -8478,11 +9250,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6d2c3ac6-8afc-4af6-a5e9-6188341aca01 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of the configuration of cloud environments: uuid: 7bb70764-9392-4462-935d-e55b2e148199 risk: Standard hardening practices for cloud environments are not performed @@ -8525,11 +9303,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/7bb70764-9392-4462-935d-e55b2e148199 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Weak password test: uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f risk: Weak passwords in components like applications or systems, specially for @@ -8555,11 +9339,17 @@ Test and Verification: - 9.4.3 iso27001-2022: - 5.17 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/61e10f9c-e126-4ffa-af12-fdbe0d0a831f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static depth for applications: API design validation: uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 @@ -8605,11 +9395,17 @@ Test and Verification: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dead code elimination: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Dead code increases the attack surface (use of hard coded credentials @@ -8638,9 +9434,16 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Exclusion of source code duplicates: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Duplicates in source code might influence the stability of the application. @@ -8668,9 +9471,16 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Local development security checks performed: uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b risk: Creating and developing code contains code smells and quality issues. @@ -9793,11 +10603,17 @@ Test and Verification: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6e180abc-7c98-4265-b4e9-852cb91b067b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis (client side): uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 risk: Client side components might have vulnerabilities. @@ -9848,11 +10664,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/07fe8c4f-ae33-4409-b1b2-cf64cfccea86 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe risk: Server side components might have vulnerabilities. @@ -9860,10 +10682,10 @@ Test and Verification: are performed. difficultyOfImplementation: knowledge: 1 - time: 2 + time: 3 resources: 1 usefulness: 5 - level: 1 + level: 2 dependsOn: - Defined build process implementation: @@ -9910,11 +10732,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d918cd44-a972-43e9-a974-eff3f4a5dcfe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 risk: Used components like libraries and legacy applications might have vulnerabilities @@ -9936,11 +10764,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for all self written components: uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 risk: Parts in the source code of the frontend or middleware have vulnerabilities. @@ -9993,11 +10827,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/ee68331f-9b1d-4f61-844b-b2ea04753a84 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for important client side components: uuid: e237176b-bec5-447d-a926-e37d6dd60e4b risk: Important parts in the source code of the frontend have vulnerabilities. @@ -10054,11 +10894,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/e237176b-bec5-447d-a926-e37d6dd60e4b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for important server side components: uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 risk: Important parts in the source code of the middleware have vulnerabilities. @@ -10067,10 +10913,10 @@ Test and Verification: dataflow analysis. difficultyOfImplementation: knowledge: 2 - time: 3 + time: 2 resources: 1 usefulness: 4 - level: 2 + level: 3 implementation: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b name: eslint @@ -10110,11 +10956,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6c05c837-8c99-46e2-828b-7c903e27dba4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Stylistic analysis: uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 risk: Unclear or obfuscated code might have unexpected behavior. @@ -10161,11 +11013,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for Patch Deployment Time: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -10196,6 +11054,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Self implementation. This activity is not repeated in @@ -10203,6 +11064,10 @@ Test and Verification: as well. tags: - patching + teamsImplemented: + Default: false + B: false + C: false Test for Time to Patch: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -10242,6 +11107,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Usage of a version control platform API (e.g. github @@ -10249,6 +11117,10 @@ Test and Verification: might be an alternative to this activity. tags: - patching + teamsImplemented: + Default: false + B: false + C: false Test libyear: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Vulnerabilities in running artifacts stay for long and might get exploited. @@ -10282,6 +11154,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: | @@ -10289,6 +11164,10 @@ Test and Verification: An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of multiple analyzers: uuid: 297be001-8d94-41ee-ab29-207020d423c0 risk: Each vulnerability analyzer has different opportunities. By using just @@ -10316,11 +11195,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/297be001-8d94-41ee-ab29-207020d423c0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static depth for infrastructure: Analyze logs: uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 @@ -10343,11 +11228,17 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/b217c8bb-5d61-4b41-a675-1083993f83b1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Correlate known vulnerabilities in infrastructure with new image versions: uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 risk: TODO. @@ -10386,11 +11277,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/7de0ae33-6538-45cd-8222-a1475647ba58 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test cluster deployment resources: uuid: 621fb6a5-5c0a-4408-826a-068868bb031b risk: The deployment configuration (e.g. kubernetes deployment resources) might @@ -10421,11 +11318,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/621fb6a5-5c0a-4408-826a-068868bb031b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for image lifetime: uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b risk: Old container images in production indicate that patch management is not @@ -10460,11 +11363,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for known vulnerabilities: uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad risk: Known vulnerabilities in infrastructure components like container images @@ -10508,11 +11417,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/26e1c6d5-5632-4ec7-80d2-e564b98732ad isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for malware: uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d risk: Third party might include malware. Ether due to the maintainer (e.g. @@ -10547,11 +11462,17 @@ Test and Verification: - 12.2.1 iso27001-2022: - 8.7 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/837f8f90-adc2-4e6b-9ebb-60c2ee29494d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for new image version: uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e risk: When a new version of an image is available, it might fix security vulnerabilities. @@ -10574,11 +11495,17 @@ Test and Verification: - 8.8 - 8.7 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/cb6321aa-0fbf-4996-9e08-05ab26ef4c1e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for stored secrets: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c risk: Stored secrets in git history, in container images or directly in code @@ -10610,11 +11537,17 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/c6e3c812-56e2-41b0-ae01-b7afc41a004c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of infrastructure components for known vulnerabilities: uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 risk: Infrastructure components might have vulnerabilities. @@ -10657,11 +11590,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/13367d8f-e37f-4197-a610-9ffca4fde261 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of virtualized environments: uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 risk: Virtualized environments (e.g. via Container Images) might contains @@ -10698,11 +11637,17 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/58825d22-1ce6-4748-af81-0ec9956e4129 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test the cloud configuration: uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc risk: Standard hardening practices for cloud environments are not performed @@ -10733,11 +11678,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test the definition of virtualized environments: uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e risk: The definition of virtualized environments (e.g. via Dockerfile) @@ -10787,11 +11738,17 @@ Test and Verification: - 8.32 - 8.29 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/8fc3de67-7b8d-420b-8d24-f35928cfed6e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test-Intensity: Creation and application of a testing concept: uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe @@ -10821,11 +11778,16 @@ Test and Verification: - 8.32 - 8.27 - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/79ef8103-e1ed-4055-8df8-fd2b2015bebe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deactivating of unneeded tests: uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 risk: As tools cover a wide range of different vulnerability tests, they might @@ -10852,11 +11814,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Default settings for intensity: uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d risk: Time pressure and ignorance might lead to false predictions for the test @@ -10880,11 +11847,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/ab0a4b51-3b18-43f1-a6fc-a98e4b28453d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false High test intensity: uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 risk: A too small intensity or a too high confidence might lead to not visible @@ -10909,11 +11881,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/2ebfc421-8c76-415c-a3b0-fa518915bd10 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular tests: uuid: 598897a2-358e-441f-984c-e12ec4f6110a risk: After pushing source code to the version control system, any delay in @@ -10937,9 +11914,14 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/598897a2-358e-441f-984c-e12ec4f6110a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false ... From 10cc8080530b74de223f93a51d3e8d6e9f6357ee Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 21 Jul 2024 11:04:45 +0200 Subject: [PATCH 004/370] optimize --- .../BuildAndDeployment/Deployment.yaml | 27 ++++++++++++++++++- .../StaticDepthForApplications.yaml | 9 ++++++- 2 files changed, 34 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 56bbba6..eb42d8b 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -203,7 +203,32 @@ Build and Deployment: isImplemented: false evidence: "" comments: "" - Inventory of running artifacts: + Inventory of production applications: + uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + risk: + An organization is unaware of applications in production. + measure: A documented inventory or applications exists (gathered manually or automatically) + dependsOn: + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - I-SD-2-A + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + isImplemented: false + evidence: "" + comments: "" + Inventory of production artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 4496a9a..18dbbe6 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -151,7 +151,8 @@ Test and Verification: - 8.27 # Secure system architecture and engineering principles - 8.28 # Secure coding isImplemented: false - evidence: "" + dependsOn: + - Inventory of production applications comments: "" Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 @@ -166,6 +167,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components + - Inventory of production applications implementation: [] references: samm2: @@ -200,6 +202,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components + - Inventory of production applications references: samm2: - V-ST-2-A @@ -233,6 +236,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process + - Inventory of production applications references: samm2: - V-ST-2-A @@ -265,6 +269,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process + - Inventory of production applications references: samm2: - V-ST-2-A @@ -318,6 +323,7 @@ Test and Verification: level: 3 dependsOn: - Defined build process + - Inventory of production applications implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit @@ -347,6 +353,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process + - Inventory of production applications implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack From 125f5ee0b95bf8a62588c8d3aea538002e335e4c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 22 Jul 2024 16:29:19 +0200 Subject: [PATCH 005/370] adjust --- .../TestAndVerification/Consolidation.yaml | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index e0f366d..6ebc99e 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -2,6 +2,69 @@ --- Test and Verification: Consolidation: + Fix based on accessibility: + uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed + risk: + Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings. + measure: |- + Implement a simple risk-based prioritization framework for vulnerability remediation based on accessibility of the applications. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + meta: + implementationGuide: |- + Develop a scoring system for asset accessibility, considering factors like: + - Whether the asset is internet-facing (highly recommended) + - The number of network hops required to reach the asset (recommended) + - Authentication requirements for access (recommended) + dependsOn: + - uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425 # Fix based on severity + #- uuid:3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f #iventory of apps + implementation: + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: ["vuln-action", "defect-management"] + Fix based on severity: + uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 + risk: |- + Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings. + measure: Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: ["vuln-action", "defect-management"] Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 risk: From 4b37b45c9a5f40c2f739f0e8509b7d07fe736224 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 31 Jul 2024 08:28:36 +0200 Subject: [PATCH 006/370] fix: formatting --- .../YAML/default/BuildAndDeployment/PatchManagement.yaml | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index 4424398..6e130ba 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -39,6 +39,7 @@ Build and Deployment: measure: Fast patching of third party component is needed. The DevOps way is to have an automated pull request for new components. This includes + * Applications * Virtualized operating system components (e.g. container images) * Operating Systems @@ -47,7 +48,7 @@ Build and Deployment: knowledge: 2 time: 2 resources: 2 - usefulness: 5 + usefulness: 4 level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependabot @@ -62,8 +63,8 @@ Build and Deployment: - 12.6.1 - 14.2.5 iso27001-2022: - - 8.8 - - 8.27 + - "8.8" + - "8.27" comments: "" tags: - patching From 73ba5926bfbc0fcef82c6bce2dc04552a7179f08 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 31 Jul 2024 08:31:12 +0200 Subject: [PATCH 007/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ src/assets/YAML/generated/generated.yaml | 14 ++++++-------- 2 files changed, 13 insertions(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f5e9a1b..c70b82e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [1.11.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.11.0...v1.11.1) (2024-07-31) + + +### Bug Fixes + +* formatting ([4b37b45](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/4b37b45c9a5f40c2f739f0e8509b7d07fe736224)) + # [1.11.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.10.1...v1.11.0) (2024-07-19) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index de5e7a1..fb5fc47 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -1871,16 +1871,14 @@ Build and Deployment: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 risk: Components with known (or unknown) vulnerabilities might stay for long and get exploited, even when a patch is available. - measure: Fast patching of third party component is needed. The DevOps way is - to have an automated pull request for new components. This includes * Applications - * Virtualized operating system components (e.g. container images) * Operating - Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository - or terraform) + measure: |- + Fast patching of third party component is needed. The DevOps way is to have an automated pull request for new components. This includes + * Applications * Virtualized operating system components (e.g. container images) * Operating Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform) difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 - usefulness: 5 + usefulness: 4 level: 1 implementation: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 @@ -1913,8 +1911,8 @@ Build and Deployment: - 12.6.1 - 14.2.5 iso27001-2022: - - 8.8 - - 8.27 + - "8.8" + - "8.27" openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 From 58e67b76c7f4457aac333900bf2430e487a72f2d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 1 Aug 2024 15:52:19 +0200 Subject: [PATCH 008/370] feat: add vuln --- .../BuildAndDeployment/Deployment.yaml | 74 +++++++++++-------- .../default/InformationGathering/Logging.yaml | 3 - .../MeasurementsAndMetrics.yaml | 60 +++++++++++++++ .../StaticDepthForApplications.yaml | 14 ++-- .../TestAndVerification/Test-Intensity.yaml | 2 +- src/assets/YAML/default/implementations.yaml | 16 +++- 6 files changed, 126 insertions(+), 43 deletions(-) create mode 100644 src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index eb42d8b..21408ef 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -49,7 +49,8 @@ Build and Deployment: Unused applications are not maintained and may contain vulnerabilities. Once exploited they can be used to attack other applications or to perform lateral movements within the organization. - measure: A clear decommissioning process ensures the removal of unused applications. + measure: |- + A clear decommissioning process ensures the removal of unused applications from the `Inventory of production components` and if implemented from `Inventory of production artifacts`. difficultyOfImplementation: knowledge: 1 time: 2 @@ -129,8 +130,8 @@ Build and Deployment: d3f: - ApplicationConfigurationHardening isImplemented: false - evidence: "" - comments: "" + tags: + - secret Handover of confidential parameters: uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a risk: @@ -169,19 +170,19 @@ Build and Deployment: d3f: - ApplicationConfigurationHardening isImplemented: false - evidence: "" - comments: "" - Inventory of dependencies: + tags: + - secret + Inventory of production dependencies: uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 risk: - In case a vulnerability of severity high or critical is known by the organization, - it needs to be known where an artifacts with that vulnerability is deployed + Delayed identification of components and their vulnerabilities in production. + In case a vulnerability is known by the organization, it needs to be known where an artifacts with that vulnerability is deployed with which dependencies. measure: - A documented inventory of dependencies used in images and containers + A documented inventory of dependencies used in artifacts like container images and containers exists. dependsOn: - - Defined deployment process + - uuid:83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts - SBOM of components difficultyOfImplementation: knowledge: 2 @@ -190,7 +191,9 @@ Build and Deployment: usefulness: 3 level: 3 implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - I-SD-2-A @@ -200,22 +203,29 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" comments: "" - Inventory of production applications: + tags: + - inventory + - sbom + Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f - risk: - An organization is unaware of applications in production. - measure: A documented inventory or applications exists (gathered manually or automatically) + risk: |- + An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it. + measure: |- + A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. + In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. dependsOn: + - Defined deployment process difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 - usefulness: 3 - level: 3 - implementation: [] + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - I-SD-2-A @@ -225,25 +235,28 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" - comments: "" + tags: + - inventory Inventory of production artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs to be known where an artifacts (e.g. container image) with that vulnerability is deployed. - measure: A documented inventory or a possibility to gather the needed information. + measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically). dependsOn: - Defined deployment process + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components difficultyOfImplementation: knowledge: 2 time: 2 resources: 3 usefulness: 3 - level: 3 - implementation: [] + level: 2 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - I-SD-2-A @@ -253,9 +266,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" - comments: "" + tags: + - inventory Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. diff --git a/src/assets/YAML/default/InformationGathering/Logging.yaml b/src/assets/YAML/default/InformationGathering/Logging.yaml index 63c73db..041b871 100755 --- a/src/assets/YAML/default/InformationGathering/Logging.yaml +++ b/src/assets/YAML/default/InformationGathering/Logging.yaml @@ -30,9 +30,6 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - isImplemented: false - evidence: "" - comments: "" Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: diff --git a/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml b/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml new file mode 100644 index 0000000..b9cc7e6 --- /dev/null +++ b/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml @@ -0,0 +1,60 @@ +# yaml-language-server: $schema=../../schemas/dsomm-schema-information-gathering.json +--- +Information Gathering: + Test KPI: + #Number of vulnerabilities - appsec - vuln management ? + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: |- + Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings. + measure: |- + Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + SLA per criticality: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of + critical security issues, increasing the risk of exploitation and potential damage to the organization. + measure: |- + Measurement and communication of how much vulnerabilities handling per severity for components like applications are aligned to SLAs. + At least quarterly. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 18dbbe6..2a0c3ad 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -152,7 +152,7 @@ Test and Verification: - 8.28 # Secure coding isImplemented: false dependsOn: - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components comments: "" Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 @@ -167,7 +167,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: [] references: samm2: @@ -202,7 +202,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -236,7 +236,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -269,7 +269,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -323,7 +323,7 @@ Test and Verification: level: 3 dependsOn: - Defined build process - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit @@ -353,7 +353,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack diff --git a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml index ee9ee4c..882b3f4 100755 --- a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml +++ b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml @@ -121,7 +121,7 @@ Test and Verification: isImplemented: false evidence: "" comments: "" - Regular tests: + Regular automated tests: uuid: 598897a2-358e-441f-984c-e12ec4f6110a risk: After pushing source code to the version control system, any delay in diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 4d77c44..564dbff 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -788,7 +788,7 @@ implementations: uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track - tags: [sca, inventory, OpenSource, "Supply Chain", vulnerability] + tags: [sca, inventory, OpenSource, "Supply Chain", vulnerability, inventory] juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -928,3 +928,17 @@ implementations: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: [documentation, inventory] + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: [documentation, inventory, kubernetes] + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. From 52e468a20ae631d359bd547b70fe72fca4e02530 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 6 Aug 2024 12:37:41 +0200 Subject: [PATCH 009/370] current state --- README.md | 10 + .../MeasurementsAndMetrics.yaml | 60 - .../default/InformationGathering/TestKPI.yaml | 192 ++ .../default/InformationGathering/_meta.yaml | 2 +- .../TestAndVerification/Consolidation.yaml | 111 +- src/assets/YAML/default/implementations.yaml | 7 + src/assets/YAML/generated/generated.yaml | 1714 +++++++++++++++-- 7 files changed, 1785 insertions(+), 311 deletions(-) delete mode 100644 src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml create mode 100644 src/assets/YAML/default/InformationGathering/TestKPI.yaml diff --git a/README.md b/README.md index a5a0366..e8e88ef 100644 --- a/README.md +++ b/README.md @@ -8,3 +8,13 @@ docker run -ti -v $(pwd)/src/assets/YAML/:/var/www/html/src/assets/YAML wurstbro # Afterwards, you can use the generated.yaml in a container docker run -v $(pwd)/src/assets/YAML/generated/generated.yaml:/usr/share/nginx/html/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm ``` + +## Credits + +* The dimension _Test and Verification_ is based on Christian Schneiders [Security DevOps Maturity Model (SDOMM)](https://www.christian-schneider.net/SecurityDevOpsMaturityModel.html). _Application tests_ and _Infrastructure tests_ are added by Timo Pagel. Also, the sub-dimension _Static depth_ has been evaluated by security experts at [OWASP Stammtisch Hamburg](https://www.owasp.org/index.php/OWASP_German_Chapter_Stammtisch_Initiative/Hamburg). +* The sub-dimension Process has been added after a discussion with [Francois Raynaud](https://www.linkedin.com/in/francoisraynaud/) that reactive activities are missing. +* Enhancement of my basic translation is performed by [Claud Camerino](https://github.com/clazba). +* Adding ISO 27001:2017 mapping, [Andre Baumeier](https://github.com/AndreBaumeier). +* [OWASP Project Integration Project Writeup](https://github.com/OWASP/www-project-integration-standards/blob/master/writeups/owasp_in_sdlc/index.md) for providing documentation on different DevSecOps practices which are copied&pasted/ (and adopted) (https://github.com/northdpole, https://github.com/ThunderSon) +* The requirements from [level 0](https://github.com/AppSecure-nrw/security-belts/blob/master/white/) are based on/copied from [AppSecure NRW](https://appsecure.nrw/) +* The sub dimension _Test KPI_, _Triage_, _Dynamic depth for app/infra_, _Static depth for app/infra_ and some other vulnerability management activities are based/inspired by [Vulnerability Managment Maturity Model - Cheat Sheet V1.6](TODO FRANCESCO LINK) diff --git a/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml b/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml deleted file mode 100644 index b9cc7e6..0000000 --- a/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml +++ /dev/null @@ -1,60 +0,0 @@ -# yaml-language-server: $schema=../../schemas/dsomm-schema-information-gathering.json ---- -Information Gathering: - Test KPI: - #Number of vulnerabilities - appsec - vuln management ? - Number of vulnerabilities/severity: - uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 - risk: |- - Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings. - measure: |- - Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly. - description: |- - Communication can be performed in a simple way, e.g. text based during the build process. - This activity depends on at least one security testing implementation. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: [] - implementation: [] - references: - samm2: - - I-DM-3-B - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.10 - tags: - - vulnerability-mgmt - - metrics - SLA per criticality: - uuid: 123e4567-e89b-12d3-a456-426614174000 - risk: |- - Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of - critical security issues, increasing the risk of exploitation and potential damage to the organization. - measure: |- - Measurement and communication of how much vulnerabilities handling per severity for components like applications are aligned to SLAs. - At least quarterly. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - dependsOn: [] - implementation: [] - references: - samm2: - - I-DM-3-B - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.10 - tags: - - vulnerability-mgmt - - metrics diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml new file mode 100644 index 0000000..8d35521 --- /dev/null +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -0,0 +1,192 @@ +# yaml-language-server: $schema=../../schemas/dsomm-schema-information-gathering.json +--- +Information Gathering: + Test KPI: + #Number of vulnerabilities - appsec - vuln management ? + # Fix Rate? + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: |- + Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings. + measure: |- + Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurement + Patching mean time to resolution via PR: + uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 + risk: |- + Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss. + measure: |- + Measurement and communication of patching Mean Time to Resolution (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + This includes the measurement of the existence of a properly configured automated pull request (PR) tool (e.g., Dependabot or Renovate) in a repository. + In addition, the measurement of the time from opening an automated PR to merging it. + + Average time to patch is visualized per component/project/team. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - patching + - metrics + - vmm-measurements + SLA per criticality: # is this the definition of SLAs or the measurement? + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of + critical security issues, increasing the risk of exploitation and potential damage to the organization. + measure: |- + Measurement and communication of how many of the vulnerabilities handling per severity for components like applications are aligned to SLAs. + This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application. + At least quarterly. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + Patching mean time to resolution via production: + uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f + risk: |- + Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss. + measure: |- + Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + Average time to patch is visualized per component/project/team. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 4 + dependsOn: + - uuid:86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR + - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + iso27001-2022: + - 5.25 + tags: + - patching + - metrics + - vmm-measurements + Generation of response statistics: + uuid: c922981b-65ed-40f3-a947-96fee9a0125f + risk: No or delayed reaction to findings leads to potential exploitation of findings. + measure: Creation and response statistics (e.g. Mean Time to Resolution) of findings. This is also referred to as _Mean Time to Resolve_. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + dependsOn: + - Usage of a vulnerability management system + level: 3 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + comments: "The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results)." + Fix rate per repo/product: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of + critical security issues, increasing the risk of exploitation and potential damage to the organization. + measure: |- + Measurement and communication of the number of vulnerabilities handled per severity level for components such as applications, ensuring alignment with SLAs. + The rate should be broken down by team, product, application, repository, and/or service. This analysis should be conducted at least quarterly. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: + - uuid:123e4567-e89b-12d3-a456-426614174000 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + diff --git a/src/assets/YAML/default/InformationGathering/_meta.yaml b/src/assets/YAML/default/InformationGathering/_meta.yaml index 646d2cc..cea4d30 100755 --- a/src/assets/YAML/default/InformationGathering/_meta.yaml +++ b/src/assets/YAML/default/InformationGathering/_meta.yaml @@ -2,4 +2,4 @@ _meta: label: Information Gathering icon: Information Gathering.png description: |- - A markdown description of this dimension. + Gathering of Information diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 6ebc99e..4fe0291 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -43,7 +43,10 @@ Test and Verification: uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 risk: |- Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings. - measure: Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. + measure: | + Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. + + On level one, fix only critical findings. difficultyOfImplementation: knowledge: 2 time: 2 @@ -97,62 +100,6 @@ Test and Verification: isImplemented: false evidence: "" comments: "" - Generation of Response Statistics: - uuid: c922981b-65ed-40f3-a947-96fee9a0125f - risk: No or delayed reaction to findings leads to potential exploitation of findings. - measure: Creation and response statistics of findings. This is also referred to as _Mean Time to Resolve_. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - dependsOn: - - Usage of a vulnerability management system - level: 3 - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client - references: - samm2: - - I-DM-2-B - iso27001-2017: - - 16.1.4 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.10 - isImplemented: false - evidence: "" - comments: "The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results)." - Generation of Patch Management Statistics: - uuid: 785e34ef-40c6-487a-984c-3e7706c9bc1f - risk: Delays in patch response lead to an increased attack surface through longer exposure of known vulnerabilities. - measure: Average time to patch is visualized per component/project/team. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 2 - level: 3 - dependsOn: - - A patch policy is defined - - Automated PRs for patches - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics - references: - samm2: - - I-DM-3-B - iso27001-2017: - - 16.1.4 - iso27001-2022: - - 5.25 - isImplemented: false - evidence: "" - comments: "" Integration of vulnerability issues into the development process: uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e risk: @@ -385,6 +332,50 @@ Test and Verification: - 5.25 - 5.26 - 5.27 - isImplemented: false - evidence: "" - comments: "" + Integration in development process: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not integrating vulnerability handling into the development process may result in product teams ignoring findings. + + Security joke: We will gain 100% false negatives. + measure: |- + Integration of findings into the development process. E.g. adding findings to the backlog of products teams. + description: |- + Validating Findings by Security Engineers Pros: + - Ensures accuracy and relevance of findings before they reach product teams + - Reduces false positives, saving development teams time and effort + - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities + + Validating Findings by Security Engineers Cons: + - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations + - May slow down the process if security engineers are overloaded with validation tasks + - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application + + Pushing Findings Directly to Product Teams Pros: + - Accelerates the process by immediately notifying product teams of potential vulnerabilities + - Empowers product teams to take swift action in addressing security issues + Pushing Findings Directly to Product Teams Cons: + - Increases the workload on product teams, potentially leading to frustration + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/jira + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - vmm-measurements diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 564dbff..57ea055 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -942,3 +942,10 @@ implementations: url: https://github.com/SDA-SE/image-metadata-collector/ description: | Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + jira: + uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: [documentation, issue, proprietary] + url: https://jira.atlassian.com/ + description: |- + Jira is a bug tracking and project management tool developed by Atlassian, used by development teams for tracking issues, planning sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 8e6fc29..b22453d 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -41,11 +41,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/a340f46b-6360-4cb8-847b-a0d3483d09d3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b risk: Performing builds without a defined process is error prone; for example, @@ -88,11 +93,16 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f6f7737f-25a9-4317-8de2-09bf59f29b5b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Pinning of artifacts: uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 risk: Unauthorized manipulation of artifacts might be difficult to spot. For @@ -128,11 +138,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false SBOM of components: uuid: 2858ac12-0179-40d9-9acf-1b839c030473 description: |- @@ -162,11 +177,16 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/2858ac12-0179-40d9-9acf-1b839c030473 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Signing of artifacts: uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -212,11 +232,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/5786959d-0c6f-46a6-8e1c-a32ff1a50222 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Signing of code: uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -251,11 +276,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/9f107927-61e9-4574-85ad-3f2b4bca8665 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deployment: Blue/Green Deployment: uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 @@ -293,11 +323,16 @@ Build and Deployment: - 8.32 - 8.19 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0cb2626b-fb0d-4a0f-9688-57f787310d97 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined decommissioning process: uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 description: |- @@ -308,7 +343,9 @@ Build and Deployment: risk: Unused applications are not maintained and may contain vulnerabilities. Once exploited they can be used to attack other applications or to perform lateral movements within the organization. - measure: A clear decommissioning process ensures the removal of unused applications. + measure: A clear decommissioning process ensures the removal of unused applications + from the `Inventory of production components` and if implemented from `Inventory + of production artifacts`. difficultyOfImplementation: knowledge: 1 time: 2 @@ -322,11 +359,16 @@ Build and Deployment: - 11.2.7 iso27001-2022: - 7.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/da4ff665-dcb9-4e93-9d20-48cdedc50fc2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a risk: Deployment of insecure or malfunctioning artifacts. @@ -361,11 +403,16 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Environment depending configuration parameters (secrets): uuid: df428c9d-efa0-4226-9f47-a15bb53f822b risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. @@ -1266,6 +1313,7 @@ Build and Deployment: - OpenSource - Supply Chain - vulnerability + - inventory juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -1452,6 +1500,25 @@ Build and Deployment: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - I-SD-1-B @@ -1463,11 +1530,15 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/df428c9d-efa0-4226-9f47-a15bb53f822b isImplemented: false - evidence: "" - comments: "" tags: - - none + - secret + teamsImplemented: + Default: false + B: false + C: false Evaluation of the trust of used components: uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba risk: Application and system components like Open Source libraries or images @@ -1511,11 +1582,16 @@ Build and Deployment: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0de465a6-55a7-4343-af79-948bb5ff10ba isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Handover of confidential parameters: uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a risk: Parameters are often used to set credentials, for example by starting @@ -1550,28 +1626,40 @@ Build and Deployment: - 8.24 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/94a96f79-8bd6-4904-97c0-994ff88f176a isImplemented: false - evidence: "" - comments: "" tags: - - none - Inventory of dependencies: - uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 - risk: In case a vulnerability of severity high or critical is known by the organization, - it needs to be known where an artifacts with that vulnerability is deployed - with which dependencies. - measure: A documented inventory of dependencies used in images and containers - exists. + - secret + teamsImplemented: + Default: false + B: false + C: false + Inventory of production artifacts: + uuid: 83057028-0b77-4d2e-8135-40969768ae88 + risk: In case a vulnerability of severity high or critical exists, it needs + to be known where an artifacts (e.g. container image) with that vulnerability + is deployed. + measure: A documented inventory of artifacts in production like container images + exists (gathered manually or automatically). dependsOn: - Defined deployment process - - SBOM of components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f difficultyOfImplementation: knowledge: 2 time: 2 resources: 3 usefulness: 3 - level: 3 + level: 2 implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply @@ -1584,6 +1672,16 @@ Build and Deployment: - OpenSource - Supply Chain - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - I-SD-2-A @@ -1593,26 +1691,124 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" - comments: "" - tags: - - none - Inventory of running artifacts: - uuid: 83057028-0b77-4d2e-8135-40969768ae88 - risk: In case a vulnerability of severity high or critical exists, it needs - to be known where an artifacts (e.g. container image) with that vulnerability - is deployed. - measure: A documented inventory or a possibility to gather the needed information. + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/83057028-0b77-4d2e-8135-40969768ae88 + tags: + - inventory + teamsImplemented: + Default: false + B: false + C: false + Inventory of production components: + uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + risk: An organization is unaware of components like applications in production. + Not knowing existing applications in production leads to not assessing it. + measure: |- + A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. + In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. dependsOn: - Defined deployment process + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + references: + samm2: + - I-SD-2-A + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/2a44b708-734f-4463-b0cb-86dc46344b2f + tags: + - inventory + teamsImplemented: + Default: false + B: false + C: false + Inventory of production dependencies: + uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 + risk: Delayed identification of components and their vulnerabilities in production. + In case a vulnerability is known by the organization, it needs to be known + where an artifacts with that vulnerability is deployed with which dependencies. + measure: A documented inventory of dependencies used in artifacts like container + images and containers exists. + dependsOn: + - uuid:83057028-0b77-4d2e-8135-40969768ae88 + - SBOM of components difficultyOfImplementation: knowledge: 2 time: 2 resources: 3 usefulness: 3 level: 3 - implementation: [] + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - I-SD-2-A @@ -1622,11 +1818,16 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/13e9757e-58e2-4277-bc0f-eadc674891e6 comments: "" tags: - - none + - inventory + - sbom + teamsImplemented: + Default: false + B: false + C: false Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. @@ -1662,11 +1863,16 @@ Build and Deployment: - 8.19 - 8.32 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/85d52588-f542-4225-a338-20dc22a5508d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Same artifact for environments: uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f risk: Building of an artifact for different environments means that an untested @@ -1697,11 +1903,16 @@ Build and Deployment: - 8.33 - 8.29 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a854b48d-83bd-4f8d-8621-a0bdd470837f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of feature toggles: uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad risk: Using environment variables to enable or disable features can lead to @@ -1743,11 +1954,16 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a511799b-045e-4b96-9843-7d63d8c1e2ad isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d @@ -1772,11 +1988,17 @@ Build and Deployment: - 8.8 - 8.19 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/99415139-6b50-441b-89e1-0aa59accd43d isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 risk: Components with known (or unknown) vulnerabilities might stay for long @@ -1825,9 +2047,16 @@ Build and Deployment: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Automated merge of automated PRs: uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: Automated merges of automated created PRs for outdated dependencies. @@ -1862,9 +2091,16 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/f2594f8f-1cd6-45f9-af29-eaf3315698eb comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Nightly build of images (base images): uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 description: |- @@ -1893,11 +2129,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/34869eaf-f2e1-4926-b0bd-28c43402f057 isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Reduction of the attack surface: uuid: 16e39c8f-5336-4001-88ed-a552d2447531 description: |- @@ -1937,10 +2179,17 @@ Build and Deployment: - 14.2.1 iso27001-2022: - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/16e39c8f-5336-4001-88ed-a552d2447531 evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of a maximum lifetime for images: uuid: 485a3383-7f2e-4dba-bb84-479377070904 description: |- @@ -1974,10 +2223,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/485a3383-7f2e-4dba-bb84-479377070904 evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of a short maximum lifetime for images: uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e description: |- @@ -2021,11 +2277,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/6b96e5a0-ce34-4ea4-a88f-469d3b84546e isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Culture and Organization: Design: Conduction of advanced threat modeling: @@ -2120,11 +2382,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of simple threat modeling on business level: uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 risk: Business related threats are discovered too late in the development and @@ -2151,11 +2418,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/48f97f31-931c-46eb-9b3e-e2fec0cd0426 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e risk: Technical related threats are discovered too late in the development and @@ -2271,11 +2543,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/47419324-e263-415b-815d-e7161b6b905e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of advanced abuse stories: uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e risk: Simple user stories are not going deep enough. Relevant security considerations @@ -2313,11 +2590,16 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/0a929c3e-ab9a-4206-8761-adf84b74622e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of simple abuse stories: uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 risk: User stories mostly don't consider security implications. Security flaws @@ -2355,11 +2637,16 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/bacf85b6-5bc0-405d-b5ba-a5d971467cc1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of threat modeling processes and standards: uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e risk: Inadequate identification of business and technical risks. @@ -2404,11 +2691,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Information security targets are communicated: uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 risk: Employees don't known their organizations security targets. Therefore @@ -2431,11 +2723,16 @@ Culture and Organization: iso27001-2022: - 5.1 - 5.4 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/1b9281b9-48e2-4c01-9ac6-9db9931c4885 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 @@ -2470,11 +2767,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Aligning security in teams: uuid: f994a55d-71bb-45a4-a887-0a213d72c504 risk: The concept of Security Champions might suggest that only he/she is responsible @@ -2501,11 +2804,17 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f994a55d-71bb-45a4-a887-0a213d72c504 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of build-it, break-it, fix-it contests: uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 risk: Understanding security is hard, even for security champions and the conduction @@ -2532,11 +2841,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/bfdb576e-a416-4ec6-96fe-a078d58b2ff8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of collaborative security checks with developers and system administrators: uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 risk: Security checks by external companies do not increase the understanding @@ -2566,11 +2881,17 @@ Culture and Organization: - 6.3 - 8.8 - 8.34 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/95caef96-36ed-458c-a087-5c35d4f9dec2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of collaborative team security checks: uuid: 35446784-7610-40d9-af9e-d43f3173bf8c risk: Development teams limited insight over security practices. @@ -2593,11 +2914,17 @@ Culture and Organization: iso27001-2022: - Mutual security testing is not explicitly required in ISO 27001 may be - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/35446784-7610-40d9-af9e-d43f3173bf8c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of war games: uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 risk: Understanding incident response plans during an incident is hard and ineffective. @@ -2624,11 +2951,17 @@ Culture and Organization: - 6.3 - 5.24 - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/534f60bf-0995-4314-bb9c-f0f2bf204694 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Each team has a security champion: uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 risk: No one feels directly responsible for security and the security champion @@ -2678,11 +3011,17 @@ Culture and Organization: - Security champions are missing in ISO 27001 most likely - 5.4 - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for all: uuid: 9768f154-357a-4c06-af6f-d66570677c9b risk: Understanding security is hard. @@ -2722,11 +3061,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/9768f154-357a-4c06-af6f-d66570677c9b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for externals: uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 risk: Understanding security is hard. @@ -2759,11 +3104,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/31833d56-35af-4ef3-9300-f23d27646ce7 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training of security champions: uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 risk: Understanding security is hard, even for security champions. @@ -2795,11 +3146,17 @@ Culture and Organization: iso27001-2022: - Security champions are missing in ISO 27001 - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Reward of good communication: uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c risk: Employees are not getting excited about security. @@ -2837,11 +3194,17 @@ Culture and Organization: but nothing to promote good behavior. iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/91b6f75b-9f4a-4d77-95a2-af7ad3222c7c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security Coaching: uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 risk: Training does not change behaviour. Therefore, even if security practices @@ -2872,11 +3235,17 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security code review: uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 risk: Understanding security is hard. @@ -2917,11 +3286,17 @@ Culture and Organization: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/7121b0c7-6ace-4d6b-95d0-94535dbccb57 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 risk: Not asking a security expert when questions regarding security appear @@ -2953,11 +3328,17 @@ Culture and Organization: - 5.2 - 5.6 - 5.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/0b28367b-75a0-4bae-a926-3725c1bf9bb0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security-Lessoned-Learned: uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 risk: After an incident, a similar incident might reoccur. @@ -2978,11 +3359,17 @@ Culture and Organization: - 16.1.6 iso27001-2022: - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/58c46807-fee9-448b-b6dd-8050c464ab52 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple mob hacking: uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de risk: Understanding security is hard. @@ -3030,11 +3417,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/535f301a-e8e8-4eda-ad77-a08b035c92de isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Process: Approval by reviewing any new version: uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 @@ -3060,11 +3453,16 @@ Culture and Organization: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/3f63bdbc-c75f-4780-a941-e6ad42e894e1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Definition of a change management process: uuid: b4193d32-3948-47e2-a326-3748c48019a1 risk: The impact of a change is not controlled because these are not recorded @@ -3086,11 +3484,16 @@ Culture and Organization: iso27001-2022: - 8.32 - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/b4193d32-3948-47e2-a326-3748c48019a1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 risk: In case of an emergency, like a power outage, DR actions to perform are @@ -3113,11 +3516,16 @@ Culture and Organization: - 17.1.1 iso27001-2022: - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/c72da779-86cc-45b1-a339-190ce5093171 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Implementation: Application Hardening: App. Hardening Level 1: @@ -3178,9 +3586,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/cf819225-30cb-4702-8e32-60225eedc33d comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 1 (50%): uuid: b597928e-54d6-48a5-a806-8003dcd56aab risk: Using an insecure application might lead to a compromised application. @@ -3237,10 +3652,17 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/b597928e-54d6-48a5-a806-8003dcd56aab isImplemented: false comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 2: uuid: ffe86caf-2fec-4630-b514-2db83983984d risk: Using an insecure application might lead to a compromised application. @@ -3275,13 +3697,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/ffe86caf-2fec-4630-b514-2db83983984d isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 (75%) tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 2 (75%): uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 risk: Using an insecure application might lead to a compromised application. @@ -3316,13 +3744,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/03643ca2-03c2-472b-8e19-956bf02fe9b7 isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 1 tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 3: uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a risk: Using an insecure application might lead to a compromised application. @@ -3357,13 +3791,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 tags: - none + teamsImplemented: + Default: false + B: false + C: false Contextualized Encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 risk: The generation of interpreter directives from user-provided data poses @@ -3388,8 +3828,15 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/e1f37abb-d848-4a3a-b3df-65e91a89dcb7 tags: - none + teamsImplemented: + Default: false + B: false + C: false Development and Source Control: .gitignore: uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d @@ -3416,10 +3863,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/363a3eea-baf9-4010-88ca-bb8186a2989d evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false API design validation: uuid: 948a4d51-ceb5-4ebd-bdc7-d74ea25e171c risk: Creation of insecure or non-compliant API. @@ -3464,11 +3918,17 @@ Implementation: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/948a4d51-ceb5-4ebd-bdc7-d74ea25e171c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Local development linting & style checks performed: uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 risk: Insecure or unmaintainable code base. @@ -3500,11 +3960,17 @@ Implementation: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/517b0957-4981-4ac0-b4c7-0d8d1934c474 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Source Control Protection: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 risk: Intentional or accidental alterations in critical branches like master. @@ -3549,11 +4015,17 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Versioning: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f risk: Deployment of untracked artifacts. @@ -3581,11 +4053,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/066084c6-1135-4635-9cc5-9e75c7c5459f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Infrastructure Hardening: Applications are running in virtualized environments: uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 @@ -3608,11 +4086,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/3a94d55e-fd82-4996-9eb3-20d23ff2a873 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Backup: uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc risk: If errors are experienced during the deployment process you want to deploy @@ -3643,11 +4127,17 @@ Implementation: iso27001-2022: - 8.13 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5c61fd6b-8106-4c68-ac28-a8a42f1c67dc isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Baseline Hardening of the environment: uuid: 5992c38c-8597-4035-89db-d15820d81c3a risk: Using default configurations for a cluster environment leads to potential @@ -3709,11 +4199,17 @@ Implementation: - 13.1.3 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5992c38c-8597-4035-89db-d15820d81c3a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Filter outgoing traffic: uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d risk: A compromised infrastructure component might try to send out stolen data. @@ -3744,11 +4240,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/6df508ef-86fc-4c22-bd9f-646c3127ce7d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Hardening of the Environment: uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 risk: Using default configurations for a cluster environment leads to potential @@ -3811,11 +4313,17 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/dcf9601b-b4f2-4e25-9143-e39af75f7c33 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Immutable infrastructure: uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 risk: The availability of IT systems might be disturbed due to components failures @@ -3841,11 +4349,17 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/48e92bb1-fdba-40e8-b6c2-35de0d431833 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Infrastructure as Code: uuid: 8b994601-575e-4ea5-b228-accb18c8e514 risk: No tracking of changes in systems might lead to errors in the configuration. @@ -3891,11 +4405,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8b994601-575e-4ea5-b228-accb18c8e514 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Isolated networks for virtual environments: uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 risk: Virtual environments in default settings are able to access other virtual @@ -3932,11 +4452,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/4ce24abd-8ba6-494c-828d-4d193e28e4a1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Limitation of system events: uuid: e5386abf-9154-4752-a1a8-c3a8900f732d risk: System events (system calls) can lead to privilege escalation. @@ -3974,11 +4500,17 @@ Implementation: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e5386abf-9154-4752-a1a8-c3a8900f732d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false MFA: uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de risk: One factor authentication is more vulnerable to brute force attacks and @@ -4022,11 +4554,17 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/598e9f13-1ac8-4a01-b85e-8fab93ee81de isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false MFA for admins: uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 risk: One factor authentication is more vulnerable to brute force attacks and @@ -4068,11 +4606,17 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8098e416-e1ed-4ae4-a561-83efbe76bf57 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Microservice-architecture: uuid: 118b869b-3850-456e-98d9-1abdb85cbc5a risk: Monolithic applications are hard to test. @@ -4092,11 +4636,17 @@ Implementation: - Not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/118b869b-3850-456e-98d9-1abdb85cbc5a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Production near environments are used by developers: uuid: e14de741-94b3-447c-8b07-eea947d82e61 risk: In case an errors occurs in production, the developer need to be able @@ -4125,11 +4675,17 @@ Implementation: iso27001-2022: - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e14de741-94b3-447c-8b07-eea947d82e61 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Role based authentication and authorization: uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 risk: Everyone is able to get unauthorized access to information on systems @@ -4160,11 +4716,17 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/070bb14b-e04a-4f3d-896a-a08eba7a35f9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple access control for systems: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 risk: Attackers a gaining access to internal systems and application interfaces @@ -4193,11 +4755,17 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/82e499d1-f463-4a4b-be90-68812a874af6 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of a chaos monkey: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In @@ -4221,11 +4789,17 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f8e80f18-2503-4e3e-b3bc-7f67bb28defe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of an security account: uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 risk: Having security auditing in the same account as infrastructure and applications @@ -4246,11 +4820,17 @@ Implementation: - 10.1 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/746025a6-dbfb-4087-a000-e46acab64ee1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of edge encryption at transit: uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 risk: Evil actors might be able to perform a man in the middle attack and sniff @@ -4271,11 +4851,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ad23be9c-5661-4f1f-81a3-5a5dc7061629 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of encryption at rest: uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 risk: Evil actors might be able to access data and read information, e.g. from @@ -4296,11 +4882,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/0ff45fb8-7eef-46ed-9b3a-84c955cd7060 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of internal encryption at transit: uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 risk: Evil actors within the organization of traffic in transit might be able @@ -4322,11 +4914,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ecb0184c-6bc9-45da-bbbb-a983797ffc93 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of security by default for components: uuid: 11b3848e-e931-4146-a35d-35409ada24ee risk: Components (images, libraries, applications) are not hardened. @@ -4363,11 +4961,17 @@ Implementation: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/11b3848e-e931-4146-a35d-35409ada24ee isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of test and production environments: uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 risk: Security tests are not running regularly because test environments are @@ -4393,11 +4997,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/bfdacb52-1e3f-431d-ae72-d844a5e86415 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Virtual environments are limited: uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca risk: Denial of service (internally by an attacker or unintentionally by a bug) @@ -4426,11 +5036,17 @@ Implementation: - 8.6 - 8.22 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/760f1056-b0ee-4f22-a35b-f65446f944ca isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF Advanced: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced risk: The presence of sophisticated threats necessitates a robust defense strategy @@ -4459,9 +5075,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF baseline: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: Vulnerable input, such as exploits, can infiltrate the application via @@ -4490,9 +5113,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF medium: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: The threat from malicious inputs remains high, with exploits seeking to @@ -4521,9 +5151,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false Information Gathering: Logging: Centralized application logging: @@ -4552,11 +5189,14 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - isImplemented: false - evidence: "" - comments: "" + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/fe875e17-ae4a-45f8-a359-244aa4fcbc04 tags: - none + teamsImplemented: + Default: false + B: false + C: false Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: Local stored system logs can be unauthorized manipulated by attackers @@ -4592,11 +5232,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/4eced38a-7904-4c45-adb0-50b663065540 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Correlation of security events: uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 risk: Detection of security related events with hints on different systems/tools/metrics @@ -4622,11 +5267,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccf4561d-253f-4762-adcb-bc4622fd6fc5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Logging of security events: uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb description: | @@ -4680,14 +5330,19 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccfdd0a8-991e-4269-ad77-c0a54ca655cb risk: |- * No track of security-relevant events makes it harder to analyze an incident. * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false PII logging concept: uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 risk: Personal identifiable information (PII) is logged and the privacy law @@ -4733,11 +5388,16 @@ Information Gathering: - Not explicitly covered by ISO 27001 - too specific - 8.15 - 5.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/613a73dc-4f60-49db-a6ce-4fb7bf8519f9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Visualized logging: uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 risk: System and application protocols are not visualized properly which leads @@ -4769,11 +5429,87 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/7c735089-6a83-419f-8b27-c1e676cedea1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false + Test KPI: + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: Failing to convey the number of vulnerabilities by severity might undermine + the effectiveness of product teams. This might lead to ignorance of findings. + measure: Measurement and communication of vulnerabilities per severity for components + like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/bc548cba-cb82-4f76-bd4b-325d9d256279 + tags: + - vulnerability-mgmt + - metrics + teamsImplemented: + Default: false + B: false + C: false + SLA per criticality: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of how much vulnerabilities handling + per severity for components like applications are aligned to SLAs. \nAt least + quarterly." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/123e4567-e89b-12d3-a456-426614174000 + tags: + - vulnerability-mgmt + - metrics + teamsImplemented: + Default: false + B: false + C: false Monitoring: Advanced app. metrics: uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf @@ -4797,11 +5533,16 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d03bc410-74a7-4e92-82cb-d01a020cb6bf isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Advanced availability and stability metrics: uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 risk: Trends and advanced attacks are not detected. @@ -4824,11 +5565,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ed715b38-c34b-40cd-83fd-ce807f306fc1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Alerting: uuid: 8a442d8e-0eb1-4793-a513-571aef982edd risk: Incidents are discovered after they happened. @@ -4854,11 +5600,16 @@ Information Gathering: - 6.8 - 5.25 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8a442d8e-0eb1-4793-a513-571aef982edd isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Audit of system events: uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 risk: System events (system calls) trends and attacks are not detected. @@ -4888,11 +5639,16 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/1cd5e4b8-be36-4726-adc7-d8f843f47ac8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage and control metrics: uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d risk: The effectiveness of configuration, patch and vulnerability management @@ -4924,11 +5680,16 @@ Information Gathering: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d0d681e7-d6de-4829-ac64-a9eb2546aa0d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deactivation of unused metrics: uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 risk: High resources are used while gathering unused metrics. @@ -4951,11 +5712,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/7f36b9ba-bc05-4fd6-9a2a-73344c249722 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defense metrics: uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 risk: IDS/IPS systems like packet- or application-firewalls detect and prevent @@ -4982,11 +5748,16 @@ Information Gathering: iso27001-2022: - 8.15 - 8.2 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e808028c-351c-42f1-bcd9-fba738d1fc55 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Grouping of metrics: uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b risk: The analysis of metrics takes long. @@ -5007,11 +5778,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/42170a71-d4c8-47af-bd71-bf36875fd05b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Metrics are combined with tests: uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 risk: Changes might cause high load due to programming errors. @@ -5032,11 +5808,16 @@ Information Gathering: - not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/71699daf-b2a4-466b-a0b2-89f7dbb18506 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Monitoring of costs: uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e risk: Not monitoring costs might lead to unexpected high resource consumption @@ -5061,11 +5842,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/10e23a8c-22ff-4487-a706-87ccc9d0798e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Screens with metric visualization: uuid: 8746647c-638c-473f-8e17-82c068e4c311 risk: Security related information is discovered too late during an incident. @@ -5089,11 +5875,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8746647c-638c-473f-8e17-82c068e4c311 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 risk: Attacks on an application are not recognized. @@ -5117,11 +5908,16 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e9a6d403-a467-445e-b98a-74f0c29da0b1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 risk: Not getting notified about reaching the end of the budget (e.g. due to @@ -5145,11 +5941,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/f08a3219-6941-43ec-8762-4aff739f4664 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 risk: Without simple metrics analysis of incidents are hard. In case an application @@ -5176,11 +5977,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/3d1f4c3b-f713-46d9-933a-54a014a26c03 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Targeted alerting: uuid: d6f06ae8-401a-4f44-85df-1079247fa030 risk: People are bored (ignorant) of incident alarm messages, as they are not @@ -5205,11 +6011,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d6f06ae8-401a-4f44-85df-1079247fa030 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Visualized metrics: uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 risk: Not visualized metrics lead to restricted usage of metrics. @@ -5231,11 +6042,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ded39bcf-4eaa-4c5f-9c94-09acde0a4734 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test and Verification: Application tests: High coverage of security related module and integration tests: @@ -5260,11 +6076,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/67667c97-c33e-4306-a4e5-e7b1d8e10c5a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security integration tests for important components: uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 risk: Vulnerabilities are rising due to code changes in a complex microservice @@ -5286,11 +6108,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security unit tests for important components: uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 risk: Vulnerabilities are rising due to code changes. @@ -5324,10 +6152,16 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Smoke Test: uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a risk: During a deployment an error might happen which leads to non-availability @@ -5352,11 +6186,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/73aaae0b-5d68-4953-9fa4-fd25bf665f2a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Consolidation: Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 @@ -5405,11 +6245,95 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/7a82020c-94d1-471c-bbd3-5f7fe7df4876 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false + Fix based on accessibility: + uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed + risk: Overwhelming volume of security findings from automated testing tools. + This might lead to ignorance of findings. + measure: Implement a simple risk-based prioritization framework for vulnerability + remediation based on accessibility of the applications. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + meta: + implementationGuide: |- + Develop a scoring system for asset accessibility, considering factors like: + - Whether the asset is internet-facing (highly recommended) + - The number of network hops required to reach the asset (recommended) + - Authentication requirements for access (recommended) + dependsOn: + - uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425 + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + implementation: ~ + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/0c10a7f7-f78f-49f2-943d-19fdef248fed + tags: + - vuln-action + - defect-management + teamsImplemented: + Default: false + B: false + C: false + Fix based on severity: + uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 + risk: Overwhelming volume of security findings from automated testing tools. + This might lead to ignorance of findings. + measure: Implement a very simple risk-based prioritization framework for vulnerability + remediation based on the severity of the findings. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: ~ + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/38d1bd10-7b5f-4ae1-868c-0ec813285425 + tags: + - vuln-action + - defect-management + teamsImplemented: + Default: false + B: false + C: false Generation of Patch Management Statistics: uuid: 785e34ef-40c6-487a-984c-3e7706c9bc1f risk: Delays in patch response lead to an increased attack surface through longer @@ -5454,11 +6378,16 @@ Test and Verification: - 16.1.4 iso27001-2022: - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/785e34ef-40c6-487a-984c-3e7706c9bc1f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Generation of Response Statistics: uuid: c922981b-65ed-40f3-a947-96fee9a0125f risk: No or delayed reaction to findings leads to potential exploitation of @@ -5513,13 +6442,18 @@ Test and Verification: iso27001-2022: - 5.25 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c922981b-65ed-40f3-a947-96fee9a0125f isImplemented: false - evidence: "" comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). tags: - none + teamsImplemented: + Default: false + B: false + C: false Integration of vulnerability issues into the development process: uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e risk: To read console output of the build server to search for vulnerabilities @@ -5559,11 +6493,16 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/ce970c9b-da94-41cf-bd78-8c15357b7e8e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Reproducible defect tickets: uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 risk: Vulnerability descriptions are hard to understand by staff from operations @@ -5591,11 +6530,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/27337442-e4b1-4e87-8dc9-ce86fbb79a39 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 risk: As false positive occur during each test, all vulnerabilities might be @@ -5630,11 +6574,16 @@ Test and Verification: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c1acc8af-312e-4503-a817-a26220c993a0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: The security level of a component is not visible. Therefore, the motivation @@ -5666,6 +6615,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 name: LogParser Jenkins Plugins tags: [] @@ -5697,11 +6647,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/55f4c916-3a34-474d-ad96-9a9f7a4f6a83 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of all defects: uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d risk: Vulnerabilities with severity low are not visible. @@ -5722,11 +6677,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 risk: Vulnerabilities with severity high or higher are not visible. @@ -5748,11 +6708,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 implementation: [] isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of defects with severity middle: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. @@ -5773,11 +6738,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 implementation: [] isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: Maintenance of false positives in each tool enforces a high workload. @@ -5822,11 +6792,16 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/85ba5623-84be-4219-8892-808837be582d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dynamic depth for applications: Coverage analysis: uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 @@ -5859,11 +6834,17 @@ Test and Verification: - part of periodic review, PDCA iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/d0ba0be5-c573-405f-b905-b7a8f87a9cc7 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of client side dynamic components: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript @@ -5887,16 +6868,22 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/9711f871-f79d-4573-8d4f-d2c98fd0d18e implementation: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb name: Ajax Spider tags: [] url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of hidden endpoints: uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 risk: Hidden endpoints of the service are not getting tracked. @@ -5943,11 +6930,17 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/6a9cb303-0f98-48a8-bdcd-56d41c0012b8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of more input vectors: uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc risk: Parts of the service are not covered. For example specially formatted @@ -5970,6 +6963,9 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5e0ff85b-ec89-4ef0-96b1-5695fa0025dc implementation: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b name: Schemathesis @@ -5981,10 +6977,13 @@ Test and Verification: description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of sequential operations: uuid: 845f06ec-148c-4c67-9755-7041911dcca5 risk: Sequential operations like workflows (e.g. login -> put products in the @@ -6013,11 +7012,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/845f06ec-148c-4c67-9755-7041911dcca5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of service to service communication: uuid: 22aab0ef-76ce-4b8c-979c-3699784330db risk: Service to service communication is not covered. @@ -6039,6 +7044,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/22aab0ef-76ce-4b8c-979c-3699784330db implementation: - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 @@ -6926,6 +7934,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -7112,6 +8121,25 @@ Test and Verification: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing @@ -7998,6 +9026,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -8184,11 +9213,33 @@ Test and Verification: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple Scan: uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 risk: Deficient security tests are performed. Simple vulnerabilities are not @@ -8226,11 +9277,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/07796811-37f9-467c-9ff2-48f346e77ff3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of different roles: uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 risk: Parts of the service are not covered during the scan, because a login @@ -8254,6 +9311,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/65a2d7d9-5441-46bf-a4e3-f76919857750 implementation: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 name: Zest @@ -8264,10 +9324,13 @@ Test and Verification: Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. isImplemented: false assessment: For REST APIs, multiple OAuth2 scopes are used. - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of multiple scanners: uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea risk: Each vulnerability scanner has different opportunities. By using just @@ -8300,11 +9363,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dynamic depth for infrastructure: Load tests: uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd @@ -8330,11 +9399,17 @@ Test and Verification: - 8.6 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/ab5725aa-4d53-47b9-96df-c14b3fa93bcd isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for exposed services: uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 risk: Standard network segmentation and firewalling has not been performed, @@ -8371,11 +9446,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for unauthorized installation: uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a risk: Unapproved components are used. @@ -8403,12 +9484,18 @@ Test and Verification: iso27001-2022: - 8.19 - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/dccf1949-b9a8-4ce8-b992-6a4a7f3a623a isImplemented: false - evidence: "" dependsOn: - Evaluation of the trust of used components tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for unused Resources: uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 risk: Unused resources, specially secrets, might be still valid, but are exposing @@ -8443,11 +9530,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6532c1fe-9d23-4228-8722-558ddabca7d4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test network segmentation: uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 risk: Wrong or no network segmentation of pods makes it easier for an attacker @@ -8478,11 +9571,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6d2c3ac6-8afc-4af6-a5e9-6188341aca01 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of the configuration of cloud environments: uuid: 7bb70764-9392-4462-935d-e55b2e148199 risk: Standard hardening practices for cloud environments are not performed @@ -8525,11 +9624,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/7bb70764-9392-4462-935d-e55b2e148199 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Weak password test: uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f risk: Weak passwords in components like applications or systems, specially for @@ -8555,11 +9660,17 @@ Test and Verification: - 9.4.3 iso27001-2022: - 5.17 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/61e10f9c-e126-4ffa-af12-fdbe0d0a831f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static depth for applications: API design validation: uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 @@ -8605,11 +9716,19 @@ Test and Verification: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 isImplemented: false - evidence: "" + dependsOn: + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dead code elimination: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Dead code increases the attack surface (use of hard coded credentials @@ -8638,9 +9757,16 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Exclusion of source code duplicates: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Duplicates in source code might influence the stability of the application. @@ -8668,9 +9794,16 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Local development security checks performed: uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b risk: Creating and developing code contains code smells and quality issues. @@ -9588,6 +10721,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -9774,6 +10908,25 @@ Test and Verification: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 name: DevSecOps control Pre-commit url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop @@ -9793,11 +10946,17 @@ Test and Verification: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6e180abc-7c98-4265-b4e9-852cb91b067b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis (client side): uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 risk: Client side components might have vulnerabilities. @@ -9811,6 +10970,7 @@ Test and Verification: level: 3 dependsOn: - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js @@ -9832,6 +10992,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 name: Dependabot tags: @@ -9848,11 +11009,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/07fe8c4f-ae33-4409-b1b2-cf64cfccea86 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe risk: Server side components might have vulnerabilities. @@ -9860,12 +11027,13 @@ Test and Verification: are performed. difficultyOfImplementation: knowledge: 1 - time: 2 + time: 3 resources: 1 usefulness: 5 - level: 1 + level: 2 dependsOn: - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 name: OWASP Dependency Check @@ -9886,6 +11054,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js tags: [] @@ -9910,11 +11079,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d918cd44-a972-43e9-a974-eff3f4a5dcfe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 risk: Used components like libraries and legacy applications might have vulnerabilities @@ -9928,6 +11103,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: [] references: samm2: @@ -9936,11 +11112,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for all self written components: uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 risk: Parts in the source code of the frontend or middleware have vulnerabilities. @@ -9986,6 +11168,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -9993,11 +11176,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/ee68331f-9b1d-4f61-844b-b2ea04753a84 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for important client side components: uuid: e237176b-bec5-447d-a926-e37d6dd60e4b risk: Important parts in the source code of the frontend have vulnerabilities. @@ -10047,6 +11236,7 @@ Test and Verification: - sast dependsOn: - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -10054,11 +11244,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/e237176b-bec5-447d-a926-e37d6dd60e4b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for important server side components: uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 risk: Important parts in the source code of the middleware have vulnerabilities. @@ -10067,10 +11263,10 @@ Test and Verification: dataflow analysis. difficultyOfImplementation: knowledge: 2 - time: 3 + time: 2 resources: 1 usefulness: 4 - level: 2 + level: 3 implementation: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b name: eslint @@ -10103,6 +11299,7 @@ Test and Verification: - sast dependsOn: - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -10110,11 +11307,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6c05c837-8c99-46e2-828b-7c903e27dba4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Stylistic analysis: uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 risk: Unclear or obfuscated code might have unexpected behavior. @@ -10161,11 +11364,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for Patch Deployment Time: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -10196,6 +11405,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Self implementation. This activity is not repeated in @@ -10203,6 +11415,10 @@ Test and Verification: as well. tags: - patching + teamsImplemented: + Default: false + B: false + C: false Test for Time to Patch: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -10242,6 +11458,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Usage of a version control platform API (e.g. github @@ -10249,6 +11468,10 @@ Test and Verification: might be an alternative to this activity. tags: - patching + teamsImplemented: + Default: false + B: false + C: false Test libyear: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Vulnerabilities in running artifacts stay for long and might get exploited. @@ -10282,6 +11505,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: | @@ -10289,6 +11515,10 @@ Test and Verification: An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of multiple analyzers: uuid: 297be001-8d94-41ee-ab29-207020d423c0 risk: Each vulnerability analyzer has different opportunities. By using just @@ -10316,11 +11546,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/297be001-8d94-41ee-ab29-207020d423c0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static depth for infrastructure: Analyze logs: uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 @@ -10343,11 +11579,17 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/b217c8bb-5d61-4b41-a675-1083993f83b1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Correlate known vulnerabilities in infrastructure with new image versions: uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 risk: TODO. @@ -10386,11 +11628,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/7de0ae33-6538-45cd-8222-a1475647ba58 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test cluster deployment resources: uuid: 621fb6a5-5c0a-4408-826a-068868bb031b risk: The deployment configuration (e.g. kubernetes deployment resources) might @@ -10421,11 +11669,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/621fb6a5-5c0a-4408-826a-068868bb031b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for image lifetime: uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b risk: Old container images in production indicate that patch management is not @@ -10460,11 +11714,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for known vulnerabilities: uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad risk: Known vulnerabilities in infrastructure components like container images @@ -10501,6 +11761,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory references: samm2: - V-ST-2-A @@ -10508,11 +11769,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/26e1c6d5-5632-4ec7-80d2-e564b98732ad isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for malware: uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d risk: Third party might include malware. Ether due to the maintainer (e.g. @@ -10547,11 +11814,17 @@ Test and Verification: - 12.2.1 iso27001-2022: - 8.7 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/837f8f90-adc2-4e6b-9ebb-60c2ee29494d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for new image version: uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e risk: When a new version of an image is available, it might fix security vulnerabilities. @@ -10574,11 +11847,17 @@ Test and Verification: - 8.8 - 8.7 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/cb6321aa-0fbf-4996-9e08-05ab26ef4c1e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for stored secrets: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c risk: Stored secrets in git history, in container images or directly in code @@ -10610,11 +11889,17 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/c6e3c812-56e2-41b0-ae01-b7afc41a004c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of infrastructure components for known vulnerabilities: uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 risk: Infrastructure components might have vulnerabilities. @@ -10657,11 +11942,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/13367d8f-e37f-4197-a610-9ffca4fde261 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of virtualized environments: uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 risk: Virtualized environments (e.g. via Container Images) might contains @@ -10698,11 +11989,17 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/58825d22-1ce6-4748-af81-0ec9956e4129 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test the cloud configuration: uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc risk: Standard hardening practices for cloud environments are not performed @@ -10733,11 +12030,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test the definition of virtualized environments: uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e risk: The definition of virtualized environments (e.g. via Dockerfile) @@ -10787,11 +12090,17 @@ Test and Verification: - 8.32 - 8.29 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/8fc3de67-7b8d-420b-8d24-f35928cfed6e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test-Intensity: Creation and application of a testing concept: uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe @@ -10821,11 +12130,16 @@ Test and Verification: - 8.32 - 8.27 - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/79ef8103-e1ed-4055-8df8-fd2b2015bebe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deactivating of unneeded tests: uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 risk: As tools cover a wide range of different vulnerability tests, they might @@ -10852,11 +12166,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Default settings for intensity: uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d risk: Time pressure and ignorance might lead to false predictions for the test @@ -10880,11 +12199,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/ab0a4b51-3b18-43f1-a6fc-a98e4b28453d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false High test intensity: uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 risk: A too small intensity or a too high confidence might lead to not visible @@ -10909,12 +12233,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/2ebfc421-8c76-415c-a3b0-fa518915bd10 isImplemented: false - evidence: "" comments: "" tags: - none - Regular tests: + teamsImplemented: + Default: false + B: false + C: false + Regular automated tests: uuid: 598897a2-358e-441f-984c-e12ec4f6110a risk: After pushing source code to the version control system, any delay in receiving feedback on defects makes them harder for the developer to remediate. @@ -10937,9 +12266,14 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/598897a2-358e-441f-984c-e12ec4f6110a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false ... From a79e13673bbde644c7cbe679583cba5fa066662f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 7 Aug 2024 16:32:47 +0200 Subject: [PATCH 010/370] enhance SCA --- .../StaticDepthForApplications.yaml | 7 ++-- .../StaticDepthForInfrastructure.yaml | 34 ++++++++++++++++--- 2 files changed, 34 insertions(+), 7 deletions(-) diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 2a0c3ad..dfc2316 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -341,6 +341,7 @@ Test and Verification: comments: "" Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + description: Use a tool like trivy and concentrate on application related vulnerabilities. At this stage, ignore vulnerabilities in container base images used in the service. risk: Server side components might have vulnerabilities. measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) @@ -360,6 +361,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-dependabot + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy references: samm2: - V-ST-2-A @@ -367,9 +369,8 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - isImplemented: false - evidence: "" - comments: "" + tags: + - vmm-testing Usage of multiple analyzers: uuid: 297be001-8d94-41ee-ab29-207020d423c0 risk: diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index fb8994b..9074439 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -340,12 +340,38 @@ Test and Verification: - 14.2.8 - 14.2.1 iso27001-2022: - - System hardening, virtual environments are not explicitly covered by ISO - 27001 - too specific + - System hardening, virtual environments are not explicitly covered by ISO 27001 - too specific - 8.8 - 8.32 - 8.29 - 8.25 isImplemented: false - evidence: "" - comments: "" + Software Composition Analysis: + uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + risk: Infrastructure components might have vulnerabilities. + measure: + Tests for known vulnerabilities in server side components (e.g. backend/middleware) are performed. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 1 + usefulness: 2 + level: 4 + dependsOn: + - Defined build process + - uuid:d918cd44-a972-43e9-a974-eff3f4a5dcfe + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + tags: + - vmm-testing From f1644d83c183aebd9fb64ba8c253b6ad1c557b7a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 21 Jul 2024 11:04:45 +0200 Subject: [PATCH 011/370] optimize --- .../BuildAndDeployment/Deployment.yaml | 27 ++++++++++++++++++- .../StaticDepthForApplications.yaml | 9 ++++++- 2 files changed, 34 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 56bbba6..eb42d8b 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -203,7 +203,32 @@ Build and Deployment: isImplemented: false evidence: "" comments: "" - Inventory of running artifacts: + Inventory of production applications: + uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + risk: + An organization is unaware of applications in production. + measure: A documented inventory or applications exists (gathered manually or automatically) + dependsOn: + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - I-SD-2-A + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + isImplemented: false + evidence: "" + comments: "" + Inventory of production artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index c2056c0..e159862 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -156,7 +156,8 @@ Test and Verification: - 8.27 # Secure system architecture and engineering principles - 8.28 # Secure coding isImplemented: false - evidence: "" + dependsOn: + - Inventory of production applications comments: "" Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 @@ -171,6 +172,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components + - Inventory of production applications implementation: [] references: samm2: @@ -205,6 +207,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components + - Inventory of production applications references: samm2: - V-ST-2-A @@ -238,6 +241,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process + - Inventory of production applications references: samm2: - V-ST-2-A @@ -270,6 +274,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process + - Inventory of production applications references: samm2: - V-ST-2-A @@ -323,6 +328,7 @@ Test and Verification: level: 3 dependsOn: - Defined build process + - Inventory of production applications implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit @@ -352,6 +358,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process + - Inventory of production applications implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack From 9c730c1d403a7bab771e80af9827ee34ed679c4c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 22 Jul 2024 16:29:19 +0200 Subject: [PATCH 012/370] adjust --- .../TestAndVerification/Consolidation.yaml | 63 +++++++++++++++++++ 1 file changed, 63 insertions(+) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index e0f366d..6ebc99e 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -2,6 +2,69 @@ --- Test and Verification: Consolidation: + Fix based on accessibility: + uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed + risk: + Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings. + measure: |- + Implement a simple risk-based prioritization framework for vulnerability remediation based on accessibility of the applications. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + meta: + implementationGuide: |- + Develop a scoring system for asset accessibility, considering factors like: + - Whether the asset is internet-facing (highly recommended) + - The number of network hops required to reach the asset (recommended) + - Authentication requirements for access (recommended) + dependsOn: + - uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425 # Fix based on severity + #- uuid:3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f #iventory of apps + implementation: + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: ["vuln-action", "defect-management"] + Fix based on severity: + uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 + risk: |- + Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings. + measure: Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: ["vuln-action", "defect-management"] Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 risk: From 70ffec4ddb3ddb2112190b5ca30f97e80eef2d64 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 1 Aug 2024 15:52:19 +0200 Subject: [PATCH 013/370] feat: add vuln --- .../BuildAndDeployment/Deployment.yaml | 74 +++++++++++-------- .../default/InformationGathering/Logging.yaml | 3 - .../MeasurementsAndMetrics.yaml | 60 +++++++++++++++ .../StaticDepthForApplications.yaml | 14 ++-- .../TestAndVerification/Test-Intensity.yaml | 2 +- src/assets/YAML/default/implementations.yaml | 16 +++- 6 files changed, 126 insertions(+), 43 deletions(-) create mode 100644 src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index eb42d8b..21408ef 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -49,7 +49,8 @@ Build and Deployment: Unused applications are not maintained and may contain vulnerabilities. Once exploited they can be used to attack other applications or to perform lateral movements within the organization. - measure: A clear decommissioning process ensures the removal of unused applications. + measure: |- + A clear decommissioning process ensures the removal of unused applications from the `Inventory of production components` and if implemented from `Inventory of production artifacts`. difficultyOfImplementation: knowledge: 1 time: 2 @@ -129,8 +130,8 @@ Build and Deployment: d3f: - ApplicationConfigurationHardening isImplemented: false - evidence: "" - comments: "" + tags: + - secret Handover of confidential parameters: uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a risk: @@ -169,19 +170,19 @@ Build and Deployment: d3f: - ApplicationConfigurationHardening isImplemented: false - evidence: "" - comments: "" - Inventory of dependencies: + tags: + - secret + Inventory of production dependencies: uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 risk: - In case a vulnerability of severity high or critical is known by the organization, - it needs to be known where an artifacts with that vulnerability is deployed + Delayed identification of components and their vulnerabilities in production. + In case a vulnerability is known by the organization, it needs to be known where an artifacts with that vulnerability is deployed with which dependencies. measure: - A documented inventory of dependencies used in images and containers + A documented inventory of dependencies used in artifacts like container images and containers exists. dependsOn: - - Defined deployment process + - uuid:83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts - SBOM of components difficultyOfImplementation: knowledge: 2 @@ -190,7 +191,9 @@ Build and Deployment: usefulness: 3 level: 3 implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - I-SD-2-A @@ -200,22 +203,29 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" comments: "" - Inventory of production applications: + tags: + - inventory + - sbom + Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f - risk: - An organization is unaware of applications in production. - measure: A documented inventory or applications exists (gathered manually or automatically) + risk: |- + An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it. + measure: |- + A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. + In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. dependsOn: + - Defined deployment process difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 - usefulness: 3 - level: 3 - implementation: [] + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - I-SD-2-A @@ -225,25 +235,28 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" - comments: "" + tags: + - inventory Inventory of production artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs to be known where an artifacts (e.g. container image) with that vulnerability is deployed. - measure: A documented inventory or a possibility to gather the needed information. + measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically). dependsOn: - Defined deployment process + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components difficultyOfImplementation: knowledge: 2 time: 2 resources: 3 usefulness: 3 - level: 3 - implementation: [] + level: 2 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - I-SD-2-A @@ -253,9 +266,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" - comments: "" + tags: + - inventory Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. diff --git a/src/assets/YAML/default/InformationGathering/Logging.yaml b/src/assets/YAML/default/InformationGathering/Logging.yaml index 63c73db..041b871 100755 --- a/src/assets/YAML/default/InformationGathering/Logging.yaml +++ b/src/assets/YAML/default/InformationGathering/Logging.yaml @@ -30,9 +30,6 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - isImplemented: false - evidence: "" - comments: "" Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: diff --git a/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml b/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml new file mode 100644 index 0000000..b9cc7e6 --- /dev/null +++ b/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml @@ -0,0 +1,60 @@ +# yaml-language-server: $schema=../../schemas/dsomm-schema-information-gathering.json +--- +Information Gathering: + Test KPI: + #Number of vulnerabilities - appsec - vuln management ? + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: |- + Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings. + measure: |- + Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + SLA per criticality: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of + critical security issues, increasing the risk of exploitation and potential damage to the organization. + measure: |- + Measurement and communication of how much vulnerabilities handling per severity for components like applications are aligned to SLAs. + At least quarterly. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index e159862..5697046 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -157,7 +157,7 @@ Test and Verification: - 8.28 # Secure coding isImplemented: false dependsOn: - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components comments: "" Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 @@ -172,7 +172,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: [] references: samm2: @@ -207,7 +207,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -241,7 +241,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -274,7 +274,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -328,7 +328,7 @@ Test and Verification: level: 3 dependsOn: - Defined build process - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit @@ -358,7 +358,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process - - Inventory of production applications + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack diff --git a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml index ee9ee4c..882b3f4 100755 --- a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml +++ b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml @@ -121,7 +121,7 @@ Test and Verification: isImplemented: false evidence: "" comments: "" - Regular tests: + Regular automated tests: uuid: 598897a2-358e-441f-984c-e12ec4f6110a risk: After pushing source code to the version control system, any delay in diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index ff8e035..20d13e3 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -793,7 +793,7 @@ implementations: uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track - tags: [sca, inventory, OpenSource, "Supply Chain", vulnerability] + tags: [sca, inventory, OpenSource, "Supply Chain", vulnerability, inventory] juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -933,3 +933,17 @@ implementations: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: [documentation, inventory] + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: [documentation, inventory, kubernetes] + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. From 4ab95c91957eeab48e73873405d89386ef9cc11f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 6 Aug 2024 12:37:41 +0200 Subject: [PATCH 014/370] current state --- README.md | 10 + .../MeasurementsAndMetrics.yaml | 60 - .../default/InformationGathering/TestKPI.yaml | 192 ++ .../default/InformationGathering/_meta.yaml | 2 +- .../TestAndVerification/Consolidation.yaml | 111 +- src/assets/YAML/default/implementations.yaml | 7 + src/assets/YAML/generated/generated.yaml | 1777 ++++++++++++++--- 7 files changed, 1785 insertions(+), 374 deletions(-) delete mode 100644 src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml create mode 100644 src/assets/YAML/default/InformationGathering/TestKPI.yaml diff --git a/README.md b/README.md index a5a0366..e8e88ef 100644 --- a/README.md +++ b/README.md @@ -8,3 +8,13 @@ docker run -ti -v $(pwd)/src/assets/YAML/:/var/www/html/src/assets/YAML wurstbro # Afterwards, you can use the generated.yaml in a container docker run -v $(pwd)/src/assets/YAML/generated/generated.yaml:/usr/share/nginx/html/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm ``` + +## Credits + +* The dimension _Test and Verification_ is based on Christian Schneiders [Security DevOps Maturity Model (SDOMM)](https://www.christian-schneider.net/SecurityDevOpsMaturityModel.html). _Application tests_ and _Infrastructure tests_ are added by Timo Pagel. Also, the sub-dimension _Static depth_ has been evaluated by security experts at [OWASP Stammtisch Hamburg](https://www.owasp.org/index.php/OWASP_German_Chapter_Stammtisch_Initiative/Hamburg). +* The sub-dimension Process has been added after a discussion with [Francois Raynaud](https://www.linkedin.com/in/francoisraynaud/) that reactive activities are missing. +* Enhancement of my basic translation is performed by [Claud Camerino](https://github.com/clazba). +* Adding ISO 27001:2017 mapping, [Andre Baumeier](https://github.com/AndreBaumeier). +* [OWASP Project Integration Project Writeup](https://github.com/OWASP/www-project-integration-standards/blob/master/writeups/owasp_in_sdlc/index.md) for providing documentation on different DevSecOps practices which are copied&pasted/ (and adopted) (https://github.com/northdpole, https://github.com/ThunderSon) +* The requirements from [level 0](https://github.com/AppSecure-nrw/security-belts/blob/master/white/) are based on/copied from [AppSecure NRW](https://appsecure.nrw/) +* The sub dimension _Test KPI_, _Triage_, _Dynamic depth for app/infra_, _Static depth for app/infra_ and some other vulnerability management activities are based/inspired by [Vulnerability Managment Maturity Model - Cheat Sheet V1.6](TODO FRANCESCO LINK) diff --git a/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml b/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml deleted file mode 100644 index b9cc7e6..0000000 --- a/src/assets/YAML/default/InformationGathering/MeasurementsAndMetrics.yaml +++ /dev/null @@ -1,60 +0,0 @@ -# yaml-language-server: $schema=../../schemas/dsomm-schema-information-gathering.json ---- -Information Gathering: - Test KPI: - #Number of vulnerabilities - appsec - vuln management ? - Number of vulnerabilities/severity: - uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 - risk: |- - Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings. - measure: |- - Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly. - description: |- - Communication can be performed in a simple way, e.g. text based during the build process. - This activity depends on at least one security testing implementation. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: [] - implementation: [] - references: - samm2: - - I-DM-3-B - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.10 - tags: - - vulnerability-mgmt - - metrics - SLA per criticality: - uuid: 123e4567-e89b-12d3-a456-426614174000 - risk: |- - Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of - critical security issues, increasing the risk of exploitation and potential damage to the organization. - measure: |- - Measurement and communication of how much vulnerabilities handling per severity for components like applications are aligned to SLAs. - At least quarterly. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - dependsOn: [] - implementation: [] - references: - samm2: - - I-DM-3-B - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.10 - tags: - - vulnerability-mgmt - - metrics diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml new file mode 100644 index 0000000..8d35521 --- /dev/null +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -0,0 +1,192 @@ +# yaml-language-server: $schema=../../schemas/dsomm-schema-information-gathering.json +--- +Information Gathering: + Test KPI: + #Number of vulnerabilities - appsec - vuln management ? + # Fix Rate? + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: |- + Failing to convey the number of vulnerabilities by severity might undermine the effectiveness of product teams. This might lead to ignorance of findings. + measure: |- + Measurement and communication of vulnerabilities per severity for components like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurement + Patching mean time to resolution via PR: + uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 + risk: |- + Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss. + measure: |- + Measurement and communication of patching Mean Time to Resolution (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + This includes the measurement of the existence of a properly configured automated pull request (PR) tool (e.g., Dependabot or Renovate) in a repository. + In addition, the measurement of the time from opening an automated PR to merging it. + + Average time to patch is visualized per component/project/team. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - patching + - metrics + - vmm-measurements + SLA per criticality: # is this the definition of SLAs or the measurement? + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of + critical security issues, increasing the risk of exploitation and potential damage to the organization. + measure: |- + Measurement and communication of how many of the vulnerabilities handling per severity for components like applications are aligned to SLAs. + This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application. + At least quarterly. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + Patching mean time to resolution via production: + uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f + risk: |- + Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss. + measure: |- + Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + Average time to patch is visualized per component/project/team. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 4 + dependsOn: + - uuid:86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR + - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + iso27001-2022: + - 5.25 + tags: + - patching + - metrics + - vmm-measurements + Generation of response statistics: + uuid: c922981b-65ed-40f3-a947-96fee9a0125f + risk: No or delayed reaction to findings leads to potential exploitation of findings. + measure: Creation and response statistics (e.g. Mean Time to Resolution) of findings. This is also referred to as _Mean Time to Resolve_. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + dependsOn: + - Usage of a vulnerability management system + level: 3 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + comments: "The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results)." + Fix rate per repo/product: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of + critical security issues, increasing the risk of exploitation and potential damage to the organization. + measure: |- + Measurement and communication of the number of vulnerabilities handled per severity level for components such as applications, ensuring alignment with SLAs. + The rate should be broken down by team, product, application, repository, and/or service. This analysis should be conducted at least quarterly. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: + - uuid:123e4567-e89b-12d3-a456-426614174000 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + diff --git a/src/assets/YAML/default/InformationGathering/_meta.yaml b/src/assets/YAML/default/InformationGathering/_meta.yaml index 646d2cc..cea4d30 100755 --- a/src/assets/YAML/default/InformationGathering/_meta.yaml +++ b/src/assets/YAML/default/InformationGathering/_meta.yaml @@ -2,4 +2,4 @@ _meta: label: Information Gathering icon: Information Gathering.png description: |- - A markdown description of this dimension. + Gathering of Information diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 6ebc99e..4fe0291 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -43,7 +43,10 @@ Test and Verification: uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 risk: |- Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings. - measure: Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. + measure: | + Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. + + On level one, fix only critical findings. difficultyOfImplementation: knowledge: 2 time: 2 @@ -97,62 +100,6 @@ Test and Verification: isImplemented: false evidence: "" comments: "" - Generation of Response Statistics: - uuid: c922981b-65ed-40f3-a947-96fee9a0125f - risk: No or delayed reaction to findings leads to potential exploitation of findings. - measure: Creation and response statistics of findings. This is also referred to as _Mean Time to Resolve_. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - dependsOn: - - Usage of a vulnerability management system - level: 3 - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client - references: - samm2: - - I-DM-2-B - iso27001-2017: - - 16.1.4 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.10 - isImplemented: false - evidence: "" - comments: "The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results)." - Generation of Patch Management Statistics: - uuid: 785e34ef-40c6-487a-984c-3e7706c9bc1f - risk: Delays in patch response lead to an increased attack surface through longer exposure of known vulnerabilities. - measure: Average time to patch is visualized per component/project/team. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 2 - level: 3 - dependsOn: - - A patch policy is defined - - Automated PRs for patches - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics - references: - samm2: - - I-DM-3-B - iso27001-2017: - - 16.1.4 - iso27001-2022: - - 5.25 - isImplemented: false - evidence: "" - comments: "" Integration of vulnerability issues into the development process: uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e risk: @@ -385,6 +332,50 @@ Test and Verification: - 5.25 - 5.26 - 5.27 - isImplemented: false - evidence: "" - comments: "" + Integration in development process: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not integrating vulnerability handling into the development process may result in product teams ignoring findings. + + Security joke: We will gain 100% false negatives. + measure: |- + Integration of findings into the development process. E.g. adding findings to the backlog of products teams. + description: |- + Validating Findings by Security Engineers Pros: + - Ensures accuracy and relevance of findings before they reach product teams + - Reduces false positives, saving development teams time and effort + - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities + + Validating Findings by Security Engineers Cons: + - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations + - May slow down the process if security engineers are overloaded with validation tasks + - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application + + Pushing Findings Directly to Product Teams Pros: + - Accelerates the process by immediately notifying product teams of potential vulnerabilities + - Empowers product teams to take swift action in addressing security issues + Pushing Findings Directly to Product Teams Cons: + - Increases the workload on product teams, potentially leading to frustration + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/jira + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - vmm-measurements diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 20d13e3..c98fb5d 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -947,3 +947,10 @@ implementations: url: https://github.com/SDA-SE/image-metadata-collector/ description: | Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + jira: + uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: [documentation, issue, proprietary] + url: https://jira.atlassian.com/ + description: |- + Jira is a bug tracking and project management tool developed by Atlassian, used by development teams for tracking issues, planning sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 105d6c1..b22453d 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -41,11 +41,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/a340f46b-6360-4cb8-847b-a0d3483d09d3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b risk: Performing builds without a defined process is error prone; for example, @@ -88,11 +93,16 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f6f7737f-25a9-4317-8de2-09bf59f29b5b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Pinning of artifacts: uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 risk: Unauthorized manipulation of artifacts might be difficult to spot. For @@ -128,11 +138,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false SBOM of components: uuid: 2858ac12-0179-40d9-9acf-1b839c030473 description: |- @@ -162,11 +177,16 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/2858ac12-0179-40d9-9acf-1b839c030473 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Signing of artifacts: uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -212,11 +232,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/5786959d-0c6f-46a6-8e1c-a32ff1a50222 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Signing of code: uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -251,11 +276,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/9f107927-61e9-4574-85ad-3f2b4bca8665 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deployment: Blue/Green Deployment: uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 @@ -293,11 +323,16 @@ Build and Deployment: - 8.32 - 8.19 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0cb2626b-fb0d-4a0f-9688-57f787310d97 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined decommissioning process: uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 description: |- @@ -308,7 +343,9 @@ Build and Deployment: risk: Unused applications are not maintained and may contain vulnerabilities. Once exploited they can be used to attack other applications or to perform lateral movements within the organization. - measure: A clear decommissioning process ensures the removal of unused applications. + measure: A clear decommissioning process ensures the removal of unused applications + from the `Inventory of production components` and if implemented from `Inventory + of production artifacts`. difficultyOfImplementation: knowledge: 1 time: 2 @@ -322,11 +359,16 @@ Build and Deployment: - 11.2.7 iso27001-2022: - 7.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/da4ff665-dcb9-4e93-9d20-48cdedc50fc2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a risk: Deployment of insecure or malfunctioning artifacts. @@ -361,11 +403,16 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Environment depending configuration parameters (secrets): uuid: df428c9d-efa0-4226-9f47-a15bb53f822b risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. @@ -380,13 +427,7 @@ Build and Deployment: usefulness: 4 level: 2 implementation: - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: + - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -1272,6 +1313,7 @@ Build and Deployment: - OpenSource - Supply Chain - vulnerability + - inventory juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -1458,6 +1500,25 @@ Build and Deployment: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - I-SD-1-B @@ -1469,11 +1530,15 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/df428c9d-efa0-4226-9f47-a15bb53f822b isImplemented: false - evidence: "" - comments: "" tags: - - none + - secret + teamsImplemented: + Default: false + B: false + C: false Evaluation of the trust of used components: uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba risk: Application and system components like Open Source libraries or images @@ -1517,11 +1582,16 @@ Build and Deployment: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0de465a6-55a7-4343-af79-948bb5ff10ba isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Handover of confidential parameters: uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a risk: Parameters are often used to set credentials, for example by starting @@ -1556,28 +1626,40 @@ Build and Deployment: - 8.24 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/94a96f79-8bd6-4904-97c0-994ff88f176a isImplemented: false - evidence: "" - comments: "" tags: - - none - Inventory of dependencies: - uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 - risk: In case a vulnerability of severity high or critical is known by the organization, - it needs to be known where an artifacts with that vulnerability is deployed - with which dependencies. - measure: A documented inventory of dependencies used in images and containers - exists. + - secret + teamsImplemented: + Default: false + B: false + C: false + Inventory of production artifacts: + uuid: 83057028-0b77-4d2e-8135-40969768ae88 + risk: In case a vulnerability of severity high or critical exists, it needs + to be known where an artifacts (e.g. container image) with that vulnerability + is deployed. + measure: A documented inventory of artifacts in production like container images + exists (gathered manually or automatically). dependsOn: - Defined deployment process - - SBOM of components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f difficultyOfImplementation: knowledge: 2 time: 2 resources: 3 usefulness: 3 - level: 3 + level: 2 implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply @@ -1590,6 +1672,16 @@ Build and Deployment: - OpenSource - Supply Chain - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - I-SD-2-A @@ -1599,26 +1691,124 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" - comments: "" - tags: - - none - Inventory of running artifacts: - uuid: 83057028-0b77-4d2e-8135-40969768ae88 - risk: In case a vulnerability of severity high or critical exists, it needs - to be known where an artifacts (e.g. container image) with that vulnerability - is deployed. - measure: A documented inventory or a possibility to gather the needed information. + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/83057028-0b77-4d2e-8135-40969768ae88 + tags: + - inventory + teamsImplemented: + Default: false + B: false + C: false + Inventory of production components: + uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + risk: An organization is unaware of components like applications in production. + Not knowing existing applications in production leads to not assessing it. + measure: |- + A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. + In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. dependsOn: - Defined deployment process + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + references: + samm2: + - I-SD-2-A + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/2a44b708-734f-4463-b0cb-86dc46344b2f + tags: + - inventory + teamsImplemented: + Default: false + B: false + C: false + Inventory of production dependencies: + uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 + risk: Delayed identification of components and their vulnerabilities in production. + In case a vulnerability is known by the organization, it needs to be known + where an artifacts with that vulnerability is deployed with which dependencies. + measure: A documented inventory of dependencies used in artifacts like container + images and containers exists. + dependsOn: + - uuid:83057028-0b77-4d2e-8135-40969768ae88 + - SBOM of components difficultyOfImplementation: knowledge: 2 time: 2 resources: 3 usefulness: 3 level: 3 - implementation: [] + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - I-SD-2-A @@ -1628,11 +1818,16 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - isImplemented: false - evidence: "" + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/13e9757e-58e2-4277-bc0f-eadc674891e6 comments: "" tags: - - none + - inventory + - sbom + teamsImplemented: + Default: false + B: false + C: false Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. @@ -1668,11 +1863,16 @@ Build and Deployment: - 8.19 - 8.32 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/85d52588-f542-4225-a338-20dc22a5508d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Same artifact for environments: uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f risk: Building of an artifact for different environments means that an untested @@ -1703,11 +1903,16 @@ Build and Deployment: - 8.33 - 8.29 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a854b48d-83bd-4f8d-8621-a0bdd470837f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of feature toggles: uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad risk: Using environment variables to enable or disable features can lead to @@ -1749,11 +1954,16 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a511799b-045e-4b96-9843-7d63d8c1e2ad isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d @@ -1778,11 +1988,17 @@ Build and Deployment: - 8.8 - 8.19 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/99415139-6b50-441b-89e1-0aa59accd43d isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 risk: Components with known (or unknown) vulnerabilities might stay for long @@ -1831,45 +2047,16 @@ Build and Deployment: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 comments: "" tags: - patching - Automated deployment of automated PRs: - uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d - description: Automated merges of automated created PRs for outdated dependencies. - risk: Even if automated dependencies PRs are merged, they might not be deployed. - This results in vulnerabilities in running artifacts stay for too long and - might get exploited. - measure: | - After merging of an automated dependency PR, automated deployment is needed, - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - dependsOn: - - Automated merge of automated PRs - implementation: - - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - references: - samm2: [] - iso27001-2017: [] - iso27001-2022: [] - comments: "" - tags: - - patching + teamsImplemented: + Default: false + B: false + C: false Automated merge of automated PRs: uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: Automated merges of automated created PRs for outdated dependencies. @@ -1884,8 +2071,6 @@ Build and Deployment: resources: 1 usefulness: 3 level: 2 - dependsOn: - - Automated PRs for patches implementation: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 name: dependabot @@ -1906,9 +2091,16 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/f2594f8f-1cd6-45f9-af29-eaf3315698eb comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Nightly build of images (base images): uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 description: |- @@ -1937,11 +2129,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/34869eaf-f2e1-4926-b0bd-28c43402f057 isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Reduction of the attack surface: uuid: 16e39c8f-5336-4001-88ed-a552d2447531 description: |- @@ -1981,10 +2179,17 @@ Build and Deployment: - 14.2.1 iso27001-2022: - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/16e39c8f-5336-4001-88ed-a552d2447531 evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of a maximum lifetime for images: uuid: 485a3383-7f2e-4dba-bb84-479377070904 description: |- @@ -2018,10 +2223,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/485a3383-7f2e-4dba-bb84-479377070904 evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of a short maximum lifetime for images: uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e description: |- @@ -2065,11 +2277,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/6b96e5a0-ce34-4ea4-a88f-469d3b84546e isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Culture and Organization: Design: Conduction of advanced threat modeling: @@ -2164,11 +2382,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of simple threat modeling on business level: uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 risk: Business related threats are discovered too late in the development and @@ -2195,11 +2418,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/48f97f31-931c-46eb-9b3e-e2fec0cd0426 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e risk: Technical related threats are discovered too late in the development and @@ -2315,11 +2543,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/47419324-e263-415b-815d-e7161b6b905e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of advanced abuse stories: uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e risk: Simple user stories are not going deep enough. Relevant security considerations @@ -2357,11 +2590,16 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/0a929c3e-ab9a-4206-8761-adf84b74622e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of simple abuse stories: uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 risk: User stories mostly don't consider security implications. Security flaws @@ -2399,11 +2637,16 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/bacf85b6-5bc0-405d-b5ba-a5d971467cc1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of threat modeling processes and standards: uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e risk: Inadequate identification of business and technical risks. @@ -2448,11 +2691,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Information security targets are communicated: uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 risk: Employees don't known their organizations security targets. Therefore @@ -2475,11 +2723,16 @@ Culture and Organization: iso27001-2022: - 5.1 - 5.4 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/1b9281b9-48e2-4c01-9ac6-9db9931c4885 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 @@ -2514,11 +2767,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Aligning security in teams: uuid: f994a55d-71bb-45a4-a887-0a213d72c504 risk: The concept of Security Champions might suggest that only he/she is responsible @@ -2545,11 +2804,17 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f994a55d-71bb-45a4-a887-0a213d72c504 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of build-it, break-it, fix-it contests: uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 risk: Understanding security is hard, even for security champions and the conduction @@ -2576,11 +2841,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/bfdb576e-a416-4ec6-96fe-a078d58b2ff8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of collaborative security checks with developers and system administrators: uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 risk: Security checks by external companies do not increase the understanding @@ -2610,11 +2881,17 @@ Culture and Organization: - 6.3 - 8.8 - 8.34 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/95caef96-36ed-458c-a087-5c35d4f9dec2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of collaborative team security checks: uuid: 35446784-7610-40d9-af9e-d43f3173bf8c risk: Development teams limited insight over security practices. @@ -2637,11 +2914,17 @@ Culture and Organization: iso27001-2022: - Mutual security testing is not explicitly required in ISO 27001 may be - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/35446784-7610-40d9-af9e-d43f3173bf8c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of war games: uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 risk: Understanding incident response plans during an incident is hard and ineffective. @@ -2668,11 +2951,17 @@ Culture and Organization: - 6.3 - 5.24 - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/534f60bf-0995-4314-bb9c-f0f2bf204694 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Each team has a security champion: uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 risk: No one feels directly responsible for security and the security champion @@ -2722,11 +3011,17 @@ Culture and Organization: - Security champions are missing in ISO 27001 most likely - 5.4 - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for all: uuid: 9768f154-357a-4c06-af6f-d66570677c9b risk: Understanding security is hard. @@ -2766,11 +3061,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/9768f154-357a-4c06-af6f-d66570677c9b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for externals: uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 risk: Understanding security is hard. @@ -2803,11 +3104,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/31833d56-35af-4ef3-9300-f23d27646ce7 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training of security champions: uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 risk: Understanding security is hard, even for security champions. @@ -2839,11 +3146,17 @@ Culture and Organization: iso27001-2022: - Security champions are missing in ISO 27001 - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Reward of good communication: uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c risk: Employees are not getting excited about security. @@ -2881,11 +3194,17 @@ Culture and Organization: but nothing to promote good behavior. iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/91b6f75b-9f4a-4d77-95a2-af7ad3222c7c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security Coaching: uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 risk: Training does not change behaviour. Therefore, even if security practices @@ -2916,11 +3235,17 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security code review: uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 risk: Understanding security is hard. @@ -2961,11 +3286,17 @@ Culture and Organization: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/7121b0c7-6ace-4d6b-95d0-94535dbccb57 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 risk: Not asking a security expert when questions regarding security appear @@ -2997,11 +3328,17 @@ Culture and Organization: - 5.2 - 5.6 - 5.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/0b28367b-75a0-4bae-a926-3725c1bf9bb0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security-Lessoned-Learned: uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 risk: After an incident, a similar incident might reoccur. @@ -3022,11 +3359,17 @@ Culture and Organization: - 16.1.6 iso27001-2022: - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/58c46807-fee9-448b-b6dd-8050c464ab52 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple mob hacking: uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de risk: Understanding security is hard. @@ -3074,11 +3417,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/535f301a-e8e8-4eda-ad77-a08b035c92de isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Process: Approval by reviewing any new version: uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 @@ -3104,11 +3453,16 @@ Culture and Organization: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/3f63bdbc-c75f-4780-a941-e6ad42e894e1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Definition of a change management process: uuid: b4193d32-3948-47e2-a326-3748c48019a1 risk: The impact of a change is not controlled because these are not recorded @@ -3130,11 +3484,16 @@ Culture and Organization: iso27001-2022: - 8.32 - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/b4193d32-3948-47e2-a326-3748c48019a1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 risk: In case of an emergency, like a power outage, DR actions to perform are @@ -3157,11 +3516,16 @@ Culture and Organization: - 17.1.1 iso27001-2022: - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/c72da779-86cc-45b1-a339-190ce5093171 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Implementation: Application Hardening: App. Hardening Level 1: @@ -3222,9 +3586,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/cf819225-30cb-4702-8e32-60225eedc33d comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 1 (50%): uuid: b597928e-54d6-48a5-a806-8003dcd56aab risk: Using an insecure application might lead to a compromised application. @@ -3281,10 +3652,17 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/b597928e-54d6-48a5-a806-8003dcd56aab isImplemented: false comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 2: uuid: ffe86caf-2fec-4630-b514-2db83983984d risk: Using an insecure application might lead to a compromised application. @@ -3319,13 +3697,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/ffe86caf-2fec-4630-b514-2db83983984d isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 (75%) tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 2 (75%): uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 risk: Using an insecure application might lead to a compromised application. @@ -3360,13 +3744,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/03643ca2-03c2-472b-8e19-956bf02fe9b7 isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 1 tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 3: uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a risk: Using an insecure application might lead to a compromised application. @@ -3401,13 +3791,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 tags: - none + teamsImplemented: + Default: false + B: false + C: false Contextualized Encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 risk: The generation of interpreter directives from user-provided data poses @@ -3432,8 +3828,15 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/e1f37abb-d848-4a3a-b3df-65e91a89dcb7 tags: - none + teamsImplemented: + Default: false + B: false + C: false Development and Source Control: .gitignore: uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d @@ -3460,10 +3863,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/363a3eea-baf9-4010-88ca-bb8186a2989d evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false API design validation: uuid: 948a4d51-ceb5-4ebd-bdc7-d74ea25e171c risk: Creation of insecure or non-compliant API. @@ -3508,11 +3918,17 @@ Implementation: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/948a4d51-ceb5-4ebd-bdc7-d74ea25e171c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Local development linting & style checks performed: uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 risk: Insecure or unmaintainable code base. @@ -3544,11 +3960,17 @@ Implementation: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/517b0957-4981-4ac0-b4c7-0d8d1934c474 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Source Control Protection: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 risk: Intentional or accidental alterations in critical branches like master. @@ -3593,11 +4015,17 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Versioning: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f risk: Deployment of untracked artifacts. @@ -3625,11 +4053,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/066084c6-1135-4635-9cc5-9e75c7c5459f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Infrastructure Hardening: Applications are running in virtualized environments: uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 @@ -3652,11 +4086,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/3a94d55e-fd82-4996-9eb3-20d23ff2a873 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Backup: uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc risk: If errors are experienced during the deployment process you want to deploy @@ -3687,11 +4127,17 @@ Implementation: iso27001-2022: - 8.13 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5c61fd6b-8106-4c68-ac28-a8a42f1c67dc isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Baseline Hardening of the environment: uuid: 5992c38c-8597-4035-89db-d15820d81c3a risk: Using default configurations for a cluster environment leads to potential @@ -3753,11 +4199,17 @@ Implementation: - 13.1.3 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5992c38c-8597-4035-89db-d15820d81c3a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Filter outgoing traffic: uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d risk: A compromised infrastructure component might try to send out stolen data. @@ -3788,11 +4240,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/6df508ef-86fc-4c22-bd9f-646c3127ce7d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Hardening of the Environment: uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 risk: Using default configurations for a cluster environment leads to potential @@ -3855,11 +4313,17 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/dcf9601b-b4f2-4e25-9143-e39af75f7c33 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Immutable infrastructure: uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 risk: The availability of IT systems might be disturbed due to components failures @@ -3885,11 +4349,17 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/48e92bb1-fdba-40e8-b6c2-35de0d431833 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Infrastructure as Code: uuid: 8b994601-575e-4ea5-b228-accb18c8e514 risk: No tracking of changes in systems might lead to errors in the configuration. @@ -3935,11 +4405,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8b994601-575e-4ea5-b228-accb18c8e514 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Isolated networks for virtual environments: uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 risk: Virtual environments in default settings are able to access other virtual @@ -3976,11 +4452,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/4ce24abd-8ba6-494c-828d-4d193e28e4a1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Limitation of system events: uuid: e5386abf-9154-4752-a1a8-c3a8900f732d risk: System events (system calls) can lead to privilege escalation. @@ -4018,11 +4500,17 @@ Implementation: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e5386abf-9154-4752-a1a8-c3a8900f732d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false MFA: uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de risk: One factor authentication is more vulnerable to brute force attacks and @@ -4066,11 +4554,17 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/598e9f13-1ac8-4a01-b85e-8fab93ee81de isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false MFA for admins: uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 risk: One factor authentication is more vulnerable to brute force attacks and @@ -4112,11 +4606,17 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8098e416-e1ed-4ae4-a561-83efbe76bf57 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Microservice-architecture: uuid: 118b869b-3850-456e-98d9-1abdb85cbc5a risk: Monolithic applications are hard to test. @@ -4136,11 +4636,17 @@ Implementation: - Not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/118b869b-3850-456e-98d9-1abdb85cbc5a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Production near environments are used by developers: uuid: e14de741-94b3-447c-8b07-eea947d82e61 risk: In case an errors occurs in production, the developer need to be able @@ -4169,11 +4675,17 @@ Implementation: iso27001-2022: - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e14de741-94b3-447c-8b07-eea947d82e61 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Role based authentication and authorization: uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 risk: Everyone is able to get unauthorized access to information on systems @@ -4204,11 +4716,17 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/070bb14b-e04a-4f3d-896a-a08eba7a35f9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple access control for systems: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 risk: Attackers a gaining access to internal systems and application interfaces @@ -4237,11 +4755,17 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/82e499d1-f463-4a4b-be90-68812a874af6 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of a chaos monkey: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In @@ -4265,11 +4789,17 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f8e80f18-2503-4e3e-b3bc-7f67bb28defe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of an security account: uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 risk: Having security auditing in the same account as infrastructure and applications @@ -4290,11 +4820,17 @@ Implementation: - 10.1 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/746025a6-dbfb-4087-a000-e46acab64ee1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of edge encryption at transit: uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 risk: Evil actors might be able to perform a man in the middle attack and sniff @@ -4315,11 +4851,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ad23be9c-5661-4f1f-81a3-5a5dc7061629 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of encryption at rest: uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 risk: Evil actors might be able to access data and read information, e.g. from @@ -4340,11 +4882,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/0ff45fb8-7eef-46ed-9b3a-84c955cd7060 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of internal encryption at transit: uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 risk: Evil actors within the organization of traffic in transit might be able @@ -4366,11 +4914,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ecb0184c-6bc9-45da-bbbb-a983797ffc93 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of security by default for components: uuid: 11b3848e-e931-4146-a35d-35409ada24ee risk: Components (images, libraries, applications) are not hardened. @@ -4407,11 +4961,17 @@ Implementation: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/11b3848e-e931-4146-a35d-35409ada24ee isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of test and production environments: uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 risk: Security tests are not running regularly because test environments are @@ -4437,11 +4997,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/bfdacb52-1e3f-431d-ae72-d844a5e86415 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Virtual environments are limited: uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca risk: Denial of service (internally by an attacker or unintentionally by a bug) @@ -4470,11 +5036,17 @@ Implementation: - 8.6 - 8.22 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/760f1056-b0ee-4f22-a35b-f65446f944ca isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF Advanced: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced risk: The presence of sophisticated threats necessitates a robust defense strategy @@ -4503,9 +5075,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF baseline: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: Vulnerable input, such as exploits, can infiltrate the application via @@ -4534,9 +5113,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF medium: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: The threat from malicious inputs remains high, with exploits seeking to @@ -4565,9 +5151,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false Information Gathering: Logging: Centralized application logging: @@ -4596,11 +5189,14 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - isImplemented: false - evidence: "" - comments: "" + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/fe875e17-ae4a-45f8-a359-244aa4fcbc04 tags: - none + teamsImplemented: + Default: false + B: false + C: false Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: Local stored system logs can be unauthorized manipulated by attackers @@ -4636,11 +5232,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/4eced38a-7904-4c45-adb0-50b663065540 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Correlation of security events: uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 risk: Detection of security related events with hints on different systems/tools/metrics @@ -4666,11 +5267,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccf4561d-253f-4762-adcb-bc4622fd6fc5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Logging of security events: uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb description: | @@ -4724,14 +5330,19 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccfdd0a8-991e-4269-ad77-c0a54ca655cb risk: |- * No track of security-relevant events makes it harder to analyze an incident. * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false PII logging concept: uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 risk: Personal identifiable information (PII) is logged and the privacy law @@ -4777,11 +5388,16 @@ Information Gathering: - Not explicitly covered by ISO 27001 - too specific - 8.15 - 5.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/613a73dc-4f60-49db-a6ce-4fb7bf8519f9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Visualized logging: uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 risk: System and application protocols are not visualized properly which leads @@ -4813,11 +5429,87 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/7c735089-6a83-419f-8b27-c1e676cedea1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false + Test KPI: + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: Failing to convey the number of vulnerabilities by severity might undermine + the effectiveness of product teams. This might lead to ignorance of findings. + measure: Measurement and communication of vulnerabilities per severity for components + like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/bc548cba-cb82-4f76-bd4b-325d9d256279 + tags: + - vulnerability-mgmt + - metrics + teamsImplemented: + Default: false + B: false + C: false + SLA per criticality: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of how much vulnerabilities handling + per severity for components like applications are aligned to SLAs. \nAt least + quarterly." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/123e4567-e89b-12d3-a456-426614174000 + tags: + - vulnerability-mgmt + - metrics + teamsImplemented: + Default: false + B: false + C: false Monitoring: Advanced app. metrics: uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf @@ -4841,11 +5533,16 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d03bc410-74a7-4e92-82cb-d01a020cb6bf isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Advanced availability and stability metrics: uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 risk: Trends and advanced attacks are not detected. @@ -4868,11 +5565,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ed715b38-c34b-40cd-83fd-ce807f306fc1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Alerting: uuid: 8a442d8e-0eb1-4793-a513-571aef982edd risk: Incidents are discovered after they happened. @@ -4898,11 +5600,16 @@ Information Gathering: - 6.8 - 5.25 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8a442d8e-0eb1-4793-a513-571aef982edd isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Audit of system events: uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 risk: System events (system calls) trends and attacks are not detected. @@ -4932,11 +5639,16 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/1cd5e4b8-be36-4726-adc7-d8f843f47ac8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage and control metrics: uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d risk: The effectiveness of configuration, patch and vulnerability management @@ -4968,11 +5680,16 @@ Information Gathering: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d0d681e7-d6de-4829-ac64-a9eb2546aa0d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deactivation of unused metrics: uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 risk: High resources are used while gathering unused metrics. @@ -4995,11 +5712,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/7f36b9ba-bc05-4fd6-9a2a-73344c249722 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defense metrics: uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 risk: IDS/IPS systems like packet- or application-firewalls detect and prevent @@ -5026,11 +5748,16 @@ Information Gathering: iso27001-2022: - 8.15 - 8.2 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e808028c-351c-42f1-bcd9-fba738d1fc55 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Grouping of metrics: uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b risk: The analysis of metrics takes long. @@ -5051,11 +5778,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/42170a71-d4c8-47af-bd71-bf36875fd05b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Metrics are combined with tests: uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 risk: Changes might cause high load due to programming errors. @@ -5076,11 +5808,16 @@ Information Gathering: - not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/71699daf-b2a4-466b-a0b2-89f7dbb18506 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Monitoring of costs: uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e risk: Not monitoring costs might lead to unexpected high resource consumption @@ -5105,11 +5842,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/10e23a8c-22ff-4487-a706-87ccc9d0798e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Screens with metric visualization: uuid: 8746647c-638c-473f-8e17-82c068e4c311 risk: Security related information is discovered too late during an incident. @@ -5133,11 +5875,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8746647c-638c-473f-8e17-82c068e4c311 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 risk: Attacks on an application are not recognized. @@ -5161,11 +5908,16 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e9a6d403-a467-445e-b98a-74f0c29da0b1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 risk: Not getting notified about reaching the end of the budget (e.g. due to @@ -5189,11 +5941,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/f08a3219-6941-43ec-8762-4aff739f4664 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 risk: Without simple metrics analysis of incidents are hard. In case an application @@ -5220,11 +5977,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/3d1f4c3b-f713-46d9-933a-54a014a26c03 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Targeted alerting: uuid: d6f06ae8-401a-4f44-85df-1079247fa030 risk: People are bored (ignorant) of incident alarm messages, as they are not @@ -5249,11 +6011,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d6f06ae8-401a-4f44-85df-1079247fa030 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Visualized metrics: uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 risk: Not visualized metrics lead to restricted usage of metrics. @@ -5275,11 +6042,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ded39bcf-4eaa-4c5f-9c94-09acde0a4734 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test and Verification: Application tests: High coverage of security related module and integration tests: @@ -5304,11 +6076,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/67667c97-c33e-4306-a4e5-e7b1d8e10c5a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security integration tests for important components: uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 risk: Vulnerabilities are rising due to code changes in a complex microservice @@ -5330,11 +6108,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security unit tests for important components: uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 risk: Vulnerabilities are rising due to code changes. @@ -5368,10 +6152,16 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Smoke Test: uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a risk: During a deployment an error might happen which leads to non-availability @@ -5396,11 +6186,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/73aaae0b-5d68-4953-9fa4-fd25bf665f2a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Consolidation: Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 @@ -5449,11 +6245,95 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/7a82020c-94d1-471c-bbd3-5f7fe7df4876 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false + Fix based on accessibility: + uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed + risk: Overwhelming volume of security findings from automated testing tools. + This might lead to ignorance of findings. + measure: Implement a simple risk-based prioritization framework for vulnerability + remediation based on accessibility of the applications. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + meta: + implementationGuide: |- + Develop a scoring system for asset accessibility, considering factors like: + - Whether the asset is internet-facing (highly recommended) + - The number of network hops required to reach the asset (recommended) + - Authentication requirements for access (recommended) + dependsOn: + - uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425 + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + implementation: ~ + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/0c10a7f7-f78f-49f2-943d-19fdef248fed + tags: + - vuln-action + - defect-management + teamsImplemented: + Default: false + B: false + C: false + Fix based on severity: + uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 + risk: Overwhelming volume of security findings from automated testing tools. + This might lead to ignorance of findings. + measure: Implement a very simple risk-based prioritization framework for vulnerability + remediation based on the severity of the findings. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: ~ + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/38d1bd10-7b5f-4ae1-868c-0ec813285425 + tags: + - vuln-action + - defect-management + teamsImplemented: + Default: false + B: false + C: false Generation of Patch Management Statistics: uuid: 785e34ef-40c6-487a-984c-3e7706c9bc1f risk: Delays in patch response lead to an increased attack surface through longer @@ -5498,11 +6378,16 @@ Test and Verification: - 16.1.4 iso27001-2022: - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/785e34ef-40c6-487a-984c-3e7706c9bc1f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Generation of Response Statistics: uuid: c922981b-65ed-40f3-a947-96fee9a0125f risk: No or delayed reaction to findings leads to potential exploitation of @@ -5557,13 +6442,18 @@ Test and Verification: iso27001-2022: - 5.25 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c922981b-65ed-40f3-a947-96fee9a0125f isImplemented: false - evidence: "" comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). tags: - none + teamsImplemented: + Default: false + B: false + C: false Integration of vulnerability issues into the development process: uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e risk: To read console output of the build server to search for vulnerabilities @@ -5603,11 +6493,16 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/ce970c9b-da94-41cf-bd78-8c15357b7e8e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Reproducible defect tickets: uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 risk: Vulnerability descriptions are hard to understand by staff from operations @@ -5635,11 +6530,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/27337442-e4b1-4e87-8dc9-ce86fbb79a39 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 risk: As false positive occur during each test, all vulnerabilities might be @@ -5674,11 +6574,16 @@ Test and Verification: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c1acc8af-312e-4503-a817-a26220c993a0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: The security level of a component is not visible. Therefore, the motivation @@ -5710,6 +6615,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 name: LogParser Jenkins Plugins tags: [] @@ -5741,11 +6647,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/55f4c916-3a34-474d-ad96-9a9f7a4f6a83 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of all defects: uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d risk: Vulnerabilities with severity low are not visible. @@ -5766,11 +6677,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 risk: Vulnerabilities with severity high or higher are not visible. @@ -5792,11 +6708,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 implementation: [] isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of defects with severity middle: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. @@ -5817,11 +6738,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 implementation: [] isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: Maintenance of false positives in each tool enforces a high workload. @@ -5866,11 +6792,16 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/85ba5623-84be-4219-8892-808837be582d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dynamic depth for applications: Coverage analysis: uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 @@ -5903,11 +6834,17 @@ Test and Verification: - part of periodic review, PDCA iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/d0ba0be5-c573-405f-b905-b7a8f87a9cc7 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of client side dynamic components: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript @@ -5931,16 +6868,22 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/9711f871-f79d-4573-8d4f-d2c98fd0d18e implementation: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb name: Ajax Spider tags: [] url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of hidden endpoints: uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 risk: Hidden endpoints of the service are not getting tracked. @@ -5987,11 +6930,17 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/6a9cb303-0f98-48a8-bdcd-56d41c0012b8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of more input vectors: uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc risk: Parts of the service are not covered. For example specially formatted @@ -6014,6 +6963,9 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5e0ff85b-ec89-4ef0-96b1-5695fa0025dc implementation: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b name: Schemathesis @@ -6025,10 +6977,13 @@ Test and Verification: description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of sequential operations: uuid: 845f06ec-148c-4c67-9755-7041911dcca5 risk: Sequential operations like workflows (e.g. login -> put products in the @@ -6057,11 +7012,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/845f06ec-148c-4c67-9755-7041911dcca5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of service to service communication: uuid: 22aab0ef-76ce-4b8c-979c-3699784330db risk: Service to service communication is not covered. @@ -6083,14 +7044,11 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/22aab0ef-76ce-4b8c-979c-3699784330db implementation: - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: + - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -6976,6 +7934,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -7162,13 +8121,26 @@ Test and Verification: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -8054,6 +9026,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -8240,11 +9213,33 @@ Test and Verification: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple Scan: uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 risk: Deficient security tests are performed. Simple vulnerabilities are not @@ -8282,11 +9277,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/07796811-37f9-467c-9ff2-48f346e77ff3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of different roles: uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 risk: Parts of the service are not covered during the scan, because a login @@ -8310,6 +9311,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/65a2d7d9-5441-46bf-a4e3-f76919857750 implementation: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 name: Zest @@ -8320,10 +9324,13 @@ Test and Verification: Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. isImplemented: false assessment: For REST APIs, multiple OAuth2 scopes are used. - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of multiple scanners: uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea risk: Each vulnerability scanner has different opportunities. By using just @@ -8356,11 +9363,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dynamic depth for infrastructure: Load tests: uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd @@ -8386,11 +9399,17 @@ Test and Verification: - 8.6 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/ab5725aa-4d53-47b9-96df-c14b3fa93bcd isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for exposed services: uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 risk: Standard network segmentation and firewalling has not been performed, @@ -8427,11 +9446,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for unauthorized installation: uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a risk: Unapproved components are used. @@ -8459,12 +9484,18 @@ Test and Verification: iso27001-2022: - 8.19 - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/dccf1949-b9a8-4ce8-b992-6a4a7f3a623a isImplemented: false - evidence: "" dependsOn: - Evaluation of the trust of used components tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for unused Resources: uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 risk: Unused resources, specially secrets, might be still valid, but are exposing @@ -8499,11 +9530,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6532c1fe-9d23-4228-8722-558ddabca7d4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test network segmentation: uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 risk: Wrong or no network segmentation of pods makes it easier for an attacker @@ -8534,11 +9571,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6d2c3ac6-8afc-4af6-a5e9-6188341aca01 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of the configuration of cloud environments: uuid: 7bb70764-9392-4462-935d-e55b2e148199 risk: Standard hardening practices for cloud environments are not performed @@ -8581,11 +9624,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/7bb70764-9392-4462-935d-e55b2e148199 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Weak password test: uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f risk: Weak passwords in components like applications or systems, specially for @@ -8611,11 +9660,17 @@ Test and Verification: - 9.4.3 iso27001-2022: - 5.17 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/61e10f9c-e126-4ffa-af12-fdbe0d0a831f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static depth for applications: API design validation: uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 @@ -8661,11 +9716,19 @@ Test and Verification: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 isImplemented: false - evidence: "" + dependsOn: + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dead code elimination: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Dead code increases the attack surface (use of hard coded credentials @@ -8694,9 +9757,16 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Exclusion of source code duplicates: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Duplicates in source code might influence the stability of the application. @@ -8724,9 +9794,16 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Local development security checks performed: uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b risk: Creating and developing code contains code smells and quality issues. @@ -8758,13 +9835,7 @@ Test and Verification: tags: - ide - sast - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: + - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -9650,6 +10721,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory juice-shop: uuid: c021aa72-c71c-43e4-9573-717b74d6c19d name: OWASP Juice Shop @@ -9836,6 +10908,25 @@ Test and Verification: url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html description: | There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 name: DevSecOps control Pre-commit url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop @@ -9855,11 +10946,17 @@ Test and Verification: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6e180abc-7c98-4265-b4e9-852cb91b067b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis (client side): uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 risk: Client side components might have vulnerabilities. @@ -9873,6 +10970,7 @@ Test and Verification: level: 3 dependsOn: - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js @@ -9894,6 +10992,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 name: Dependabot tags: @@ -9910,11 +11009,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/07fe8c4f-ae33-4409-b1b2-cf64cfccea86 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe risk: Server side components might have vulnerabilities. @@ -9928,6 +11033,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 name: OWASP Dependency Check @@ -9948,6 +11054,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js tags: [] @@ -9972,11 +11079,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d918cd44-a972-43e9-a974-eff3f4a5dcfe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 risk: Used components like libraries and legacy applications might have vulnerabilities @@ -9990,6 +11103,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: [] references: samm2: @@ -9998,11 +11112,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for all self written components: uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 risk: Parts in the source code of the frontend or middleware have vulnerabilities. @@ -10048,6 +11168,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -10055,11 +11176,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/ee68331f-9b1d-4f61-844b-b2ea04753a84 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for important client side components: uuid: e237176b-bec5-447d-a926-e37d6dd60e4b risk: Important parts in the source code of the frontend have vulnerabilities. @@ -10109,6 +11236,7 @@ Test and Verification: - sast dependsOn: - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -10116,11 +11244,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/e237176b-bec5-447d-a926-e37d6dd60e4b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for important server side components: uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 risk: Important parts in the source code of the middleware have vulnerabilities. @@ -10165,6 +11299,7 @@ Test and Verification: - sast dependsOn: - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -10172,11 +11307,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6c05c837-8c99-46e2-828b-7c903e27dba4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Stylistic analysis: uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 risk: Unclear or obfuscated code might have unexpected behavior. @@ -10223,11 +11364,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for Patch Deployment Time: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -10246,7 +11393,6 @@ Test and Verification: name: PMD tags: [] dependsOn: - - Automated PRs for patches - Defined build process references: samm2: @@ -10259,6 +11405,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Self implementation. This activity is not repeated in @@ -10266,6 +11415,10 @@ Test and Verification: as well. tags: - patching + teamsImplemented: + Default: false + B: false + C: false Test for Time to Patch: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -10293,7 +11446,7 @@ Test and Verification: - patching url: https://github.com/renovatebot/renovate dependsOn: - - Automated PRs for patches + - Defined build process references: samm2: - V-ST-2-A @@ -10305,6 +11458,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Usage of a version control platform API (e.g. github @@ -10312,6 +11468,10 @@ Test and Verification: might be an alternative to this activity. tags: - patching + teamsImplemented: + Default: false + B: false + C: false Test libyear: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Vulnerabilities in running artifacts stay for long and might get exploited. @@ -10345,6 +11505,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: | @@ -10352,6 +11515,10 @@ Test and Verification: An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of multiple analyzers: uuid: 297be001-8d94-41ee-ab29-207020d423c0 risk: Each vulnerability analyzer has different opportunities. By using just @@ -10379,11 +11546,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/297be001-8d94-41ee-ab29-207020d423c0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static depth for infrastructure: Analyze logs: uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 @@ -10406,11 +11579,17 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/b217c8bb-5d61-4b41-a675-1083993f83b1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Correlate known vulnerabilities in infrastructure with new image versions: uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 risk: TODO. @@ -10449,11 +11628,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/7de0ae33-6538-45cd-8222-a1475647ba58 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test cluster deployment resources: uuid: 621fb6a5-5c0a-4408-826a-068868bb031b risk: The deployment configuration (e.g. kubernetes deployment resources) might @@ -10484,11 +11669,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/621fb6a5-5c0a-4408-826a-068868bb031b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for image lifetime: uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b risk: Old container images in production indicate that patch management is not @@ -10523,11 +11714,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for known vulnerabilities: uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad risk: Known vulnerabilities in infrastructure components like container images @@ -10564,6 +11761,7 @@ Test and Verification: - OpenSource - Supply Chain - vulnerability + - inventory references: samm2: - V-ST-2-A @@ -10571,11 +11769,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/26e1c6d5-5632-4ec7-80d2-e564b98732ad isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for malware: uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d risk: Third party might include malware. Ether due to the maintainer (e.g. @@ -10610,11 +11814,17 @@ Test and Verification: - 12.2.1 iso27001-2022: - 8.7 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/837f8f90-adc2-4e6b-9ebb-60c2ee29494d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for new image version: uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e risk: When a new version of an image is available, it might fix security vulnerabilities. @@ -10637,11 +11847,17 @@ Test and Verification: - 8.8 - 8.7 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/cb6321aa-0fbf-4996-9e08-05ab26ef4c1e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for stored secrets: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c risk: Stored secrets in git history, in container images or directly in code @@ -10673,11 +11889,17 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/c6e3c812-56e2-41b0-ae01-b7afc41a004c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of infrastructure components for known vulnerabilities: uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 risk: Infrastructure components might have vulnerabilities. @@ -10720,11 +11942,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/13367d8f-e37f-4197-a610-9ffca4fde261 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of virtualized environments: uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 risk: Virtualized environments (e.g. via Container Images) might contains @@ -10761,11 +11989,17 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/58825d22-1ce6-4748-af81-0ec9956e4129 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test the cloud configuration: uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc risk: Standard hardening practices for cloud environments are not performed @@ -10796,11 +12030,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test the definition of virtualized environments: uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e risk: The definition of virtualized environments (e.g. via Dockerfile) @@ -10850,11 +12090,17 @@ Test and Verification: - 8.32 - 8.29 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/8fc3de67-7b8d-420b-8d24-f35928cfed6e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test-Intensity: Creation and application of a testing concept: uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe @@ -10884,11 +12130,16 @@ Test and Verification: - 8.32 - 8.27 - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/79ef8103-e1ed-4055-8df8-fd2b2015bebe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deactivating of unneeded tests: uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 risk: As tools cover a wide range of different vulnerability tests, they might @@ -10915,11 +12166,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Default settings for intensity: uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d risk: Time pressure and ignorance might lead to false predictions for the test @@ -10943,11 +12199,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/ab0a4b51-3b18-43f1-a6fc-a98e4b28453d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false High test intensity: uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 risk: A too small intensity or a too high confidence might lead to not visible @@ -10972,12 +12233,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/2ebfc421-8c76-415c-a3b0-fa518915bd10 isImplemented: false - evidence: "" comments: "" tags: - none - Regular tests: + teamsImplemented: + Default: false + B: false + C: false + Regular automated tests: uuid: 598897a2-358e-441f-984c-e12ec4f6110a risk: After pushing source code to the version control system, any delay in receiving feedback on defects makes them harder for the developer to remediate. @@ -11000,9 +12266,14 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/598897a2-358e-441f-984c-e12ec4f6110a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false ... From 9f47930b5ceb199bac51e5a840a59eec522bde0f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 7 Aug 2024 16:32:47 +0200 Subject: [PATCH 015/370] enhance SCA --- .../StaticDepthForApplications.yaml | 7 ++-- .../StaticDepthForInfrastructure.yaml | 34 ++++++++++++++++--- 2 files changed, 34 insertions(+), 7 deletions(-) diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 5697046..27d9666 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -346,6 +346,7 @@ Test and Verification: comments: "" Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + description: Use a tool like trivy and concentrate on application related vulnerabilities. At this stage, ignore vulnerabilities in container base images used in the service. risk: Server side components might have vulnerabilities. measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) @@ -365,6 +366,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-dependabot + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy references: samm2: - V-ST-2-A @@ -372,9 +374,8 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - isImplemented: false - evidence: "" - comments: "" + tags: + - vmm-testing Usage of multiple analyzers: uuid: 297be001-8d94-41ee-ab29-207020d423c0 risk: diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index fb8994b..9074439 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -340,12 +340,38 @@ Test and Verification: - 14.2.8 - 14.2.1 iso27001-2022: - - System hardening, virtual environments are not explicitly covered by ISO - 27001 - too specific + - System hardening, virtual environments are not explicitly covered by ISO 27001 - too specific - 8.8 - 8.32 - 8.29 - 8.25 isImplemented: false - evidence: "" - comments: "" + Software Composition Analysis: + uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + risk: Infrastructure components might have vulnerabilities. + measure: + Tests for known vulnerabilities in server side components (e.g. backend/middleware) are performed. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 1 + usefulness: 2 + level: 4 + dependsOn: + - Defined build process + - uuid:d918cd44-a972-43e9-a974-eff3f4a5dcfe + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + tags: + - vmm-testing From 8e4ee9c8d1bfc439e3a7699564bad510f247bb0d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 7 Aug 2024 17:18:55 +0200 Subject: [PATCH 016/370] current status --- .../CultureAndOrganization/Process.yaml | 42 +- .../default/InformationGathering/TestKPI.yaml | 67 +- .../TestAndVerification/Consolidation.yaml | 39 + .../StaticDepthForInfrastructure.yaml | 32 +- src/assets/YAML/generated/generated.yaml | 4839 +++++++++++------ 5 files changed, 3329 insertions(+), 1690 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index 5bc822e..b8b8c1f 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -80,6 +80,42 @@ Culture and Organization: - 17.1.1 iso27001-2022: - 5.29 - isImplemented: false - evidence: "" - comments: "" + Determining the protection requirement: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of + critical security issues, increasing the risk of exploitation and potential damage to the organization. + measure: |- + Defining the SLA to respond to findings depending on protection requirement and the corresponding handling of vulnerabilities per severity for components like applications are aligned to SLAs. + This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application. + At least quarterly. + description: |- + The protection requirements for an application should consider: + - Data criticality + - Application accessibility (internal vs. external) + - Regulatory compliance + - Other relevant factors + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements \ No newline at end of file diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml index 8d35521..4951871 100644 --- a/src/assets/YAML/default/InformationGathering/TestKPI.yaml +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -33,24 +33,33 @@ Information Gathering: - vulnerability-mgmt - metrics - vmm-measurement - Patching mean time to resolution via PR: - uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 + Number of vulnerabilities/severity/layer: + uuid: 0ec92899-a5cb-4649-984b-2fb1d6c784ad risk: |- - Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss. + Failing to convey the number of vulnerabilities by severity and layer (app/infra) might undermine the effectiveness of product teams. This might lead to ignorance of findings. measure: |- - Measurement and communication of patching Mean Time to Resolution (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. - This includes the measurement of the existence of a properly configured automated pull request (PR) tool (e.g., Dependabot or Renovate) in a repository. - In addition, the measurement of the time from opening an automated PR to merging it. + Measurement and communication of vulnerabilities per severity for components like applications and split it depending on the layer (e.g. app/infra). At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + Layers to consider (SCA): + - Cloud provider (if insights are possible) + - Runtimes, e.g. Kubernetes nodes + - Base images and container images + - Application - Average time to patch is visualized per component/project/team. + Layers to consider SAST/DAST: + - Cloud provider + - Runtime, e.g. Kubernetes + - Base images and container images + - Application difficultyOfImplementation: - knowledge: 1 - time: 1 + knowledge: 2 + time: 2 resources: 2 usefulness: 3 level: 2 - dependsOn: - - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches + dependsOn: [] implementation: [] references: samm2: @@ -61,30 +70,28 @@ Information Gathering: - 5.13 - 5.10 tags: - - patching + - vulnerability-mgmt - metrics - - vmm-measurements - SLA per criticality: # is this the definition of SLAs or the measurement? - uuid: 123e4567-e89b-12d3-a456-426614174000 + - vmm-measurement + Patching mean time to resolution via PR: + uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 risk: |- - Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of - critical security issues, increasing the risk of exploitation and potential damage to the organization. + Without measuring Mean Time to Resolution (MTTR) related to patching, it is challenging to identify delays in the patching process. Unaddressed vulnerabilities can be exploited by attackers, leading to potential security breaches and data loss. measure: |- - Measurement and communication of how many of the vulnerabilities handling per severity for components like applications are aligned to SLAs. - This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application. - At least quarterly. + Measurement and communication of patching Mean Time to Resolution (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + This includes the measurement of the existence of a properly configured automated pull request (PR) tool (e.g., Dependabot or Renovate) in a repository. + In addition, the measurement of the time from opening an automated PR to merging it. + + Average time to patch is visualized per component/project/team. difficultyOfImplementation: - knowledge: 2 - time: 2 + knowledge: 1 + time: 1 resources: 2 usefulness: 3 - level: 3 - dependsOn: [] - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + level: 2 + dependsOn: + - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches + implementation: [] references: samm2: - I-DM-3-B @@ -94,7 +101,7 @@ Information Gathering: - 5.13 - 5.10 tags: - - vulnerability-mgmt + - patching - metrics - vmm-measurements Patching mean time to resolution via production: diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 4fe0291..310279f 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -379,3 +379,42 @@ Test and Verification: tags: - vulnerability-mgmt - vmm-measurements + Treatment of defects per protection requirement: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: |- + Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of + critical security issues, increasing the risk of exploitation and potential damage to the organization. + measure: |- + Defining the protection requirement and the corresponding handling of vulnerabilities per severity for components like applications are aligned to SLAs. + This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application. + At least quarterly. + description: |- + The protection requirements for an application should consider: + - Data criticality + - Application accessibility (internal vs. external) + - Regulatory compliance + - Other relevant factors + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.10 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements \ No newline at end of file diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index 9074439..001325b 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -49,7 +49,7 @@ Test and Verification: isImplemented: false evidence: "" comments: "" - Test for known vulnerabilities: + Software Composition Analysis: uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad risk: Known vulnerabilities in infrastructure components like container images @@ -346,32 +346,4 @@ Test and Verification: - 8.29 - 8.25 isImplemented: false - Software Composition Analysis: - uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe - risk: Infrastructure components might have vulnerabilities. - measure: - Tests for known vulnerabilities in server side components (e.g. backend/middleware) are performed. - difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 1 - usefulness: 2 - level: 4 - dependsOn: - - Defined build process - - uuid:d918cd44-a972-43e9-a974-eff3f4a5dcfe - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy - references: - samm2: - - V-ST-2-A - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - tags: - - vmm-testing + diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index b22453d..dea596b 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -41,16 +41,11 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/a340f46b-6360-4cb8-847b-a0d3483d09d3 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b risk: Performing builds without a defined process is error prone; for example, @@ -93,16 +88,11 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f6f7737f-25a9-4317-8de2-09bf59f29b5b isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Pinning of artifacts: uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 risk: Unauthorized manipulation of artifacts might be difficult to spot. For @@ -138,16 +128,11 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false SBOM of components: uuid: 2858ac12-0179-40d9-9acf-1b839c030473 description: |- @@ -177,16 +162,11 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/2858ac12-0179-40d9-9acf-1b839c030473 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Signing of artifacts: uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -232,16 +212,11 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/5786959d-0c6f-46a6-8e1c-a32ff1a50222 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Signing of code: uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -276,16 +251,11 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/9f107927-61e9-4574-85ad-3f2b4bca8665 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Deployment: Blue/Green Deployment: uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 @@ -323,16 +293,11 @@ Build and Deployment: - 8.32 - 8.19 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0cb2626b-fb0d-4a0f-9688-57f787310d97 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Defined decommissioning process: uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 description: |- @@ -359,16 +324,11 @@ Build and Deployment: - 11.2.7 iso27001-2022: - 7.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/da4ff665-dcb9-4e93-9d20-48cdedc50fc2 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a risk: Deployment of insecure or malfunctioning artifacts. @@ -403,16 +363,11 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Environment depending configuration parameters (secrets): uuid: df428c9d-efa0-4226-9f47-a15bb53f822b risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. @@ -1519,6 +1474,19 @@ Build and Deployment: url: https://github.com/SDA-SE/image-metadata-collector/ description: | Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + jira: + uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning + sprints, and managing software releases. It offers features for creating + and managing tasks, assigning them to team members, and monitoring progress + through customizable workflows and dashboards. references: samm2: - I-SD-1-B @@ -1530,15 +1498,9 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/df428c9d-efa0-4226-9f47-a15bb53f822b isImplemented: false tags: - secret - teamsImplemented: - Default: false - B: false - C: false Evaluation of the trust of used components: uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba risk: Application and system components like Open Source libraries or images @@ -1582,16 +1544,11 @@ Build and Deployment: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0de465a6-55a7-4343-af79-948bb5ff10ba isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Handover of confidential parameters: uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a risk: Parameters are often used to set credentials, for example by starting @@ -1626,15 +1583,9 @@ Build and Deployment: - 8.24 d3f: - ApplicationConfigurationHardening - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/94a96f79-8bd6-4904-97c0-994ff88f176a isImplemented: false tags: - secret - teamsImplemented: - Default: false - B: false - C: false Inventory of production artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs @@ -1691,14 +1642,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/83057028-0b77-4d2e-8135-40969768ae88 tags: - inventory - teamsImplemented: - Default: false - B: false - C: false Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f risk: An organization is unaware of components like applications in production. @@ -1754,14 +1699,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/2a44b708-734f-4463-b0cb-86dc46344b2f tags: - inventory - teamsImplemented: - Default: false - B: false - C: false Inventory of production dependencies: uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 risk: Delayed identification of components and their vulnerabilities in production. @@ -1818,16 +1757,10 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/13e9757e-58e2-4277-bc0f-eadc674891e6 comments: "" tags: - inventory - sbom - teamsImplemented: - Default: false - B: false - C: false Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. @@ -1863,16 +1796,11 @@ Build and Deployment: - 8.19 - 8.32 - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/85d52588-f542-4225-a338-20dc22a5508d isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Same artifact for environments: uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f risk: Building of an artifact for different environments means that an untested @@ -1903,16 +1831,11 @@ Build and Deployment: - 8.33 - 8.29 - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a854b48d-83bd-4f8d-8621-a0bdd470837f isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of feature toggles: uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad risk: Using environment variables to enable or disable features can lead to @@ -1954,16 +1877,11 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a511799b-045e-4b96-9843-7d63d8c1e2ad isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d @@ -1988,17 +1906,11 @@ Build and Deployment: - 8.8 - 8.19 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/99415139-6b50-441b-89e1-0aa59accd43d isImplemented: false + evidence: "" comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 risk: Components with known (or unknown) vulnerabilities might stay for long @@ -2047,16 +1959,9 @@ Build and Deployment: iso27001-2022: - 8.8 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Automated merge of automated PRs: uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: Automated merges of automated created PRs for outdated dependencies. @@ -2091,16 +1996,9 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/f2594f8f-1cd6-45f9-af29-eaf3315698eb comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Nightly build of images (base images): uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 description: |- @@ -2129,17 +2027,11 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/34869eaf-f2e1-4926-b0bd-28c43402f057 isImplemented: false + evidence: "" comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Reduction of the attack surface: uuid: 16e39c8f-5336-4001-88ed-a552d2447531 description: |- @@ -2179,17 +2071,10 @@ Build and Deployment: - 14.2.1 iso27001-2022: - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/16e39c8f-5336-4001-88ed-a552d2447531 evidence: "" comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Usage of a maximum lifetime for images: uuid: 485a3383-7f2e-4dba-bb84-479377070904 description: |- @@ -2223,17 +2108,10 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/485a3383-7f2e-4dba-bb84-479377070904 evidence: "" comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Usage of a short maximum lifetime for images: uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e description: |- @@ -2277,17 +2155,11 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/6b96e5a0-ce34-4ea4-a88f-469d3b84546e isImplemented: false + evidence: "" comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Culture and Organization: Design: Conduction of advanced threat modeling: @@ -2382,16 +2254,11 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of simple threat modeling on business level: uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 risk: Business related threats are discovered too late in the development and @@ -2418,16 +2285,11 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/48f97f31-931c-46eb-9b3e-e2fec0cd0426 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e risk: Technical related threats are discovered too late in the development and @@ -2543,16 +2405,11 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/47419324-e263-415b-815d-e7161b6b905e isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Creation of advanced abuse stories: uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e risk: Simple user stories are not going deep enough. Relevant security considerations @@ -2590,16 +2447,11 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/0a929c3e-ab9a-4206-8761-adf84b74622e isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Creation of simple abuse stories: uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 risk: User stories mostly don't consider security implications. Security flaws @@ -2637,16 +2489,11 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/bacf85b6-5bc0-405d-b5ba-a5d971467cc1 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Creation of threat modeling processes and standards: uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e risk: Inadequate identification of business and technical risks. @@ -2691,16 +2538,11 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Information security targets are communicated: uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 risk: Employees don't known their organizations security targets. Therefore @@ -2723,16 +2565,11 @@ Culture and Organization: iso27001-2022: - 5.1 - 5.4 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/1b9281b9-48e2-4c01-9ac6-9db9931c4885 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 @@ -2767,17 +2604,11 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Aligning security in teams: uuid: f994a55d-71bb-45a4-a887-0a213d72c504 risk: The concept of Security Champions might suggest that only he/she is responsible @@ -2804,17 +2635,11 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/f994a55d-71bb-45a4-a887-0a213d72c504 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of build-it, break-it, fix-it contests: uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 risk: Understanding security is hard, even for security champions and the conduction @@ -2841,17 +2666,11 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/bfdb576e-a416-4ec6-96fe-a078d58b2ff8 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of collaborative security checks with developers and system administrators: uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 risk: Security checks by external companies do not increase the understanding @@ -2881,17 +2700,11 @@ Culture and Organization: - 6.3 - 8.8 - 8.34 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/95caef96-36ed-458c-a087-5c35d4f9dec2 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of collaborative team security checks: uuid: 35446784-7610-40d9-af9e-d43f3173bf8c risk: Development teams limited insight over security practices. @@ -2914,17 +2727,11 @@ Culture and Organization: iso27001-2022: - Mutual security testing is not explicitly required in ISO 27001 may be - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/35446784-7610-40d9-af9e-d43f3173bf8c isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of war games: uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 risk: Understanding incident response plans during an incident is hard and ineffective. @@ -2951,17 +2758,11 @@ Culture and Organization: - 6.3 - 5.24 - 5.26 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/534f60bf-0995-4314-bb9c-f0f2bf204694 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Each team has a security champion: uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 risk: No one feels directly responsible for security and the security champion @@ -3011,17 +2812,11 @@ Culture and Organization: - Security champions are missing in ISO 27001 most likely - 5.4 - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Regular security training for all: uuid: 9768f154-357a-4c06-af6f-d66570677c9b risk: Understanding security is hard. @@ -3061,17 +2856,11 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/9768f154-357a-4c06-af6f-d66570677c9b isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Regular security training for externals: uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 risk: Understanding security is hard. @@ -3104,17 +2893,11 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/31833d56-35af-4ef3-9300-f23d27646ce7 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Regular security training of security champions: uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 risk: Understanding security is hard, even for security champions. @@ -3146,17 +2929,11 @@ Culture and Organization: iso27001-2022: - Security champions are missing in ISO 27001 - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Reward of good communication: uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c risk: Employees are not getting excited about security. @@ -3194,17 +2971,11 @@ Culture and Organization: but nothing to promote good behavior. iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/91b6f75b-9f4a-4d77-95a2-af7ad3222c7c isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security Coaching: uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 risk: Training does not change behaviour. Therefore, even if security practices @@ -3235,17 +3006,11 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security code review: uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 risk: Understanding security is hard. @@ -3286,17 +3051,11 @@ Culture and Organization: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/7121b0c7-6ace-4d6b-95d0-94535dbccb57 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 risk: Not asking a security expert when questions regarding security appear @@ -3328,17 +3087,11 @@ Culture and Organization: - 5.2 - 5.6 - 5.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/0b28367b-75a0-4bae-a926-3725c1bf9bb0 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security-Lessoned-Learned: uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 risk: After an incident, a similar incident might reoccur. @@ -3359,17 +3112,11 @@ Culture and Organization: - 16.1.6 iso27001-2022: - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/58c46807-fee9-448b-b6dd-8050c464ab52 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple mob hacking: uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de risk: Understanding security is hard. @@ -3417,17 +3164,11 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/535f301a-e8e8-4eda-ad77-a08b035c92de isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Process: Approval by reviewing any new version: uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 @@ -3453,16 +3194,11 @@ Culture and Organization: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/3f63bdbc-c75f-4780-a941-e6ad42e894e1 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Definition of a change management process: uuid: b4193d32-3948-47e2-a326-3748c48019a1 risk: The impact of a change is not controlled because these are not recorded @@ -3484,16 +3220,11 @@ Culture and Organization: iso27001-2022: - 8.32 - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/b4193d32-3948-47e2-a326-3748c48019a1 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 risk: In case of an emergency, like a power outage, DR actions to perform are @@ -3516,16 +3247,73 @@ Culture and Organization: - 17.1.1 iso27001-2022: - 5.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/c72da779-86cc-45b1-a339-190ce5093171 - isImplemented: false - comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false + Determining of the protection requirement: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: "Not defining the protection requirement of applications can lead to wrong + prioritization, delayed remediation of \ncritical security issues, increasing + the risk of exploitation and potential damage to the organization." + measure: "Defining the protection requirement and the corresponding handling + of vulnerabilities per severity for components like applications are aligned + to SLAs. \n This is performed for the hole organization and doesn't need to + be broken down (yet) on team/product/application. \n At least quarterly." + description: |- + The protection requirements for an application should consider: + - Data criticality + - Application accessibility (internal vs. external) + - Regulatory compliance + - Other relevant factors + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements Implementation: Application Hardening: App. Hardening Level 1: @@ -3586,16 +3374,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/cf819225-30cb-4702-8e32-60225eedc33d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false App. Hardening Level 1 (50%): uuid: b597928e-54d6-48a5-a806-8003dcd56aab risk: Using an insecure application might lead to a compromised application. @@ -3652,17 +3433,10 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/b597928e-54d6-48a5-a806-8003dcd56aab isImplemented: false comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false App. Hardening Level 2: uuid: ffe86caf-2fec-4630-b514-2db83983984d risk: Using an insecure application might lead to a compromised application. @@ -3697,19 +3471,13 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/ffe86caf-2fec-4630-b514-2db83983984d isImplemented: false + evidence: "" comments: "" dependsOn: - App. Hardening Level 2 (75%) tags: - none - teamsImplemented: - Default: false - B: false - C: false App. Hardening Level 2 (75%): uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 risk: Using an insecure application might lead to a compromised application. @@ -3744,19 +3512,13 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/03643ca2-03c2-472b-8e19-956bf02fe9b7 isImplemented: false + evidence: "" comments: "" dependsOn: - App. Hardening Level 1 tags: - none - teamsImplemented: - Default: false - B: false - C: false App. Hardening Level 3: uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a risk: Using an insecure application might lead to a compromised application. @@ -3791,19 +3553,13 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a isImplemented: false + evidence: "" comments: "" dependsOn: - App. Hardening Level 2 tags: - none - teamsImplemented: - Default: false - B: false - C: false Contextualized Encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 risk: The generation of interpreter directives from user-provided data poses @@ -3828,15 +3584,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/e1f37abb-d848-4a3a-b3df-65e91a89dcb7 tags: - none - teamsImplemented: - Default: false - B: false - C: false Development and Source Control: .gitignore: uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d @@ -3863,17 +3612,10 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/363a3eea-baf9-4010-88ca-bb8186a2989d evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false API design validation: uuid: 948a4d51-ceb5-4ebd-bdc7-d74ea25e171c risk: Creation of insecure or non-compliant API. @@ -3918,17 +3660,11 @@ Implementation: - 8.25 - 8.27 - 8.28 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/948a4d51-ceb5-4ebd-bdc7-d74ea25e171c isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Local development linting & style checks performed: uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 risk: Insecure or unmaintainable code base. @@ -3960,17 +3696,11 @@ Implementation: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/517b0957-4981-4ac0-b4c7-0d8d1934c474 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Source Control Protection: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 risk: Intentional or accidental alterations in critical branches like master. @@ -4015,17 +3745,11 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Versioning: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f risk: Deployment of untracked artifacts. @@ -4053,17 +3777,11 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/066084c6-1135-4635-9cc5-9e75c7c5459f isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Infrastructure Hardening: Applications are running in virtualized environments: uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 @@ -4086,17 +3804,11 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/3a94d55e-fd82-4996-9eb3-20d23ff2a873 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Backup: uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc risk: If errors are experienced during the deployment process you want to deploy @@ -4127,17 +3839,11 @@ Implementation: iso27001-2022: - 8.13 - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/5c61fd6b-8106-4c68-ac28-a8a42f1c67dc isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Baseline Hardening of the environment: uuid: 5992c38c-8597-4035-89db-d15820d81c3a risk: Using default configurations for a cluster environment leads to potential @@ -4199,17 +3905,11 @@ Implementation: - 13.1.3 iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/5992c38c-8597-4035-89db-d15820d81c3a isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Filter outgoing traffic: uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d risk: A compromised infrastructure component might try to send out stolen data. @@ -4240,17 +3940,11 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/6df508ef-86fc-4c22-bd9f-646c3127ce7d isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Hardening of the Environment: uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 risk: Using default configurations for a cluster environment leads to potential @@ -4313,17 +4007,11 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/dcf9601b-b4f2-4e25-9143-e39af75f7c33 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Immutable infrastructure: uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 risk: The availability of IT systems might be disturbed due to components failures @@ -4349,17 +4037,11 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/48e92bb1-fdba-40e8-b6c2-35de0d431833 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Infrastructure as Code: uuid: 8b994601-575e-4ea5-b228-accb18c8e514 risk: No tracking of changes in systems might lead to errors in the configuration. @@ -4405,17 +4087,11 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/8b994601-575e-4ea5-b228-accb18c8e514 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Isolated networks for virtual environments: uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 risk: Virtual environments in default settings are able to access other virtual @@ -4452,17 +4128,11 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/4ce24abd-8ba6-494c-828d-4d193e28e4a1 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Limitation of system events: uuid: e5386abf-9154-4752-a1a8-c3a8900f732d risk: System events (system calls) can lead to privilege escalation. @@ -4500,17 +4170,11 @@ Implementation: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/e5386abf-9154-4752-a1a8-c3a8900f732d isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false MFA: uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de risk: One factor authentication is more vulnerable to brute force attacks and @@ -4554,17 +4218,11 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/598e9f13-1ac8-4a01-b85e-8fab93ee81de isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false MFA for admins: uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 risk: One factor authentication is more vulnerable to brute force attacks and @@ -4606,17 +4264,11 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/8098e416-e1ed-4ae4-a561-83efbe76bf57 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Microservice-architecture: uuid: 118b869b-3850-456e-98d9-1abdb85cbc5a risk: Monolithic applications are hard to test. @@ -4636,17 +4288,11 @@ Implementation: - Not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/118b869b-3850-456e-98d9-1abdb85cbc5a isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Production near environments are used by developers: uuid: e14de741-94b3-447c-8b07-eea947d82e61 risk: In case an errors occurs in production, the developer need to be able @@ -4675,17 +4321,11 @@ Implementation: iso27001-2022: - 8.31 - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/e14de741-94b3-447c-8b07-eea947d82e61 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Role based authentication and authorization: uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 risk: Everyone is able to get unauthorized access to information on systems @@ -4716,17 +4356,11 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/070bb14b-e04a-4f3d-896a-a08eba7a35f9 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple access control for systems: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 risk: Attackers a gaining access to internal systems and application interfaces @@ -4755,17 +4389,11 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/82e499d1-f463-4a4b-be90-68812a874af6 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of a chaos monkey: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In @@ -4789,17 +4417,11 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f8e80f18-2503-4e3e-b3bc-7f67bb28defe isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of an security account: uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 risk: Having security auditing in the same account as infrastructure and applications @@ -4820,17 +4442,11 @@ Implementation: - 10.1 iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/746025a6-dbfb-4087-a000-e46acab64ee1 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of edge encryption at transit: uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 risk: Evil actors might be able to perform a man in the middle attack and sniff @@ -4851,17 +4467,11 @@ Implementation: - 10.1 iso27001-2022: - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/ad23be9c-5661-4f1f-81a3-5a5dc7061629 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of encryption at rest: uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 risk: Evil actors might be able to access data and read information, e.g. from @@ -4882,17 +4492,11 @@ Implementation: - 10.1 iso27001-2022: - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/0ff45fb8-7eef-46ed-9b3a-84c955cd7060 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of internal encryption at transit: uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 risk: Evil actors within the organization of traffic in transit might be able @@ -4914,17 +4518,11 @@ Implementation: - 10.1 iso27001-2022: - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/ecb0184c-6bc9-45da-bbbb-a983797ffc93 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of security by default for components: uuid: 11b3848e-e931-4146-a35d-35409ada24ee risk: Components (images, libraries, applications) are not hardened. @@ -4961,17 +4559,11 @@ Implementation: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/11b3848e-e931-4146-a35d-35409ada24ee isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of test and production environments: uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 risk: Security tests are not running regularly because test environments are @@ -4997,17 +4589,11 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 8.31 - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/bfdacb52-1e3f-431d-ae72-d844a5e86415 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Virtual environments are limited: uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca risk: Denial of service (internally by an attacker or unintentionally by a bug) @@ -5036,17 +4622,11 @@ Implementation: - 8.6 - 8.22 - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/760f1056-b0ee-4f22-a35b-f65446f944ca isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false WAF Advanced: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced risk: The presence of sophisticated threats necessitates a robust defense strategy @@ -5075,16 +4655,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced comments: ~ tags: - none - teamsImplemented: - Default: false - B: false - C: false WAF baseline: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: Vulnerable input, such as exploits, can infiltrate the application via @@ -5113,16 +4686,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none - teamsImplemented: - Default: false - B: false - C: false WAF medium: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: The threat from malicious inputs remains high, with exploits seeking to @@ -5151,16 +4717,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none - teamsImplemented: - Default: false - B: false - C: false Information Gathering: Logging: Centralized application logging: @@ -5189,14 +4748,8 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/fe875e17-ae4a-45f8-a359-244aa4fcbc04 tags: - none - teamsImplemented: - Default: false - B: false - C: false Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: Local stored system logs can be unauthorized manipulated by attackers @@ -5232,16 +4785,11 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/4eced38a-7904-4c45-adb0-50b663065540 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Correlation of security events: uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 risk: Detection of security related events with hints on different systems/tools/metrics @@ -5267,16 +4815,11 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccf4561d-253f-4762-adcb-bc4622fd6fc5 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Logging of security events: uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb description: | @@ -5330,19 +4873,14 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccfdd0a8-991e-4269-ad77-c0a54ca655cb risk: |- * No track of security-relevant events makes it harder to analyze an incident. * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false PII logging concept: uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 risk: Personal identifiable information (PII) is logged and the privacy law @@ -5388,16 +4926,11 @@ Information Gathering: - Not explicitly covered by ISO 27001 - too specific - 8.15 - 5.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/613a73dc-4f60-49db-a6ce-4fb7bf8519f9 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Visualized logging: uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 risk: System and application protocols are not visualized properly which leads @@ -5429,87 +4962,11 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/7c735089-6a83-419f-8b27-c1e676cedea1 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false - Test KPI: - Number of vulnerabilities/severity: - uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 - risk: Failing to convey the number of vulnerabilities by severity might undermine - the effectiveness of product teams. This might lead to ignorance of findings. - measure: Measurement and communication of vulnerabilities per severity for components - like applications. At least quarterly. - description: |- - Communication can be performed in a simple way, e.g. text based during the build process. - This activity depends on at least one security testing implementation. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: [] - implementation: [] - references: - samm2: - - I-DM-3-B - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/bc548cba-cb82-4f76-bd4b-325d9d256279 - tags: - - vulnerability-mgmt - - metrics - teamsImplemented: - Default: false - B: false - C: false - SLA per criticality: - uuid: 123e4567-e89b-12d3-a456-426614174000 - risk: "Not communicating how many applications are adhering to SLAs based on - the criticality of vulnerabilities can lead to delayed remediation of \ncritical - security issues, increasing the risk of exploitation and potential damage - to the organization." - measure: "Measurement and communication of how much vulnerabilities handling - per severity for components like applications are aligned to SLAs. \nAt least - quarterly." - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - dependsOn: [] - implementation: [] - references: - samm2: - - I-DM-3-B - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/123e4567-e89b-12d3-a456-426614174000 - tags: - - vulnerability-mgmt - - metrics - teamsImplemented: - Default: false - B: false - C: false Monitoring: Advanced app. metrics: uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf @@ -5533,16 +4990,11 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d03bc410-74a7-4e92-82cb-d01a020cb6bf isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Advanced availability and stability metrics: uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 risk: Trends and advanced attacks are not detected. @@ -5565,16 +5017,11 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ed715b38-c34b-40cd-83fd-ce807f306fc1 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Alerting: uuid: 8a442d8e-0eb1-4793-a513-571aef982edd risk: Incidents are discovered after they happened. @@ -5600,16 +5047,11 @@ Information Gathering: - 6.8 - 5.25 - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8a442d8e-0eb1-4793-a513-571aef982edd isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Audit of system events: uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 risk: System events (system calls) trends and attacks are not detected. @@ -5639,16 +5081,11 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/1cd5e4b8-be36-4726-adc7-d8f843f47ac8 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage and control metrics: uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d risk: The effectiveness of configuration, patch and vulnerability management @@ -5680,16 +5117,11 @@ Information Gathering: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d0d681e7-d6de-4829-ac64-a9eb2546aa0d isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Deactivation of unused metrics: uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 risk: High resources are used while gathering unused metrics. @@ -5712,16 +5144,11 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/7f36b9ba-bc05-4fd6-9a2a-73344c249722 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Defense metrics: uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 risk: IDS/IPS systems like packet- or application-firewalls detect and prevent @@ -5748,16 +5175,11 @@ Information Gathering: iso27001-2022: - 8.15 - 8.2 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e808028c-351c-42f1-bcd9-fba738d1fc55 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Grouping of metrics: uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b risk: The analysis of metrics takes long. @@ -5778,16 +5200,11 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/42170a71-d4c8-47af-bd71-bf36875fd05b isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Metrics are combined with tests: uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 risk: Changes might cause high load due to programming errors. @@ -5808,16 +5225,11 @@ Information Gathering: - not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/71699daf-b2a4-466b-a0b2-89f7dbb18506 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Monitoring of costs: uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e risk: Not monitoring costs might lead to unexpected high resource consumption @@ -5842,16 +5254,11 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/10e23a8c-22ff-4487-a706-87ccc9d0798e isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Screens with metric visualization: uuid: 8746647c-638c-473f-8e17-82c068e4c311 risk: Security related information is discovered too late during an incident. @@ -5875,16 +5282,11 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8746647c-638c-473f-8e17-82c068e4c311 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 risk: Attacks on an application are not recognized. @@ -5908,16 +5310,11 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e9a6d403-a467-445e-b98a-74f0c29da0b1 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 risk: Not getting notified about reaching the end of the budget (e.g. due to @@ -5941,16 +5338,11 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/f08a3219-6941-43ec-8762-4aff739f4664 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 risk: Without simple metrics analysis of incidents are hard. In case an application @@ -5977,16 +5369,11 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/3d1f4c3b-f713-46d9-933a-54a014a26c03 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Targeted alerting: uuid: d6f06ae8-401a-4f44-85df-1079247fa030 risk: People are bored (ignorant) of incident alarm messages, as they are not @@ -6011,16 +5398,11 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d6f06ae8-401a-4f44-85df-1079247fa030 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Visualized metrics: uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 risk: Not visualized metrics lead to restricted usage of metrics. @@ -6042,51 +5424,298 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ded39bcf-4eaa-4c5f-9c94-09acde0a4734 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false -Test and Verification: - Application tests: - High coverage of security related module and integration tests: - uuid: 67667c97-c33e-4306-a4e5-e7b1d8e10c5a - risk: Vulnerabilities are rising due to code changes in a complex microservice - environment in not important components. - measure: Implementation of security related tests via unit tests and integration - tests. Including the test of libraries, in case the are not tested already. + Test KPI: + Fix rate per repo/product: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of the number of vulnerabilities handled + per severity level for components such as applications, ensuring alignment + with SLAs. \nThe rate should be broken down by team, product, application, + repository, and/or service. This analysis should be conducted at least quarterly." difficultyOfImplementation: - knowledge: 5 - time: 5 - resources: 3 + knowledge: 2 + time: 2 + resources: 2 usefulness: 3 - level: 5 - implementation: [] + level: 3 + dependsOn: + - uuid:123e4567-e89b-12d3-a456-426614174000 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - V-ST-3-B + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + Generation of response statistics: + uuid: c922981b-65ed-40f3-a947-96fee9a0125f + risk: No or delayed reaction to findings leads to potential exploitation of + findings. + measure: Creation and response statistics (e.g. Mean Time to Resolution) of + findings. This is also referred to as _Mean Time to Resolve_. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + dependsOn: + - Usage of a vulnerability management system + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.1 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) + generates statistics from OWASP DefectDojo and places the results in a [Github + repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: Failing to convey the number of vulnerabilities by severity might undermine + the effectiveness of product teams. This might lead to ignorance of findings. + measure: Measurement and communication of vulnerabilities per severity for components + like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurement + Number of vulnerabilities/severity/layer: + uuid: 0ec92899-a5cb-4649-984b-2fb1d6c784ad + risk: Failing to convey the number of vulnerabilities by severity and layer + (app/infra) might undermine the effectiveness of product teams. This might + lead to ignorance of findings. + measure: Measurement and communication of vulnerabilities per severity for components + like applications and split it depending on the layer (e.g. app/infra). At + least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + Layers to consider (SCA): + - Cloud provider (if insights are possible) + - Runtimes, e.g. Kubernetes nodes + - Base images and container images + - Application + + Layers to consider SAST/DAST: + - Cloud provider + - Runtime, e.g. Kubernetes + - Base images and container images + - Application + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurement + Patching mean time to resolution via PR: + uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 + risk: Without measuring Mean Time to Resolution (MTTR) related to patching, + it is challenging to identify delays in the patching process. Unaddressed + vulnerabilities can be exploited by attackers, leading to potential security + breaches and data loss. + measure: "Measurement and communication of patching Mean Time to Resolution + (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least + on a quarterly basis.\nThis includes the measurement of the existence of a + properly configured automated pull request (PR) tool (e.g., Dependabot or + Renovate) in a repository. \nIn addition, the measurement of the time from + opening an automated PR to merging it.\n\nAverage time to patch is visualized + per component/project/team." + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + tags: + - patching + - metrics + - vmm-measurements + Patching mean time to resolution via production: + uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f + risk: Without measuring Mean Time to Resolution (MTTR) related to patching, + it is challenging to identify delays in the patching process. Unaddressed + vulnerabilities can be exploited by attackers, leading to potential security + breaches and data loss. + measure: |- + Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + Average time to patch is visualized per component/project/team. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 4 + dependsOn: + - uuid:86d490b9-d798-4a5b-a011-ab9688014c46 + - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 + implementation: [] + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + iso27001-2022: + - 5.25 + tags: + - patching + - metrics + - vmm-measurements +Test and Verification: + Application tests: + High coverage of security related module and integration tests: + uuid: 67667c97-c33e-4306-a4e5-e7b1d8e10c5a + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment in not important components. + measure: Implementation of security related tests via unit tests and integration + tests. Including the test of libraries, in case the are not tested already. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 3 + usefulness: 3 + level: 5 + implementation: [] + references: + samm2: + - V-ST-3-B iso27001-2017: - 14.2.3 - 14.2.8 iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - tests/67667c97-c33e-4306-a4e5-e7b1d8e10c5a isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security integration tests for important components: uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 risk: Vulnerabilities are rising due to code changes in a complex microservice @@ -6108,17 +5737,11 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - tests/f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security unit tests for important components: uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 risk: Vulnerabilities are rising due to code changes. @@ -6152,16 +5775,10 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - tests/eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 isImplemented: false + evidence: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Smoke Test: uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a risk: During a deployment an error might happen which leads to non-availability @@ -6186,17 +5803,11 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - tests/73aaae0b-5d68-4953-9fa4-fd25bf665f2a isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Consolidation: Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 @@ -6245,16 +5856,11 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/7a82020c-94d1-471c-bbd3-5f7fe7df4876 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Fix based on accessibility: uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed risk: Overwhelming volume of security findings from automated testing tools. @@ -6290,21 +5896,17 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/0c10a7f7-f78f-49f2-943d-19fdef248fed tags: - vuln-action - defect-management - teamsImplemented: - Default: false - B: false - C: false Fix based on severity: uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 risk: Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings. - measure: Implement a very simple risk-based prioritization framework for vulnerability - remediation based on the severity of the findings. + measure: | + Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. + + On level one, fix only critical findings. difficultyOfImplementation: knowledge: 2 time: 2 @@ -6325,84 +5927,52 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/38d1bd10-7b5f-4ae1-868c-0ec813285425 tags: - vuln-action - defect-management - teamsImplemented: - Default: false - B: false - C: false - Generation of Patch Management Statistics: - uuid: 785e34ef-40c6-487a-984c-3e7706c9bc1f - risk: Delays in patch response lead to an increased attack surface through longer - exposure of known vulnerabilities. - measure: Average time to patch is visualized per component/project/team. + Integration in development process: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: "Not integrating vulnerability handling into the development process may + result in product teams ignoring findings. \n\nSecurity joke: We will gain + 100% false negatives." + measure: Integration of findings into the development process. E.g. adding findings + to the backlog of products teams. + description: |- + Validating Findings by Security Engineers Pros: + - Ensures accuracy and relevance of findings before they reach product teams + - Reduces false positives, saving development teams time and effort + - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities + + Validating Findings by Security Engineers Cons: + - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations + - May slow down the process if security engineers are overloaded with validation tasks + - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application + + Pushing Findings Directly to Product Teams Pros: + - Accelerates the process by immediately notifying product teams of potential vulnerabilities + - Empowers product teams to take swift action in addressing security issues + Pushing Findings Directly to Product Teams Cons: + - Increases the workload on product teams, potentially leading to frustration difficultyOfImplementation: knowledge: 2 time: 2 - resources: 1 - usefulness: 2 + resources: 2 + usefulness: 3 level: 3 - dependsOn: - - A patch policy is defined - - Automated PRs for patches + dependsOn: [] implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + - uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira tags: - documentation - - vulnerability - - vulnerability management system - references: - samm2: - - I-DM-3-B - iso27001-2017: - - 16.1.4 - iso27001-2022: - - 5.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/785e34ef-40c6-487a-984c-3e7706c9bc1f - isImplemented: false - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false - Generation of Response Statistics: - uuid: c922981b-65ed-40f3-a947-96fee9a0125f - risk: No or delayed reaction to findings leads to potential exploitation of - findings. - measure: Creation and response statistics of findings. This is also referred - to as _Mean Time to Resolve_. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - dependsOn: - - Usage of a vulnerability management system - level: 3 - implementation: + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning sprints, + and managing software releases. It offers features for creating and managing + tasks, assigning them to team members, and monitoring progress through customizable + workflows and dashboards. - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo tags: @@ -6418,13 +5988,6 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f name: DefectDojo Client tags: @@ -6435,25 +5998,15 @@ Test and Verification: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-2-B - iso27001-2017: - - 16.1.4 - - 8.2.3 + - I-DM-3-B iso27001-2022: - 5.25 + - 5.12 + - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c922981b-65ed-40f3-a947-96fee9a0125f - isImplemented: false - comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) - generates statistics from OWASP DefectDojo and places the results in a [Github - repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). tags: - - none - teamsImplemented: - Default: false - B: false - C: false + - vulnerability-mgmt + - vmm-measurements Integration of vulnerability issues into the development process: uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e risk: To read console output of the build server to search for vulnerabilities @@ -6493,16 +6046,11 @@ Test and Verification: - 5.25 - 5.26 - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/ce970c9b-da94-41cf-bd78-8c15357b7e8e isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Reproducible defect tickets: uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 risk: Vulnerability descriptions are hard to understand by staff from operations @@ -6530,16 +6078,11 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/27337442-e4b1-4e87-8dc9-ce86fbb79a39 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 risk: As false positive occur during each test, all vulnerabilities might be @@ -6574,16 +6117,11 @@ Test and Verification: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c1acc8af-312e-4503-a817-a26220c993a0 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: The security level of a component is not visible. Therefore, the motivation @@ -6647,16 +6185,11 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/55f4c916-3a34-474d-ad96-9a9f7a4f6a83 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Treatment of all defects: uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d risk: Vulnerabilities with severity low are not visible. @@ -6677,16 +6210,76 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false + Treatment of defects per protection requirement: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: "Not defining the protection requirement of applications can lead to wrong + prioritization, delayed remediation of \ncritical security issues, increasing + the risk of exploitation and potential damage to the organization." + measure: "Defining the protection requirement and the corresponding handling + of vulnerabilities per severity for components like applications are aligned + to SLAs. \n This is performed for the hole organization and doesn't need to + be broken down (yet) on team/product/application. \n At least quarterly." + description: |- + The protection requirements for an application should consider: + - Data criticality + - Application accessibility (internal vs. external) + - Regulatory compliance + - Other relevant factors + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 risk: Vulnerabilities with severity high or higher are not visible. @@ -6708,16 +6301,11 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 implementation: [] isImplemented: false + evidence: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Treatment of defects with severity middle: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. @@ -6738,16 +6326,11 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 implementation: [] isImplemented: false + evidence: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: Maintenance of false positives in each tool enforces a high workload. @@ -6792,16 +6375,8 @@ Test and Verification: - 5.25 - 5.26 - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/85ba5623-84be-4219-8892-808837be582d - isImplemented: false - comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Dynamic depth for applications: Coverage analysis: uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 @@ -6834,17 +6409,11 @@ Test and Verification: - part of periodic review, PDCA iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/d0ba0be5-c573-405f-b905-b7a8f87a9cc7 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of client side dynamic components: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript @@ -6868,22 +6437,16 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/9711f871-f79d-4573-8d4f-d2c98fd0d18e implementation: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb name: Ajax Spider tags: [] url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of hidden endpoints: uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 risk: Hidden endpoints of the service are not getting tracked. @@ -6930,17 +6493,11 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/6a9cb303-0f98-48a8-bdcd-56d41c0012b8 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of more input vectors: uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc risk: Parts of the service are not covered. For example specially formatted @@ -6963,9 +6520,6 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/5e0ff85b-ec89-4ef0-96b1-5695fa0025dc implementation: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b name: Schemathesis @@ -6977,13 +6531,10 @@ Test and Verification: description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of sequential operations: uuid: 845f06ec-148c-4c67-9755-7041911dcca5 risk: Sequential operations like workflows (e.g. login -> put products in the @@ -7012,17 +6563,11 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/845f06ec-148c-4c67-9755-7041911dcca5 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of service to service communication: uuid: 22aab0ef-76ce-4b8c-979c-3699784330db risk: Service to service communication is not covered. @@ -7044,9 +6589,6 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/22aab0ef-76ce-4b8c-979c-3699784330db implementation: - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 @@ -8140,6 +7682,19 @@ Test and Verification: url: https://github.com/SDA-SE/image-metadata-collector/ description: | Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + jira: + uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning + sprints, and managing software releases. It offers features for creating + and managing tasks, assigning them to team members, and monitoring progress + through customizable workflows and dashboards. - signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing @@ -9232,14 +8787,24 @@ Test and Verification: url: https://github.com/SDA-SE/image-metadata-collector/ description: | Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + jira: + uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning + sprints, and managing software releases. It offers features for creating + and managing tasks, assigning them to team members, and monitoring progress + through customizable workflows and dashboards. isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple Scan: uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 risk: Deficient security tests are performed. Simple vulnerabilities are not @@ -9277,17 +8842,11 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/07796811-37f9-467c-9ff2-48f346e77ff3 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of different roles: uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 risk: Parts of the service are not covered during the scan, because a login @@ -9311,9 +8870,6 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/65a2d7d9-5441-46bf-a4e3-f76919857750 implementation: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 name: Zest @@ -9324,13 +8880,10 @@ Test and Verification: Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. isImplemented: false assessment: For REST APIs, multiple OAuth2 scopes are used. + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of multiple scanners: uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea risk: Each vulnerability scanner has different opportunities. By using just @@ -9363,17 +8916,11 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Dynamic depth for infrastructure: Load tests: uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd @@ -9399,17 +8946,11 @@ Test and Verification: - 8.6 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/ab5725aa-4d53-47b9-96df-c14b3fa93bcd isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for exposed services: uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 risk: Standard network segmentation and firewalling has not been performed, @@ -9446,17 +8987,11 @@ Test and Verification: - 8.22 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for unauthorized installation: uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a risk: Unapproved components are used. @@ -9484,18 +9019,12 @@ Test and Verification: iso27001-2022: - 8.19 - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/dccf1949-b9a8-4ce8-b992-6a4a7f3a623a isImplemented: false + evidence: "" dependsOn: - Evaluation of the trust of used components tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for unused Resources: uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 risk: Unused resources, specially secrets, might be still valid, but are exposing @@ -9530,17 +9059,11 @@ Test and Verification: - 8.22 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/6532c1fe-9d23-4228-8722-558ddabca7d4 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test network segmentation: uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 risk: Wrong or no network segmentation of pods makes it easier for an attacker @@ -9571,17 +9094,11 @@ Test and Verification: - 8.22 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/6d2c3ac6-8afc-4af6-a5e9-6188341aca01 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test of the configuration of cloud environments: uuid: 7bb70764-9392-4462-935d-e55b2e148199 risk: Standard hardening practices for cloud environments are not performed @@ -9624,17 +9141,11 @@ Test and Verification: - 8.8 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/7bb70764-9392-4462-935d-e55b2e148199 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Weak password test: uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f risk: Weak passwords in components like applications or systems, specially for @@ -9660,17 +9171,11 @@ Test and Verification: - 9.4.3 iso27001-2022: - 5.17 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/61e10f9c-e126-4ffa-af12-fdbe0d0a831f isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Static depth for applications: API design validation: uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 @@ -9716,19 +9221,12 @@ Test and Verification: - 8.25 - 8.27 - 8.28 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 isImplemented: false dependsOn: - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Dead code elimination: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Dead code increases the attack surface (use of hard coded credentials @@ -9757,16 +9255,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Exclusion of source code duplicates: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Duplicates in source code might influence the stability of the application. @@ -9794,16 +9285,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Local development security checks performed: uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b risk: Creating and developing code contains code smells and quality issues. @@ -10927,6 +10411,19 @@ Test and Verification: url: https://github.com/SDA-SE/image-metadata-collector/ description: | Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + jira: + uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning + sprints, and managing software releases. It offers features for creating + and managing tasks, assigning them to team members, and monitoring progress + through customizable workflows and dashboards. - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 name: DevSecOps control Pre-commit url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop @@ -10946,17 +10443,11 @@ Test and Verification: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/6e180abc-7c98-4265-b4e9-852cb91b067b isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Software Composition Analysis (client side): uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 risk: Client side components might have vulnerabilities. @@ -11009,19 +10500,16 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/07fe8c4f-ae33-4409-b1b2-cf64cfccea86 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + description: Use a tool like trivy and concentrate on application related vulnerabilities. + At this stage, ignore vulnerabilities in container base images used in the + service. risk: Server side components might have vulnerabilities. measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) are performed. @@ -11072,208 +10560,1286 @@ Test and Verification: url: https://github.com/dependabot/dependabot-core description: | Dependabot creates pull requests to keep your dependencies secure and up-to-date. - references: - samm2: - - V-ST-2-A - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d918cd44-a972-43e9-a974-eff3f4a5dcfe - isImplemented: false - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false - Static analysis for all components/libraries: - uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 - risk: Used components like libraries and legacy applications might have vulnerabilities - measure: Usage of a static analysis for all used components. - difficultyOfImplementation: - knowledge: 2 - time: 4 - resources: 2 - usefulness: 3 - level: 5 - dependsOn: - - Static analysis for important client side components - - Static analysis for important server side components - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f - implementation: [] - references: - samm2: - - V-ST-2-A - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 - isImplemented: false - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false - Static analysis for all self written components: - uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 - risk: Parts in the source code of the frontend or middleware have vulnerabilities. - measure: Usage of static analysis tools for all parts of the middleware and - frontend. Static analysis uses for example string matching algorithms and/or - dataflow analysis. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 4 - implementation: - - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - dependsOn: - - Static analysis for important client side components - - Static analysis for important server side components - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f - references: - samm2: - - V-ST-2-A - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/ee68331f-9b1d-4f61-844b-b2ea04753a84 - isImplemented: false - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false - Static analysis for important client side components: - uuid: e237176b-bec5-447d-a926-e37d6dd60e4b - risk: Important parts in the source code of the frontend have vulnerabilities. - measure: Usage of static analysis tools for important parts of the frontend - are used. Static analysis uses for example string matching algorithms and/or - dataflow analysis. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - dependsOn: - - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f - references: - samm2: - - V-ST-2-A - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/e237176b-bec5-447d-a926-e37d6dd60e4b - isImplemented: false - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false - Static analysis for important server side components: - uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 - risk: Important parts in the source code of the middleware have vulnerabilities. - measure: Usage of static analysis tools for important parts of the middleware - are used. Static analysis uses for example string matching algorithms and/or - dataflow analysis. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 3 - implementation: - - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs + - signing-of-commits-protection: + uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + signing-of-commits: + uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + ci-cd-tools: + uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + apimaturity: + uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + container-technologi: + uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + cwe25: + uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + docker-content-trust: + uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + in-toto: + uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + a-complete-backup-of: + uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + a-point-in-time-reco: + uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + blue-green-deploymen: + uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + docker: + uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + webserver: + uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + rolling-update: + uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + kubernetes-admission: + uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + dependabot: + uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + renovate: + uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + jenkins: + uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + sample-concept-1: + uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service + outage will occur to the end users. \n(2) twice a day a rebuild of images + is done. The rebuilds are put into a automated testing pipeline. If the + testing has no blocking issues the new images will be released for deployment + during the next \"restart\" of a container. What has to be done, is to + ensure the new containers are deployed in some canary deployment manner, + this will ensure that if (and only if) something buggy has been introduced + which breaks functionality the canary deployment will make sure the \"older + version\" is being used and not the buggy newer one." + distroless: + uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + fedora-coreos: + uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + distroless-usage: + uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + threat-modeling-play: + uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + owasp-samm: + uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + whiteboard: + uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + miro-or-any-other-c: + uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + draw-io: + uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + threagile: + uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + don-t-forget-evil-u: + uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: '[Don''t Forget EVIL U' + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + libyear: + uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 + name: libyear + tags: + - patching + - build + url: https://libyear.com/ + description: A simple measure of software dependency freshness. It is a + single number telling you how up-to-date your dependencies are. + owasp-juice-shop: + uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + owasp-cheatsheet-ser: + uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-juiceshop: + uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 + name: OWASP JuiceShop + tags: [] + url: https://github.com/bkimminich/juice-shop + description: |- + In case you do not have the budget to hire an external security expert, an option + is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + https-cheatsheetse: + uuid: 99080ac7-60cd-46af-93a1-a53a33597cba + name: https://cheatsheetseries.owasp.org/ + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-security-champ: + uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + build-it-break-it-fi: + uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + motivate-people: + uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + owasp-top-10-maturit: + uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + involve-security-sme: + uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + damn-vulnerable-web: + uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + example-all-docker: + uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + owasp-asvs: + uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + owasp-masvs: + uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + cis-kubernetes-bench: + uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + cis-docker-bench-for: + uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + for-example-for-cont: + uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, + ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + attack-matrix-cloud: + uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + attack-matrix-contai: + uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for containers + attack-matrix-kubern: + uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + istio: + uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + bridges: + uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + firewalls: + uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + open-policy-agent: + uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + gitops: + uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + ansible: + uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + chef: + uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + puppet: + uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + jenkinsfile: + uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + seccomp: + uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + strace: + uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + remove-direct-access: + uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + directory-service: + uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + plugins: + uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + smartcard: + uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 + name: Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + yubikey: + uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + sms: + uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + totp: + uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + http-basic-authentic: + uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + vpn: + uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + for-applications-ch: + uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + managing-secrets: + uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + crypto: + uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + authentication: + uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + rsyslog: + uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + logstash: + uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + fluentd: + uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + bash: + uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + owasp-logging-cheats: + uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + elk-stack: + uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + https-ht-transpare: + uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + prometheus: + uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + collected: + uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + httpunit: + uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 + name: HttpUnit + tags: [] + url: http://httpunit.sourceforge.net/ + junit: + uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + karma: + uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + owasp-defectdojo: + uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + purify: + uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + see-other-actions-e: + uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 + name: See other actions, e.g. "Treatment of defects with severity high". + tags: [] + sast: + uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side + / client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + dast: + uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + owasp-defect-dojo: + uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c + name: OWASP Defect Dojo + tags: [] + url: https://github.com/DefectDojo/django-DefectDojo + owasp-dependency-che: + uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + logparser-jenkins-pl: + uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + owasp-code-pulse: + uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + ajax-spider: + uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + curl: + uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + openapi: + uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + owasp-zap: + uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + arachni: + uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + zest: + uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + owasp-securecodebox: + uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + kube-hunter: + uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + openvas: + uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + htc-hydra: + uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + netassert: + uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + nmap: + uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + owasp-amass: + uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + k8spurger: + uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + pmd: + uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + eslint: + uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + findsecuritybugs: + uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + jsprime: + uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + bdd-mobile-security: + uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + retire-js: + uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + npm-audit: + uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + sigmahq: + uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + dive-to-inspect-a-co: + uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + clusterscanner: + url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + dockerfile-with-hado: + uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + deployment-with-kube: + uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + kubesec: + uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + anchore-io: + uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + clair: + uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + openscap: + uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + vuls: + uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + kube-bench: + uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + trufflehog: + uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + go-pillage-registrie: + uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + https-github-com-a: + uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + registries-like-quay: + uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + dockerfilelint: + uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile + and looks for common traps, mistakes and helps enforce best practices. + threat-matrix-for-storage: + uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + defend-the-core-kubernetes: + uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + business-friendly-vulnerability-metrics: + uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + kubescape: + uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + azuredevops: + uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + github-policies: + uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + sonarqube: + uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + stylecop: + uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + fortify-vscode-extension: + uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + appscan-vscode-extension: + uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + checkmarx-vscode-extension: + uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + pre-commit-microsoft: + uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + pre-commit-synopsis: + uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + dependencyTrack: + uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach + by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + juice-shop: + uuid: c021aa72-c71c-43e4-9573-717b74d6c19d + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + dvwa: + uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + loggingCheatSheet: + uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + zap: + uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + secureCodeBox: + uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + K8sPurger: + uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + hashicorp-vault: + uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. + stoplight-spectral: + uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + api-oas-checker: + uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + coveragepy: + uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + github-dependabot: + uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + github-super-linter: + uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + schemathesis: + uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + martin-feature-toggles: + uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + defectdojo-client: + uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + falco: + uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + sammancoaching: + uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + terraform: + uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + packj: + uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + apiMyth: + uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + jira: + uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning + sprints, and managing software releases. It offers features for creating + and managing tasks, assigning them to team members, and monitoring progress + through customizable workflows and dashboards. + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + tags: + - vmm-testing + Static analysis for all components/libraries: + uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 + risk: Used components like libraries and legacy applications might have vulnerabilities + measure: Usage of a static analysis for all used components. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 + usefulness: 3 + level: 5 + dependsOn: + - Static analysis for important client side components + - Static analysis for important server side components + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + implementation: [] + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Static analysis for all self written components: + uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 + risk: Parts in the source code of the frontend or middleware have vulnerabilities. + measure: Usage of static analysis tools for all parts of the middleware and + frontend. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 4 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - Static analysis for important client side components + - Static analysis for important server side components + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Static analysis for important client side components: + uuid: e237176b-bec5-447d-a926-e37d6dd60e4b + risk: Important parts in the source code of the frontend have vulnerabilities. + measure: Usage of static analysis tools for important parts of the frontend + are used. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - Defined build process + - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Static analysis for important server side components: + uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 + risk: Important parts in the source code of the middleware have vulnerabilities. + measure: Usage of static analysis tools for important parts of the middleware + are used. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs tags: [] - uuid: cccc2882-62ab-4175-afa1-58471017e8ed name: jsprime @@ -11307,17 +11873,11 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/6c05c837-8c99-46e2-828b-7c903e27dba4 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Stylistic analysis: uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 risk: Unclear or obfuscated code might have unexpected behavior. @@ -11364,17 +11924,11 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for Patch Deployment Time: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -11405,9 +11959,6 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Self implementation. This activity is not repeated in @@ -11415,10 +11966,6 @@ Test and Verification: as well. tags: - patching - teamsImplemented: - Default: false - B: false - C: false Test for Time to Patch: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -11458,187 +12005,1312 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" - meta: - implementationGuide: Usage of a version control platform API (e.g. github - API) can be used to fetch the information. Consider that `Measure libyears` - might be an alternative to this activity. + meta: + implementationGuide: Usage of a version control platform API (e.g. github + API) can be used to fetch the information. Consider that `Measure libyears` + might be an alternative to this activity. + tags: + - patching + Test libyear: + uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + risk: Vulnerabilities in running artifacts stay for long and might get exploited. + measure: Test `libyear`, which provides a good insight how good patch management + is. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 + name: libyear + tags: + - patching + - build + url: https://libyear.com/ + description: A simple measure of software dependency freshness. It is a single + number telling you how up-to-date your dependencies are. + dependsOn: + - Defined build process + references: + samm2: + - V-ST-2-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + comments: "" + meta: + implementationGuide: | + `libyear` can be integrated into the build process and flag or even better break the build in case the defined threshold (e.g. 30 years) is reached. + An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). + tags: + - patching + Usage of multiple analyzers: + uuid: 297be001-8d94-41ee-ab29-207020d423c0 + risk: Each vulnerability analyzer has different opportunities. By using just + one analyzer, some vulnerabilities might not be found. + measure: Usage of multiple static tools to find more vulnerabilities. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 1 + level: 4 + dependsOn: + - Software Composition Analysis (server side) + - Software Composition Analysis (client side) + - Static analysis for all self written components + implementation: [] + references: + samm2: + - V-ST-3-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Static depth for infrastructure: + Analyze logs: + uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 + risk: Not aware of attacks happening. + measure: Check logs for keywords. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + references: + samm2: [] + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Correlate known vulnerabilities in infrastructure with new image versions: + uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 + risk: TODO. + measure: TODO + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 4 + usefulness: 1 + level: 4 + dependsOn: + - Usage of a maximum lifetime for images + implementation: + - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + iso27001-2022: + - 8.8 + - 8.25 + isImplemented: false + evidence: "" + comments: "" tags: - - patching - teamsImplemented: - Default: false - B: false - C: false - Test libyear: - uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 - risk: Vulnerabilities in running artifacts stay for long and might get exploited. - measure: Test `libyear`, which provides a good insight how good patch management - is. + - none + Software Composition Analysis: + uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + risk: Infrastructure components might have vulnerabilities. + measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) + are performed. difficultyOfImplementation: - knowledge: 1 - time: 1 + knowledge: 3 + time: 5 resources: 1 - usefulness: 3 - level: 2 - implementation: - - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a single - number telling you how up-to-date your dependencies are. + usefulness: 2 + level: 4 dependsOn: - Defined build process + - uuid:d918cd44-a972-43e9-a974-eff3f4a5dcfe + implementation: + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + - signing-of-commits-protection: + uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + signing-of-commits: + uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + ci-cd-tools: + uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + apimaturity: + uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + container-technologi: + uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + cwe25: + uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + docker-content-trust: + uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + in-toto: + uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + a-complete-backup-of: + uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + a-point-in-time-reco: + uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + blue-green-deploymen: + uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + docker: + uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + webserver: + uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + rolling-update: + uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + kubernetes-admission: + uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + dependabot: + uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + renovate: + uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + jenkins: + uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + sample-concept-1: + uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service + outage will occur to the end users. \n(2) twice a day a rebuild of images + is done. The rebuilds are put into a automated testing pipeline. If the + testing has no blocking issues the new images will be released for deployment + during the next \"restart\" of a container. What has to be done, is to + ensure the new containers are deployed in some canary deployment manner, + this will ensure that if (and only if) something buggy has been introduced + which breaks functionality the canary deployment will make sure the \"older + version\" is being used and not the buggy newer one." + distroless: + uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + fedora-coreos: + uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + distroless-usage: + uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + threat-modeling-play: + uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + owasp-samm: + uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + whiteboard: + uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + miro-or-any-other-c: + uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + draw-io: + uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + threagile: + uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + don-t-forget-evil-u: + uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: '[Don''t Forget EVIL U' + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + libyear: + uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 + name: libyear + tags: + - patching + - build + url: https://libyear.com/ + description: A simple measure of software dependency freshness. It is a + single number telling you how up-to-date your dependencies are. + owasp-juice-shop: + uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + owasp-cheatsheet-ser: + uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-juiceshop: + uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 + name: OWASP JuiceShop + tags: [] + url: https://github.com/bkimminich/juice-shop + description: |- + In case you do not have the budget to hire an external security expert, an option + is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + https-cheatsheetse: + uuid: 99080ac7-60cd-46af-93a1-a53a33597cba + name: https://cheatsheetseries.owasp.org/ + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-security-champ: + uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + build-it-break-it-fi: + uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + motivate-people: + uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + owasp-top-10-maturit: + uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + involve-security-sme: + uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + damn-vulnerable-web: + uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + example-all-docker: + uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + owasp-asvs: + uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + owasp-masvs: + uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + cis-kubernetes-bench: + uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + cis-docker-bench-for: + uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + for-example-for-cont: + uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, + ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + attack-matrix-cloud: + uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + attack-matrix-contai: + uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for containers + attack-matrix-kubern: + uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + istio: + uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + bridges: + uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + firewalls: + uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + open-policy-agent: + uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + gitops: + uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + ansible: + uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + chef: + uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + puppet: + uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + jenkinsfile: + uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + seccomp: + uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + strace: + uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + remove-direct-access: + uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + directory-service: + uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + plugins: + uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + smartcard: + uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 + name: Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + yubikey: + uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + sms: + uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + totp: + uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + http-basic-authentic: + uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + vpn: + uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + for-applications-ch: + uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + managing-secrets: + uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + crypto: + uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + authentication: + uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + rsyslog: + uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + logstash: + uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + fluentd: + uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + bash: + uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + owasp-logging-cheats: + uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + elk-stack: + uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + https-ht-transpare: + uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + prometheus: + uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + collected: + uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + httpunit: + uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 + name: HttpUnit + tags: [] + url: http://httpunit.sourceforge.net/ + junit: + uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + karma: + uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + owasp-defectdojo: + uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + purify: + uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + see-other-actions-e: + uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 + name: See other actions, e.g. "Treatment of defects with severity high". + tags: [] + sast: + uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side + / client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + dast: + uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + owasp-defect-dojo: + uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c + name: OWASP Defect Dojo + tags: [] + url: https://github.com/DefectDojo/django-DefectDojo + owasp-dependency-che: + uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + logparser-jenkins-pl: + uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + owasp-code-pulse: + uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + ajax-spider: + uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + curl: + uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + openapi: + uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + owasp-zap: + uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + arachni: + uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + zest: + uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + owasp-securecodebox: + uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + kube-hunter: + uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + openvas: + uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + htc-hydra: + uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + netassert: + uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + nmap: + uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + owasp-amass: + uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + k8spurger: + uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + pmd: + uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + eslint: + uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + findsecuritybugs: + uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + jsprime: + uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + bdd-mobile-security: + uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + retire-js: + uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + npm-audit: + uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + sigmahq: + uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + dive-to-inspect-a-co: + uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + clusterscanner: + url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + dockerfile-with-hado: + uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + deployment-with-kube: + uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + kubesec: + uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + anchore-io: + uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + clair: + uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + openscap: + uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + vuls: + uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + kube-bench: + uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + trufflehog: + uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + go-pillage-registrie: + uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + https-github-com-a: + uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + registries-like-quay: + uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + dockerfilelint: + uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile + and looks for common traps, mistakes and helps enforce best practices. + threat-matrix-for-storage: + uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + defend-the-core-kubernetes: + uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + business-friendly-vulnerability-metrics: + uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + kubescape: + uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + azuredevops: + uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + github-policies: + uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + sonarqube: + uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + stylecop: + uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + fortify-vscode-extension: + uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + appscan-vscode-extension: + uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + checkmarx-vscode-extension: + uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + pre-commit-microsoft: + uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + pre-commit-synopsis: + uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + dependencyTrack: + uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach + by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + juice-shop: + uuid: c021aa72-c71c-43e4-9573-717b74d6c19d + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + dvwa: + uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + loggingCheatSheet: + uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + zap: + uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + secureCodeBox: + uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + K8sPurger: + uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + hashicorp-vault: + uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. + stoplight-spectral: + uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + api-oas-checker: + uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + coveragepy: + uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + github-dependabot: + uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + github-super-linter: + uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + schemathesis: + uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + martin-feature-toggles: + uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + defectdojo-client: + uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + falco: + uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + sammancoaching: + uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + terraform: + uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + packj: + uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + apiMyth: + uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + backstage: + uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + image-metadata-collector: + uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + jira: + uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning + sprints, and managing software releases. It offers features for creating + and managing tasks, assigning them to team members, and monitoring progress + through customizable workflows and dashboards. references: samm2: - V-ST-2-A iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 - comments: "" - meta: - implementationGuide: | - `libyear` can be integrated into the build process and flag or even better break the build in case the defined threshold (e.g. 30 years) is reached. - An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). - tags: - - patching - teamsImplemented: - Default: false - B: false - C: false - Usage of multiple analyzers: - uuid: 297be001-8d94-41ee-ab29-207020d423c0 - risk: Each vulnerability analyzer has different opportunities. By using just - one analyzer, some vulnerabilities might not be found. - measure: Usage of multiple static tools to find more vulnerabilities. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 - usefulness: 1 - level: 4 - dependsOn: - - Software Composition Analysis (server side) - - Software Composition Analysis (client side) - - Static analysis for all self written components - implementation: [] - references: - samm2: - - V-ST-3-A - iso27001-2017: - - 12.6.1 - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.25 - - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/297be001-8d94-41ee-ab29-207020d423c0 - isImplemented: false - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false - Static depth for infrastructure: - Analyze logs: - uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 - risk: Not aware of attacks happening. - measure: Check logs for keywords. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - references: - samm2: [] - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/b217c8bb-5d61-4b41-a675-1083993f83b1 - isImplemented: false - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false - Correlate known vulnerabilities in infrastructure with new image versions: - uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 - risk: TODO. - measure: TODO - difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 4 - usefulness: 1 - level: 4 - dependsOn: - - Usage of a maximum lifetime for images - implementation: - - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - references: - samm2: - - V-ST-1-A - iso27001-2017: - 12.6.1 - - 14.2.1 iso27001-2022: - 8.8 - - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/7de0ae33-6538-45cd-8222-a1475647ba58 - isImplemented: false - comments: "" tags: - - none - teamsImplemented: - Default: false - B: false - C: false + - vmm-testing Test cluster deployment resources: uuid: 621fb6a5-5c0a-4408-826a-068868bb031b risk: The deployment configuration (e.g. kubernetes deployment resources) might @@ -11669,17 +13341,11 @@ Test and Verification: - 8.8 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/621fb6a5-5c0a-4408-826a-068868bb031b isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for image lifetime: uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b risk: Old container images in production indicate that patch management is not @@ -11714,17 +13380,11 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for known vulnerabilities: uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad risk: Known vulnerabilities in infrastructure components like container images @@ -11769,17 +13429,11 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/26e1c6d5-5632-4ec7-80d2-e564b98732ad isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for malware: uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d risk: Third party might include malware. Ether due to the maintainer (e.g. @@ -11814,17 +13468,11 @@ Test and Verification: - 12.2.1 iso27001-2022: - 8.7 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/837f8f90-adc2-4e6b-9ebb-60c2ee29494d isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for new image version: uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e risk: When a new version of an image is available, it might fix security vulnerabilities. @@ -11847,17 +13495,11 @@ Test and Verification: - 8.8 - 8.7 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/cb6321aa-0fbf-4996-9e08-05ab26ef4c1e isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for stored secrets: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c risk: Stored secrets in git history, in container images or directly in code @@ -11889,17 +13531,11 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/c6e3c812-56e2-41b0-ae01-b7afc41a004c isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test of infrastructure components for known vulnerabilities: uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 risk: Infrastructure components might have vulnerabilities. @@ -11942,17 +13578,11 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/13367d8f-e37f-4197-a610-9ffca4fde261 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test of virtualized environments: uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 risk: Virtualized environments (e.g. via Container Images) might contains @@ -11989,17 +13619,11 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/58825d22-1ce6-4748-af81-0ec9956e4129 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test the cloud configuration: uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc risk: Standard hardening practices for cloud environments are not performed @@ -12030,17 +13654,11 @@ Test and Verification: - 8.8 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test the definition of virtualized environments: uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e risk: The definition of virtualized environments (e.g. via Dockerfile) @@ -12090,17 +13708,9 @@ Test and Verification: - 8.32 - 8.29 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/8fc3de67-7b8d-420b-8d24-f35928cfed6e isImplemented: false - comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test-Intensity: Creation and application of a testing concept: uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe @@ -12130,16 +13740,11 @@ Test and Verification: - 8.32 - 8.27 - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/79ef8103-e1ed-4055-8df8-fd2b2015bebe isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Deactivating of unneeded tests: uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 risk: As tools cover a wide range of different vulnerability tests, they might @@ -12166,16 +13771,11 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Default settings for intensity: uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d risk: Time pressure and ignorance might lead to false predictions for the test @@ -12199,16 +13799,11 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/ab0a4b51-3b18-43f1-a6fc-a98e4b28453d isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false High test intensity: uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 risk: A too small intensity or a too high confidence might lead to not visible @@ -12233,16 +13828,11 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/2ebfc421-8c76-415c-a3b0-fa518915bd10 isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Regular automated tests: uuid: 598897a2-358e-441f-984c-e12ec4f6110a risk: After pushing source code to the version control system, any delay in @@ -12266,14 +13856,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/598897a2-358e-441f-984c-e12ec4f6110a isImplemented: false + evidence: "" comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false ... From a2a55b363e2c50ef7af9eaca814ef9137f61835d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 7 Aug 2024 17:57:54 +0200 Subject: [PATCH 017/370] feat: add uuid: resolution to name --- yaml-generation/functions.php | 24 +++++++++ yaml-generation/generateDimensions.php | 74 ++++++++++++++++---------- 2 files changed, 70 insertions(+), 28 deletions(-) diff --git a/yaml-generation/functions.php b/yaml-generation/functions.php index d98a95b..591eee1 100644 --- a/yaml-generation/functions.php +++ b/yaml-generation/functions.php @@ -146,6 +146,30 @@ function getReferenceLabel($reference_id) { } +function getActivityNameByUuid($uuid, $dimensionsAggregated) { + foreach ($dimensionsAggregated as $dimension => $subdimensions) { + ksort($subdimensions); + foreach ($subdimensions as $subdimension => $elements) { + if (sizeof($elements) == 0) { + echo "unsetting $subdimension\n"; + unset($dimensionsAggregated[$dimension][$subdimension]); + continue; + } + if (substr($subdimension, 0, 1) == "_") { + continue; + } + + foreach ($elements as $activityName => $activity) { + if($activity["uuid"] == $uuid) { + return $activityName; + } + } + } + } + return "TODO:Mapping"; +} + + /** * * @param unknown $headings diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 6cf6908..decab24 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -4,18 +4,17 @@ $metadata = readYaml("src/assets/YAML/meta.yaml"); $teams = $metadata["teams"]; -if(sizeof($teams) == 0) { +if (sizeof($teams) == 0) { echo "Warning: No teams defined"; } $teamsImplemented = array(); -foreach($teams as $team) { +foreach ($teams as $team) { $teamsImplemented[$team] = false; } - $files = glob("src/assets/YAML/default/*/*.yaml"); -$dimensions=array(); +$dimensions = array(); foreach ($files as $filename) { //echo "Found $filename"; if (preg_match("/_meta.yaml/", $filename)) continue; @@ -27,8 +26,8 @@ } $files = glob("src/assets/YAML/custom/*/*.yaml"); -$dimensionsCustom=array(); -$dimensionsAggregated=array(); +$dimensionsCustom = array(); +$dimensionsAggregated = array(); foreach ($files as $filename) { //echo "Found $filename"; $dimensionCustom = getDimensions($filename); @@ -46,16 +45,16 @@ } } } else { - $dimensionsAggregated=$dimensions; + $dimensionsAggregated = $dimensions; } foreach ($dimensionsAggregated as $dimension => $subdimensions) { ksort($subdimensions); foreach ($subdimensions as $subdimension => $elements) { - if(sizeof($elements) == 0) { + if (sizeof($elements) == 0) { echo "unsetting $subdimension\n"; unset($dimensionsAggregated[$dimension][$subdimension]); - continue; + continue; } if (substr($subdimension, 0, 1) == "_") { continue; @@ -70,37 +69,53 @@ exit; } if (!array_key_exists("tags", $activity)) { - $dimensionsAggregated[$dimension][$subdimension][$activityName]["tags"] = [ "none" ]; + $dimensionsAggregated[$dimension][$subdimension][$activityName]["tags"] = ["none"]; } if (!array_key_exists("teamsImplemented", $activity)) { $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = array(); } $evidenceImplemented = array(); - if(array_key_exists("evidence", $activity) && is_array($activity["evidence"]) && IS_IMPLEMENTED_WHEN_EVIDENCE) { - foreach($activity["evidence"] as $team => $evidenceForTeam) { - if(strlen($activity["evidence"][$team]) > 0) { + if (array_key_exists("evidence", $activity) && is_array($activity["evidence"]) && IS_IMPLEMENTED_WHEN_EVIDENCE) { + foreach ($activity["evidence"] as $team => $evidenceForTeam) { + if (strlen($activity["evidence"][$team]) > 0) { $evidenceImplemented[$team] = true; - }else { + } else { echo "Warning: '$activityName -> evidence -> $team' has no evidence set but should have"; } } - } + } - if (!array_key_exists("openCRE", $activity["references"])) { - $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"] = array(); - $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = "https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/" . $subdimension . "/" . $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; + if (!array_key_exists("openCRE", $activity["references"])) { + $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"] = array(); + $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = "https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/" . $subdimension . "/" . $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; } $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = array_merge($teamsImplemented, $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"], $evidenceImplemented); // can be removed in 2024 if (array_key_exists("isImplemented", $activity)) { unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["evidence"]); - } + } + if (array_key_exists("dependsOn", $activity)) { + foreach($activity['dependsOn'] as $index => $dependingElement) { + if(!is_string($dependingElement)) { + echo "$dependingElement is not a string in $activityName"; + var_dump($dependingElement); + continue; + } + if(str_starts_with($dependingElement, "uuid:" )) { + echo "$dependingElement is having a uuuid\n"; + $dependsOnUuid = str_replace("uuid:", "", $dependingElement); + $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOnUuid; + $dependsOnActivityName = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); + echo "exchanged $dependingElement to name $dependsOnActivityName"; + } + } + } } } } foreach ($dimensionsAggregated as $dimension => $subdimensions) { - if(sizeof($subdimensions) == 0) { + if (sizeof($subdimensions) == 0) { echo "unsetting $dimension\n"; unset($dimensionsAggregated[$dimension]); } @@ -112,14 +127,14 @@ file_put_contents("src/assets/YAML/generated/generated.yaml", $dimensionsString); - /** * * @param unknown $dimensions * @param unknown $activityName * @return unknown */ -function isActivityExisting($dimensions, $activityName) { +function isActivityExisting($dimensions, $activityName) +{ foreach (getActions($dimensions) as list($dimension, $subdimension, $activities)) { foreach ($activities as $activity => $activityContent) { if ($activity == $activityName) { @@ -133,11 +148,12 @@ function isActivityExisting($dimensions, $activityName) { /** * - * @param array $array1 - * @param array $array2 + * @param array $array1 + * @param array $array2 * @return unknown */ -function array_merge_recursive_ex(array $array1, array $array2) { +function array_merge_recursive_ex(array $array1, array $array2) +{ $merged = $array1; foreach ($array2 as $key => & $value) { @@ -161,7 +177,8 @@ function array_merge_recursive_ex(array $array1, array $array2) { * * @param unknown $data (reference) */ -function resolve_json_ref(&$data) { +function resolve_json_ref(&$data) +{ /** @@ -170,8 +187,9 @@ function resolve_json_ref(&$data) { * @param unknown $key * @param unknown $ctx */ - function resolve_json_ref_cb(&$value, $key, $ctx) { - if (! is_array($value)) { + function resolve_json_ref_cb(&$value, $key, $ctx) + { + if (!is_array($value)) { return; } From bb7b5898cd3a31c855e4bad288a5793000885156 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Aug 2024 13:10:56 +0200 Subject: [PATCH 018/370] update --- .../BuildAndDeployment/PatchManagement.yaml | 1 - .../CultureAndOrganization/Process.yaml | 10 +- .../TestAndVerification/Consolidation.yaml | 2 +- .../StaticDepthForApplications.yaml | 14 +- src/assets/YAML/generated/generated.yaml | 2763 ++++++++--------- 5 files changed, 1382 insertions(+), 1408 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index 22aac63..3114a97 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -262,4 +262,3 @@ Build and Deployment: implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/terraform - $ref: src/assets/YAML/default/implementations.yaml#/implementations/argocd - references: diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index b8b8c1f..9564715 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -86,12 +86,9 @@ Culture and Organization: Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of critical security issues, increasing the risk of exploitation and potential damage to the organization. measure: |- - Defining the SLA to respond to findings depending on protection requirement and the corresponding handling of vulnerabilities per severity for components like applications are aligned to SLAs. - This is performed for the hole organization and doesn't need to be broken down (yet) on team/product/application. - At least quarterly. - description: |- + Defining the protection requirement. The protection requirements for an application should consider: - - Data criticality + - Processed data criticality - Application accessibility (internal vs. external) - Regulatory compliance - Other relevant factors @@ -101,7 +98,8 @@ Culture and Organization: resources: 1 usefulness: 3 level: 2 - dependsOn: [] + dependsOn: + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 310279f..9520a7e 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -23,7 +23,7 @@ Test and Verification: dependsOn: - uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425 # Fix based on severity #- uuid:3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f #iventory of apps + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f #iventory of apps implementation: references: samm2: diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 27d9666..7768d80 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -157,7 +157,7 @@ Test and Verification: - 8.28 # Secure coding isImplemented: false dependsOn: - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components comments: "" Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 @@ -172,7 +172,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: [] references: samm2: @@ -207,7 +207,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -241,7 +241,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -274,7 +274,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-2-A @@ -328,7 +328,7 @@ Test and Verification: level: 3 dependsOn: - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit @@ -359,7 +359,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index dea596b..82774b5 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -41,11 +41,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/a340f46b-6360-4cb8-847b-a0d3483d09d3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b risk: Performing builds without a defined process is error prone; for example, @@ -88,11 +93,16 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f6f7737f-25a9-4317-8de2-09bf59f29b5b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Pinning of artifacts: uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 risk: Unauthorized manipulation of artifacts might be difficult to spot. For @@ -128,11 +138,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false SBOM of components: uuid: 2858ac12-0179-40d9-9acf-1b839c030473 description: |- @@ -162,31 +177,35 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/2858ac12-0179-40d9-9acf-1b839c030473 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Signing of artifacts: uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 risk: Execution or usage of malicious code or data e.g. via executables, libraries or container images. measure: Digitally signing artifacts for all steps during the build and especially docker images, helps to ensure their integrity and authenticity. - description: "### GitHub Authentication and Commit Signing \n To perform a - push to a GitHub repository, you must be authenticated. It's important to - note that GitHub does not verify if the authenticated user's email address - matches the one in the commit.\n To clearly identify the author of a commit - for reviewers, commit signing is recommended.\n\n GitHub actions such as - [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) - do not automatically sign commits and may encounter issues as a result. \n\n - \ To address this, you can refer to a working configuration example in the - [workflow folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) + description: "To perform a push to a GitHub repository, you must be authenticated. + It's important to note that GitHub does not verify if the authenticated user's + email address matches the one in the commit.\nTo clearly identify the author + of a commit for reviewers, commit signing is recommended.\n\nGitHub actions + such as [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) + do not automatically sign commits and may encounter issues as a result. \n\nTo + address this, you can refer to a working configuration example in the [workflow + folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) of DSOMM, which demonstrates how to use semantic release action in conjunction - with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action).\n - \ For added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) + with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action).\nFor + added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) provided by your organization for a specific repository. Store the Personal - Access Token (PAT) as a secret in your project.\n" + Access Token (PAT) as a secret in your project." difficultyOfImplementation: knowledge: 2 time: 2 @@ -212,11 +231,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/5786959d-0c6f-46a6-8e1c-a32ff1a50222 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Signing of code: uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -251,11 +275,16 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/9f107927-61e9-4574-85ad-3f2b4bca8665 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deployment: Blue/Green Deployment: uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 @@ -293,11 +322,16 @@ Build and Deployment: - 8.32 - 8.19 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0cb2626b-fb0d-4a0f-9688-57f787310d97 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined decommissioning process: uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 description: |- @@ -324,11 +358,16 @@ Build and Deployment: - 11.2.7 iso27001-2022: - 7.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/da4ff665-dcb9-4e93-9d20-48cdedc50fc2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a risk: Deployment of insecure or malfunctioning artifacts. @@ -363,11 +402,16 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Environment depending configuration parameters (secrets): uuid: df428c9d-efa0-4226-9f47-a15bb53f822b risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. @@ -382,7 +426,13 @@ Build and Deployment: usefulness: 4 level: 2 implementation: - - signing-of-commits-protection: + - argocd: + uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -1498,9 +1548,15 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/df428c9d-efa0-4226-9f47-a15bb53f822b isImplemented: false tags: - secret + teamsImplemented: + Default: false + B: false + C: false Evaluation of the trust of used components: uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba risk: Application and system components like Open Source libraries or images @@ -1544,11 +1600,16 @@ Build and Deployment: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0de465a6-55a7-4343-af79-948bb5ff10ba isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Handover of confidential parameters: uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a risk: Parameters are often used to set credentials, for example by starting @@ -1583,9 +1644,15 @@ Build and Deployment: - 8.24 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/94a96f79-8bd6-4904-97c0-994ff88f176a isImplemented: false tags: - secret + teamsImplemented: + Default: false + B: false + C: false Inventory of production artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs @@ -1595,7 +1662,7 @@ Build and Deployment: exists (gathered manually or automatically). dependsOn: - Defined deployment process - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f + - 2a44b708-734f-4463-b0cb-86dc46344b2f difficultyOfImplementation: knowledge: 2 time: 2 @@ -1642,8 +1709,14 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/83057028-0b77-4d2e-8135-40969768ae88 tags: - inventory + teamsImplemented: + Default: false + B: false + C: false Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f risk: An organization is unaware of components like applications in production. @@ -1699,8 +1772,14 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/2a44b708-734f-4463-b0cb-86dc46344b2f tags: - inventory + teamsImplemented: + Default: false + B: false + C: false Inventory of production dependencies: uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 risk: Delayed identification of components and their vulnerabilities in production. @@ -1709,7 +1788,7 @@ Build and Deployment: measure: A documented inventory of dependencies used in artifacts like container images and containers exists. dependsOn: - - uuid:83057028-0b77-4d2e-8135-40969768ae88 + - 83057028-0b77-4d2e-8135-40969768ae88 - SBOM of components difficultyOfImplementation: knowledge: 2 @@ -1757,10 +1836,16 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/13e9757e-58e2-4277-bc0f-eadc674891e6 comments: "" tags: - inventory - sbom + teamsImplemented: + Default: false + B: false + C: false Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. @@ -1796,11 +1881,16 @@ Build and Deployment: - 8.19 - 8.32 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/85d52588-f542-4225-a338-20dc22a5508d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Same artifact for environments: uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f risk: Building of an artifact for different environments means that an untested @@ -1831,11 +1921,16 @@ Build and Deployment: - 8.33 - 8.29 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a854b48d-83bd-4f8d-8621-a0bdd470837f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of feature toggles: uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad risk: Using environment variables to enable or disable features can lead to @@ -1877,11 +1972,16 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a511799b-045e-4b96-9843-7d63d8c1e2ad isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d @@ -1906,11 +2006,17 @@ Build and Deployment: - 8.8 - 8.19 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/99415139-6b50-441b-89e1-0aa59accd43d isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 risk: Components with known (or unknown) vulnerabilities might stay for long @@ -1959,9 +2065,62 @@ Build and Deployment: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Automated deployment of automated PRs: + uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d + description: Automated merges of automated created PRs for outdated dependencies. + risk: Even if automated dependencies PRs are merged, they might not be deployed. + This results in vulnerabilities in running artifacts stay for too long and + might get exploited. + measure: | + After merging of an automated dependency PR, automated deployment is needed, + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + dependsOn: + - Automated merge of automated PRs + implementation: + - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + references: + samm2: + - O-EM-2-B + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/08f27c26-2c6a-47fe-9458-5e88f188085d comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Automated merge of automated PRs: uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: Automated merges of automated created PRs for outdated dependencies. @@ -1976,6 +2135,8 @@ Build and Deployment: resources: 1 usefulness: 3 level: 2 + dependsOn: + - Automated PRs for patches implementation: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 name: dependabot @@ -1996,9 +2157,16 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/f2594f8f-1cd6-45f9-af29-eaf3315698eb comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Nightly build of images (base images): uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 description: |- @@ -2027,11 +2195,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/34869eaf-f2e1-4926-b0bd-28c43402f057 isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Reduction of the attack surface: uuid: 16e39c8f-5336-4001-88ed-a552d2447531 description: |- @@ -2071,10 +2245,17 @@ Build and Deployment: - 14.2.1 iso27001-2022: - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/16e39c8f-5336-4001-88ed-a552d2447531 evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of a maximum lifetime for images: uuid: 485a3383-7f2e-4dba-bb84-479377070904 description: |- @@ -2108,10 +2289,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/485a3383-7f2e-4dba-bb84-479377070904 evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of a short maximum lifetime for images: uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e description: |- @@ -2155,11 +2343,17 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/6b96e5a0-ce34-4ea4-a88f-469d3b84546e isImplemented: false - evidence: "" comments: "" tags: - patching + teamsImplemented: + Default: false + B: false + C: false Culture and Organization: Design: Conduction of advanced threat modeling: @@ -2254,11 +2448,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of simple threat modeling on business level: uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 risk: Business related threats are discovered too late in the development and @@ -2285,11 +2484,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/48f97f31-931c-46eb-9b3e-e2fec0cd0426 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e risk: Technical related threats are discovered too late in the development and @@ -2405,11 +2609,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/47419324-e263-415b-815d-e7161b6b905e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of advanced abuse stories: uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e risk: Simple user stories are not going deep enough. Relevant security considerations @@ -2447,11 +2656,16 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/0a929c3e-ab9a-4206-8761-adf84b74622e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of simple abuse stories: uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 risk: User stories mostly don't consider security implications. Security flaws @@ -2489,11 +2703,16 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/bacf85b6-5bc0-405d-b5ba-a5d971467cc1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Creation of threat modeling processes and standards: uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e risk: Inadequate identification of business and technical risks. @@ -2538,11 +2757,16 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Information security targets are communicated: uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 risk: Employees don't known their organizations security targets. Therefore @@ -2565,11 +2789,16 @@ Culture and Organization: iso27001-2022: - 5.1 - 5.4 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/1b9281b9-48e2-4c01-9ac6-9db9931c4885 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 @@ -2604,11 +2833,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Aligning security in teams: uuid: f994a55d-71bb-45a4-a887-0a213d72c504 risk: The concept of Security Champions might suggest that only he/she is responsible @@ -2635,11 +2870,17 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f994a55d-71bb-45a4-a887-0a213d72c504 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of build-it, break-it, fix-it contests: uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 risk: Understanding security is hard, even for security champions and the conduction @@ -2666,11 +2907,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/bfdb576e-a416-4ec6-96fe-a078d58b2ff8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of collaborative security checks with developers and system administrators: uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 risk: Security checks by external companies do not increase the understanding @@ -2700,11 +2947,17 @@ Culture and Organization: - 6.3 - 8.8 - 8.34 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/95caef96-36ed-458c-a087-5c35d4f9dec2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of collaborative team security checks: uuid: 35446784-7610-40d9-af9e-d43f3173bf8c risk: Development teams limited insight over security practices. @@ -2727,11 +2980,17 @@ Culture and Organization: iso27001-2022: - Mutual security testing is not explicitly required in ISO 27001 may be - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/35446784-7610-40d9-af9e-d43f3173bf8c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Conduction of war games: uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 risk: Understanding incident response plans during an incident is hard and ineffective. @@ -2758,11 +3017,17 @@ Culture and Organization: - 6.3 - 5.24 - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/534f60bf-0995-4314-bb9c-f0f2bf204694 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Each team has a security champion: uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 risk: No one feels directly responsible for security and the security champion @@ -2812,11 +3077,17 @@ Culture and Organization: - Security champions are missing in ISO 27001 most likely - 5.4 - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for all: uuid: 9768f154-357a-4c06-af6f-d66570677c9b risk: Understanding security is hard. @@ -2856,11 +3127,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/9768f154-357a-4c06-af6f-d66570677c9b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for externals: uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 risk: Understanding security is hard. @@ -2893,11 +3170,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/31833d56-35af-4ef3-9300-f23d27646ce7 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular security training of security champions: uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 risk: Understanding security is hard, even for security champions. @@ -2929,11 +3212,17 @@ Culture and Organization: iso27001-2022: - Security champions are missing in ISO 27001 - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Reward of good communication: uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c risk: Employees are not getting excited about security. @@ -2971,11 +3260,17 @@ Culture and Organization: but nothing to promote good behavior. iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/91b6f75b-9f4a-4d77-95a2-af7ad3222c7c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security Coaching: uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 risk: Training does not change behaviour. Therefore, even if security practices @@ -3006,11 +3301,17 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security code review: uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 risk: Understanding security is hard. @@ -3051,11 +3352,17 @@ Culture and Organization: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/7121b0c7-6ace-4d6b-95d0-94535dbccb57 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 risk: Not asking a security expert when questions regarding security appear @@ -3087,11 +3394,17 @@ Culture and Organization: - 5.2 - 5.6 - 5.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/0b28367b-75a0-4bae-a926-3725c1bf9bb0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security-Lessoned-Learned: uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 risk: After an incident, a similar incident might reoccur. @@ -3112,11 +3425,17 @@ Culture and Organization: - 16.1.6 iso27001-2022: - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/58c46807-fee9-448b-b6dd-8050c464ab52 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple mob hacking: uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de risk: Understanding security is hard. @@ -3164,11 +3483,17 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/535f301a-e8e8-4eda-ad77-a08b035c92de isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Process: Approval by reviewing any new version: uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 @@ -3194,11 +3519,16 @@ Culture and Organization: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/3f63bdbc-c75f-4780-a941-e6ad42e894e1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Definition of a change management process: uuid: b4193d32-3948-47e2-a326-3748c48019a1 risk: The impact of a change is not controlled because these are not recorded @@ -3220,11 +3550,16 @@ Culture and Organization: iso27001-2022: - 8.32 - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/b4193d32-3948-47e2-a326-3748c48019a1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 risk: In case of an emergency, like a power outage, DR actions to perform are @@ -3247,30 +3582,31 @@ Culture and Organization: - 17.1.1 iso27001-2022: - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/c72da779-86cc-45b1-a339-190ce5093171 tags: - none - Determining of the protection requirement: + teamsImplemented: + Default: false + B: false + C: false + Determining the protection requirement: uuid: 123e4567-e89b-12d3-a456-426614174000 risk: "Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of \ncritical security issues, increasing the risk of exploitation and potential damage to the organization." - measure: "Defining the protection requirement and the corresponding handling - of vulnerabilities per severity for components like applications are aligned - to SLAs. \n This is performed for the hole organization and doesn't need to - be broken down (yet) on team/product/application. \n At least quarterly." - description: |- - The protection requirements for an application should consider: - - Data criticality - - Application accessibility (internal vs. external) - - Regulatory compliance - - Other relevant factors + measure: "Defining the protection requirement. \nThe protection requirements + for an application should consider:\n- Processed data criticality\n- Application + accessibility (internal vs. external)\n- Regulatory compliance\n- Other relevant + factors" difficultyOfImplementation: knowledge: 2 time: 2 - resources: 2 + resources: 1 usefulness: 3 - level: 3 - dependsOn: [] + level: 2 + dependsOn: + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -3310,10 +3646,16 @@ Culture and Organization: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/123e4567-e89b-12d3-a456-426614174000 tags: - vulnerability-mgmt - metrics - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false Implementation: Application Hardening: App. Hardening Level 1: @@ -3374,9 +3716,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/cf819225-30cb-4702-8e32-60225eedc33d comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 1 (50%): uuid: b597928e-54d6-48a5-a806-8003dcd56aab risk: Using an insecure application might lead to a compromised application. @@ -3433,10 +3782,17 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/b597928e-54d6-48a5-a806-8003dcd56aab isImplemented: false comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 2: uuid: ffe86caf-2fec-4630-b514-2db83983984d risk: Using an insecure application might lead to a compromised application. @@ -3471,13 +3827,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/ffe86caf-2fec-4630-b514-2db83983984d isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 (75%) tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 2 (75%): uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 risk: Using an insecure application might lead to a compromised application. @@ -3512,13 +3874,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/03643ca2-03c2-472b-8e19-956bf02fe9b7 isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 1 tags: - none + teamsImplemented: + Default: false + B: false + C: false App. Hardening Level 3: uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a risk: Using an insecure application might lead to a compromised application. @@ -3553,13 +3921,19 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 tags: - none + teamsImplemented: + Default: false + B: false + C: false Contextualized Encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 risk: The generation of interpreter directives from user-provided data poses @@ -3584,8 +3958,15 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/e1f37abb-d848-4a3a-b3df-65e91a89dcb7 tags: - none + teamsImplemented: + Default: false + B: false + C: false Development and Source Control: .gitignore: uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d @@ -3612,10 +3993,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/363a3eea-baf9-4010-88ca-bb8186a2989d evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false API design validation: uuid: 948a4d51-ceb5-4ebd-bdc7-d74ea25e171c risk: Creation of insecure or non-compliant API. @@ -3660,11 +4048,17 @@ Implementation: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/948a4d51-ceb5-4ebd-bdc7-d74ea25e171c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Local development linting & style checks performed: uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 risk: Insecure or unmaintainable code base. @@ -3696,11 +4090,17 @@ Implementation: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/517b0957-4981-4ac0-b4c7-0d8d1934c474 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Source Control Protection: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 risk: Intentional or accidental alterations in critical branches like master. @@ -3745,11 +4145,17 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Versioning: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f risk: Deployment of untracked artifacts. @@ -3777,11 +4183,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/066084c6-1135-4635-9cc5-9e75c7c5459f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Infrastructure Hardening: Applications are running in virtualized environments: uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 @@ -3804,11 +4216,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/3a94d55e-fd82-4996-9eb3-20d23ff2a873 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Backup: uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc risk: If errors are experienced during the deployment process you want to deploy @@ -3839,11 +4257,17 @@ Implementation: iso27001-2022: - 8.13 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5c61fd6b-8106-4c68-ac28-a8a42f1c67dc isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Baseline Hardening of the environment: uuid: 5992c38c-8597-4035-89db-d15820d81c3a risk: Using default configurations for a cluster environment leads to potential @@ -3905,11 +4329,17 @@ Implementation: - 13.1.3 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5992c38c-8597-4035-89db-d15820d81c3a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Filter outgoing traffic: uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d risk: A compromised infrastructure component might try to send out stolen data. @@ -3940,11 +4370,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/6df508ef-86fc-4c22-bd9f-646c3127ce7d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Hardening of the Environment: uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 risk: Using default configurations for a cluster environment leads to potential @@ -4007,11 +4443,17 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/dcf9601b-b4f2-4e25-9143-e39af75f7c33 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Immutable infrastructure: uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 risk: The availability of IT systems might be disturbed due to components failures @@ -4037,11 +4479,17 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/48e92bb1-fdba-40e8-b6c2-35de0d431833 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Infrastructure as Code: uuid: 8b994601-575e-4ea5-b228-accb18c8e514 risk: No tracking of changes in systems might lead to errors in the configuration. @@ -4087,11 +4535,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8b994601-575e-4ea5-b228-accb18c8e514 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Isolated networks for virtual environments: uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 risk: Virtual environments in default settings are able to access other virtual @@ -4128,11 +4582,17 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/4ce24abd-8ba6-494c-828d-4d193e28e4a1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Limitation of system events: uuid: e5386abf-9154-4752-a1a8-c3a8900f732d risk: System events (system calls) can lead to privilege escalation. @@ -4170,11 +4630,17 @@ Implementation: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e5386abf-9154-4752-a1a8-c3a8900f732d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false MFA: uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de risk: One factor authentication is more vulnerable to brute force attacks and @@ -4218,11 +4684,17 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/598e9f13-1ac8-4a01-b85e-8fab93ee81de isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false MFA for admins: uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 risk: One factor authentication is more vulnerable to brute force attacks and @@ -4264,11 +4736,17 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8098e416-e1ed-4ae4-a561-83efbe76bf57 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Microservice-architecture: uuid: 118b869b-3850-456e-98d9-1abdb85cbc5a risk: Monolithic applications are hard to test. @@ -4288,11 +4766,17 @@ Implementation: - Not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/118b869b-3850-456e-98d9-1abdb85cbc5a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Production near environments are used by developers: uuid: e14de741-94b3-447c-8b07-eea947d82e61 risk: In case an errors occurs in production, the developer need to be able @@ -4321,11 +4805,17 @@ Implementation: iso27001-2022: - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e14de741-94b3-447c-8b07-eea947d82e61 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Role based authentication and authorization: uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 risk: Everyone is able to get unauthorized access to information on systems @@ -4356,11 +4846,17 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/070bb14b-e04a-4f3d-896a-a08eba7a35f9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple access control for systems: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 risk: Attackers a gaining access to internal systems and application interfaces @@ -4389,11 +4885,17 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/82e499d1-f463-4a4b-be90-68812a874af6 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of a chaos monkey: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In @@ -4417,11 +4919,17 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f8e80f18-2503-4e3e-b3bc-7f67bb28defe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of an security account: uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 risk: Having security auditing in the same account as infrastructure and applications @@ -4442,11 +4950,17 @@ Implementation: - 10.1 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/746025a6-dbfb-4087-a000-e46acab64ee1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of edge encryption at transit: uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 risk: Evil actors might be able to perform a man in the middle attack and sniff @@ -4467,11 +4981,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ad23be9c-5661-4f1f-81a3-5a5dc7061629 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of encryption at rest: uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 risk: Evil actors might be able to access data and read information, e.g. from @@ -4492,11 +5012,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/0ff45fb8-7eef-46ed-9b3a-84c955cd7060 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of internal encryption at transit: uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 risk: Evil actors within the organization of traffic in transit might be able @@ -4518,11 +5044,17 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ecb0184c-6bc9-45da-bbbb-a983797ffc93 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of security by default for components: uuid: 11b3848e-e931-4146-a35d-35409ada24ee risk: Components (images, libraries, applications) are not hardened. @@ -4559,11 +5091,17 @@ Implementation: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/11b3848e-e931-4146-a35d-35409ada24ee isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of test and production environments: uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 risk: Security tests are not running regularly because test environments are @@ -4589,11 +5127,17 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/bfdacb52-1e3f-431d-ae72-d844a5e86415 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Virtual environments are limited: uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca risk: Denial of service (internally by an attacker or unintentionally by a bug) @@ -4622,11 +5166,17 @@ Implementation: - 8.6 - 8.22 - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/760f1056-b0ee-4f22-a35b-f65446f944ca isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF Advanced: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced risk: The presence of sophisticated threats necessitates a robust defense strategy @@ -4655,9 +5205,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF baseline: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: Vulnerable input, such as exploits, can infiltrate the application via @@ -4686,9 +5243,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false WAF medium: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: The threat from malicious inputs remains high, with exploits seeking to @@ -4717,9 +5281,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none + teamsImplemented: + Default: false + B: false + C: false Information Gathering: Logging: Centralized application logging: @@ -4748,8 +5319,14 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/fe875e17-ae4a-45f8-a359-244aa4fcbc04 tags: - none + teamsImplemented: + Default: false + B: false + C: false Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: Local stored system logs can be unauthorized manipulated by attackers @@ -4785,11 +5362,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/4eced38a-7904-4c45-adb0-50b663065540 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Correlation of security events: uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 risk: Detection of security related events with hints on different systems/tools/metrics @@ -4815,11 +5397,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccf4561d-253f-4762-adcb-bc4622fd6fc5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Logging of security events: uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb description: | @@ -4873,14 +5460,19 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccfdd0a8-991e-4269-ad77-c0a54ca655cb risk: |- * No track of security-relevant events makes it harder to analyze an incident. * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false PII logging concept: uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 risk: Personal identifiable information (PII) is logged and the privacy law @@ -4926,11 +5518,16 @@ Information Gathering: - Not explicitly covered by ISO 27001 - too specific - 8.15 - 5.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/613a73dc-4f60-49db-a6ce-4fb7bf8519f9 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Visualized logging: uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 risk: System and application protocols are not visualized properly which leads @@ -4962,11 +5559,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/7c735089-6a83-419f-8b27-c1e676cedea1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Monitoring: Advanced app. metrics: uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf @@ -4990,11 +5592,16 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d03bc410-74a7-4e92-82cb-d01a020cb6bf isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Advanced availability and stability metrics: uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 risk: Trends and advanced attacks are not detected. @@ -5017,11 +5624,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ed715b38-c34b-40cd-83fd-ce807f306fc1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Alerting: uuid: 8a442d8e-0eb1-4793-a513-571aef982edd risk: Incidents are discovered after they happened. @@ -5047,11 +5659,16 @@ Information Gathering: - 6.8 - 5.25 - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8a442d8e-0eb1-4793-a513-571aef982edd isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Audit of system events: uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 risk: System events (system calls) trends and attacks are not detected. @@ -5081,11 +5698,16 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/1cd5e4b8-be36-4726-adc7-d8f843f47ac8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage and control metrics: uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d risk: The effectiveness of configuration, patch and vulnerability management @@ -5117,11 +5739,16 @@ Information Gathering: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d0d681e7-d6de-4829-ac64-a9eb2546aa0d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deactivation of unused metrics: uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 risk: High resources are used while gathering unused metrics. @@ -5144,11 +5771,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/7f36b9ba-bc05-4fd6-9a2a-73344c249722 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Defense metrics: uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 risk: IDS/IPS systems like packet- or application-firewalls detect and prevent @@ -5175,11 +5807,16 @@ Information Gathering: iso27001-2022: - 8.15 - 8.2 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e808028c-351c-42f1-bcd9-fba738d1fc55 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Grouping of metrics: uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b risk: The analysis of metrics takes long. @@ -5200,11 +5837,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/42170a71-d4c8-47af-bd71-bf36875fd05b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Metrics are combined with tests: uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 risk: Changes might cause high load due to programming errors. @@ -5225,11 +5867,16 @@ Information Gathering: - not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/71699daf-b2a4-466b-a0b2-89f7dbb18506 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Monitoring of costs: uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e risk: Not monitoring costs might lead to unexpected high resource consumption @@ -5254,11 +5901,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/10e23a8c-22ff-4487-a706-87ccc9d0798e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Screens with metric visualization: uuid: 8746647c-638c-473f-8e17-82c068e4c311 risk: Security related information is discovered too late during an incident. @@ -5282,11 +5934,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8746647c-638c-473f-8e17-82c068e4c311 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 risk: Attacks on an application are not recognized. @@ -5310,11 +5967,16 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e9a6d403-a467-445e-b98a-74f0c29da0b1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 risk: Not getting notified about reaching the end of the budget (e.g. due to @@ -5338,11 +6000,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/f08a3219-6941-43ec-8762-4aff739f4664 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 risk: Without simple metrics analysis of incidents are hard. In case an application @@ -5369,11 +6036,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/3d1f4c3b-f713-46d9-933a-54a014a26c03 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Targeted alerting: uuid: d6f06ae8-401a-4f44-85df-1079247fa030 risk: People are bored (ignorant) of incident alarm messages, as they are not @@ -5398,11 +6070,16 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d6f06ae8-401a-4f44-85df-1079247fa030 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Visualized metrics: uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 risk: Not visualized metrics lead to restricted usage of metrics. @@ -5424,11 +6101,16 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ded39bcf-4eaa-4c5f-9c94-09acde0a4734 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test KPI: Fix rate per repo/product: uuid: 123e4567-e89b-12d3-a456-426614174000 @@ -5447,7 +6129,7 @@ Information Gathering: usefulness: 3 level: 3 dependsOn: - - uuid:123e4567-e89b-12d3-a456-426614174000 + - 123e4567-e89b-12d3-a456-426614174000 implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -5487,10 +6169,17 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/123e4567-e89b-12d3-a456-426614174000 tags: - vulnerability-mgmt - metrics - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false Generation of response statistics: uuid: c922981b-65ed-40f3-a947-96fee9a0125f risk: No or delayed reaction to findings leads to potential exploitation of @@ -5545,6 +6234,9 @@ Information Gathering: iso27001-2022: - 5.25 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/c922981b-65ed-40f3-a947-96fee9a0125f tags: - vulnerability-mgmt - metrics @@ -5552,6 +6244,10 @@ Information Gathering: comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). + teamsImplemented: + Default: false + B: false + C: false Number of vulnerabilities/severity: uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 risk: Failing to convey the number of vulnerabilities by severity might undermine @@ -5577,10 +6273,17 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/bc548cba-cb82-4f76-bd4b-325d9d256279 tags: - vulnerability-mgmt - metrics - vmm-measurement + teamsImplemented: + Default: false + B: false + C: false Number of vulnerabilities/severity/layer: uuid: 0ec92899-a5cb-4649-984b-2fb1d6c784ad risk: Failing to convey the number of vulnerabilities by severity and layer @@ -5619,10 +6322,17 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/0ec92899-a5cb-4649-984b-2fb1d6c784ad tags: - vulnerability-mgmt - metrics - vmm-measurement + teamsImplemented: + Default: false + B: false + C: false Patching mean time to resolution via PR: uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 risk: Without measuring Mean Time to Resolution (MTTR) related to patching, @@ -5643,7 +6353,7 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 implementation: [] references: samm2: @@ -5653,10 +6363,17 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/86d490b9-d798-4a5b-a011-ab9688014c46 tags: - patching - metrics - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false Patching mean time to resolution via production: uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f risk: Without measuring Mean Time to Resolution (MTTR) related to patching, @@ -5673,8 +6390,8 @@ Information Gathering: usefulness: 3 level: 4 dependsOn: - - uuid:86d490b9-d798-4a5b-a011-ab9688014c46 - - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 + - 86d490b9-d798-4a5b-a011-ab9688014c46 + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 implementation: [] references: samm2: @@ -5683,10 +6400,17 @@ Information Gathering: - 16.1.4 iso27001-2022: - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f tags: - patching - metrics - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false Test and Verification: Application tests: High coverage of security related module and integration tests: @@ -5711,11 +6435,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/67667c97-c33e-4306-a4e5-e7b1d8e10c5a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security integration tests for important components: uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 risk: Vulnerabilities are rising due to code changes in a complex microservice @@ -5737,11 +6467,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Security unit tests for important components: uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 risk: Vulnerabilities are rising due to code changes. @@ -5775,10 +6511,16 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Smoke Test: uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a risk: During a deployment an error might happen which leads to non-availability @@ -5803,11 +6545,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/73aaae0b-5d68-4953-9fa4-fd25bf665f2a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Consolidation: Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 @@ -5856,11 +6604,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/7a82020c-94d1-471c-bbd3-5f7fe7df4876 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Fix based on accessibility: uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed risk: Overwhelming volume of security findings from automated testing tools. @@ -5880,8 +6633,8 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425 - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + - 38d1bd10-7b5f-4ae1-868c-0ec813285425 + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: ~ references: samm2: @@ -5896,9 +6649,15 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/0c10a7f7-f78f-49f2-943d-19fdef248fed tags: - vuln-action - defect-management + teamsImplemented: + Default: false + B: false + C: false Fix based on severity: uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 risk: Overwhelming volume of security findings from automated testing tools. @@ -5927,9 +6686,15 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/38d1bd10-7b5f-4ae1-868c-0ec813285425 tags: - vuln-action - defect-management + teamsImplemented: + Default: false + B: false + C: false Integration in development process: uuid: 123e4567-e89b-12d3-a456-426614174000 risk: "Not integrating vulnerability handling into the development process may @@ -6004,9 +6769,15 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/123e4567-e89b-12d3-a456-426614174000 tags: - vulnerability-mgmt - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false Integration of vulnerability issues into the development process: uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e risk: To read console output of the build server to search for vulnerabilities @@ -6046,11 +6817,16 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/ce970c9b-da94-41cf-bd78-8c15357b7e8e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Reproducible defect tickets: uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 risk: Vulnerability descriptions are hard to understand by staff from operations @@ -6078,11 +6854,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/27337442-e4b1-4e87-8dc9-ce86fbb79a39 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 risk: As false positive occur during each test, all vulnerabilities might be @@ -6117,11 +6898,16 @@ Test and Verification: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c1acc8af-312e-4503-a817-a26220c993a0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: The security level of a component is not visible. Therefore, the motivation @@ -6185,11 +6971,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/55f4c916-3a34-474d-ad96-9a9f7a4f6a83 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of all defects: uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d risk: Vulnerabilities with severity low are not visible. @@ -6210,11 +7001,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of defects per protection requirement: uuid: 123e4567-e89b-12d3-a456-426614174000 risk: "Not defining the protection requirement of applications can lead to wrong @@ -6276,10 +7072,16 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/123e4567-e89b-12d3-a456-426614174000 tags: - vulnerability-mgmt - metrics - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 risk: Vulnerabilities with severity high or higher are not visible. @@ -6301,11 +7103,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 implementation: [] isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Treatment of defects with severity middle: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. @@ -6326,11 +7133,16 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 implementation: [] isImplemented: false - evidence: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: Maintenance of false positives in each tool enforces a high workload. @@ -6375,8 +7187,14 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/85ba5623-84be-4219-8892-808837be582d tags: - none + teamsImplemented: + Default: false + B: false + C: false Dynamic depth for applications: Coverage analysis: uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 @@ -6409,11 +7227,17 @@ Test and Verification: - part of periodic review, PDCA iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/d0ba0be5-c573-405f-b905-b7a8f87a9cc7 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of client side dynamic components: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript @@ -6437,16 +7261,22 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/9711f871-f79d-4573-8d4f-d2c98fd0d18e implementation: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb name: Ajax Spider tags: [] url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of hidden endpoints: uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 risk: Hidden endpoints of the service are not getting tracked. @@ -6493,11 +7323,17 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/6a9cb303-0f98-48a8-bdcd-56d41c0012b8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of more input vectors: uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc risk: Parts of the service are not covered. For example specially formatted @@ -6520,6 +7356,9 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5e0ff85b-ec89-4ef0-96b1-5695fa0025dc implementation: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b name: Schemathesis @@ -6531,10 +7370,13 @@ Test and Verification: description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of sequential operations: uuid: 845f06ec-148c-4c67-9755-7041911dcca5 risk: Sequential operations like workflows (e.g. login -> put products in the @@ -6563,11 +7405,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/845f06ec-148c-4c67-9755-7041911dcca5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Coverage of service to service communication: uuid: 22aab0ef-76ce-4b8c-979c-3699784330db risk: Service to service communication is not covered. @@ -6589,8 +7437,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/22aab0ef-76ce-4b8c-979c-3699784330db implementation: - - signing-of-commits-protection: + - argocd: + uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -7695,7 +8552,13 @@ Test and Verification: sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. - - signing-of-commits-protection: + - argocd: + uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -8801,10 +9664,13 @@ Test and Verification: and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Simple Scan: uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 risk: Deficient security tests are performed. Simple vulnerabilities are not @@ -8842,11 +9708,17 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/07796811-37f9-467c-9ff2-48f346e77ff3 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of different roles: uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 risk: Parts of the service are not covered during the scan, because a login @@ -8870,6 +9742,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/65a2d7d9-5441-46bf-a4e3-f76919857750 implementation: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 name: Zest @@ -8880,10 +9755,13 @@ Test and Verification: Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. isImplemented: false assessment: For REST APIs, multiple OAuth2 scopes are used. - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Usage of multiple scanners: uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea risk: Each vulnerability scanner has different opportunities. By using just @@ -8916,11 +9794,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dynamic depth for infrastructure: Load tests: uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd @@ -8946,11 +9830,17 @@ Test and Verification: - 8.6 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/ab5725aa-4d53-47b9-96df-c14b3fa93bcd isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for exposed services: uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 risk: Standard network segmentation and firewalling has not been performed, @@ -8987,11 +9877,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for unauthorized installation: uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a risk: Unapproved components are used. @@ -9019,12 +9915,18 @@ Test and Verification: iso27001-2022: - 8.19 - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/dccf1949-b9a8-4ce8-b992-6a4a7f3a623a isImplemented: false - evidence: "" dependsOn: - Evaluation of the trust of used components tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for unused Resources: uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 risk: Unused resources, specially secrets, might be still valid, but are exposing @@ -9059,11 +9961,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6532c1fe-9d23-4228-8722-558ddabca7d4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test network segmentation: uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 risk: Wrong or no network segmentation of pods makes it easier for an attacker @@ -9094,11 +10002,17 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6d2c3ac6-8afc-4af6-a5e9-6188341aca01 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of the configuration of cloud environments: uuid: 7bb70764-9392-4462-935d-e55b2e148199 risk: Standard hardening practices for cloud environments are not performed @@ -9141,11 +10055,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/7bb70764-9392-4462-935d-e55b2e148199 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Weak password test: uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f risk: Weak passwords in components like applications or systems, specially for @@ -9171,11 +10091,17 @@ Test and Verification: - 9.4.3 iso27001-2022: - 5.17 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/61e10f9c-e126-4ffa-af12-fdbe0d0a831f isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static depth for applications: API design validation: uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 @@ -9221,12 +10147,19 @@ Test and Verification: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 isImplemented: false dependsOn: - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + - 2a44b708-734f-4463-b0cb-86dc46344b2f comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Dead code elimination: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Dead code increases the attack surface (use of hard coded credentials @@ -9255,9 +10188,16 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Exclusion of source code duplicates: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Duplicates in source code might influence the stability of the application. @@ -9285,9 +10225,16 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Local development security checks performed: uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b risk: Creating and developing code contains code smells and quality issues. @@ -9319,7 +10266,13 @@ Test and Verification: tags: - ide - sast - - signing-of-commits-protection: + - argocd: + uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -10443,11 +11396,17 @@ Test and Verification: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6e180abc-7c98-4265-b4e9-852cb91b067b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis (client side): uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 risk: Client side components might have vulnerabilities. @@ -10461,7 +11420,7 @@ Test and Verification: level: 3 dependsOn: - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js @@ -10500,11 +11459,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/07fe8c4f-ae33-4409-b1b2-cf64cfccea86 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe description: Use a tool like trivy and concentrate on application related vulnerabilities. @@ -10521,7 +11486,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 name: OWASP Dependency Check @@ -10560,7 +11525,13 @@ Test and Verification: url: https://github.com/dependabot/dependabot-core description: | Dependabot creates pull requests to keep your dependencies secure and up-to-date. - - signing-of-commits-protection: + - argocd: + uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + signing-of-commits-protection: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: @@ -11672,8 +12643,15 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d918cd44-a972-43e9-a974-eff3f4a5dcfe tags: - vmm-testing + teamsImplemented: + Default: false + B: false + C: false Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 risk: Used components like libraries and legacy applications might have vulnerabilities @@ -11687,7 +12665,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: [] references: samm2: @@ -11696,11 +12674,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for all self written components: uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 risk: Parts in the source code of the frontend or middleware have vulnerabilities. @@ -11746,7 +12730,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + - 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -11754,11 +12738,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/ee68331f-9b1d-4f61-844b-b2ea04753a84 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for important client side components: uuid: e237176b-bec5-447d-a926-e37d6dd60e4b risk: Important parts in the source code of the frontend have vulnerabilities. @@ -11808,7 +12798,7 @@ Test and Verification: - sast dependsOn: - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + - 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -11816,11 +12806,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/e237176b-bec5-447d-a926-e37d6dd60e4b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static analysis for important server side components: uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 risk: Important parts in the source code of the middleware have vulnerabilities. @@ -11865,7 +12861,7 @@ Test and Verification: - sast dependsOn: - Defined build process - - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + - 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -11873,11 +12869,17 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6c05c837-8c99-46e2-828b-7c903e27dba4 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Stylistic analysis: uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 risk: Unclear or obfuscated code might have unexpected behavior. @@ -11924,11 +12926,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for Patch Deployment Time: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -11947,6 +12955,7 @@ Test and Verification: name: PMD tags: [] dependsOn: + - Automated PRs for patches - Defined build process references: samm2: @@ -11959,6 +12968,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Self implementation. This activity is not repeated in @@ -11966,6 +12978,10 @@ Test and Verification: as well. tags: - patching + teamsImplemented: + Default: false + B: false + C: false Test for Time to Patch: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -11993,7 +13009,7 @@ Test and Verification: - patching url: https://github.com/renovatebot/renovate dependsOn: - - Defined build process + - Automated PRs for patches references: samm2: - V-ST-2-A @@ -12005,6 +13021,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: Usage of a version control platform API (e.g. github @@ -12012,6 +13031,10 @@ Test and Verification: might be an alternative to this activity. tags: - patching + teamsImplemented: + Default: false + B: false + C: false Test libyear: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Vulnerabilities in running artifacts stay for long and might get exploited. @@ -12045,6 +13068,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" meta: implementationGuide: | @@ -12052,6 +13078,10 @@ Test and Verification: An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). tags: - patching + teamsImplemented: + Default: false + B: false + C: false Usage of multiple analyzers: uuid: 297be001-8d94-41ee-ab29-207020d423c0 risk: Each vulnerability analyzer has different opportunities. By using just @@ -12079,11 +13109,17 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/297be001-8d94-41ee-ab29-207020d423c0 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Static depth for infrastructure: Analyze logs: uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 @@ -12106,11 +13142,17 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/b217c8bb-5d61-4b41-a675-1083993f83b1 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Correlate known vulnerabilities in infrastructure with new image versions: uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 risk: TODO. @@ -12149,33 +13191,41 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/7de0ae33-6538-45cd-8222-a1475647ba58 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Software Composition Analysis: - uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe - risk: Infrastructure components might have vulnerabilities. - measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) - are performed. + uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad + risk: Known vulnerabilities in infrastructure components like container images + might get exploited. + measure: Check for known vulnerabilities difficultyOfImplementation: - knowledge: 3 - time: 5 + knowledge: 2 + time: 1 resources: 1 - usefulness: 2 + usefulness: 4 level: 4 - dependsOn: - - Defined build process - - uuid:d918cd44-a972-43e9-a974-eff3f4a5dcfe + description: Subscribing to Github projects and reading release notes might + help. Software Composition Analysis for infrastructure might help, but is + often too fine-granular. implementation: - - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply @@ -12189,1143 +13239,39 @@ Test and Verification: - Supply Chain - vulnerability - inventory - - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - - signing-of-commits-protection: - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - signing-of-commits: - uuid: d6d755d3-b9f1-4942-a084-e62b266541df - name: Signing of commits - tags: - - signing - url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work - description: Signing of commits in git - ci-cd-tools: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - apimaturity: - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ - container-technologi: - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - cwe25: - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 - name: CWE Top 25 Most Dangerous Software Weaknesses - tags: - - documentation - - threat - url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html - docker-content-trust: - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 - name: Docker Content Trust - tags: [] - url: https://docs.docker.com/engine/security/trust/ - in-toto: - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f - name: in-toto - tags: [] - url: https://in-toto.github.io/ - a-complete-backup-of: - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b - name: A complete backup of persisted data might be performed*. - tags: [] - a-point-in-time-reco: - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 - name: A Point in Time Recovery for databases should be implemented. - tags: [] - blue-green-deploymen: - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 - name: Blue/Green Deployments - tags: [] - url: https://martinfowler.com/bliki/BlueGreenDeployment.html - docker: - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - webserver: - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb - name: Webserver - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ - rolling-update: - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e - name: rolling update - tags: [] - kubernetes-admission: - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af - name: Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. - tags: [] - url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d - dependabot: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - renovate: - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - jenkins: - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 - name: Jenkins - tags: [] - url: https://www.jenkins.io/ - sample-concept-1: - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" - tags: [] - description: "Sample concept: \n(1) each container has a set lifetime and - is killed / replaced with a new container multiple times a day where you - have some form of a graceful replacement to ensure no (short) service - outage will occur to the end users. \n(2) twice a day a rebuild of images - is done. The rebuilds are put into a automated testing pipeline. If the - testing has no blocking issues the new images will be released for deployment - during the next \"restart\" of a container. What has to be done, is to - ensure the new containers are deployed in some canary deployment manner, - this will ensure that if (and only if) something buggy has been introduced - which breaks functionality the canary deployment will make sure the \"older - version\" is being used and not the buggy newer one." - distroless: - uuid: ef647044-b675-47d3-9720-3ebc144ef37b - name: Distroless - tags: [] - url: https://github.com/GoogleContainerTools/distroless - fedora-coreos: - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a - name: Fedora CoreOS - tags: [] - url: https://getfedora.org/coreos - distroless-usage: - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd - name: Distroless or Alpine - tags: [] - url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 - threat-modeling-play: - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - owasp-samm: - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - whiteboard: - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - miro-or-any-other-c: - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - draw-io: - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - threagile: - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c - name: Threagile - tags: - - threat-modeling - url: https://github.com/Threagile/threagile - don-t-forget-evil-u: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: '[Don''t Forget EVIL U' - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' - libyear: - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a - single number telling you how up-to-date your dependencies are. - owasp-juice-shop: - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - owasp-cheatsheet-ser: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-juiceshop: - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] - url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - https-cheatsheetse: - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-security-champ: - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 - name: OWASP Security Champions Playbook - tags: - - security champions - url: https://github.com/c0rdis/security-champions-playbook - build-it-break-it-fi: - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f - name: Build it Break it Fix it Contest - tags: [] - url: https://builditbreakit.org/ - motivate-people: - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 - name: Motivate people - tags: - - security champions - - gamification - - nudging - url: https://github.com/wurstbrot/security-pins - description: |- - Enhance motivation can be performed with the distribution of pins - as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) - owasp-top-10-maturit: - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 - name: OWASP Top 10 Maturity Categories for Security Champions - tags: - - security champions - url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx - involve-security-sme: - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 - name: Involve Security SME - tags: [] - description: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. - damn-vulnerable-web: - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - example-all-docker: - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 - name: 'Example: All docker images used by teams need to be based on standard - images.' - tags: [] - owasp-asvs: - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - owasp-masvs: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - cis-kubernetes-bench: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - cis-docker-bench-for: - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - for-example-for-cont: - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont - tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, - ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - attack-matrix-cloud: - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - attack-matrix-contai: - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for containers - attack-matrix-kubern: - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - istio: - uuid: 9429d52c-203d-49ae-814f-1401210887cd - name: istio - tags: [] - url: https://istio.io/ - bridges: - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 - name: bridges - tags: [] - firewalls: - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - open-policy-agent: - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 - name: Open Policy Agent - tags: [] - url: https://www.openpolicyagent.org/ - gitops: - uuid: b0931397-2402-44f1-814b-63292ab4a339 - name: GitOps - tags: [] - url: https://www.redhat.com/en/topics/devops/what-is-gitops - ansible: - uuid: 73747d35-2185-4f22-94a0-723288fa283c - name: Ansible - tags: [] - url: https://github.com/ansible/ansible - chef: - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce - name: Chef - tags: [] - url: https://github.com/chef/chef - puppet: - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 - name: Puppet - tags: [] - url: https://github.com/puppetlabs/puppet - jenkinsfile: - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 - name: Jenkinsfile - tags: [] - url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ - seccomp: - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd - name: seccomp - tags: [] - url: https://man7.org/linux/man-pages/man2/seccomp.2.html - strace: - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff - name: strace - tags: [] - url: https://man7.org/linux/man-pages/man1/strace.1.html - remove-direct-access: - uuid: b206481f-9c66-45e2-843c-37c5730580cd - name: Remove direct access to infrastructure - tags: [] - directory-service: - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 - name: Directory Service - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ - plugins: - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e - name: Plugins - tags: [] - smartcard: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - yubikey: - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - sms: - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS - tags: [] - totp: - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP - tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ - http-basic-authentic: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 - name: HTTP-Basic Authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ - vpn: - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e - name: VPN - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ - for-applications-ch: - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c - name: 'For applications: Check default encoding' - tags: [] - managing-secrets: - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf - name: managing secrets - tags: [] - url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ - crypto: - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 - name: crypto - tags: [] - authentication: - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 - name: authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ - rsyslog: - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 - name: rsyslog - url: https://www.rsyslog.com/ - tags: - - tool - - logging - logstash: - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - fluentd: - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 - name: fluentd - tags: - - tool - url: https://www.fluentd.org/ - bash: - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 - name: bash - tags: - - tool - url: https://www.gnu.org/software/bash/ - owasp-logging-cheats: - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - elk-stack: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 - name: ELK-Stack - tags: [] - url: https://www.elastic.co/elk-stack - https-ht-transpare: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf - prometheus: - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c - name: Prometheus - tags: [] - url: https://prometheus.io/ - collected: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - httpunit: - uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 - name: HttpUnit - tags: [] - url: http://httpunit.sourceforge.net/ - junit: - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d - name: JUnit - tags: - - unittest - url: https://junit.org/junit5/ - karma: - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 - name: Karma - tags: [] - url: https://karma-runner.github.io - owasp-defectdojo: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - purify: - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - see-other-actions-e: - uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 - name: See other actions, e.g. "Treatment of defects with severity high". - tags: [] - sast: - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a - name: SAST - tags: [] - description: 'At SAST (Static Application Security Testing): Server-side - / client-side teams can easily be recorded. With microservice architecture - individual microservices can be used usually Teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ - dast: - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 - name: DAST - tags: [] - description: 'At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - owasp-defect-dojo: - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] - url: https://github.com/DefectDojo/django-DefectDojo - owasp-dependency-che: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - logparser-jenkins-pl: - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 - name: LogParser Jenkins Plugins - tags: [] - owasp-code-pulse: - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 - name: OWASP Code Pulse - tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse - ajax-spider: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb - name: Ajax Spider - tags: [] - url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ - curl: - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - openapi: - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 - name: OpenAPI Specifications - tags: [] - url: https://spec.openapis.org/ - owasp-zap: - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - arachni: - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 - name: Arachni - url: https://github.com/Arachni/arachni - zest: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 - name: Zest - url: https://www.zaproxy.org/docs/desktop/addons/zest/ - tags: - - zap - description: | - Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - owasp-securecodebox: - uuid: f220b299-0917-4750-96c5-d81cd402b4df - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - kube-hunter: - uuid: 2af7204c-a25c-4625-9775-889978386407 - name: kube-hunter - tags: [] - url: https://github.com/aquasecurity/kube-hunter - openvas: - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f - name: openVAS - tags: [] - url: https://www.openvas.org/ - htc-hydra: - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce - name: HTC Hydra - tags: - - password - url: https://www.htc-cs.com/en/products/htc-hydra/ - netassert: - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c - name: netassert - tags: [] - url: https://github.com/controlplaneio/netassert - nmap: - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 - name: nmap - tags: [] - url: https://nmap.org/ - owasp-amass: - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a - name: OWASP Amass - tags: [] - url: https://github.com/OWASP/Amass - k8spurger: - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - pmd: - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - eslint: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - findsecuritybugs: - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - jsprime: - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - bdd-mobile-security: - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - retire-js: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - npm-audit: - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - sigmahq: - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - dive-to-inspect-a-co: - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 - name: Dive to inspect a container images - tags: [] - url: https://github.com/wagoodman/dive - clusterscanner: - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - dockerfile-with-hado: - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 - name: Dockerfile with hadolint - tags: [] - url: https://github.com/hadolint/hadolint - deployment-with-kube: - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b - name: Deployment with kube-score - tags: [] - url: https://github.com/zegl/kube-score - kubesec: - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba - name: kubesec - tags: [] - url: https://kubesec.io - anchore-io: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - clair: - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - openscap: - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - vuls: - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - kube-bench: - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 - name: kube-bench - tags: [] - url: https://github.com/aquasecurity/kube-bench - trufflehog: - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - go-pillage-registrie: - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - https-github-com-a: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - registries-like-quay: - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay - tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - dockerfilelint: - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 - name: dockerfilelint - tags: - - sast - - docker - - dockerfile - url: https://github.com/replicatedhq/dockerfilelint - description: dockerfilelint is an node module that analyzes a Dockerfile - and looks for common traps, mistakes and helps enforce best practices. - threat-matrix-for-storage: - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - defend-the-core-kubernetes: - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes - business-friendly-vulnerability-metrics: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - kubescape: - uuid: 893d9f37-2142-4490-996c-e43b55064d3d - name: kubescape - url: https://github.com/armosec/kubescape - tags: - - kubernetes - - vulnerability - - misconfiguration - description: _Testing if Kubernetes is deployed securely as defined in Kubernetes - Hardening Guidance by to NSA and CISA_ - azuredevops: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - github-policies: - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - sonarqube: - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - stylecop: - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - fortify-vscode-extension: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - appscan-vscode-extension: - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - checkmarx-vscode-extension: - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - pre-commit-microsoft: - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 - name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop - tags: - - pre-commit - pre-commit-synopsis: - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb - name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ - tags: - - pre-commit - dependencyTrack: - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach - by leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - juice-shop: - uuid: c021aa72-c71c-43e4-9573-717b74d6c19d - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - dvwa: - uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - loggingCheatSheet: - uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - zap: - uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - secureCodeBox: - uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - K8sPurger: - uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - hashicorp-vault: - uuid: e3a2ffc8-313f-437e-9663-b24591568209 - name: Hashicorp Vault - tags: - - authentication - - authorization - - secrets - - infrastructure - url: https://github.com/hashicorp/vault - description: | - A tool for secrets management, encryption as a service, and privileged access management. - stoplight-spectral: - uuid: 261f243e-f89c-4169-b076-b22a03ec00be - name: Spectral - tags: - - linting - - api - - documentation - url: https://github.com/stoplightio/spectral - description: | - Spectral is a flexible JSON/YAML linter built with extensibility in mind. - It uses JSON/YAML path rules to describe the problems you want to find. - api-oas-checker: - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f - name: API OAS Checker - tags: - - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. - coveragepy: - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 - name: Coverage.py - tags: - - testing - - coverage - url: https://github.com/nedbat/coveragepy - description: | - Code coverage measurement for Python - github-dependabot: - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - github-super-linter: - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f - name: Super-Linter - tags: - - linting - - scm - url: https://github.com/github/super-linter - description: | - Lint code bases to catch common errors and enforce code style - schemathesis: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b - name: Schemathesis - tags: - - testing - - api - - documentation - url: https://github.com/schemathesis/schemathesis - description: | - Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - martin-feature-toggles: - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 - name: Feature Toggles - tags: - - development - - architecture - url: https://martinfowler.com/articles/feature-toggles.html - description: | - Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) - defectdojo-client: - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - falco: - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. - sammancoaching: - uuid: 9223be73-00da-400e-a910-3871734cff2f - name: sammancoaching - tags: - - documentation - - coaching - - education - url: https://sammancoaching.org/ - description: | - Security coaches work with software development teams to help them adopt better security practices. - terraform: - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - packj: - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a - name: packj - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://github.com/ossillate-inc/packj - description: | - Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. - apiMyth: - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 - name: Top 5 API Security Myths That Are Crushing Your Business - tags: - - documentation - - waf - url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html - description: | - There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business - backstage: - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - image-metadata-collector: - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - jira: - uuid: 889444eb-de68-4367-bada-a66f8cb9733a - name: Jira - tags: - - documentation - - issue - - proprietary - url: https://jira.atlassian.com/ - description: Jira is a bug tracking and project management tool developed - by Atlassian, used by development teams for tracking issues, planning - sprints, and managing software releases. It offers features for creating - and managing tasks, assigning them to team members, and monitoring progress - through customizable workflows and dashboards. - references: - samm2: - - V-ST-2-A - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - tags: - - vmm-testing - Test cluster deployment resources: - uuid: 621fb6a5-5c0a-4408-826a-068868bb031b - risk: The deployment configuration (e.g. kubernetes deployment resources) might - contain unsecured configurations. - measure: Test the deployment configuration for virtualized environments for - unsecured configurations. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 3 - level: 2 - implementation: - - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba - name: kubesec + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/26e1c6d5-5632-4ec7-80d2-e564b98732ad + isImplemented: false + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test cluster deployment resources: + uuid: 621fb6a5-5c0a-4408-826a-068868bb031b + risk: The deployment configuration (e.g. kubernetes deployment resources) might + contain unsecured configurations. + measure: Test the deployment configuration for virtualized environments for + unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec tags: [] url: https://kubesec.io references: @@ -13341,11 +13287,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/621fb6a5-5c0a-4408-826a-068868bb031b isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for image lifetime: uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b risk: Old container images in production indicate that patch management is not @@ -13380,60 +13332,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b isImplemented: false - evidence: "" - comments: "" - tags: - - none - Test for known vulnerabilities: - uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad - risk: Known vulnerabilities in infrastructure components like container images - might get exploited. - measure: Check for known vulnerabilities - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 4 - level: 4 - description: Subscribing to Github projects and reading release notes might - help. Software Composition Analysis for infrastructure might help, but is - often too fine-granular. - implementation: - - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay - tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - references: - samm2: - - V-ST-2-A - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for malware: uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d risk: Third party might include malware. Ether due to the maintainer (e.g. @@ -13468,11 +13377,17 @@ Test and Verification: - 12.2.1 iso27001-2022: - 8.7 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/837f8f90-adc2-4e6b-9ebb-60c2ee29494d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for new image version: uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e risk: When a new version of an image is available, it might fix security vulnerabilities. @@ -13495,11 +13410,17 @@ Test and Verification: - 8.8 - 8.7 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/cb6321aa-0fbf-4996-9e08-05ab26ef4c1e isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test for stored secrets: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c risk: Stored secrets in git history, in container images or directly in code @@ -13531,11 +13452,17 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/c6e3c812-56e2-41b0-ae01-b7afc41a004c isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of infrastructure components for known vulnerabilities: uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 risk: Infrastructure components might have vulnerabilities. @@ -13578,11 +13505,17 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/13367d8f-e37f-4197-a610-9ffca4fde261 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test of virtualized environments: uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 risk: Virtualized environments (e.g. via Container Images) might contains @@ -13619,11 +13552,17 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/58825d22-1ce6-4748-af81-0ec9956e4129 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test the cloud configuration: uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc risk: Standard hardening practices for cloud environments are not performed @@ -13654,11 +13593,17 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Test the definition of virtualized environments: uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e risk: The definition of virtualized environments (e.g. via Dockerfile) @@ -13708,9 +13653,16 @@ Test and Verification: - 8.32 - 8.29 - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/8fc3de67-7b8d-420b-8d24-f35928cfed6e isImplemented: false tags: - none + teamsImplemented: + Default: false + B: false + C: false Test-Intensity: Creation and application of a testing concept: uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe @@ -13740,11 +13692,16 @@ Test and Verification: - 8.32 - 8.27 - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/79ef8103-e1ed-4055-8df8-fd2b2015bebe isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Deactivating of unneeded tests: uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 risk: As tools cover a wide range of different vulnerability tests, they might @@ -13771,11 +13728,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Default settings for intensity: uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d risk: Time pressure and ignorance might lead to false predictions for the test @@ -13799,11 +13761,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/ab0a4b51-3b18-43f1-a6fc-a98e4b28453d isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false High test intensity: uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 risk: A too small intensity or a too high confidence might lead to not visible @@ -13828,11 +13795,16 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/2ebfc421-8c76-415c-a3b0-fa518915bd10 isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false Regular automated tests: uuid: 598897a2-358e-441f-984c-e12ec4f6110a risk: After pushing source code to the version control system, any delay in @@ -13856,9 +13828,14 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/598897a2-358e-441f-984c-e12ec4f6110a isImplemented: false - evidence: "" comments: "" tags: - none + teamsImplemented: + Default: false + B: false + C: false ... From 2049504bfab5d284ecba144814260cad10864e60 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 17 Aug 2024 17:00:23 +0200 Subject: [PATCH 019/370] feat: enhance source control platform requirements --- .../DevelopmentAndSourceControl.yaml | 101 +++++++++++++++--- 1 file changed, 87 insertions(+), 14 deletions(-) diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index b540e6e..1feebdd 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -53,15 +53,12 @@ Implementation: - 8.25 # Secure development lifecycle - 8.27 # Secure system architecture and engineering principles - 8.28 # Secure coding - isImplemented: false - evidence: "" - comments: "" - Source Control Protection: + Require a PR before merging: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 - risk: Intentional or accidental alterations in critical branches like master. + risk: Intentional or accidental alterations in critical branches like main (or master). measure: >- Define source code management system policies (e.g. branch protection rules, - mandatory code reviews, ...) + mandatory code reviews from at least one person, ...) to ensure that changes to critical branches are only possible under defined conditions. These policies can be implemented at repository level or organization level, depending on the source code management system. @@ -71,6 +68,33 @@ Implementation: resources: 2 usefulness: 4 level: 2 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + Dismiss stale PR approvals: + uuid: ea6f69f7-54a5-4922-ac15-a77ff0c16162 + risk: Intentional or accidental alterations in critical branches like main (or master) through post-approval code additions. + measure: >- + Implement a policy where any commits made after a pull request has been approved automatically revoke that approval, necessitating a fresh review and re-approval process. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies @@ -86,9 +110,6 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 - isImplemented: false - evidence: "" - comments: "" Versioning: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f risk: Deployment of untracked artifacts. @@ -116,9 +137,6 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 - isImplemented: false - evidence: "" - comments: "" .gitignore: uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d risk: Unintended leakage of secrets, debug, or workstation specific data @@ -144,5 +162,60 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 - evidence: "" - comments: "" + Require status checks to pass: + uuid: ac8730a2-ccc0-465c-9550-d91edae9d5ee + risk: Organizations risk introducing broken builds, quality issues, and security vulnerabilities into their codebase. + measure: >- + Mandate passing of security related specified status checks, like successful builds or static application security tests, before proceeding. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/signing-of-commits-protection + references: + samm2: + - O-EM-1-A + iso27001-2017: + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.3 + - 8.25 + Block force pushes: + uuid: c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 + risk: |- + Misuse of force push can lead to loss of work. It may overwrite remote + branches without warning, potentially erasing valuable contributions from team members. This can disrupt collaboration, + cause data loss, and create confusion in the development process. + + Bypassing the pull request process might remove an important code review step. + This increases the risk of merging low-quality or buggy code into the main branch, potentially introducing bugs in the codebase. + measure: >- + Mandate blocking of force pushes in the version control platform. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies + references: + samm2: + - O-EM-1-A + iso27001-2017: + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.3 + - 8.25 From e8c57ffb898839c26927d0fc827623935e48c82a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 17 Aug 2024 17:00:56 +0200 Subject: [PATCH 020/370] feat: enhance source control platform requirements --- .../default/Implementation/DevelopmentAndSourceControl.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index 1feebdd..f8aef0d 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -203,7 +203,7 @@ Implementation: knowledge: 2 time: 1 resources: 2 - usefulness: 4 + usefulness: 3 level: 3 dependsOn: - uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2 From c6d82427ddc272f27afc5d7eee36d91e96face14 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 17 Aug 2024 17:07:11 +0200 Subject: [PATCH 021/370] fix: de-duplicate API design validation --- .../DevelopmentAndSourceControl.yaml | 26 ------------------- .../StaticDepthForApplications.yaml | 5 ++-- 2 files changed, 2 insertions(+), 29 deletions(-) diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index f8aef0d..3005ec0 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -27,32 +27,6 @@ Implementation: isImplemented: false evidence: "" comments: "" - API design validation: - uuid: 948a4d51-ceb5-4ebd-bdc7-d74ea25e171c - risk: Creation of insecure or non-compliant API. - measure: | - Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP - and validate the specification using specific tools. - Checks should be integrated in IDEs and CI/CD pipelines. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 3 - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/stoplight-spectral - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-oas-checker - references: - samm2: - - V-ST-1-A - iso27001-2017: - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.25 # Secure development lifecycle - - 8.27 # Secure system architecture and engineering principles - - 8.28 # Secure coding Require a PR before merging: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 risk: Intentional or accidental alterations in critical branches like main (or master). diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 7768d80..e22ded0 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -140,8 +140,8 @@ Test and Verification: knowledge: 2 time: 2 resources: 2 - usefulness: 4 - level: 2 + usefulness: 3 + level: 3 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/stoplight-spectral - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-oas-checker @@ -158,7 +158,6 @@ Test and Verification: isImplemented: false dependsOn: - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - comments: "" Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 risk: Used components like libraries and legacy applications might have vulnerabilities From c09f101ea3e64deb36eb61fc98d9bafce6eac8a8 Mon Sep 17 00:00:00 2001 From: Andrew Kenneth MacLeay Date: Wed, 28 Aug 2024 16:59:30 -0400 Subject: [PATCH 022/370] Add unique UUID for all of "static depth for applications" --- .../TestAndVerification/StaticDepthForApplications.yaml | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 4496a9a..8506d5a 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -30,6 +30,7 @@ Test and Verification: comments: "" Test libyear: <<: *Exclusion-of-source-code-duplicates + uuid: 87b54313-fafd-4860-930f-5ef132b3e4ad risk: Vulnerabilities in running artifacts stay for long and might get exploited. measure: |- Test `libyear`, which provides a good insight how good patch management is. @@ -49,6 +50,7 @@ Test and Verification: - patching Test for Time to Patch: <<: *Exclusion-of-source-code-duplicates + uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities in production artifacts. measure: |- Test of the Time to Patch (e.g. based on Mean Time to Close automatic PRs) @@ -70,6 +72,7 @@ Test and Verification: - patching Test for Patch Deployment Time: <<: *Exclusion-of-source-code-duplicates + uuid: 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities in production artifacts. measure: | Test of the Patch Deployment Time. @@ -88,7 +91,7 @@ Test and Verification: - patching Dead code elimination: <<: *Exclusion-of-source-code-duplicates - uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + uuid: a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d risk: Dead code increases the attack surface (use of hard coded credentials and variables, sensitive information) From d453ce2d09cec1ca2b737b1f45d34d901e22990e Mon Sep 17 00:00:00 2001 From: Andrew Kenneth MacLeay Date: Wed, 28 Aug 2024 17:14:51 -0400 Subject: [PATCH 023/370] Fix: also uniquify InfrastructureHardening --- .../YAML/default/Implementation/InfrastructureHardening.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 75e9a3f..711081d 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -714,7 +714,7 @@ Implementation: - 8.22 comments: WAF medium: - uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium risk: The threat from malicious inputs remains high, with exploits seeking to exploit any vulnerabilities present at the various points of entry to the application. measure: From bfb9a993e85cd6c88f79ca314c3cf34e03c1d7be Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 30 Aug 2024 09:38:39 +0200 Subject: [PATCH 024/370] feat: add includes --- yaml-generation/functions.php | 45 +++++++++++++++++++++++++- yaml-generation/generateDimensions.php | 30 +++++++++++------ 2 files changed, 65 insertions(+), 10 deletions(-) diff --git a/yaml-generation/functions.php b/yaml-generation/functions.php index 591eee1..c9fa0b1 100644 --- a/yaml-generation/functions.php +++ b/yaml-generation/functions.php @@ -41,9 +41,52 @@ function readYaml($file) { } } + + if (isset($ret['_yaml_references'])) { + foreach ($ret['_yaml_references'] as $include) { + if (preg_match('/^include\((\w+),\s*(.+)\)$/', $include, $matches)) { + $team = $matches[1]; + $baseDir = dirname($file); + + $includeFile = $baseDir . DIRECTORY_SEPARATOR . $matches[2]; + echo "In file $file, including $includeFile for team $team\n"; + $includedContent = includeYamlAndSetTeamImplemented($includeFile, $team); + $ret = array_merge_recursive_ex($ret, $includedContent); + } + } + unset($ret['_yaml_references']); + } + return $ret; } +function includeYamlAndSetTeamImplemented($filename, $team) { + echo "File to include $filename"; + $content = yaml_parse_file($filename); + if ($content === false) { + echo "Error parsing YAML file: $filename\n"; + return array(); + } + // Add teamsImplemented for each activity + foreach ($content as $dimension => $subdimensions) { + foreach ($subdimensions as $subdimension => $elements) { + foreach ($elements as $activityName => $activity) { + if (is_array($elements) && (isset($activity['teamsEvidence']) || isset($activity['teamsImplemented']))) { + if (!isset($activity['teamsImplemented'])) { + echo "# setting teamsImplemented first time for team $team"; + $content[$dimension][$subdimension][$activityName]['teamsImplemented'] = array(); + } + if(array_key_exists('teamsEvidence', $activity)) { + echo "# adding team to teamsImplemented for team $team"; + $content[$dimension][$subdimension][$activityName]['teamsImplemented'][$team] = true ; + } + } + } + } + } + return $content; + +} /** * Get dimensions from yaml file. @@ -275,4 +318,4 @@ function test_readYaml() { } -?> \ No newline at end of file +?> diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index decab24..a0acab3 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -31,7 +31,7 @@ foreach ($files as $filename) { //echo "Found $filename"; $dimensionCustom = getDimensions($filename); - $dimensionsCustom = array_merge_recursive($dimensionsCustom, $dimensionCustom); + $dimensionsCustom = array_merge_recursive_ex($dimensionsCustom, $dimensionCustom); } if (sizeof($files) > 0) { $dimensions = array_merge_recursive_ex($dimensions, $dimensionsCustom); @@ -75,24 +75,34 @@ $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = array(); } $evidenceImplemented = array(); - if (array_key_exists("evidence", $activity) && is_array($activity["evidence"]) && IS_IMPLEMENTED_WHEN_EVIDENCE) { - foreach ($activity["evidence"] as $team => $evidenceForTeam) { - if (strlen($activity["evidence"][$team]) > 0) { + if (array_key_exists("teamsEvidence", $activity) && is_array($activity["teamsEvidence"]) && IS_IMPLEMENTED_WHEN_EVIDENCE) { + foreach ($activity["teamsEvidence"] as $team => $evidenceForTeam) { + if(!is_string($activity["teamsEvidence"][$team])) { + echo "teamsEvidence for team $team in $activityName is not a string, ignoring"; + continue; + } + if (strlen($activity["teamsEvidence"][$team]) > 0) { $evidenceImplemented[$team] = true; } else { echo "Warning: '$activityName -> evidence -> $team' has no evidence set but should have"; } } } - + $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = + array_merge( + $teamsImplemented, + $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"], + $evidenceImplemented + ); if (!array_key_exists("openCRE", $activity["references"])) { $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"] = array(); $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = "https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/" . $subdimension . "/" . $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; } - - $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = array_merge($teamsImplemented, $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"], $evidenceImplemented); - // can be removed in 2024 + // can be removed in 2025 if (array_key_exists("isImplemented", $activity)) { + unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["isImplemented"]); + } + if (array_key_exists("evidence", $activity)) { unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["evidence"]); } if (array_key_exists("dependsOn", $activity)) { @@ -124,7 +134,9 @@ resolve_json_ref($dimensionsAggregated); $dimensionsString = yaml_emit($dimensionsAggregated); -file_put_contents("src/assets/YAML/generated/generated.yaml", $dimensionsString); +$targetGeneratedFile = getcwd() . "/src/assets/YAML/generated/generated.yaml"; +echo "\nStoring to $targetGeneratedFile\n"; +file_put_contents($targetGeneratedFile, $dimensionsString); /** From c492e8a0dddc12b9d630ee7ff0614dcafc213147 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 23 Sep 2024 11:30:28 +0200 Subject: [PATCH 025/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 18 + src/assets/YAML/generated/generated.yaml | 446 ++++++++++++----------- 2 files changed, 243 insertions(+), 221 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c70b82e..6ac4bed 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,21 @@ +# [1.12.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.11.1...v1.12.0) (2024-09-23) + + +### Bug Fixes + +* de-duplicate API design validation ([c6d8242](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/c6d82427ddc272f27afc5d7eee36d91e96face14)) + + +### Features + +* add dependsOn for new patching activities ([72e26ad](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/72e26ad825e4a8458e39e5e93814ebf3bcb9aa71)) +* add includes ([bfb9a99](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/bfb9a993e85cd6c88f79ca314c3cf34e03c1d7be)) +* add uuid: resolution to name ([a2a55b3](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/a2a55b363e2c50ef7af9eaca814ef9137f61835d)) +* add vuln ([70ffec4](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/70ffec4ddb3ddb2112190b5ca30f97e80eef2d64)) +* add vuln ([58e67b7](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/58e67b76c7f4457aac333900bf2430e487a72f2d)) +* enhance source control platform requirements ([e8c57ff](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/e8c57ffb898839c26927d0fc827623935e48c82a)) +* enhance source control platform requirements ([2049504](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/2049504bfab5d284ecba144814260cad10864e60)) + ## [1.11.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.11.0...v1.11.1) (2024-07-31) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 6fb028b..f50f922 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -43,7 +43,6 @@ Build and Deployment: - 8.31 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/a340f46b-6360-4cb8-847b-a0d3483d09d3 - isImplemented: false comments: "" tags: - none @@ -95,7 +94,6 @@ Build and Deployment: - 8.32 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f6f7737f-25a9-4317-8de2-09bf59f29b5b - isImplemented: false comments: "" tags: - none @@ -140,7 +138,6 @@ Build and Deployment: - 8.31 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 - isImplemented: false comments: "" tags: - none @@ -179,7 +176,6 @@ Build and Deployment: - 5.12 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/2858ac12-0179-40d9-9acf-1b839c030473 - isImplemented: false comments: "" tags: - none @@ -233,7 +229,6 @@ Build and Deployment: - 8.31 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/5786959d-0c6f-46a6-8e1c-a32ff1a50222 - isImplemented: false comments: "" tags: - none @@ -277,7 +272,6 @@ Build and Deployment: - 8.31 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/9f107927-61e9-4574-85ad-3f2b4bca8665 - isImplemented: false comments: "" tags: - none @@ -324,7 +318,6 @@ Build and Deployment: - 8.29 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0cb2626b-fb0d-4a0f-9688-57f787310d97 - isImplemented: false comments: "" tags: - none @@ -360,7 +353,6 @@ Build and Deployment: - 7.14 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/da4ff665-dcb9-4e93-9d20-48cdedc50fc2 - isImplemented: false comments: "" tags: - none @@ -404,7 +396,6 @@ Build and Deployment: - 8.32 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a - isImplemented: false comments: "" tags: - none @@ -1550,7 +1541,6 @@ Build and Deployment: - ApplicationConfigurationHardening openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/df428c9d-efa0-4226-9f47-a15bb53f822b - isImplemented: false tags: - secret teamsImplemented: @@ -1602,7 +1592,6 @@ Build and Deployment: - 8.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0de465a6-55a7-4343-af79-948bb5ff10ba - isImplemented: false comments: "" tags: - none @@ -1646,7 +1635,6 @@ Build and Deployment: - ApplicationConfigurationHardening openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/94a96f79-8bd6-4904-97c0-994ff88f176a - isImplemented: false tags: - secret teamsImplemented: @@ -1883,7 +1871,6 @@ Build and Deployment: - 8.14 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/85d52588-f542-4225-a338-20dc22a5508d - isImplemented: false comments: "" tags: - none @@ -1923,7 +1910,6 @@ Build and Deployment: - 8.31 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a854b48d-83bd-4f8d-8621-a0bdd470837f - isImplemented: false comments: "" tags: - none @@ -1974,7 +1960,6 @@ Build and Deployment: - ApplicationConfigurationHardening openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a511799b-045e-4b96-9843-7d63d8c1e2ad - isImplemented: false comments: "" tags: - none @@ -2009,7 +1994,6 @@ Build and Deployment: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch Management/99415139-6b50-441b-89e1-0aa59accd43d - isImplemented: false comments: "" tags: - patching @@ -2021,16 +2005,14 @@ Build and Deployment: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 risk: Components with known (or unknown) vulnerabilities might stay for long and get exploited, even when a patch is available. - measure: Fast patching of third party component is needed. The DevOps way is - to have an automated pull request for new components. This includes * Applications - * Virtualized operating system components (e.g. container images) * Operating - Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository - or terraform) + measure: |- + Fast patching of third party component is needed. The DevOps way is to have an automated pull request for new components. This includes + * Applications * Virtualized operating system components (e.g. container images) * Operating Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform) difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 - usefulness: 5 + usefulness: 4 level: 1 implementation: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 @@ -2063,8 +2045,8 @@ Build and Deployment: - 12.6.1 - 14.2.5 iso27001-2022: - - 8.8 - - 8.27 + - "8.8" + - "8.27" openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 @@ -2198,7 +2180,6 @@ Build and Deployment: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch Management/34869eaf-f2e1-4926-b0bd-28c43402f057 - isImplemented: false comments: "" tags: - patching @@ -2248,7 +2229,6 @@ Build and Deployment: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch Management/16e39c8f-5336-4001-88ed-a552d2447531 - evidence: "" comments: "" tags: - patching @@ -2292,7 +2272,6 @@ Build and Deployment: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch Management/485a3383-7f2e-4dba-bb84-479377070904 - evidence: "" comments: "" tags: - patching @@ -2346,7 +2325,6 @@ Build and Deployment: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch Management/6b96e5a0-ce34-4ea4-a88f-469d3b84546e - isImplemented: false comments: "" tags: - patching @@ -2450,7 +2428,6 @@ Culture and Organization: - 8.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 - isImplemented: false comments: "" tags: - none @@ -2486,7 +2463,6 @@ Culture and Organization: - 8.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/48f97f31-931c-46eb-9b3e-e2fec0cd0426 - isImplemented: false comments: "" tags: - none @@ -2611,7 +2587,6 @@ Culture and Organization: - 8.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/47419324-e263-415b-815d-e7161b6b905e - isImplemented: false comments: "" tags: - none @@ -2658,7 +2633,6 @@ Culture and Organization: - 5.9 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/0a929c3e-ab9a-4206-8761-adf84b74622e - isImplemented: false comments: "" tags: - none @@ -2705,7 +2679,6 @@ Culture and Organization: - 5.9 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/bacf85b6-5bc0-405d-b5ba-a5d971467cc1 - isImplemented: false comments: "" tags: - none @@ -2759,7 +2732,6 @@ Culture and Organization: - 8.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e - isImplemented: false comments: "" tags: - none @@ -2769,9 +2741,9 @@ Culture and Organization: C: false Information security targets are communicated: uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 - risk: Employees don't known their organizations security targets. Therefore - security is not considered during development and administration as much as - it should be. + risk: Employees don't know their organizations security targets. Therefore security + is not considered during development and administration as much as it should + be. measure: Transparent and timely communication of the security targets by senior management is essential to ensure teams' buy-in and support. difficultyOfImplementation: @@ -2791,7 +2763,6 @@ Culture and Organization: - 5.4 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/1b9281b9-48e2-4c01-9ac6-9db9931c4885 - isImplemented: false comments: "" tags: - none @@ -2836,7 +2807,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 - isImplemented: false comments: "" tags: - none @@ -2873,7 +2843,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/f994a55d-71bb-45a4-a887-0a213d72c504 - isImplemented: false comments: "" tags: - none @@ -2910,7 +2879,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/bfdb576e-a416-4ec6-96fe-a078d58b2ff8 - isImplemented: false comments: "" tags: - none @@ -2950,7 +2918,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/95caef96-36ed-458c-a087-5c35d4f9dec2 - isImplemented: false comments: "" tags: - none @@ -2983,7 +2950,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/35446784-7610-40d9-af9e-d43f3173bf8c - isImplemented: false comments: "" tags: - none @@ -3020,7 +2986,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/534f60bf-0995-4314-bb9c-f0f2bf204694 - isImplemented: false comments: "" tags: - none @@ -3080,7 +3045,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 - isImplemented: false comments: "" tags: - none @@ -3130,7 +3094,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/9768f154-357a-4c06-af6f-d66570677c9b - isImplemented: false comments: "" tags: - none @@ -3173,7 +3136,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/31833d56-35af-4ef3-9300-f23d27646ce7 - isImplemented: false comments: "" tags: - none @@ -3215,7 +3177,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 - isImplemented: false comments: "" tags: - none @@ -3263,7 +3224,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/91b6f75b-9f4a-4d77-95a2-af7ad3222c7c - isImplemented: false comments: "" tags: - none @@ -3304,7 +3264,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 - isImplemented: false comments: "" tags: - none @@ -3355,7 +3314,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/7121b0c7-6ace-4d6b-95d0-94535dbccb57 - isImplemented: false comments: "" tags: - none @@ -3397,7 +3355,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/0b28367b-75a0-4bae-a926-3725c1bf9bb0 - isImplemented: false comments: "" tags: - none @@ -3428,7 +3385,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/58c46807-fee9-448b-b6dd-8050c464ab52 - isImplemented: false comments: "" tags: - none @@ -3486,7 +3442,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/535f301a-e8e8-4eda-ad77-a08b035c92de - isImplemented: false comments: "" tags: - none @@ -3521,7 +3476,6 @@ Culture and Organization: - 8.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/3f63bdbc-c75f-4780-a941-e6ad42e894e1 - isImplemented: false comments: "" tags: - none @@ -3552,7 +3506,6 @@ Culture and Organization: - 8.15 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/b4193d32-3948-47e2-a326-3748c48019a1 - isImplemented: false comments: "" tags: - none @@ -3785,7 +3738,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application Hardening/b597928e-54d6-48a5-a806-8003dcd56aab - isImplemented: false comments: "" tags: - none @@ -3830,7 +3782,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application Hardening/ffe86caf-2fec-4630-b514-2db83983984d - isImplemented: false comments: "" dependsOn: - App. Hardening Level 2 (75%) @@ -3877,7 +3828,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application Hardening/03643ca2-03c2-472b-8e19-956bf02fe9b7 - isImplemented: false comments: "" dependsOn: - App. Hardening Level 1 @@ -3924,7 +3874,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a - isImplemented: false comments: "" dependsOn: - App. Hardening Level 2 @@ -3996,63 +3945,109 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development and Source Control/363a3eea-baf9-4010-88ca-bb8186a2989d - evidence: "" - comments: "" tags: - none teamsImplemented: Default: false B: false C: false - API design validation: - uuid: 948a4d51-ceb5-4ebd-bdc7-d74ea25e171c - risk: Creation of insecure or non-compliant API. - measure: | - Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP - and validate the specification using specific tools. - Checks should be integrated in IDEs and CI/CD pipelines. + Block force pushes: + uuid: c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 + risk: "Misuse of force push can lead to loss of work. It may overwrite remote + \nbranches without warning, potentially erasing valuable contributions from + team members. This can disrupt collaboration, \ncause data loss, and create + confusion in the development process.\n\nBypassing the pull request process + might remove an important code review step. \nThis increases the risk of merging + low-quality or buggy code into the main branch, potentially introducing bugs + in the codebase." + measure: Mandate blocking of force pushes in the version control platform. difficultyOfImplementation: knowledge: 2 - time: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + references: + samm2: + - O-EM-1-A + iso27001-2017: + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Dismiss stale PR approvals: + uuid: ea6f69f7-54a5-4922-ac15-a77ff0c16162 + risk: Intentional or accidental alterations in critical branches like main (or + master) through post-approval code additions. + measure: Implement a policy where any commits made after a pull request has + been approved automatically revoke that approval, necessitating a fresh review + and re-approval process. + difficultyOfImplementation: + knowledge: 2 + time: 1 resources: 2 usefulness: 4 level: 3 + dependsOn: + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 implementation: - - uuid: 261f243e-f89c-4169-b076-b22a03ec00be - name: Spectral + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops tags: - - linting - - api - - documentation - url: https://github.com/stoplightio/spectral - description: | - Spectral is a flexible JSON/YAML linter built with extensibility in mind. - It uses JSON/YAML path rules to describe the problems you want to find. - - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f - name: API OAS Checker + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches tags: - - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. + - source-code-protection + - scm + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules references: samm2: - - V-ST-1-A + - O-EM-1-A iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 - 14.2.1 - - 14.2.5 iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 - 8.25 - - 8.27 - - 8.28 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/948a4d51-ceb5-4ebd-bdc7-d74ea25e171c - isImplemented: false - comments: "" + and Source Control/ea6f69f7-54a5-4922-ac15-a77ff0c16162 tags: - none teamsImplemented: @@ -4093,7 +4088,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development and Source Control/517b0957-4981-4ac0-b4c7-0d8d1934c474 - isImplemented: false comments: "" tags: - none @@ -4101,14 +4095,15 @@ Implementation: Default: false B: false C: false - Source Control Protection: + Require a PR before merging: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 - risk: Intentional or accidental alterations in critical branches like master. + risk: Intentional or accidental alterations in critical branches like main (or + master). measure: Define source code management system policies (e.g. branch protection - rules, mandatory code reviews, ...) to ensure that changes to critical branches - are only possible under defined conditions. These policies can be implemented - at repository level or organization level, depending on the source code management - system. + rules, mandatory code reviews from at least one person, ...) to ensure that + changes to critical branches are only possible under defined conditions. These + policies can be implemented at repository level or organization level, depending + on the source code management system. difficultyOfImplementation: knowledge: 2 time: 1 @@ -4116,6 +4111,53 @@ Implementation: usefulness: 4 level: 2 implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Require status checks to pass: + uuid: ac8730a2-ccc0-465c-9550-d91edae9d5ee + risk: Organizations risk introducing broken builds, quality issues, and security + vulnerabilities into their codebase. + measure: Mandate passing of security related specified status checks, like successful + builds or static application security tests, before proceeding. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops @@ -4138,18 +4180,14 @@ Implementation: samm2: - O-EM-1-A iso27001-2017: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - 6.1.2 - 14.2.1 iso27001-2022: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 - isImplemented: false - comments: "" + and Source Control/ac8730a2-ccc0-465c-9550-d91edae9d5ee tags: - none teamsImplemented: @@ -4186,8 +4224,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development and Source Control/066084c6-1135-4635-9cc5-9e75c7c5459f - isImplemented: false - comments: "" tags: - none teamsImplemented: @@ -4219,7 +4255,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/3a94d55e-fd82-4996-9eb3-20d23ff2a873 - isImplemented: false comments: "" tags: - none @@ -4260,7 +4295,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/5c61fd6b-8106-4c68-ac28-a8a42f1c67dc - isImplemented: false comments: "" tags: - none @@ -4332,7 +4366,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/5992c38c-8597-4035-89db-d15820d81c3a - isImplemented: false comments: "" tags: - none @@ -4373,7 +4406,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/6df508ef-86fc-4c22-bd9f-646c3127ce7d - isImplemented: false comments: "" tags: - none @@ -4446,7 +4478,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/dcf9601b-b4f2-4e25-9143-e39af75f7c33 - isImplemented: false comments: "" tags: - none @@ -4482,7 +4513,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/48e92bb1-fdba-40e8-b6c2-35de0d431833 - isImplemented: false comments: "" tags: - none @@ -4538,7 +4568,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/8b994601-575e-4ea5-b228-accb18c8e514 - isImplemented: false comments: "" tags: - none @@ -4585,7 +4614,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/4ce24abd-8ba6-494c-828d-4d193e28e4a1 - isImplemented: false comments: "" tags: - none @@ -4633,7 +4661,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/e5386abf-9154-4752-a1a8-c3a8900f732d - isImplemented: false comments: "" tags: - none @@ -4687,7 +4714,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/598e9f13-1ac8-4a01-b85e-8fab93ee81de - isImplemented: false comments: "" tags: - none @@ -4739,7 +4765,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/8098e416-e1ed-4ae4-a561-83efbe76bf57 - isImplemented: false comments: "" tags: - none @@ -4769,7 +4794,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/118b869b-3850-456e-98d9-1abdb85cbc5a - isImplemented: false comments: "" tags: - none @@ -4808,7 +4832,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/e14de741-94b3-447c-8b07-eea947d82e61 - isImplemented: false comments: "" tags: - none @@ -4849,7 +4872,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/070bb14b-e04a-4f3d-896a-a08eba7a35f9 - isImplemented: false comments: "" tags: - none @@ -4888,7 +4910,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/82e499d1-f463-4a4b-be90-68812a874af6 - isImplemented: false comments: "" tags: - none @@ -4922,7 +4943,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/f8e80f18-2503-4e3e-b3bc-7f67bb28defe - isImplemented: false comments: "" tags: - none @@ -4953,7 +4973,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/746025a6-dbfb-4087-a000-e46acab64ee1 - isImplemented: false comments: "" tags: - none @@ -4984,7 +5003,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/ad23be9c-5661-4f1f-81a3-5a5dc7061629 - isImplemented: false comments: "" tags: - none @@ -5015,7 +5033,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/0ff45fb8-7eef-46ed-9b3a-84c955cd7060 - isImplemented: false comments: "" tags: - none @@ -5047,7 +5064,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/ecb0184c-6bc9-45da-bbbb-a983797ffc93 - isImplemented: false comments: "" tags: - none @@ -5094,7 +5110,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/11b3848e-e931-4146-a35d-35409ada24ee - isImplemented: false comments: "" tags: - none @@ -5130,7 +5145,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/bfdacb52-1e3f-431d-ae72-d844a5e86415 - isImplemented: false comments: "" tags: - none @@ -5169,7 +5183,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure Hardening/760f1056-b0ee-4f22-a35b-f65446f944ca - isImplemented: false comments: "" tags: - none @@ -5254,7 +5267,7 @@ Implementation: B: false C: false WAF medium: - uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium risk: The threat from malicious inputs remains high, with exploits seeking to exploit any vulnerabilities present at the various points of entry to the application. @@ -5283,7 +5296,7 @@ Implementation: - 8.22 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium comments: ~ tags: - none @@ -5364,7 +5377,6 @@ Information Gathering: - 8.15 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/4eced38a-7904-4c45-adb0-50b663065540 - isImplemented: false comments: "" tags: - none @@ -5399,7 +5411,6 @@ Information Gathering: - 8.15 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccf4561d-253f-4762-adcb-bc4622fd6fc5 - isImplemented: false comments: "" tags: - none @@ -5465,7 +5476,6 @@ Information Gathering: risk: |- * No track of security-relevant events makes it harder to analyze an incident. * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. - isImplemented: false comments: "" tags: - none @@ -5520,7 +5530,6 @@ Information Gathering: - 5.31 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/613a73dc-4f60-49db-a6ce-4fb7bf8519f9 - isImplemented: false comments: "" tags: - none @@ -5561,7 +5570,6 @@ Information Gathering: - 8.15 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/7c735089-6a83-419f-8b27-c1e676cedea1 - isImplemented: false comments: "" tags: - none @@ -5594,7 +5602,6 @@ Information Gathering: - 8.8 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d03bc410-74a7-4e92-82cb-d01a020cb6bf - isImplemented: false comments: "" tags: - none @@ -5626,7 +5633,6 @@ Information Gathering: - 8.6 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ed715b38-c34b-40cd-83fd-ce807f306fc1 - isImplemented: false comments: "" tags: - none @@ -5661,7 +5667,6 @@ Information Gathering: - 8.31 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8a442d8e-0eb1-4793-a513-571aef982edd - isImplemented: false comments: "" tags: - none @@ -5700,7 +5705,6 @@ Information Gathering: - 8.8 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/1cd5e4b8-be36-4726-adc7-d8f843f47ac8 - isImplemented: false comments: "" tags: - none @@ -5741,7 +5745,6 @@ Information Gathering: - ISO 27001:2022 mapping is missing openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d0d681e7-d6de-4829-ac64-a9eb2546aa0d - isImplemented: false comments: "" tags: - none @@ -5773,7 +5776,6 @@ Information Gathering: - 8.6 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/7f36b9ba-bc05-4fd6-9a2a-73344c249722 - isImplemented: false comments: "" tags: - none @@ -5809,7 +5811,6 @@ Information Gathering: - 8.2 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e808028c-351c-42f1-bcd9-fba738d1fc55 - isImplemented: false comments: "" tags: - none @@ -5839,7 +5840,6 @@ Information Gathering: - 8.6 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/42170a71-d4c8-47af-bd71-bf36875fd05b - isImplemented: false comments: "" tags: - none @@ -5869,7 +5869,6 @@ Information Gathering: - ISO 27001:2022 mapping is missing openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/71699daf-b2a4-466b-a0b2-89f7dbb18506 - isImplemented: false comments: "" tags: - none @@ -5903,7 +5902,6 @@ Information Gathering: - 8.6 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/10e23a8c-22ff-4487-a706-87ccc9d0798e - isImplemented: false comments: "" tags: - none @@ -5936,7 +5934,6 @@ Information Gathering: - 5.26 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8746647c-638c-473f-8e17-82c068e4c311 - isImplemented: false comments: "" tags: - none @@ -5969,7 +5966,6 @@ Information Gathering: - 8.15 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e9a6d403-a467-445e-b98a-74f0c29da0b1 - isImplemented: false comments: "" tags: - none @@ -6002,7 +5998,6 @@ Information Gathering: - 8.6 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/f08a3219-6941-43ec-8762-4aff739f4664 - isImplemented: false comments: "" tags: - none @@ -6038,7 +6033,6 @@ Information Gathering: - 8.6 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/3d1f4c3b-f713-46d9-933a-54a014a26c03 - isImplemented: false comments: "" tags: - none @@ -6072,7 +6066,6 @@ Information Gathering: - 5.26 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d6f06ae8-401a-4f44-85df-1079247fa030 - isImplemented: false comments: "" tags: - none @@ -6103,7 +6096,6 @@ Information Gathering: - 8.6 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ded39bcf-4eaa-4c5f-9c94-09acde0a4734 - isImplemented: false comments: "" tags: - none @@ -6411,6 +6403,73 @@ Information Gathering: Default: false B: false C: false + SLA per criticality: + uuid: 123e4567-e89b-12d3-a456-426614174000 + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of how many of the vulnerabilities handling + per severity for components like applications are aligned to SLAs. \nThis + is performed for the hole organization and doesn't need to be broken down + (yet) on team/product/application. \nAt least quarterly." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-3-B + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/123e4567-e89b-12d3-a456-426614174000 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false Test and Verification: Application tests: High coverage of security related module and integration tests: @@ -6438,7 +6497,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application tests/67667c97-c33e-4306-a4e5-e7b1d8e10c5a - isImplemented: false comments: "" tags: - none @@ -6470,7 +6528,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application tests/f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 - isImplemented: false comments: "" tags: - none @@ -6514,7 +6571,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application tests/eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 - isImplemented: false tags: - none teamsImplemented: @@ -6548,7 +6604,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application tests/73aaae0b-5d68-4953-9fa4-fd25bf665f2a - isImplemented: false comments: "" tags: - none @@ -6606,7 +6661,6 @@ Test and Verification: - 5.1 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/7a82020c-94d1-471c-bbd3-5f7fe7df4876 - isImplemented: false comments: "" tags: - none @@ -6819,7 +6873,6 @@ Test and Verification: - 5.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/ce970c9b-da94-41cf-bd78-8c15357b7e8e - isImplemented: false comments: "" tags: - none @@ -6856,7 +6909,6 @@ Test and Verification: - 5.1 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/27337442-e4b1-4e87-8dc9-ce86fbb79a39 - isImplemented: false comments: "" tags: - none @@ -6900,7 +6952,6 @@ Test and Verification: - 5.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c1acc8af-312e-4503-a817-a26220c993a0 - isImplemented: false comments: "" tags: - none @@ -6973,7 +7024,6 @@ Test and Verification: - 5.1 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/55f4c916-3a34-474d-ad96-9a9f7a4f6a83 - isImplemented: false comments: "" tags: - none @@ -7003,7 +7053,6 @@ Test and Verification: - 5.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d - isImplemented: false comments: "" tags: - none @@ -7106,7 +7155,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 implementation: [] - isImplemented: false tags: - none teamsImplemented: @@ -7136,7 +7184,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 implementation: [] - isImplemented: false tags: - none teamsImplemented: @@ -7230,7 +7277,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for applications/d0ba0be5-c573-405f-b905-b7a8f87a9cc7 - isImplemented: false comments: "" tags: - none @@ -7269,7 +7315,6 @@ Test and Verification: name: Ajax Spider tags: [] url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ - isImplemented: false comments: "" tags: - none @@ -7326,7 +7371,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for applications/6a9cb303-0f98-48a8-bdcd-56d41c0012b8 - isImplemented: false comments: "" tags: - none @@ -7369,7 +7413,6 @@ Test and Verification: url: https://github.com/schemathesis/schemathesis description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - isImplemented: false comments: "" tags: - none @@ -7408,7 +7451,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for applications/845f06ec-148c-4c67-9755-7041911dcca5 - isImplemented: false comments: "" tags: - none @@ -9663,7 +9705,6 @@ Test and Verification: sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. - isImplemented: false comments: "" tags: - none @@ -9711,7 +9752,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for applications/07796811-37f9-467c-9ff2-48f346e77ff3 - isImplemented: false comments: "" tags: - none @@ -9753,7 +9793,6 @@ Test and Verification: - zap description: | Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - isImplemented: false assessment: For REST APIs, multiple OAuth2 scopes are used. comments: "" tags: @@ -9797,7 +9836,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for applications/5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea - isImplemented: false comments: "" tags: - none @@ -9833,7 +9871,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for infrastructure/ab5725aa-4d53-47b9-96df-c14b3fa93bcd - isImplemented: false comments: "" tags: - none @@ -9880,7 +9917,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for infrastructure/a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 - isImplemented: false comments: "" tags: - none @@ -9918,7 +9954,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for infrastructure/dccf1949-b9a8-4ce8-b992-6a4a7f3a623a - isImplemented: false dependsOn: - Evaluation of the trust of used components tags: @@ -9964,7 +9999,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for infrastructure/6532c1fe-9d23-4228-8722-558ddabca7d4 - isImplemented: false comments: "" tags: - none @@ -10005,7 +10039,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for infrastructure/6d2c3ac6-8afc-4af6-a5e9-6188341aca01 - isImplemented: false comments: "" tags: - none @@ -10058,7 +10091,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for infrastructure/7bb70764-9392-4462-935d-e55b2e148199 - isImplemented: false comments: "" tags: - none @@ -10094,7 +10126,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for infrastructure/61e10f9c-e126-4ffa-af12-fdbe0d0a831f - isImplemented: false comments: "" tags: - none @@ -10114,8 +10145,8 @@ Test and Verification: knowledge: 2 time: 2 resources: 2 - usefulness: 4 - level: 2 + usefulness: 3 + level: 3 implementation: - uuid: 261f243e-f89c-4169-b076-b22a03ec00be name: Spectral @@ -10150,10 +10181,8 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 - isImplemented: false dependsOn: - 2a44b708-734f-4463-b0cb-86dc46344b2f - comments: "" tags: - none teamsImplemented: @@ -10161,7 +10190,7 @@ Test and Verification: B: false C: false Dead code elimination: - uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + uuid: a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d risk: Dead code increases the attack surface (use of hard coded credentials and variables, sensitive information) measure: Collection of unused code and then manual removal of unused code. @@ -10190,7 +10219,7 @@ Test and Verification: - 8.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 + depth for applications/a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d comments: "" tags: - none @@ -11399,7 +11428,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/6e180abc-7c98-4265-b4e9-852cb91b067b - isImplemented: false comments: "" tags: - none @@ -11462,7 +11490,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/07fe8c4f-ae33-4409-b1b2-cf64cfccea86 - isImplemented: false comments: "" tags: - none @@ -12677,7 +12704,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 - isImplemented: false comments: "" tags: - none @@ -12741,7 +12767,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/ee68331f-9b1d-4f61-844b-b2ea04753a84 - isImplemented: false comments: "" tags: - none @@ -12809,7 +12834,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/e237176b-bec5-447d-a926-e37d6dd60e4b - isImplemented: false comments: "" tags: - none @@ -12872,7 +12896,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/6c05c837-8c99-46e2-828b-7c903e27dba4 - isImplemented: false comments: "" tags: - none @@ -12929,7 +12952,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 - isImplemented: false comments: "" tags: - none @@ -12938,7 +12960,7 @@ Test and Verification: B: false C: false Test for Patch Deployment Time: - uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + uuid: 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities in production artifacts. measure: | @@ -12970,7 +12992,7 @@ Test and Verification: - 8.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 + depth for applications/0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 comments: "" meta: implementationGuide: Self implementation. This activity is not repeated in @@ -12983,7 +13005,7 @@ Test and Verification: B: false C: false Test for Time to Patch: - uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities in production artifacts. measure: |- @@ -13023,7 +13045,7 @@ Test and Verification: - 8.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 + depth for applications/13af1227-3dd1-4d4f-a9e9-53deb793c18f comments: "" meta: implementationGuide: Usage of a version control platform API (e.g. github @@ -13036,7 +13058,7 @@ Test and Verification: B: false C: false Test libyear: - uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + uuid: 87b54313-fafd-4860-930f-5ef132b3e4ad risk: Vulnerabilities in running artifacts stay for long and might get exploited. measure: Test `libyear`, which provides a good insight how good patch management is. @@ -13070,7 +13092,7 @@ Test and Verification: - 8.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 + depth for applications/87b54313-fafd-4860-930f-5ef132b3e4ad comments: "" meta: implementationGuide: | @@ -13112,7 +13134,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/297be001-8d94-41ee-ab29-207020d423c0 - isImplemented: false comments: "" tags: - none @@ -13145,7 +13166,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/b217c8bb-5d61-4b41-a675-1083993f83b1 - isImplemented: false comments: "" tags: - none @@ -13194,7 +13214,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/7de0ae33-6538-45cd-8222-a1475647ba58 - isImplemented: false comments: "" tags: - none @@ -13249,7 +13268,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/26e1c6d5-5632-4ec7-80d2-e564b98732ad - isImplemented: false comments: "" tags: - none @@ -13290,7 +13308,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/621fb6a5-5c0a-4408-826a-068868bb031b - isImplemented: false comments: "" tags: - none @@ -13335,7 +13352,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b - isImplemented: false comments: "" tags: - none @@ -13380,7 +13396,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/837f8f90-adc2-4e6b-9ebb-60c2ee29494d - isImplemented: false comments: "" tags: - none @@ -13413,7 +13428,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/cb6321aa-0fbf-4996-9e08-05ab26ef4c1e - isImplemented: false comments: "" tags: - none @@ -13455,7 +13469,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/c6e3c812-56e2-41b0-ae01-b7afc41a004c - isImplemented: false comments: "" tags: - none @@ -13508,7 +13521,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/13367d8f-e37f-4197-a610-9ffca4fde261 - isImplemented: false comments: "" tags: - none @@ -13555,7 +13567,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/58825d22-1ce6-4748-af81-0ec9956e4129 - isImplemented: false comments: "" tags: - none @@ -13596,7 +13607,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc - isImplemented: false comments: "" tags: - none @@ -13656,7 +13666,6 @@ Test and Verification: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for infrastructure/8fc3de67-7b8d-420b-8d24-f35928cfed6e - isImplemented: false tags: - none teamsImplemented: @@ -13694,7 +13703,6 @@ Test and Verification: - 8.8 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/79ef8103-e1ed-4055-8df8-fd2b2015bebe - isImplemented: false comments: "" tags: - none @@ -13730,7 +13738,6 @@ Test and Verification: - 8.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 - isImplemented: false comments: "" tags: - none @@ -13763,7 +13770,6 @@ Test and Verification: - 8.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/ab0a4b51-3b18-43f1-a6fc-a98e4b28453d - isImplemented: false comments: "" tags: - none @@ -13797,7 +13803,6 @@ Test and Verification: - 8.27 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/2ebfc421-8c76-415c-a3b0-fa518915bd10 - isImplemented: false comments: "" tags: - none @@ -13830,7 +13835,6 @@ Test and Verification: - 8.29 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/598897a2-358e-441f-984c-e12ec4f6110a - isImplemented: false comments: "" tags: - none @@ -13838,4 +13842,4 @@ Test and Verification: Default: false B: false C: false -... \ No newline at end of file +... From cd76d117b9befb762c60adb3a0d999b2625fd2f6 Mon Sep 17 00:00:00 2001 From: William Golembieski Date: Tue, 24 Sep 2024 18:03:10 -0400 Subject: [PATCH 026/370] Update EducationAndGuidance.yaml Changing the description of security champion section to markdown to resolve build issues. --- .../EducationAndGuidance.yaml | 26 +++++-------------- 1 file changed, 6 insertions(+), 20 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index 3229463..27160d2 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -211,26 +211,12 @@ Culture and Organization: resources: 1 usefulness: 4 level: 2 - description: - "Implement a program where each software development team has a - member considered a \u201CSecurity Champion\u201D who is the liaison between - Information Security and developers. Depending on the size and structure of - the team the \u201CSecurity Champion\u201D may be a software developer, tester, - or a product manager. The \u201CSecurity Champion\u201D has a set number of - hours per week for Information Security related activities. They participate - in periodic briefings to increase awareness and expertise in different security - disciplines. \u201CSecurity Champions\u201D have additional training to help - develop these roles as Software Security subject-matter experts. You may need - to customize the way you create and support \u201CSecurity Champions\u201D - for cultural reasons.\n\nThe goals of the position are to increase effectiveness - and efficiency of application security and compliance and to strengthen the - relationship between various teams and Information Security. To achieve these - objectives, \u201CSecurity Champions\u201D assist with researching, verifying, - and prioritizing security and compliance related software defects. They are - involved in all Risk Assessments, Threat Assessments, and Architectural Reviews - to help identify opportunities to remediate security defects by making the - architecture of the application more resilient and reducing the attack threat - surface.\nSource: [OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/)\n" + description: | + Implement a program where each software development team has a member considered a "Security Champion" who is the liaison between Information Security and developers. Depending on the size and structure of the team the "Security Champion" may be a software developer, tester, or a product manager. The "Security Champion" has a set number of hours per week for Information Security related activities. They participate in periodic briefings to increase awareness and expertise in different security disciplines. "Security Champions" have additional training to help develop these roles as Software Security subject-matter experts. You may need to customize the way you create and support "Security Champions" for cultural reasons. + + The goals of the position are to increase effectiveness and efficiency of application security and compliance and to strengthen the relationship between various teams and Information Security. To achieve these objectives, "Security Champions" assist with researching, verifying, and prioritizing security and compliance related software defects. They are involved in all Risk Assessments, Threat Assessments, and Architectural Reviews to help identify opportunities to remediate security defects by making the architecture of the application more resilient and reducing the attack threat surface. + + [Source: OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/) implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-security-champ references: From 09b3e8a69936aec7b10dbdb293cbe41fc864edfe Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 15 Oct 2024 15:26:39 +0200 Subject: [PATCH 027/370] feat: add office hours, vuln management tools, epss --- .../EducationAndGuidance.yaml | 23 +++++++++++++++--- .../TestAndVerification/Consolidation.yaml | 17 +++++++++---- .../StaticDepthForApplications.yaml | 24 +++++++++++++++++++ src/assets/YAML/default/implementations.yaml | 21 ++++++++++++++++ .../dsomm-schema-test-and-verification.json | 7 ++---- 5 files changed, 79 insertions(+), 13 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index 3229463..17f73a7 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -27,9 +27,26 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - isImplemented: false - evidence: "" - comments: "" + Office Hours: + uuid: 185d5a74-19dc-4422-be07-44ea35226783 + risk: + Developers and Operations are not in contact with the security team and therefore do not ask prior implementation of (known or unknown) threats- + measure: + As a security team, be open for questions and hints during defined office hours. x x d + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 3 + implementation: + references: + samm2: + - G-EG-1-A + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 Security Coaching: uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 risk: Training does not change behaviour. Therefore, even if security practices are understood, it's likely that they are not performed. diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 9520a7e..35a2a54 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -297,8 +297,6 @@ Test and Verification: - 8.8 - 5.25 implementation: [] - isImplemented: false - evidence: "" Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: @@ -306,17 +304,26 @@ Test and Verification: In addition a correlation of the same finding from different tools is not possible. measure: - Aggregation of vulnerabilities in one tool reduce the workload to mark - false positives. + Aggregation of vulnerabilities in one tool reduce the workload to handle them, e.g. mark as false positives. difficultyOfImplementation: knowledge: 3 time: 3 resources: 2 usefulness: 2 + dependsOn: + - uuid:f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV + - uuid:6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion + - uuid:185d5a74-19dc-4422-be07-44ea35226783 # Office Hours level: 3 + description: |- + For known vulnerabilities a processes to estimate the exploit ability of a vulnerability is recommended. + + To implement a security culture including training, office hours and security champions can help integrating + security scanning at scale. Such activities help to understand why a vulnerability is potentially critical and needs handling. implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/SecObserve references: samm2: - I-DM-1-B @@ -417,4 +424,4 @@ Test and Verification: tags: - vulnerability-mgmt - metrics - - vmm-measurements \ No newline at end of file + - vmm-measurements diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 83d6888..92edf4b 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -318,6 +318,29 @@ Test and Verification: isImplemented: false evidence: "" comments: "" + Exploit likelihood estimation: + uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + risk: |- + Without proper prioritization, organizations may waste time and effort on low-risk vulnerabilities while neglecting critical ones. + measure: Estimate the likelihood of exploitation by using data (CISA KEV) from the past or prediction models (EPSS). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - uuid:d918cd44-a972-43e9-a974-eff3f4a5dcfe # SCA for server + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cisa-kev + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/epss + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 Software Composition Analysis (client side): uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 risk: Client side components might have vulnerabilities. @@ -331,6 +354,7 @@ Test and Verification: dependsOn: - Defined build process - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - uuid:f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index c98fb5d..320eb43 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -479,6 +479,13 @@ implementations: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + SecObserve: + uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: [vulnerability management system] + url: https://github.com/MaibornWolff/SecObserve + description: | + The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. see-other-actions-e: uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 name: See other actions, e.g. "Treatment of defects with severity high". @@ -954,3 +961,17 @@ implementations: url: https://jira.atlassian.com/ description: |- Jira is a bug tracking and project management tool developed by Atlassian, used by development teams for tracking issues, planning sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. + epss: + uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: [vulnerability] + url: https://www.first.org/epss/ + description: |- + Estimates the likelihood that a software vulnerability will be exploited. + cisa-kev: + uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: [vulnerability] + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: |- + A catalog of vulnerabilities that have been exploited. diff --git a/src/assets/YAML/schemas/dsomm-schema-test-and-verification.json b/src/assets/YAML/schemas/dsomm-schema-test-and-verification.json index 0a992f3..2a619bc 100644 --- a/src/assets/YAML/schemas/dsomm-schema-test-and-verification.json +++ b/src/assets/YAML/schemas/dsomm-schema-test-and-verification.json @@ -154,10 +154,7 @@ "usefulness", "level", "implementation", - "references", - "isImplemented", - "evidence", - "comments" + "references" ], "additionalProperties": false } @@ -169,4 +166,4 @@ "required": [ "Test and Verification" ] -} \ No newline at end of file +} From ca25d85b9bf7ceb92b95b55ee3ed18b272e3b307 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 15 Oct 2024 15:30:50 +0200 Subject: [PATCH 028/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 + src/assets/YAML/generated/generated.yaml | 210 ++++++++++++++++++++++- 2 files changed, 214 insertions(+), 3 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6ac4bed..3afac59 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [1.13.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.12.0...v1.13.0) (2024-10-15) + + +### Features + +* add office hours, vuln management tools, epss ([09b3e8a](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/09b3e8a69936aec7b10dbdb293cbe41fc864edfe)) + # [1.12.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.11.1...v1.12.0) (2024-09-23) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index f50f922..cf609e9 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -943,6 +943,14 @@ Build and Deployment: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + SecObserve: + uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: + - vulnerability management system + url: https://github.com/MaibornWolff/SecObserve + description: | + The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. see-other-actions-e: uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 name: See other actions, e.g. "Treatment of defects with severity high". @@ -1528,6 +1536,21 @@ Build and Deployment: sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. + epss: + uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will + be exploited. + cisa-kev: + uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. references: samm2: - I-SD-1-B @@ -2807,7 +2830,6 @@ Culture and Organization: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 - comments: "" tags: - none teamsImplemented: @@ -3052,6 +3074,35 @@ Culture and Organization: Default: false B: false C: false + Office Hours: + uuid: 185d5a74-19dc-4422-be07-44ea35226783 + risk: Developers and Operations are not in contact with the security team and + therefore do not ask prior implementation of (known or unknown) threats- + measure: As a security team, be open for questions and hints during defined + office hours. x x d + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 3 + implementation: ~ + references: + samm2: + - G-EG-1-A + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/185d5a74-19dc-4422-be07-44ea35226783 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false Regular security training for all: uuid: 9768f154-357a-4c06-af6f-d66570677c9b risk: Understanding security is hard. @@ -7195,14 +7246,23 @@ Test and Verification: risk: Maintenance of false positives in each tool enforces a high workload. In addition a correlation of the same finding from different tools is not possible. - measure: Aggregation of vulnerabilities in one tool reduce the workload to mark - false positives. + measure: Aggregation of vulnerabilities in one tool reduce the workload to handle + them, e.g. mark as false positives. difficultyOfImplementation: knowledge: 3 time: 3 resources: 2 usefulness: 2 + dependsOn: + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 + - 185d5a74-19dc-4422-be07-44ea35226783 level: 3 + description: "For known vulnerabilities a processes to estimate the exploit + ability of a vulnerability is recommended.\n\nTo implement a security culture + including training, office hours and security champions can help integrating + \nsecurity scanning at scale. Such activities help to understand why a vulnerability + is potentially critical and needs handling." implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -7219,6 +7279,13 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: + - vulnerability management system + url: https://github.com/MaibornWolff/SecObserve + description: | + The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. references: samm2: - I-DM-1-B @@ -8009,6 +8076,14 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + SecObserve: + uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: + - vulnerability management system + url: https://github.com/MaibornWolff/SecObserve + description: | + The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. see-other-actions-e: uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 name: See other actions, e.g. "Treatment of defects with severity high". @@ -8594,6 +8669,21 @@ Test and Verification: sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. + epss: + uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will + be exploited. + cisa-kev: + uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. - argocd: uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f name: argoCD @@ -9120,6 +9210,14 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + SecObserve: + uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: + - vulnerability management system + url: https://github.com/MaibornWolff/SecObserve + description: | + The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. see-other-actions-e: uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 name: See other actions, e.g. "Treatment of defects with severity high". @@ -9705,6 +9803,21 @@ Test and Verification: sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. + epss: + uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will + be exploited. + cisa-kev: + uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. comments: "" tags: - none @@ -10264,6 +10377,50 @@ Test and Verification: Default: false B: false C: false + Exploit likelihood estimation: + uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + risk: Without proper prioritization, organizations may waste time and effort + on low-risk vulnerabilities while neglecting critical ones. + measure: Estimate the likelihood of exploitation by using data (CISA KEV) from + the past or prediction models (EPSS). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - d918cd44-a972-43e9-a974-eff3f4a5dcfe + implementation: + - uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. + - uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will be + exploited. + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + tags: + - none + teamsImplemented: + Default: false + B: false + C: false Local development security checks performed: uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b risk: Creating and developing code contains code smells and quality issues. @@ -10821,6 +10978,14 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + SecObserve: + uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: + - vulnerability management system + url: https://github.com/MaibornWolff/SecObserve + description: | + The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. see-other-actions-e: uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 name: See other actions, e.g. "Treatment of defects with severity high". @@ -11406,6 +11571,21 @@ Test and Verification: sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. + epss: + uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will + be exploited. + cisa-kev: + uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 name: DevSecOps control Pre-commit url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop @@ -11449,6 +11629,7 @@ Test and Verification: dependsOn: - Defined build process - 2a44b708-734f-4463-b0cb-86dc46344b2f + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad implementation: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js @@ -12078,6 +12259,14 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + SecObserve: + uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: + - vulnerability management system + url: https://github.com/MaibornWolff/SecObserve + description: | + The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. see-other-actions-e: uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 name: See other actions, e.g. "Treatment of defects with severity high". @@ -12663,6 +12852,21 @@ Test and Verification: sprints, and managing software releases. It offers features for creating and managing tasks, assigning them to team members, and monitoring progress through customizable workflows and dashboards. + epss: + uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will + be exploited. + cisa-kev: + uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. references: samm2: - V-ST-2-A From 93aa2e91f732f03d54c273e9bbd53a6e4a8a977b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 7 Nov 2024 13:14:43 +0100 Subject: [PATCH 029/370] feat: replace acitivity uuids with activity names --- yaml-generation/generateDimensions.php | 26 +++++++++++++++++++++++++- 1 file changed, 25 insertions(+), 1 deletion(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index a0acab3..9194f58 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -33,6 +33,29 @@ $dimensionCustom = getDimensions($filename); $dimensionsCustom = array_merge_recursive_ex($dimensionsCustom, $dimensionCustom); } + +$uuidArray=array(); +foreach ($dimensionsCustom as $dimension => $subdimensions) { + ksort($subdimensions); + $uuidArray[$dimension] = array(); + foreach ($subdimensions as $subdimension => $elements) { + $uuidArray[$dimension][$subdimension] = array(); + foreach ($elements as $activityName => $activity) { + if(str_starts_with($activityName, "uuid:" )) { + echo "activity name $activityName is having a uuuid\n"; + $activityUuid = str_replace("uuid:", "", $activityName); + $activityName = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); + $uuidArray[$dimension][$subdimension][$activityName]=$dimensionsAggregated[$dimension][$subdimension][$activityUuid]; + + array_merge_recursive_ex($dimensionsCustom, $uuidArray); + unset($dimensionsCustom[$dimension][$subdimension][$activityUuid]); + echo "exchanged uuid $activityUuid to name $activityName"; + } + } + } +} + + if (sizeof($files) > 0) { $dimensions = array_merge_recursive_ex($dimensions, $dimensionsCustom); foreach (getActions($dimensions) as list($dimension, $subdimension, $activities)) { @@ -67,7 +90,8 @@ var_dump($activity); echo ""; exit; - } + } + if (!array_key_exists("tags", $activity)) { $dimensionsAggregated[$dimension][$subdimension][$activityName]["tags"] = ["none"]; } From 0e8f3b2df8400af15d2c9a218129ab463a5be423 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 7 Nov 2024 13:17:41 +0100 Subject: [PATCH 030/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3afac59..4502792 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [1.14.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.13.0...v1.14.0) (2024-11-07) + + +### Features + +* replace acitivity uuids with activity names ([93aa2e9](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/93aa2e91f732f03d54c273e9bbd53a6e4a8a977b)) + # [1.13.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.12.0...v1.13.0) (2024-10-15) From 994bfd404e3be12dc0364cf9992ff24fd3f330ae Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 7 Nov 2024 13:26:22 +0100 Subject: [PATCH 031/370] revert uuid --- yaml-generation/generateDimensions.php | 24 ++---------------------- 1 file changed, 2 insertions(+), 22 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 9194f58..d13d425 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -34,28 +34,6 @@ $dimensionsCustom = array_merge_recursive_ex($dimensionsCustom, $dimensionCustom); } -$uuidArray=array(); -foreach ($dimensionsCustom as $dimension => $subdimensions) { - ksort($subdimensions); - $uuidArray[$dimension] = array(); - foreach ($subdimensions as $subdimension => $elements) { - $uuidArray[$dimension][$subdimension] = array(); - foreach ($elements as $activityName => $activity) { - if(str_starts_with($activityName, "uuid:" )) { - echo "activity name $activityName is having a uuuid\n"; - $activityUuid = str_replace("uuid:", "", $activityName); - $activityName = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); - $uuidArray[$dimension][$subdimension][$activityName]=$dimensionsAggregated[$dimension][$subdimension][$activityUuid]; - - array_merge_recursive_ex($dimensionsCustom, $uuidArray); - unset($dimensionsCustom[$dimension][$subdimension][$activityUuid]); - echo "exchanged uuid $activityUuid to name $activityName"; - } - } - } -} - - if (sizeof($files) > 0) { $dimensions = array_merge_recursive_ex($dimensions, $dimensionsCustom); foreach (getActions($dimensions) as list($dimension, $subdimension, $activities)) { @@ -67,6 +45,8 @@ } } } +} + } else { $dimensionsAggregated = $dimensions; } From e3a5e72a00567e923b1d6842ed483530e78d8669 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 13 Nov 2024 09:09:10 +0100 Subject: [PATCH 032/370] fix: add secure headers and Containers are running as non-root --- .../Implementation/ApplicationHardening.yaml | 108 +++++++++++++++++- .../InfrastructureHardening.yaml | 2 - src/assets/YAML/default/implementations.yaml | 10 ++ src/assets/YAML/meta.yaml | 47 -------- src/assets/YAML/teams.yaml | 9 -- 5 files changed, 115 insertions(+), 61 deletions(-) delete mode 100644 src/assets/YAML/meta.yaml delete mode 100644 src/assets/YAML/teams.yaml diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml index bb71462..52ac48e 100755 --- a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml +++ b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml @@ -222,8 +222,110 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - isImplemented: false - evidence: "" - comments: "" dependsOn: - App. Hardening Level 2 + Secure headers: + uuid: 29318d60-18ce-4526-80ea-f5928e49f639 + risk: | + Missing or misconfigured security headers can lead to various security vulnerabilities, e.g.: + - Cross-Site Scripting (XSS) due to missing Content Security Policy + - Clickjacking attacks due to missing X-Frame-Options + - Information disclosure through Server header exposure + - SSL/TLS downgrade attacks due to missing HSTS + - Cross-site scripting and injection due to missing security headers + measure: | + Implement and enforce security headers across all applications and services + + Implementation Methods: + 1. Reverse Proxy/Load Balancer: Configure at nginx/Apache level + 2. Web Application: Implement in the application middleware + 3. Service Mesh: Configure at the ingress controller level + 4. Standard Docker Image: Use secure base images with preset headers + + Remove or Secure: + - Server header: Hide server version information + - X-Powered-By: Remove technology stack information + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-secure-headers + meta: + implementationGuide: | + Essential headers: + - Content-Security-Policy: Define trusted sources for content + - Strict-Transport-Security: Enforce HTTPS connections + - X-Frame-Options: Prevent clickjacking attacks + - X-Content-Type-Options: Prevent MIME-type sniffing + - X-XSS-Protection: Enable browser's XSS filtering + - Referrer-Policy: Control information in the Referrer header + references: + samm2: + - D-SR-3-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/cre/620-421 + Containers are running as non-root: + uuid: a86c1fbc-28fd-4610-89a3-a7f73acfe45f + risk: |- + There are various reasons to run a container as non-root. Samples are listed: + ## Container Escape Vectors + + - Root privileges significantly increase the chance of breaking container isolation + - Root access can be leveraged to exploit kernel vulnerabilities + - Compromised root containers provide attackers with maximum privileges inside the container + - Greater potential for escaping container boundaries to the host system + + ## Host System Vulnerabilities + + Root containers can potentially: + + - Mount sensitive host filesystems + - Access critical device files + - Modify host network settings + - Interact with host system processes + - Override security controls + + ## Resource Management Issues + + Root privileges may allow containers to: + + - Bypass resource quotas and limits + - Modify control group (cgroup) settings + - Interfere with other containers' resources + - Circumvent memory and CPU restrictions + + Security Boundary Weakening + + - Violates the principle of least privilege + - Provides unnecessary elevated permissions + - Expands the potential attack surface + - Increases the impact of a successful compromise + + measure: |- + Containers are running as non-root. This can be enforced in the image itself or during runtime parameters + (e.g. `podman run --user [...]`). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 \ No newline at end of file diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 711081d..78a0f34 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -96,8 +96,6 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 - isImplemented: false - evidence: "" comments: "" Backup: uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 320eb43..ea37d59 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -975,3 +975,13 @@ implementations: url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog description: |- A catalog of vulnerabilities that have been exploited. + owasp-secure-headers: + uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: [header, documentation] + url: https://owasp.org/www-project-secure-headers/ + description: |- + The OWASP Secure Headers Project (also called OSHP) describes HTTP response headers that your application can use + to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers + from running into easily preventable vulnerabilities. The OWASP Secure Headers Project intends to raise awareness + and use of these headers. diff --git a/src/assets/YAML/meta.yaml b/src/assets/YAML/meta.yaml deleted file mode 100644 index e1b1b7e..0000000 --- a/src/assets/YAML/meta.yaml +++ /dev/null @@ -1,47 +0,0 @@ ---- -# -# Various strings and messages -# -strings: - en: &en - references: - samm2: - label: OWASP SAMM VERSION 2 - description: |- - Software Assurance Maturity Model - The Software Assurance Maturity Model (SAMM) is an open framework to help organizations formulate - and implement a strategy for software security that is tailored - to the specific risks facing the organization. - https://owaspsamm.org/blog/2020/01/31/samm2-release/ - iso27001-2017: - label: ISO 27001:2017 - description: |- - ISO 27001:2017 - iso27001-2022: - label: ISO 27001:2022 - description: |- - ISO 27001:2022 - labels: ['Very Low', 'Low', 'Medium', 'High', 'Very High'] - KnowledgeLabels: - [ - 'Very Low (one discipline)', - 'Low (one discipline)', - 'Medium (two disciplines)', - 'High (two disciplines)', - 'Very High (three or more disciplines)', - ] - hardness: ['Very soft', 'Soft', 'Medium', 'High', 'Very high'] - maturity_levels: - [ - 'Level 1: Basic understanding of security practices', - 'Level 2: Adoption of basic security practices', - 'Level 3: High adoption of security practices', - 'Level 4: Very high adoption of security practices', - 'Level 5: Advanced deployment of security practices at scale', - ] -# Default team -teams: ['Default', 'B', 'C'] -teamGroups: - GroupA: ['Default', 'B'] - GroupB: ['B', 'C'] - GroupC: ['Default', 'C'] diff --git a/src/assets/YAML/teams.yaml b/src/assets/YAML/teams.yaml deleted file mode 100644 index cbdecfa..0000000 --- a/src/assets/YAML/teams.yaml +++ /dev/null @@ -1,9 +0,0 @@ ---- -# -# Teams -# -teams: ['A', 'B', 'C'] -teamGroups: - AB: ['A', 'B'] - BC: ['B', 'C'] - AC: ['A', 'C'] From a30959f88609c33fdfa56509f035e333458b7b62 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 13 Nov 2024 09:13:43 +0100 Subject: [PATCH 033/370] fix: brakets --- yaml-generation/generateDimensions.php | 2 -- 1 file changed, 2 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index d13d425..5e29a9a 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -45,8 +45,6 @@ } } } -} - } else { $dimensionsAggregated = $dimensions; } From 2bc6246e0adb2db2ceb05ac8d975ac3be2418aeb Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 3 Jan 2025 17:59:17 +0100 Subject: [PATCH 034/370] feat: enhance descriptions --- .../default/BuildAndDeployment/Build.yaml | 4 +- .../Implementation/ApplicationHardening.yaml | 9 +-- .../InfrastructureHardening.yaml | 6 +- .../InformationGathering/Monitoring.yaml | 20 ++++--- .../TestAndVerification/Consolidation.yaml | 55 ++++++------------- .../TestAndVerification/Test-Intensity.yaml | 2 +- .../schemas/dsomm-schema-implementation.json | 16 ++++-- 7 files changed, 51 insertions(+), 61 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 4a75e22..40c7258 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -48,9 +48,7 @@ Build and Deployment: A well defined build process lowers the possibility of errors during the build process. description: | - Sample evidence as an attribute in the yaml: The build process is defined in [REPLACE-ME Pipeline](https://replace-me/jenkins/job) - in the folder _vars_. Projects are using a _Jenkinsfile_ to use the - defined process. + A build process can be defined in code, for example in a `Jenkinsfile`. difficultyOfImplementation: knowledge: 2 time: 3 diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml index 52ac48e..341f055 100755 --- a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml +++ b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml @@ -49,14 +49,16 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - isImplemented: false comments: "" Contextualized Encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 risk: The generation of interpreter directives from user-provided data poses difficulties and can introduce vulnerabilities to injection attacks. measure: | - Implementing contextualized encoding, such as employing object-relational mapping tools or utilizing prepared statements, nearly removes the threat of injection vulnerabilities. + Implementing contextualized encoding fpr the next interpreter, such as employing object-relational mapping tools + or utilizing prepared statements, nearly removes the threat of injection vulnerabilities. + + Also take into account a a secure by default UI framework, which performs automatic contextual encoding of outputs with potential malicious user input (e.g. angular). difficultyOfImplementation: knowledge: 2 time: 2 @@ -75,6 +77,7 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + comments: "" App. Hardening Level 1: uuid: cf819225-30cb-4702-8e32-60225eedc33d risk: @@ -155,7 +158,6 @@ Implementation: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 1 @@ -189,7 +191,6 @@ Implementation: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 isImplemented: false - evidence: "" comments: "" dependsOn: - App. Hardening Level 2 (75%) diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 78a0f34..f4f6980 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -511,9 +511,11 @@ Implementation: risk: Evil actors might be able to perform a man in the middle attack and sniff confidential information (e.g. authentication factors like passwords) - measure: + measure: |- By using encryption at the edge of traffic in transit, it is impossible - or at least harder to sniff credentials being outside of the organization. + or at least harder to sniff credentials or information being outside of the organization. + + Useage of standard protocols like HTTPS is recommended. difficultyOfImplementation: knowledge: 2 time: 2 diff --git a/src/assets/YAML/default/InformationGathering/Monitoring.yaml b/src/assets/YAML/default/InformationGathering/Monitoring.yaml index 450dbc9..510ef8f 100755 --- a/src/assets/YAML/default/InformationGathering/Monitoring.yaml +++ b/src/assets/YAML/default/InformationGathering/Monitoring.yaml @@ -291,15 +291,23 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 - isImplemented: false - evidence: "" comments: "" Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 risk: Attacks on an application are not recognized. - measure: - Gathering of application metrics helps to identify incidents like brute - force attacks, login/logout. + measure: |- + Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: + - Authentication attempts (successful/failed logins) + - Transaction volumes and patterns (e.g. orders, payments) + - API call rates and response times + - User session metrics + - Resource utilization + + Example: An e-commerce application normally processes 100 orders per hour. A sudden spike to 1000 orders per hour could indicate either: + - A legitimate event (unannounced marketing campaign, viral social media post) + - A security incident (automated bulk purchase bots, credential stuffing attack) + + By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. difficultyOfImplementation: knowledge: 2 time: 2 @@ -315,8 +323,6 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 - isImplemented: false - evidence: "" comments: "" Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 35a2a54..5976981 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -39,35 +39,6 @@ Test and Verification: - 5.13 - 5.10 tags: ["vuln-action", "defect-management"] - Fix based on severity: - uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 - risk: |- - Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings. - measure: | - Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. - - On level one, fix only critical findings. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 1 - implementation: - references: - samm2: - - I-DM-3-B - iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.10 - tags: ["vuln-action", "defect-management"] Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 risk: @@ -168,11 +139,19 @@ Test and Verification: uuid: c1acc8af-312e-4503-a817-a26220c993a0 risk: As false positive occur during each test, all vulnerabilities might be - ignored. - measure: - False positives are suppressed so they will not show up on the next - tests again. Most security tools have the possibility to suppress false positives. - A Vulnerability Management System might be used. + ignored. Specially, if tests are automated an run daily. + measure: |- + Findings from security tests must be triaged and outcomes persistend/documented to: + - Prevent re-analysis of known issues in subsequent test runs + - Track accepted risks vs false positives + - Enable consistent decision-making across teams + + At this maturity level, a simple tracking system suffices - tools need only distinguish between "triaged" and "untriaged" findings, without complex categorization. Some tools refer to this as "suppression" of findings. + + Samples for false positive handling: + - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) + - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) + - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling] difficultyOfImplementation: knowledge: 1 time: 1 @@ -248,9 +227,8 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 - isImplemented: false - evidence: "" - comments: "" + tags: ["vuln-action", "defect-management"] + comments: ""# Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 risk: Vulnerabilities with severity high or higher are not visible. @@ -274,7 +252,7 @@ Test and Verification: - 8.8 - 5.25 implementation: [] - isImplemented: false + tags: ["vuln-action", "defect-management"] evidence: "" Treatment of defects with severity middle: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 @@ -297,6 +275,7 @@ Test and Verification: - 8.8 - 5.25 implementation: [] + tags: ["vuln-action", "defect-management"] Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: diff --git a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml index 882b3f4..069fe3c 100755 --- a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml +++ b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml @@ -70,7 +70,7 @@ Test and Verification: risk: Time pressure and ignorance might lead to false predictions for the test intensity. - measure: The intensity of the used tools are not modified to safe time. + measure: The intensity of the used tools are not modified to save time. difficultyOfImplementation: knowledge: 1 time: 1 diff --git a/src/assets/YAML/schemas/dsomm-schema-implementation.json b/src/assets/YAML/schemas/dsomm-schema-implementation.json index d94a192..b842e16 100644 --- a/src/assets/YAML/schemas/dsomm-schema-implementation.json +++ b/src/assets/YAML/schemas/dsomm-schema-implementation.json @@ -135,11 +135,17 @@ "iso27001-2022" ] }, - "isImplemented": { - "type": "boolean" + "teamsImplemented": { + "type": "array", + "items": { + "type": "object" + } }, - "evidence": { - "type": "string" + "teamsEvidence": { + "type": "array", + "items": { + "type": "object" + } }, "comments": { "type": "string" @@ -155,8 +161,6 @@ "level", "implementation", "references", - "isImplemented", - "evidence", "comments" ], "additionalProperties": false From c1ae63f0c6c6ff821405ae353ef111c341b4572e Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Wed, 8 Jan 2025 23:04:03 +0100 Subject: [PATCH 035/370] Suggested improvements, and spelling corrections --- .../YAML/default/CultureAndOrganization/Process.yaml | 9 ++++++--- .../default/Implementation/ApplicationHardening.yaml | 4 ++-- .../default/Implementation/InfrastructureHardening.yaml | 4 ++-- .../YAML/default/TestAndVerification/Consolidation.yaml | 6 +++--- 4 files changed, 13 insertions(+), 10 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index 9564715..825e1c1 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -58,15 +58,18 @@ Culture and Organization: comments: "" Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 + description: + A _Business Continuity and Disaster Recovery_ (BCDR) is a plan and a process + that helps a business to return to normal operations if a disaster occurs. risk: - In case of an emergency, like a power outage, DR actions to perform are - not clear. This leads to reaction and remediation delays. + If the disaster recovery actions are not clear, you risk slow reaction and remediation delays. + This applies to cyber attacks as well as natural emergencies, such as a power outage. measure: By understanding and documenting a business continuity and disaster recovery (BCDR) plan, the overall availability of systems and applications is increased. Success factors like responsibilities, Service Level Agreements, Recovery Point Objectives, Recovery Time Objectives or Failover must be fully - documented and understood. + documented and understood by the people involved in the recovery. difficultyOfImplementation: knowledge: 4 time: 3 diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml index 341f055..67f77f4 100755 --- a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml +++ b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml @@ -55,10 +55,10 @@ Implementation: risk: The generation of interpreter directives from user-provided data poses difficulties and can introduce vulnerabilities to injection attacks. measure: | - Implementing contextualized encoding fpr the next interpreter, such as employing object-relational mapping tools + Implementing contextualized encoding for the next interpreter, such as employing object-relational mapping tools or utilizing prepared statements, nearly removes the threat of injection vulnerabilities. - Also take into account a a secure by default UI framework, which performs automatic contextual encoding of outputs with potential malicious user input (e.g. angular). + Also take into account a secure by default UI framework, which performs automatic contextual encoding of outputs with potential malicious user input (e.g. angular). difficultyOfImplementation: knowledge: 2 time: 2 diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index f4f6980..cb85064 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -510,12 +510,12 @@ Implementation: uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 risk: Evil actors might be able to perform a man in the middle attack and sniff - confidential information (e.g. authentication factors like passwords) + confidential information (e.g. authentication factors like passwords). measure: |- By using encryption at the edge of traffic in transit, it is impossible or at least harder to sniff credentials or information being outside of the organization. - Useage of standard protocols like HTTPS is recommended. + Using standard secure protocols like HTTPS is recommended. difficultyOfImplementation: knowledge: 2 time: 2 diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 5976981..fbd9c96 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -23,7 +23,7 @@ Test and Verification: dependsOn: - uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425 # Fix based on severity #- uuid:3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f #iventory of apps + - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: references: samm2: @@ -141,7 +141,7 @@ Test and Verification: As false positive occur during each test, all vulnerabilities might be ignored. Specially, if tests are automated an run daily. measure: |- - Findings from security tests must be triaged and outcomes persistend/documented to: + Findings from security tests must be triaged and outcomes persisted/documented to: - Prevent re-analysis of known issues in subsequent test runs - Track accepted risks vs false positives - Enable consistent decision-making across teams @@ -228,7 +228,7 @@ Test and Verification: - 8.8 - 5.25 tags: ["vuln-action", "defect-management"] - comments: ""# + comments: "" Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 risk: Vulnerabilities with severity high or higher are not visible. From dc8662cb18afbf6ceb87b728c2daa12b18dc2725 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 26 Jan 2025 17:23:17 +0100 Subject: [PATCH 036/370] change dependsOn to uuid:44f2c8a9-4aaa-4c72-942d-63f78b89f385 # --- src/assets/YAML/default/TestAndVerification/Consolidation.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index fbd9c96..0b9ce2b 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -21,7 +21,7 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425 # Fix based on severity + - uuid:44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher: #- uuid:3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: From 7ccfebb515dc2eb7cc4f396f6a7cad96f8f043d7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 26 Jan 2025 17:26:07 +0100 Subject: [PATCH 037/370] chore: add link to FP in DefectDojo docs --- src/assets/YAML/default/TestAndVerification/Consolidation.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 0b9ce2b..d7e4252 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -151,7 +151,7 @@ Test and Verification: Samples for false positive handling: - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) - - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling] + - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) difficultyOfImplementation: knowledge: 1 time: 1 From 329429410f7b97e3c18cce002f862322eabbe5ee Mon Sep 17 00:00:00 2001 From: RafaInformatico <39882958+RafaInformatico@users.noreply.github.com> Date: Sat, 1 Feb 2025 11:32:15 +0100 Subject: [PATCH 038/370] Update DynamicDepthForApplications.yaml Completed missing end for the risk of Coverage of client-side dynamic components --- .../TestAndVerification/DynamicDepthForApplications.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml index 33c4165..0690259 100755 --- a/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml @@ -30,7 +30,9 @@ Test and Verification: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript - is not getting executed. Therefore, the co + is not getting executed. Therefore, the coverage of client-side dynamic + components is limited, leading to potential security risks and undetected + vulnerabilities. measure: Usage of a spider which executes dynamic content like JavaScript, e.g. via Selenium. From 16c13cd5379850a2402ff48e41844c14284b6ca5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 2 Feb 2025 17:58:37 +0100 Subject: [PATCH 039/370] move high test intensity to level 3 see https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/issues/362 --- src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml index 882b3f4..ac0f1fe 100755 --- a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml +++ b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml @@ -105,7 +105,7 @@ Test and Verification: time: 3 resources: 5 usefulness: 3 - level: 1 + level: 3 implementation: [] references: samm2: From 3324d0ca5563df42512d95f9f1d95948f5013d2b Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 3 Feb 2025 23:03:54 +0100 Subject: [PATCH 040/370] Fixes typo in EVIL user stories --- src/assets/YAML/default/CultureAndOrganization/Design.yaml | 4 ++-- src/assets/YAML/default/implementations.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/Design.yaml b/src/assets/YAML/default/CultureAndOrganization/Design.yaml index efa66cd..7b205d7 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Design.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Design.yaml @@ -181,7 +181,7 @@ Culture and Organization: dependsOn: - Creation of simple abuse stories implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/don-t-forget-evil-u + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/don-t-forget-evil-user-stories references: samm2: - D-TA-2-B @@ -213,7 +213,7 @@ Culture and Organization: usefulness: 4 level: 3 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/don-t-forget-evil-u + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/don-t-forget-evil-user-stories dependsOn: - Conduction of simple threat modeling on technical level - Creation of threat modeling processes and standards diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index ea37d59..9a8421f 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -161,9 +161,9 @@ implementations: name: Threagile tags: [threat-modeling] url: https://github.com/Threagile/threagile - don-t-forget-evil-u: + don-t-forget-evil-user-stories: uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: "[Don't Forget EVIL U" + name: "Don't Forget EVIL User stories" tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: From 471a57f6e9d8ff7e182379f102d6d527a7c41ad5 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 9 Feb 2025 22:52:47 +0100 Subject: [PATCH 041/370] Split 'Contextual encoding' into 'Context-aware output encoding' and 'Parametrization' --- .../default/BuildAndDeployment/Build.yaml | 10 ++- .../Implementation/ApplicationHardening.yaml | 72 ++++++++++++++++--- src/assets/YAML/default/implementations.yaml | 19 ++++- 3 files changed, 88 insertions(+), 13 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 40c7258..3b93af8 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -41,14 +41,20 @@ Build and Deployment: comments: "" Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b + description: | + A *build process* include more than just compiling your source code. + It also includes steps such as managing (third party) dependencies, + environment configuration, running the unit tests, etc. + + A *defined build process* has automated these steps to ensure consistency. + + This can be done with a Jenkinsfile, Maven, or similar tools. risk: Performing builds without a defined process is error prone; for example, as a result of incorrect security related configuration. measure: A well defined build process lowers the possibility of errors during the build process. - description: | - A build process can be defined in code, for example in a `Jenkinsfile`. difficultyOfImplementation: knowledge: 2 time: 3 diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml index 67f77f4..fbee841 100755 --- a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml +++ b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml @@ -50,24 +50,78 @@ Implementation: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 comments: "" - Contextualized Encoding: + Context-aware output encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 + description: | + **Input validation** stops malicious data from entering your system. \ + **Output encoding** neutralizes malicious data before rendering to user, or the next system. \ + + Input validation and output encoding work together. Apply both. + + **Context-aware output encoding** encodes data differently, depending on its context. In the following example, the `{{bad_data}}` must be encoded differently, depending on its context, to render safe HTML. + + ```html +
{{bad_data}}
+ Click me + + + ``` risk: - The generation of interpreter directives from user-provided data poses difficulties and can introduce vulnerabilities to injection attacks. + If an attacker manages to slip though your input validation, the attacker may gain control over the user session or execute arbitrary actions. measure: | - Implementing contextualized encoding for the next interpreter, such as employing object-relational mapping tools - or utilizing prepared statements, nearly removes the threat of injection vulnerabilities. - - Also take into account a secure by default UI framework, which performs automatic contextual encoding of outputs with potential malicious user input (e.g. angular). + * Use modern secure frameworks such as React/Angular/Vue/Svelte. The default method here renders data in a safe way. + * Use established and well-maintained encoding libraries such as OWASP’s Java Encoder and Microsoft’s AntiXSS. + * Implement content security policies (CSP) to restrict the types of content that can be loaded and executed. difficultyOfImplementation: - knowledge: 2 + knowledge: 1 time: 2 resources: 1 usefulness: 3 level: 1 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dom-xss-cheats + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cwe-838 + references: + samm2: + - D-SR-1-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + comments: "" + Parametrization: + uuid: 00e91a8a-3972-4692-8679-674ab8547486 description: | - Bear in mind that utilizing frameworks is a recommended approach; however, they can develop known security weaknesses over time. Diligent and regular patching is crucial. - implementation: [] + By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well. + + This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed. + + Pay attention to these two lines of code. They seem similar, but behave very differently. + + * `sql.execute("SELECT * FROM table WHERE ID = " + id);` + * `sql.execute("SELECT * FROM table WHERE ID = ?", id);` + The second line is parameterized. The same principle applies to other types, such as command line execution, etc. + risk: | + Systems vulnerable to injections may lead to data breaches, loss of data, + unauthorized alteration of data, or complete database compromise or downtime. + + This applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc. + measure: | + * Identify which of the types your application is using. Check that you use: + * Use _parametrized queries_ (or _prepared statements_) + * For database queries, you may also use: + * Use _stored procedures_ () + * Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-parameterization-cheats references: samm2: - D-SR-1-A diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index ea37d59..8a8efce 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -41,6 +41,11 @@ implementations: name: CWE Top 25 Most Dangerous Software Weaknesses tags: ["documentation", "threat"] url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + cwe-838: + uuid: ae97c9b0-308c-4dab-bff9-bf3330a897dc + name: CWE-838 Inappropriate Encoding for Output Context + tags: ["documentation", "cwe"] + url: https://cwe.mitre.org/data/definitions/838.html docker-content-trust: uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 name: Docker Content Trust @@ -161,9 +166,9 @@ implementations: name: Threagile tags: [threat-modeling] url: https://github.com/Threagile/threagile - don-t-forget-evil-u: + don-t-forget-evil-user-stories: uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: "[Don't Forget EVIL U" + name: "Don't Forget EVIL User stories" tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: @@ -430,6 +435,16 @@ implementations: name: OWASP Logging CheatSheet url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html tags: [logging, documentation] + owasp-dom-xss-cheats: + uuid: 2d61e48f-bade-4332-a383-adc50c29673a + name: OWASP DOM based XSS Prevention CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html + tags: [] + owasp-parameterization-cheats: + uuid: d880fa0f-9dbb-454e-a003-d844fad31ab4 + name: OWASP Parameterization CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html + tags: [] elk-stack: uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 name: ELK-Stack From 95d8577b248fb7d56c1e49b7adbd49280255dd14 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 13 Feb 2025 19:37:16 +0100 Subject: [PATCH 042/370] fix: add meta.yaml via download --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 003460c..e88ca87 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,5 +12,6 @@ RUN cd /var/www/html/yaml-generation && composer install \ RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml RUN cd /var/www/html && php yaml-generation/generateDimensions.php +RUN curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/master/src/assets/YAML/meta.yaml -o /var/www/html/src/assets/YAML/meta.yaml workdir /var/www/html -CMD php yaml-generation/generateDimensions.php \ No newline at end of file +CMD php yaml-generation/generateDimensions.php From 5493ce00bd9fb036706ff7d1ecfa843346e72cef Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 13 Feb 2025 19:39:44 +0100 Subject: [PATCH 043/370] fix: download meta.yaml from main repo --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 003460c..f61c466 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,8 +9,8 @@ RUN cd /var/www/html/yaml-generation && composer install \ --no-scripts \ --prefer-dist - RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml +RUN curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/master/src/assets/YAML/meta.yaml -o /var/www/html/src/assets/YAML/meta.yaml RUN cd /var/www/html && php yaml-generation/generateDimensions.php workdir /var/www/html -CMD php yaml-generation/generateDimensions.php \ No newline at end of file +CMD php yaml-generation/generateDimensions.php From 05b6a52655059c9b12cd906501cd473fc02a66f5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 13 Feb 2025 19:44:51 +0100 Subject: [PATCH 044/370] chore: update readme to generate yaml with meta.yaml from the image --- README.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index e8e88ef..2f90329 100644 --- a/README.md +++ b/README.md @@ -4,7 +4,8 @@ Data for the OWASP DevSecOps Maturity Model. ## Usage To test changes to the yaml-files, please run: ```bash -docker run -ti -v $(pwd)/src/assets/YAML/:/var/www/html/src/assets/YAML wurstbrot/dsomm-yaml-generation +docker run -ti -v $(pwd)/src/assets/YAML/default:/var/www/html/src/assets/YAML/default -v $(pwd)/src/assets/YAML/generated:/var/www/html/src/assets/YAML/generated -v $(pwd)/src/assets/YAML/schema:/var/www/html/src/assets/YAML/schema wurstbrot/dsomm-yaml-generation + # Afterwards, you can use the generated.yaml in a container docker run -v $(pwd)/src/assets/YAML/generated/generated.yaml:/usr/share/nginx/html/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm ``` From 7a675a5686b8fb0d4258529cb96b3fac50f774db Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 13 Feb 2025 20:11:35 +0100 Subject: [PATCH 045/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 249 +++++++++++++++++++---- 1 file changed, 215 insertions(+), 34 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index cf609e9..72c2915 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -603,9 +603,9 @@ Build and Deployment: tags: - threat-modeling url: https://github.com/Threagile/threagile - don-t-forget-evil-u: + don-t-forget-evil-user-stories: uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: '[Don''t Forget EVIL U' + name: Don't Forget EVIL User stories tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) @@ -1551,6 +1551,19 @@ Build and Deployment: - vulnerability url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog description: A catalog of vulnerabilities that have been exploited. + owasp-secure-headers: + uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: + - header + - documentation + url: https://owasp.org/www-project-secure-headers/ + description: "The OWASP Secure Headers Project (also called OSHP) describes + HTTP response headers that your application can use \nto increase the + security of your application. Once set, these HTTP response headers can + restrict modern browsers \nfrom running into easily preventable vulnerabilities. + The OWASP Secure Headers Project intends to raise awareness\nand use of + these headers." references: samm2: - I-SD-1-B @@ -2633,7 +2646,7 @@ Culture and Organization: - Creation of simple abuse stories implementation: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: '[Don''t Forget EVIL U' + name: Don't Forget EVIL User stories tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) @@ -2676,7 +2689,7 @@ Culture and Organization: level: 3 implementation: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: '[Don''t Forget EVIL U' + name: Don't Forget EVIL User stories tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) @@ -3027,25 +3040,12 @@ Culture and Organization: resources: 1 usefulness: 4 level: 2 - description: "Implement a program where each software development team has a - member considered a \u201CSecurity Champion\u201D who is the liaison between - Information Security and developers. Depending on the size and structure of - the team the \u201CSecurity Champion\u201D may be a software developer, tester, - or a product manager. The \u201CSecurity Champion\u201D has a set number of - hours per week for Information Security related activities. They participate - in periodic briefings to increase awareness and expertise in different security - disciplines. \u201CSecurity Champions\u201D have additional training to help - develop these roles as Software Security subject-matter experts. You may need - to customize the way you create and support \u201CSecurity Champions\u201D - for cultural reasons.\n\nThe goals of the position are to increase effectiveness - and efficiency of application security and compliance and to strengthen the - relationship between various teams and Information Security. To achieve these - objectives, \u201CSecurity Champions\u201D assist with researching, verifying, - and prioritizing security and compliance related software defects. They are - involved in all Risk Assessments, Threat Assessments, and Architectural Reviews - to help identify opportunities to remediate security defects by making the - architecture of the application more resilient and reducing the attack threat - surface.\nSource: [OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/)\n" + description: | + Implement a program where each software development team has a member considered a "Security Champion" who is the liaison between Information Security and developers. Depending on the size and structure of the team the "Security Champion" may be a software developer, tester, or a product manager. The "Security Champion" has a set number of hours per week for Information Security related activities. They participate in periodic briefings to increase awareness and expertise in different security disciplines. "Security Champions" have additional training to help develop these roles as Software Security subject-matter experts. You may need to customize the way you create and support "Security Champions" for cultural reasons. + + The goals of the position are to increase effectiveness and efficiency of application security and compliance and to strengthen the relationship between various teams and Information Security. To achieve these objectives, "Security Champions" assist with researching, verifying, and prioritizing security and compliance related software defects. They are involved in all Risk Assessments, Threat Assessments, and Architectural Reviews to help identify opportunities to remediate security defects by making the architecture of the application more resilient and reducing the attack threat surface. + + [Source: OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/) implementation: - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 name: OWASP Security Champions Playbook @@ -3925,7 +3925,6 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a - comments: "" dependsOn: - App. Hardening Level 2 tags: @@ -3934,6 +3933,69 @@ Implementation: Default: false B: false C: false + Containers are running as non-root: + uuid: a86c1fbc-28fd-4610-89a3-a7f73acfe45f + risk: |- + There are various reasons to run a container as non-root. Samples are listed: + ## Container Escape Vectors + + - Root privileges significantly increase the chance of breaking container isolation + - Root access can be leveraged to exploit kernel vulnerabilities + - Compromised root containers provide attackers with maximum privileges inside the container + - Greater potential for escaping container boundaries to the host system + + ## Host System Vulnerabilities + + Root containers can potentially: + + - Mount sensitive host filesystems + - Access critical device files + - Modify host network settings + - Interact with host system processes + - Override security controls + + ## Resource Management Issues + + Root privileges may allow containers to: + + - Bypass resource quotas and limits + - Modify control group (cgroup) settings + - Interfere with other containers' resources + - Circumvent memory and CPU restrictions + + Security Boundary Weakening + + - Violates the principle of least privilege + - Provides unnecessary elevated permissions + - Expands the potential attack surface + - Increases the impact of a successful compromise + measure: "Containers are running as non-root. This can be enforced in the image + itself or during runtime parameters \n(e.g. `podman run --user [...]`)." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/a86c1fbc-28fd-4610-89a3-a7f73acfe45f + tags: + - none + teamsImplemented: + Default: false + B: false + C: false Contextualized Encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 risk: The generation of interpreter directives from user-provided data poses @@ -3967,6 +4029,72 @@ Implementation: Default: false B: false C: false + Secure headers: + uuid: 29318d60-18ce-4526-80ea-f5928e49f639 + risk: | + Missing or misconfigured security headers can lead to various security vulnerabilities, e.g.: + - Cross-Site Scripting (XSS) due to missing Content Security Policy + - Clickjacking attacks due to missing X-Frame-Options + - Information disclosure through Server header exposure + - SSL/TLS downgrade attacks due to missing HSTS + - Cross-site scripting and injection due to missing security headers + measure: | + Implement and enforce security headers across all applications and services + + Implementation Methods: + 1. Reverse Proxy/Load Balancer: Configure at nginx/Apache level + 2. Web Application: Implement in the application middleware + 3. Service Mesh: Configure at the ingress controller level + 4. Standard Docker Image: Use secure base images with preset headers + + Remove or Secure: + - Server header: Hide server version information + - X-Powered-By: Remove technology stack information + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + implementation: + - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: + - header + - documentation + url: https://owasp.org/www-project-secure-headers/ + description: "The OWASP Secure Headers Project (also called OSHP) describes + HTTP response headers that your application can use \nto increase the security + of your application. Once set, these HTTP response headers can restrict + modern browsers \nfrom running into easily preventable vulnerabilities. + The OWASP Secure Headers Project intends to raise awareness\nand use of + these headers." + meta: + implementationGuide: | + Essential headers: + - Content-Security-Policy: Define trusted sources for content + - Strict-Transport-Security: Enforce HTTPS connections + - X-Frame-Options: Prevent clickjacking attacks + - X-Content-Type-Options: Prevent MIME-type sniffing + - X-XSS-Protection: Enable browser's XSS filtering + - Referrer-Policy: Control information in the Referrer header + references: + samm2: + - D-SR-3-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/cre/620-421 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false Development and Source Control: .gitignore: uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d @@ -7354,7 +7482,8 @@ Test and Verification: Coverage of client side dynamic components: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript - is not getting executed. Therefore, the co + is not getting executed. Therefore, the coverage of client-side dynamic components + is limited, leading to potential security risks and undetected vulnerabilities. measure: Usage of a spider which executes dynamic content like JavaScript, e.g. via Selenium. difficultyOfImplementation: @@ -7736,9 +7865,9 @@ Test and Verification: tags: - threat-modeling url: https://github.com/Threagile/threagile - don-t-forget-evil-u: + don-t-forget-evil-user-stories: uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: '[Don''t Forget EVIL U' + name: Don't Forget EVIL User stories tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) @@ -8684,6 +8813,19 @@ Test and Verification: - vulnerability url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog description: A catalog of vulnerabilities that have been exploited. + owasp-secure-headers: + uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: + - header + - documentation + url: https://owasp.org/www-project-secure-headers/ + description: "The OWASP Secure Headers Project (also called OSHP) describes + HTTP response headers that your application can use \nto increase the + security of your application. Once set, these HTTP response headers can + restrict modern browsers \nfrom running into easily preventable vulnerabilities. + The OWASP Secure Headers Project intends to raise awareness\nand use of + these headers." - argocd: uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f name: argoCD @@ -8870,9 +9012,9 @@ Test and Verification: tags: - threat-modeling url: https://github.com/Threagile/threagile - don-t-forget-evil-u: + don-t-forget-evil-user-stories: uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: '[Don''t Forget EVIL U' + name: Don't Forget EVIL User stories tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) @@ -9818,6 +9960,19 @@ Test and Verification: - vulnerability url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog description: A catalog of vulnerabilities that have been exploited. + owasp-secure-headers: + uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: + - header + - documentation + url: https://owasp.org/www-project-secure-headers/ + description: "The OWASP Secure Headers Project (also called OSHP) describes + HTTP response headers that your application can use \nto increase the + security of your application. Once set, these HTTP response headers can + restrict modern browsers \nfrom running into easily preventable vulnerabilities. + The OWASP Secure Headers Project intends to raise awareness\nand use of + these headers." comments: "" tags: - none @@ -10638,9 +10793,9 @@ Test and Verification: tags: - threat-modeling url: https://github.com/Threagile/threagile - don-t-forget-evil-u: + don-t-forget-evil-user-stories: uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: '[Don''t Forget EVIL U' + name: Don't Forget EVIL User stories tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) @@ -11586,6 +11741,19 @@ Test and Verification: - vulnerability url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog description: A catalog of vulnerabilities that have been exploited. + owasp-secure-headers: + uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: + - header + - documentation + url: https://owasp.org/www-project-secure-headers/ + description: "The OWASP Secure Headers Project (also called OSHP) describes + HTTP response headers that your application can use \nto increase the + security of your application. Once set, these HTTP response headers can + restrict modern browsers \nfrom running into easily preventable vulnerabilities. + The OWASP Secure Headers Project intends to raise awareness\nand use of + these headers." - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 name: DevSecOps control Pre-commit url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop @@ -11919,9 +12087,9 @@ Test and Verification: tags: - threat-modeling url: https://github.com/Threagile/threagile - don-t-forget-evil-u: + don-t-forget-evil-user-stories: uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: '[Don''t Forget EVIL U' + name: Don't Forget EVIL User stories tags: [] url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) @@ -12867,6 +13035,19 @@ Test and Verification: - vulnerability url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog description: A catalog of vulnerabilities that have been exploited. + owasp-secure-headers: + uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: + - header + - documentation + url: https://owasp.org/www-project-secure-headers/ + description: "The OWASP Secure Headers Project (also called OSHP) describes + HTTP response headers that your application can use \nto increase the + security of your application. Once set, these HTTP response headers can + restrict modern browsers \nfrom running into easily preventable vulnerabilities. + The OWASP Secure Headers Project intends to raise awareness\nand use of + these headers." references: samm2: - V-ST-2-A @@ -13992,7 +14173,7 @@ Test and Verification: time: 3 resources: 5 usefulness: 3 - level: 1 + level: 3 implementation: [] references: samm2: From 7ba1bec80ec910f9f7a04ca098423a847718a248 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 16 Feb 2025 08:59:13 +0100 Subject: [PATCH 046/370] fix references --- .../YAML/default/BuildAndDeployment/Deployment.yaml | 2 +- .../TestAndVerification/DynamicDepthForApplications.yaml | 1 - .../TestAndVerification/StaticDepthForApplications.yaml | 1 - .../StaticDepthForInfrastructure.yaml | 2 +- src/assets/YAML/default/implementations.yaml | 9 ++++++++- 5 files changed, 10 insertions(+), 5 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 21408ef..ce242a7 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -117,7 +117,7 @@ Build and Deployment: usefulness: 4 level: 2 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/hasicorp-vault + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/hashicorp-vault references: samm2: - I-SD-1-B diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml index 0690259..daa188f 100755 --- a/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml @@ -168,7 +168,6 @@ Test and Verification: - 8.32 - 8.29 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/pact-io - $ref: src/assets/YAML/default/implementations.yaml#/implementations/citrusframework isImplemented: false evidence: "" diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 92edf4b..c828142 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -117,7 +117,6 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/fortify-vscode-extension - $ref: src/assets/YAML/default/implementations.yaml#/implementations/checkmarx-vscode-extension - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/pre-commit - $ref: src/assets/YAML/default/implementations.yaml#/implementations/pre-commit-microsoft - $ref: src/assets/YAML/default/implementations.yaml#/implementations/pre-commit-synopsis references: diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index 001325b..3038fb5 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -63,7 +63,7 @@ Test and Verification: level: 4 description: Subscribing to Github projects and reading release notes might help. Software Composition Analysis for infrastructure might help, but is often too fine-granular. implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/https-github-com-a + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy - $ref: src/assets/YAML/default/implementations.yaml#/implementations/registries-like-quay - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack references: diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 9a8421f..d6b08eb 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -712,7 +712,7 @@ implementations: name: go-pillage-registries tags: [] url: https://github.com/nccgroup/go-pillage-registries - https-github-com-a: + trivy: uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b name: https://github.com/aquasecurity/trivy tags: [] @@ -985,3 +985,10 @@ implementations: to increase the security of your application. Once set, these HTTP response headers can restrict modern browsers from running into easily preventable vulnerabilities. The OWASP Secure Headers Project intends to raise awareness and use of these headers. + citrusframework: + uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 + name: Citrus Fresh Integration Testing + tags: [framework, testing] + url: https://citrusframework.org/ + description: |- + Integration Test framework with focus on messaging applications and Microservices. From b5f19fe2381d60761ab6edaafb25ebb25f456948 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 16 Feb 2025 09:20:25 +0100 Subject: [PATCH 047/370] fix meta.yaml fetching --- yaml-generation/generateDimensions.bash | 1 + 1 file changed, 1 insertion(+) diff --git a/yaml-generation/generateDimensions.bash b/yaml-generation/generateDimensions.bash index 68a773e..f1f302b 100755 --- a/yaml-generation/generateDimensions.bash +++ b/yaml-generation/generateDimensions.bash @@ -1,5 +1,6 @@ #!/bin/bash +curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/master/src/assets/YAML/meta.yaml -o ../src/assets/YAML/meta.yaml docker run -e IS_IMPLEMENTED_WHEN_EVIDENCE=true -ti --rm --volume ${PWD}/../:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' #docker run --rm --interactive --tty --volume $PWD/:/app --user $(id -u):$(id -g) composer install \ From 172ab3b9fa6b584ba59ae818981dfc9c8e80fa47 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 16 Feb 2025 09:23:13 +0100 Subject: [PATCH 048/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 5757 +--------------------- 1 file changed, 22 insertions(+), 5735 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 72c2915..8b35b2f 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -417,1153 +417,16 @@ Build and Deployment: usefulness: 4 level: 2 implementation: - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - signing-of-commits: - uuid: d6d755d3-b9f1-4942-a084-e62b266541df - name: Signing of commits - tags: - - signing - url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work - description: Signing of commits in git - ci-cd-tools: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - apimaturity: - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ - container-technologi: - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - cwe25: - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 - name: CWE Top 25 Most Dangerous Software Weaknesses - tags: - - documentation - - threat - url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html - docker-content-trust: - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 - name: Docker Content Trust - tags: [] - url: https://docs.docker.com/engine/security/trust/ - in-toto: - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f - name: in-toto - tags: [] - url: https://in-toto.github.io/ - a-complete-backup-of: - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b - name: A complete backup of persisted data might be performed*. - tags: [] - a-point-in-time-reco: - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 - name: A Point in Time Recovery for databases should be implemented. - tags: [] - blue-green-deploymen: - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 - name: Blue/Green Deployments - tags: [] - url: https://martinfowler.com/bliki/BlueGreenDeployment.html - docker: - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - webserver: - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb - name: Webserver - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ - rolling-update: - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e - name: rolling update - tags: [] - kubernetes-admission: - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af - name: Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. - tags: [] - url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d - dependabot: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - renovate: - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - jenkins: - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 - name: Jenkins - tags: [] - url: https://www.jenkins.io/ - sample-concept-1: - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" - tags: [] - description: "Sample concept: \n(1) each container has a set lifetime and - is killed / replaced with a new container multiple times a day where you - have some form of a graceful replacement to ensure no (short) service - outage will occur to the end users. \n(2) twice a day a rebuild of images - is done. The rebuilds are put into a automated testing pipeline. If the - testing has no blocking issues the new images will be released for deployment - during the next \"restart\" of a container. What has to be done, is to - ensure the new containers are deployed in some canary deployment manner, - this will ensure that if (and only if) something buggy has been introduced - which breaks functionality the canary deployment will make sure the \"older - version\" is being used and not the buggy newer one." - distroless: - uuid: ef647044-b675-47d3-9720-3ebc144ef37b - name: Distroless - tags: [] - url: https://github.com/GoogleContainerTools/distroless - fedora-coreos: - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a - name: Fedora CoreOS - tags: [] - url: https://getfedora.org/coreos - distroless-usage: - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd - name: Distroless or Alpine - tags: [] - url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 - threat-modeling-play: - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - owasp-samm: - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - whiteboard: - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - miro-or-any-other-c: - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - draw-io: - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - threagile: - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c - name: Threagile - tags: - - threat-modeling - url: https://github.com/Threagile/threagile - don-t-forget-evil-user-stories: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: Don't Forget EVIL User stories - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' - libyear: - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a - single number telling you how up-to-date your dependencies are. - owasp-juice-shop: - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - owasp-cheatsheet-ser: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-juiceshop: - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] - url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - https-cheatsheetse: - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-security-champ: - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 - name: OWASP Security Champions Playbook - tags: - - security champions - url: https://github.com/c0rdis/security-champions-playbook - build-it-break-it-fi: - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f - name: Build it Break it Fix it Contest - tags: [] - url: https://builditbreakit.org/ - motivate-people: - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 - name: Motivate people - tags: - - security champions - - gamification - - nudging - url: https://github.com/wurstbrot/security-pins - description: |- - Enhance motivation can be performed with the distribution of pins - as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) - owasp-top-10-maturit: - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 - name: OWASP Top 10 Maturity Categories for Security Champions - tags: - - security champions - url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx - involve-security-sme: - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 - name: Involve Security SME - tags: [] - description: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. - damn-vulnerable-web: - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - example-all-docker: - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 - name: 'Example: All docker images used by teams need to be based on standard - images.' - tags: [] - owasp-asvs: - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - owasp-masvs: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - cis-kubernetes-bench: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - cis-docker-bench-for: - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - for-example-for-cont: - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont - tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, - ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - attack-matrix-cloud: - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - attack-matrix-contai: - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for containers - attack-matrix-kubern: - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - istio: - uuid: 9429d52c-203d-49ae-814f-1401210887cd - name: istio - tags: [] - url: https://istio.io/ - bridges: - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 - name: bridges - tags: [] - firewalls: - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - open-policy-agent: - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 - name: Open Policy Agent - tags: [] - url: https://www.openpolicyagent.org/ - gitops: - uuid: b0931397-2402-44f1-814b-63292ab4a339 - name: GitOps - tags: [] - url: https://www.redhat.com/en/topics/devops/what-is-gitops - ansible: - uuid: 73747d35-2185-4f22-94a0-723288fa283c - name: Ansible - tags: [] - url: https://github.com/ansible/ansible - chef: - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce - name: Chef - tags: [] - url: https://github.com/chef/chef - puppet: - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 - name: Puppet - tags: [] - url: https://github.com/puppetlabs/puppet - jenkinsfile: - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 - name: Jenkinsfile - tags: [] - url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ - seccomp: - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd - name: seccomp - tags: [] - url: https://man7.org/linux/man-pages/man2/seccomp.2.html - strace: - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff - name: strace - tags: [] - url: https://man7.org/linux/man-pages/man1/strace.1.html - remove-direct-access: - uuid: b206481f-9c66-45e2-843c-37c5730580cd - name: Remove direct access to infrastructure - tags: [] - directory-service: - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 - name: Directory Service - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ - plugins: - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e - name: Plugins - tags: [] - smartcard: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - yubikey: - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - sms: - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS - tags: [] - totp: - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP - tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ - http-basic-authentic: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 - name: HTTP-Basic Authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ - vpn: - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e - name: VPN - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ - for-applications-ch: - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c - name: 'For applications: Check default encoding' - tags: [] - managing-secrets: - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf - name: managing secrets - tags: [] - url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ - crypto: - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 - name: crypto - tags: [] - authentication: - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 - name: authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ - rsyslog: - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 - name: rsyslog - url: https://www.rsyslog.com/ - tags: - - tool - - logging - logstash: - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - fluentd: - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 - name: fluentd - tags: - - tool - url: https://www.fluentd.org/ - bash: - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 - name: bash - tags: - - tool - url: https://www.gnu.org/software/bash/ - owasp-logging-cheats: - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - elk-stack: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 - name: ELK-Stack - tags: [] - url: https://www.elastic.co/elk-stack - https-ht-transpare: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf - prometheus: - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c - name: Prometheus - tags: [] - url: https://prometheus.io/ - collected: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - httpunit: - uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 - name: HttpUnit - tags: [] - url: http://httpunit.sourceforge.net/ - junit: - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d - name: JUnit - tags: - - unittest - url: https://junit.org/junit5/ - karma: - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 - name: Karma - tags: [] - url: https://karma-runner.github.io - owasp-defectdojo: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - purify: - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - SecObserve: - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 - name: SecObserve - tags: - - vulnerability management system - url: https://github.com/MaibornWolff/SecObserve - description: | - The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. - see-other-actions-e: - uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 - name: See other actions, e.g. "Treatment of defects with severity high". - tags: [] - sast: - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a - name: SAST - tags: [] - description: 'At SAST (Static Application Security Testing): Server-side - / client-side teams can easily be recorded. With microservice architecture - individual microservices can be used usually Teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ - dast: - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 - name: DAST - tags: [] - description: 'At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - owasp-defect-dojo: - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] - url: https://github.com/DefectDojo/django-DefectDojo - owasp-dependency-che: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - logparser-jenkins-pl: - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 - name: LogParser Jenkins Plugins - tags: [] - owasp-code-pulse: - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 - name: OWASP Code Pulse - tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse - ajax-spider: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb - name: Ajax Spider - tags: [] - url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ - curl: - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - openapi: - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 - name: OpenAPI Specifications - tags: [] - url: https://spec.openapis.org/ - owasp-zap: - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - arachni: - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 - name: Arachni - url: https://github.com/Arachni/arachni - zest: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 - name: Zest - url: https://www.zaproxy.org/docs/desktop/addons/zest/ - tags: - - zap - description: | - Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - owasp-securecodebox: - uuid: f220b299-0917-4750-96c5-d81cd402b4df - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - kube-hunter: - uuid: 2af7204c-a25c-4625-9775-889978386407 - name: kube-hunter - tags: [] - url: https://github.com/aquasecurity/kube-hunter - openvas: - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f - name: openVAS - tags: [] - url: https://www.openvas.org/ - htc-hydra: - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce - name: HTC Hydra - tags: - - password - url: https://www.htc-cs.com/en/products/htc-hydra/ - netassert: - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c - name: netassert - tags: [] - url: https://github.com/controlplaneio/netassert - nmap: - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 - name: nmap - tags: [] - url: https://nmap.org/ - owasp-amass: - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a - name: OWASP Amass - tags: [] - url: https://github.com/OWASP/Amass - k8spurger: - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - pmd: - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - eslint: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - findsecuritybugs: - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - jsprime: - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - bdd-mobile-security: - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - retire-js: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - npm-audit: - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - sigmahq: - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - dive-to-inspect-a-co: - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 - name: Dive to inspect a container images - tags: [] - url: https://github.com/wagoodman/dive - clusterscanner: - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - dockerfile-with-hado: - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 - name: Dockerfile with hadolint - tags: [] - url: https://github.com/hadolint/hadolint - deployment-with-kube: - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b - name: Deployment with kube-score - tags: [] - url: https://github.com/zegl/kube-score - kubesec: - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba - name: kubesec - tags: [] - url: https://kubesec.io - anchore-io: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - clair: - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - openscap: - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - vuls: - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - kube-bench: - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 - name: kube-bench - tags: [] - url: https://github.com/aquasecurity/kube-bench - trufflehog: - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - go-pillage-registrie: - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - https-github-com-a: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - registries-like-quay: - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay - tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - dockerfilelint: - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 - name: dockerfilelint - tags: - - sast - - docker - - dockerfile - url: https://github.com/replicatedhq/dockerfilelint - description: dockerfilelint is an node module that analyzes a Dockerfile - and looks for common traps, mistakes and helps enforce best practices. - threat-matrix-for-storage: - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - defend-the-core-kubernetes: - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes - business-friendly-vulnerability-metrics: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - kubescape: - uuid: 893d9f37-2142-4490-996c-e43b55064d3d - name: kubescape - url: https://github.com/armosec/kubescape - tags: - - kubernetes - - vulnerability - - misconfiguration - description: _Testing if Kubernetes is deployed securely as defined in Kubernetes - Hardening Guidance by to NSA and CISA_ - azuredevops: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - github-policies: - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - sonarqube: - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - stylecop: - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - fortify-vscode-extension: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - appscan-vscode-extension: - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - checkmarx-vscode-extension: - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - pre-commit-microsoft: - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 - name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop - tags: - - pre-commit - pre-commit-synopsis: - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb - name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ - tags: - - pre-commit - dependencyTrack: - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach - by leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - juice-shop: - uuid: c021aa72-c71c-43e4-9573-717b74d6c19d - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - dvwa: - uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - loggingCheatSheet: - uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - zap: - uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - secureCodeBox: - uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - K8sPurger: - uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - hashicorp-vault: - uuid: e3a2ffc8-313f-437e-9663-b24591568209 - name: Hashicorp Vault - tags: - - authentication - - authorization - - secrets - - infrastructure - url: https://github.com/hashicorp/vault - description: | - A tool for secrets management, encryption as a service, and privileged access management. - stoplight-spectral: - uuid: 261f243e-f89c-4169-b076-b22a03ec00be - name: Spectral - tags: - - linting - - api - - documentation - url: https://github.com/stoplightio/spectral - description: | - Spectral is a flexible JSON/YAML linter built with extensibility in mind. - It uses JSON/YAML path rules to describe the problems you want to find. - api-oas-checker: - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f - name: API OAS Checker - tags: - - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. - coveragepy: - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 - name: Coverage.py - tags: - - testing - - coverage - url: https://github.com/nedbat/coveragepy - description: | - Code coverage measurement for Python - github-dependabot: - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - github-super-linter: - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f - name: Super-Linter - tags: - - linting - - scm - url: https://github.com/github/super-linter - description: | - Lint code bases to catch common errors and enforce code style - schemathesis: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b - name: Schemathesis - tags: - - testing - - api - - documentation - url: https://github.com/schemathesis/schemathesis - description: | - Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - martin-feature-toggles: - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 - name: Feature Toggles - tags: - - development - - architecture - url: https://martinfowler.com/articles/feature-toggles.html - description: | - Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) - defectdojo-client: - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - falco: - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. - sammancoaching: - uuid: 9223be73-00da-400e-a910-3871734cff2f - name: sammancoaching - tags: - - documentation - - coaching - - education - url: https://sammancoaching.org/ - description: | - Security coaches work with software development teams to help them adopt better security practices. - terraform: - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - packj: - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a - name: packj - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://github.com/ossillate-inc/packj - description: | - Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. - apiMyth: - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 - name: Top 5 API Security Myths That Are Crushing Your Business - tags: - - documentation - - waf - url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html - description: | - There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business - backstage: - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - image-metadata-collector: - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - jira: - uuid: 889444eb-de68-4367-bada-a66f8cb9733a - name: Jira - tags: - - documentation - - issue - - proprietary - url: https://jira.atlassian.com/ - description: Jira is a bug tracking and project management tool developed - by Atlassian, used by development teams for tracking issues, planning - sprints, and managing software releases. It offers features for creating - and managing tasks, assigning them to team members, and monitoring progress - through customizable workflows and dashboards. - epss: - uuid: e39afc58-8195-4600-92c6-11922e3a141b - name: Exploit Prediction Scoring System - tags: - - vulnerability - url: https://www.first.org/epss/ - description: Estimates the likelihood that a software vulnerability will - be exploited. - cisa-kev: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 - name: Known Exploited Vulnerabilities - tags: - - vulnerability - url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - description: A catalog of vulnerabilities that have been exploited. - owasp-secure-headers: - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e - name: OWASP Secure Headers Project - tags: - - header - - documentation - url: https://owasp.org/www-project-secure-headers/ - description: "The OWASP Secure Headers Project (also called OSHP) describes - HTTP response headers that your application can use \nto increase the - security of your application. Once set, these HTTP response headers can - restrict modern browsers \nfrom running into easily preventable vulnerabilities. - The OWASP Secure Headers Project intends to raise awareness\nand use of - these headers." + - uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. references: samm2: - I-SD-1-B @@ -7679,2300 +6542,14 @@ Test and Verification: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic depth for applications/22aab0ef-76ce-4b8c-979c-3699784330db implementation: - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - signing-of-commits: - uuid: d6d755d3-b9f1-4942-a084-e62b266541df - name: Signing of commits - tags: - - signing - url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work - description: Signing of commits in git - ci-cd-tools: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - apimaturity: - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ - container-technologi: - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - cwe25: - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 - name: CWE Top 25 Most Dangerous Software Weaknesses - tags: - - documentation - - threat - url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html - docker-content-trust: - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 - name: Docker Content Trust - tags: [] - url: https://docs.docker.com/engine/security/trust/ - in-toto: - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f - name: in-toto - tags: [] - url: https://in-toto.github.io/ - a-complete-backup-of: - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b - name: A complete backup of persisted data might be performed*. - tags: [] - a-point-in-time-reco: - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 - name: A Point in Time Recovery for databases should be implemented. - tags: [] - blue-green-deploymen: - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 - name: Blue/Green Deployments - tags: [] - url: https://martinfowler.com/bliki/BlueGreenDeployment.html - docker: - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - webserver: - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb - name: Webserver - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ - rolling-update: - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e - name: rolling update - tags: [] - kubernetes-admission: - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af - name: Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. - tags: [] - url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d - dependabot: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - renovate: - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - jenkins: - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 - name: Jenkins - tags: [] - url: https://www.jenkins.io/ - sample-concept-1: - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" - tags: [] - description: "Sample concept: \n(1) each container has a set lifetime and - is killed / replaced with a new container multiple times a day where you - have some form of a graceful replacement to ensure no (short) service - outage will occur to the end users. \n(2) twice a day a rebuild of images - is done. The rebuilds are put into a automated testing pipeline. If the - testing has no blocking issues the new images will be released for deployment - during the next \"restart\" of a container. What has to be done, is to - ensure the new containers are deployed in some canary deployment manner, - this will ensure that if (and only if) something buggy has been introduced - which breaks functionality the canary deployment will make sure the \"older - version\" is being used and not the buggy newer one." - distroless: - uuid: ef647044-b675-47d3-9720-3ebc144ef37b - name: Distroless - tags: [] - url: https://github.com/GoogleContainerTools/distroless - fedora-coreos: - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a - name: Fedora CoreOS - tags: [] - url: https://getfedora.org/coreos - distroless-usage: - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd - name: Distroless or Alpine - tags: [] - url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 - threat-modeling-play: - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - owasp-samm: - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - whiteboard: - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - miro-or-any-other-c: - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - draw-io: - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - threagile: - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c - name: Threagile - tags: - - threat-modeling - url: https://github.com/Threagile/threagile - don-t-forget-evil-user-stories: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: Don't Forget EVIL User stories - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' - libyear: - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a - single number telling you how up-to-date your dependencies are. - owasp-juice-shop: - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - owasp-cheatsheet-ser: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-juiceshop: - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] - url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - https-cheatsheetse: - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-security-champ: - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 - name: OWASP Security Champions Playbook - tags: - - security champions - url: https://github.com/c0rdis/security-champions-playbook - build-it-break-it-fi: - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f - name: Build it Break it Fix it Contest - tags: [] - url: https://builditbreakit.org/ - motivate-people: - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 - name: Motivate people - tags: - - security champions - - gamification - - nudging - url: https://github.com/wurstbrot/security-pins - description: |- - Enhance motivation can be performed with the distribution of pins - as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) - owasp-top-10-maturit: - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 - name: OWASP Top 10 Maturity Categories for Security Champions - tags: - - security champions - url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx - involve-security-sme: - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 - name: Involve Security SME - tags: [] - description: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. - damn-vulnerable-web: - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - example-all-docker: - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 - name: 'Example: All docker images used by teams need to be based on standard - images.' - tags: [] - owasp-asvs: - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - owasp-masvs: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - cis-kubernetes-bench: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - cis-docker-bench-for: - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - for-example-for-cont: - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont - tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, - ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - attack-matrix-cloud: - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - attack-matrix-contai: - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for containers - attack-matrix-kubern: - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - istio: - uuid: 9429d52c-203d-49ae-814f-1401210887cd - name: istio - tags: [] - url: https://istio.io/ - bridges: - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 - name: bridges - tags: [] - firewalls: - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - open-policy-agent: - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 - name: Open Policy Agent - tags: [] - url: https://www.openpolicyagent.org/ - gitops: - uuid: b0931397-2402-44f1-814b-63292ab4a339 - name: GitOps - tags: [] - url: https://www.redhat.com/en/topics/devops/what-is-gitops - ansible: - uuid: 73747d35-2185-4f22-94a0-723288fa283c - name: Ansible - tags: [] - url: https://github.com/ansible/ansible - chef: - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce - name: Chef - tags: [] - url: https://github.com/chef/chef - puppet: - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 - name: Puppet - tags: [] - url: https://github.com/puppetlabs/puppet - jenkinsfile: - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 - name: Jenkinsfile - tags: [] - url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ - seccomp: - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd - name: seccomp - tags: [] - url: https://man7.org/linux/man-pages/man2/seccomp.2.html - strace: - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff - name: strace - tags: [] - url: https://man7.org/linux/man-pages/man1/strace.1.html - remove-direct-access: - uuid: b206481f-9c66-45e2-843c-37c5730580cd - name: Remove direct access to infrastructure - tags: [] - directory-service: - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 - name: Directory Service - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ - plugins: - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e - name: Plugins - tags: [] - smartcard: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - yubikey: - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - sms: - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS - tags: [] - totp: - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP - tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ - http-basic-authentic: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 - name: HTTP-Basic Authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ - vpn: - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e - name: VPN - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ - for-applications-ch: - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c - name: 'For applications: Check default encoding' - tags: [] - managing-secrets: - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf - name: managing secrets - tags: [] - url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ - crypto: - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 - name: crypto - tags: [] - authentication: - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 - name: authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ - rsyslog: - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 - name: rsyslog - url: https://www.rsyslog.com/ - tags: - - tool - - logging - logstash: - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - fluentd: - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 - name: fluentd - tags: - - tool - url: https://www.fluentd.org/ - bash: - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 - name: bash - tags: - - tool - url: https://www.gnu.org/software/bash/ - owasp-logging-cheats: - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - elk-stack: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 - name: ELK-Stack - tags: [] - url: https://www.elastic.co/elk-stack - https-ht-transpare: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf - prometheus: - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c - name: Prometheus - tags: [] - url: https://prometheus.io/ - collected: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - httpunit: - uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 - name: HttpUnit - tags: [] - url: http://httpunit.sourceforge.net/ - junit: - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d - name: JUnit - tags: - - unittest - url: https://junit.org/junit5/ - karma: - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 - name: Karma - tags: [] - url: https://karma-runner.github.io - owasp-defectdojo: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - purify: - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - SecObserve: - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 - name: SecObserve - tags: - - vulnerability management system - url: https://github.com/MaibornWolff/SecObserve - description: | - The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. - see-other-actions-e: - uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 - name: See other actions, e.g. "Treatment of defects with severity high". - tags: [] - sast: - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a - name: SAST - tags: [] - description: 'At SAST (Static Application Security Testing): Server-side - / client-side teams can easily be recorded. With microservice architecture - individual microservices can be used usually Teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ - dast: - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 - name: DAST - tags: [] - description: 'At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - owasp-defect-dojo: - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] - url: https://github.com/DefectDojo/django-DefectDojo - owasp-dependency-che: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - logparser-jenkins-pl: - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 - name: LogParser Jenkins Plugins - tags: [] - owasp-code-pulse: - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 - name: OWASP Code Pulse - tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse - ajax-spider: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb - name: Ajax Spider - tags: [] - url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ - curl: - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - openapi: - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 - name: OpenAPI Specifications - tags: [] - url: https://spec.openapis.org/ - owasp-zap: - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - arachni: - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 - name: Arachni - url: https://github.com/Arachni/arachni - zest: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 - name: Zest - url: https://www.zaproxy.org/docs/desktop/addons/zest/ - tags: - - zap - description: | - Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - owasp-securecodebox: - uuid: f220b299-0917-4750-96c5-d81cd402b4df - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - kube-hunter: - uuid: 2af7204c-a25c-4625-9775-889978386407 - name: kube-hunter - tags: [] - url: https://github.com/aquasecurity/kube-hunter - openvas: - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f - name: openVAS - tags: [] - url: https://www.openvas.org/ - htc-hydra: - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce - name: HTC Hydra - tags: - - password - url: https://www.htc-cs.com/en/products/htc-hydra/ - netassert: - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c - name: netassert - tags: [] - url: https://github.com/controlplaneio/netassert - nmap: - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 - name: nmap - tags: [] - url: https://nmap.org/ - owasp-amass: - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a - name: OWASP Amass - tags: [] - url: https://github.com/OWASP/Amass - k8spurger: - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - pmd: - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - eslint: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - findsecuritybugs: - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - jsprime: - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - bdd-mobile-security: - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - retire-js: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - npm-audit: - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - sigmahq: - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - dive-to-inspect-a-co: - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 - name: Dive to inspect a container images - tags: [] - url: https://github.com/wagoodman/dive - clusterscanner: - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - dockerfile-with-hado: - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 - name: Dockerfile with hadolint - tags: [] - url: https://github.com/hadolint/hadolint - deployment-with-kube: - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b - name: Deployment with kube-score - tags: [] - url: https://github.com/zegl/kube-score - kubesec: - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba - name: kubesec - tags: [] - url: https://kubesec.io - anchore-io: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - clair: - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - openscap: - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - vuls: - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - kube-bench: - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 - name: kube-bench - tags: [] - url: https://github.com/aquasecurity/kube-bench - trufflehog: - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - go-pillage-registrie: - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - https-github-com-a: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - registries-like-quay: - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay - tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - dockerfilelint: - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 - name: dockerfilelint - tags: - - sast - - docker - - dockerfile - url: https://github.com/replicatedhq/dockerfilelint - description: dockerfilelint is an node module that analyzes a Dockerfile - and looks for common traps, mistakes and helps enforce best practices. - threat-matrix-for-storage: - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - defend-the-core-kubernetes: - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes - business-friendly-vulnerability-metrics: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - kubescape: - uuid: 893d9f37-2142-4490-996c-e43b55064d3d - name: kubescape - url: https://github.com/armosec/kubescape - tags: - - kubernetes - - vulnerability - - misconfiguration - description: _Testing if Kubernetes is deployed securely as defined in Kubernetes - Hardening Guidance by to NSA and CISA_ - azuredevops: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - github-policies: - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - sonarqube: - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - stylecop: - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - fortify-vscode-extension: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - appscan-vscode-extension: - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - checkmarx-vscode-extension: - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - pre-commit-microsoft: - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 - name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop - tags: - - pre-commit - pre-commit-synopsis: - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb - name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ - tags: - - pre-commit - dependencyTrack: - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach - by leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - juice-shop: - uuid: c021aa72-c71c-43e4-9573-717b74d6c19d - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - dvwa: - uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - loggingCheatSheet: - uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - zap: - uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - secureCodeBox: - uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - K8sPurger: - uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - hashicorp-vault: - uuid: e3a2ffc8-313f-437e-9663-b24591568209 - name: Hashicorp Vault - tags: - - authentication - - authorization - - secrets - - infrastructure - url: https://github.com/hashicorp/vault - description: | - A tool for secrets management, encryption as a service, and privileged access management. - stoplight-spectral: - uuid: 261f243e-f89c-4169-b076-b22a03ec00be - name: Spectral - tags: - - linting - - api - - documentation - url: https://github.com/stoplightio/spectral - description: | - Spectral is a flexible JSON/YAML linter built with extensibility in mind. - It uses JSON/YAML path rules to describe the problems you want to find. - api-oas-checker: - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f - name: API OAS Checker - tags: - - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. - coveragepy: - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 - name: Coverage.py - tags: - - testing - - coverage - url: https://github.com/nedbat/coveragepy - description: | - Code coverage measurement for Python - github-dependabot: - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - github-super-linter: - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f - name: Super-Linter - tags: - - linting - - scm - url: https://github.com/github/super-linter - description: | - Lint code bases to catch common errors and enforce code style - schemathesis: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b - name: Schemathesis - tags: - - testing - - api - - documentation - url: https://github.com/schemathesis/schemathesis - description: | - Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - martin-feature-toggles: - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 - name: Feature Toggles - tags: - - development - - architecture - url: https://martinfowler.com/articles/feature-toggles.html - description: | - Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) - defectdojo-client: - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - falco: - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. - sammancoaching: - uuid: 9223be73-00da-400e-a910-3871734cff2f - name: sammancoaching - tags: - - documentation - - coaching - - education - url: https://sammancoaching.org/ - description: | - Security coaches work with software development teams to help them adopt better security practices. - terraform: - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - packj: - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a - name: packj - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://github.com/ossillate-inc/packj - description: | - Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. - apiMyth: - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 - name: Top 5 API Security Myths That Are Crushing Your Business - tags: - - documentation - - waf - url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html - description: | - There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business - backstage: - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - image-metadata-collector: - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - jira: - uuid: 889444eb-de68-4367-bada-a66f8cb9733a - name: Jira - tags: - - documentation - - issue - - proprietary - url: https://jira.atlassian.com/ - description: Jira is a bug tracking and project management tool developed - by Atlassian, used by development teams for tracking issues, planning - sprints, and managing software releases. It offers features for creating - and managing tasks, assigning them to team members, and monitoring progress - through customizable workflows and dashboards. - epss: - uuid: e39afc58-8195-4600-92c6-11922e3a141b - name: Exploit Prediction Scoring System - tags: - - vulnerability - url: https://www.first.org/epss/ - description: Estimates the likelihood that a software vulnerability will - be exploited. - cisa-kev: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 - name: Known Exploited Vulnerabilities - tags: - - vulnerability - url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - description: A catalog of vulnerabilities that have been exploited. - owasp-secure-headers: - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e - name: OWASP Secure Headers Project - tags: - - header - - documentation - url: https://owasp.org/www-project-secure-headers/ - description: "The OWASP Secure Headers Project (also called OSHP) describes - HTTP response headers that your application can use \nto increase the - security of your application. Once set, these HTTP response headers can - restrict modern browsers \nfrom running into easily preventable vulnerabilities. - The OWASP Secure Headers Project intends to raise awareness\nand use of - these headers." - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - signing-of-commits: - uuid: d6d755d3-b9f1-4942-a084-e62b266541df - name: Signing of commits - tags: - - signing - url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work - description: Signing of commits in git - ci-cd-tools: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - apimaturity: - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ - container-technologi: - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - cwe25: - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 - name: CWE Top 25 Most Dangerous Software Weaknesses - tags: - - documentation - - threat - url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html - docker-content-trust: - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 - name: Docker Content Trust - tags: [] - url: https://docs.docker.com/engine/security/trust/ - in-toto: - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f - name: in-toto - tags: [] - url: https://in-toto.github.io/ - a-complete-backup-of: - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b - name: A complete backup of persisted data might be performed*. - tags: [] - a-point-in-time-reco: - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 - name: A Point in Time Recovery for databases should be implemented. - tags: [] - blue-green-deploymen: - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 - name: Blue/Green Deployments - tags: [] - url: https://martinfowler.com/bliki/BlueGreenDeployment.html - docker: - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - webserver: - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb - name: Webserver - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ - rolling-update: - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e - name: rolling update - tags: [] - kubernetes-admission: - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af - name: Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. - tags: [] - url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d - dependabot: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - renovate: - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - jenkins: - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 - name: Jenkins - tags: [] - url: https://www.jenkins.io/ - sample-concept-1: - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" - tags: [] - description: "Sample concept: \n(1) each container has a set lifetime and - is killed / replaced with a new container multiple times a day where you - have some form of a graceful replacement to ensure no (short) service - outage will occur to the end users. \n(2) twice a day a rebuild of images - is done. The rebuilds are put into a automated testing pipeline. If the - testing has no blocking issues the new images will be released for deployment - during the next \"restart\" of a container. What has to be done, is to - ensure the new containers are deployed in some canary deployment manner, - this will ensure that if (and only if) something buggy has been introduced - which breaks functionality the canary deployment will make sure the \"older - version\" is being used and not the buggy newer one." - distroless: - uuid: ef647044-b675-47d3-9720-3ebc144ef37b - name: Distroless - tags: [] - url: https://github.com/GoogleContainerTools/distroless - fedora-coreos: - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a - name: Fedora CoreOS - tags: [] - url: https://getfedora.org/coreos - distroless-usage: - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd - name: Distroless or Alpine - tags: [] - url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 - threat-modeling-play: - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - owasp-samm: - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - whiteboard: - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - miro-or-any-other-c: - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - draw-io: - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - threagile: - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c - name: Threagile - tags: - - threat-modeling - url: https://github.com/Threagile/threagile - don-t-forget-evil-user-stories: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: Don't Forget EVIL User stories - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' - libyear: - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a - single number telling you how up-to-date your dependencies are. - owasp-juice-shop: - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - owasp-cheatsheet-ser: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-juiceshop: - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] - url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - https-cheatsheetse: - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-security-champ: - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 - name: OWASP Security Champions Playbook - tags: - - security champions - url: https://github.com/c0rdis/security-champions-playbook - build-it-break-it-fi: - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f - name: Build it Break it Fix it Contest - tags: [] - url: https://builditbreakit.org/ - motivate-people: - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 - name: Motivate people - tags: - - security champions - - gamification - - nudging - url: https://github.com/wurstbrot/security-pins - description: |- - Enhance motivation can be performed with the distribution of pins - as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) - owasp-top-10-maturit: - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 - name: OWASP Top 10 Maturity Categories for Security Champions - tags: - - security champions - url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx - involve-security-sme: - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 - name: Involve Security SME - tags: [] - description: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. - damn-vulnerable-web: - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - example-all-docker: - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 - name: 'Example: All docker images used by teams need to be based on standard - images.' - tags: [] - owasp-asvs: - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - owasp-masvs: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - cis-kubernetes-bench: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - cis-docker-bench-for: - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - for-example-for-cont: - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont - tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, - ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - attack-matrix-cloud: - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - attack-matrix-contai: - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for containers - attack-matrix-kubern: - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - istio: - uuid: 9429d52c-203d-49ae-814f-1401210887cd - name: istio - tags: [] - url: https://istio.io/ - bridges: - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 - name: bridges - tags: [] - firewalls: - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - open-policy-agent: - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 - name: Open Policy Agent - tags: [] - url: https://www.openpolicyagent.org/ - gitops: - uuid: b0931397-2402-44f1-814b-63292ab4a339 - name: GitOps - tags: [] - url: https://www.redhat.com/en/topics/devops/what-is-gitops - ansible: - uuid: 73747d35-2185-4f22-94a0-723288fa283c - name: Ansible - tags: [] - url: https://github.com/ansible/ansible - chef: - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce - name: Chef - tags: [] - url: https://github.com/chef/chef - puppet: - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 - name: Puppet - tags: [] - url: https://github.com/puppetlabs/puppet - jenkinsfile: - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 - name: Jenkinsfile - tags: [] - url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ - seccomp: - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd - name: seccomp - tags: [] - url: https://man7.org/linux/man-pages/man2/seccomp.2.html - strace: - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff - name: strace - tags: [] - url: https://man7.org/linux/man-pages/man1/strace.1.html - remove-direct-access: - uuid: b206481f-9c66-45e2-843c-37c5730580cd - name: Remove direct access to infrastructure - tags: [] - directory-service: - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 - name: Directory Service - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ - plugins: - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e - name: Plugins - tags: [] - smartcard: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - yubikey: - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - sms: - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS - tags: [] - totp: - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP - tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ - http-basic-authentic: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 - name: HTTP-Basic Authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ - vpn: - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e - name: VPN - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ - for-applications-ch: - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c - name: 'For applications: Check default encoding' - tags: [] - managing-secrets: - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf - name: managing secrets - tags: [] - url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ - crypto: - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 - name: crypto - tags: [] - authentication: - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 - name: authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ - rsyslog: - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 - name: rsyslog - url: https://www.rsyslog.com/ - tags: - - tool - - logging - logstash: - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - fluentd: - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 - name: fluentd - tags: - - tool - url: https://www.fluentd.org/ - bash: - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 - name: bash - tags: - - tool - url: https://www.gnu.org/software/bash/ - owasp-logging-cheats: - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - elk-stack: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 - name: ELK-Stack - tags: [] - url: https://www.elastic.co/elk-stack - https-ht-transpare: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf - prometheus: - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c - name: Prometheus - tags: [] - url: https://prometheus.io/ - collected: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - httpunit: - uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 - name: HttpUnit - tags: [] - url: http://httpunit.sourceforge.net/ - junit: - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d - name: JUnit - tags: - - unittest - url: https://junit.org/junit5/ - karma: - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 - name: Karma - tags: [] - url: https://karma-runner.github.io - owasp-defectdojo: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - purify: - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - SecObserve: - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 - name: SecObserve - tags: - - vulnerability management system - url: https://github.com/MaibornWolff/SecObserve - description: | - The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. - see-other-actions-e: - uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 - name: See other actions, e.g. "Treatment of defects with severity high". - tags: [] - sast: - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a - name: SAST - tags: [] - description: 'At SAST (Static Application Security Testing): Server-side - / client-side teams can easily be recorded. With microservice architecture - individual microservices can be used usually Teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ - dast: - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 - name: DAST - tags: [] - description: 'At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - owasp-defect-dojo: - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] - url: https://github.com/DefectDojo/django-DefectDojo - owasp-dependency-che: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - logparser-jenkins-pl: - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 - name: LogParser Jenkins Plugins - tags: [] - owasp-code-pulse: - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 - name: OWASP Code Pulse - tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse - ajax-spider: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb - name: Ajax Spider - tags: [] - url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ - curl: - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - openapi: - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 - name: OpenAPI Specifications - tags: [] - url: https://spec.openapis.org/ - owasp-zap: - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - arachni: - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 - name: Arachni - url: https://github.com/Arachni/arachni - zest: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 - name: Zest - url: https://www.zaproxy.org/docs/desktop/addons/zest/ - tags: - - zap - description: | - Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - owasp-securecodebox: - uuid: f220b299-0917-4750-96c5-d81cd402b4df - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - kube-hunter: - uuid: 2af7204c-a25c-4625-9775-889978386407 - name: kube-hunter - tags: [] - url: https://github.com/aquasecurity/kube-hunter - openvas: - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f - name: openVAS - tags: [] - url: https://www.openvas.org/ - htc-hydra: - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce - name: HTC Hydra - tags: - - password - url: https://www.htc-cs.com/en/products/htc-hydra/ - netassert: - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c - name: netassert - tags: [] - url: https://github.com/controlplaneio/netassert - nmap: - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 - name: nmap - tags: [] - url: https://nmap.org/ - owasp-amass: - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a - name: OWASP Amass - tags: [] - url: https://github.com/OWASP/Amass - k8spurger: - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - pmd: - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - eslint: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - findsecuritybugs: - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - jsprime: - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - bdd-mobile-security: - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - retire-js: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - npm-audit: - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - sigmahq: - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - dive-to-inspect-a-co: - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 - name: Dive to inspect a container images - tags: [] - url: https://github.com/wagoodman/dive - clusterscanner: - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - dockerfile-with-hado: - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 - name: Dockerfile with hadolint - tags: [] - url: https://github.com/hadolint/hadolint - deployment-with-kube: - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b - name: Deployment with kube-score - tags: [] - url: https://github.com/zegl/kube-score - kubesec: - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba - name: kubesec - tags: [] - url: https://kubesec.io - anchore-io: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - clair: - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - openscap: - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - vuls: - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - kube-bench: - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 - name: kube-bench - tags: [] - url: https://github.com/aquasecurity/kube-bench - trufflehog: - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - go-pillage-registrie: - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - https-github-com-a: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - registries-like-quay: - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay - tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - dockerfilelint: - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 - name: dockerfilelint - tags: - - sast - - docker - - dockerfile - url: https://github.com/replicatedhq/dockerfilelint - description: dockerfilelint is an node module that analyzes a Dockerfile - and looks for common traps, mistakes and helps enforce best practices. - threat-matrix-for-storage: - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - defend-the-core-kubernetes: - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes - business-friendly-vulnerability-metrics: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - kubescape: - uuid: 893d9f37-2142-4490-996c-e43b55064d3d - name: kubescape - url: https://github.com/armosec/kubescape - tags: - - kubernetes - - vulnerability - - misconfiguration - description: _Testing if Kubernetes is deployed securely as defined in Kubernetes - Hardening Guidance by to NSA and CISA_ - azuredevops: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - github-policies: - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - sonarqube: - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - stylecop: - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - fortify-vscode-extension: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - appscan-vscode-extension: - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - checkmarx-vscode-extension: - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - pre-commit-microsoft: - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 - name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop - tags: - - pre-commit - pre-commit-synopsis: - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb - name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ - tags: - - pre-commit - dependencyTrack: - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach - by leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - juice-shop: - uuid: c021aa72-c71c-43e4-9573-717b74d6c19d - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - dvwa: - uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - loggingCheatSheet: - uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - zap: - uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - secureCodeBox: - uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - K8sPurger: - uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - hashicorp-vault: - uuid: e3a2ffc8-313f-437e-9663-b24591568209 - name: Hashicorp Vault - tags: - - authentication - - authorization - - secrets - - infrastructure - url: https://github.com/hashicorp/vault - description: | - A tool for secrets management, encryption as a service, and privileged access management. - stoplight-spectral: - uuid: 261f243e-f89c-4169-b076-b22a03ec00be - name: Spectral - tags: - - linting - - api - - documentation - url: https://github.com/stoplightio/spectral - description: | - Spectral is a flexible JSON/YAML linter built with extensibility in mind. - It uses JSON/YAML path rules to describe the problems you want to find. - api-oas-checker: - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f - name: API OAS Checker - tags: - - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. - coveragepy: - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 - name: Coverage.py - tags: - - testing - - coverage - url: https://github.com/nedbat/coveragepy - description: | - Code coverage measurement for Python - github-dependabot: - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - github-super-linter: - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f - name: Super-Linter - tags: - - linting - - scm - url: https://github.com/github/super-linter - description: | - Lint code bases to catch common errors and enforce code style - schemathesis: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b - name: Schemathesis - tags: - - testing - - api - - documentation - url: https://github.com/schemathesis/schemathesis - description: | - Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - martin-feature-toggles: - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 - name: Feature Toggles - tags: - - development - - architecture - url: https://martinfowler.com/articles/feature-toggles.html - description: | - Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) - defectdojo-client: - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - falco: - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. - sammancoaching: - uuid: 9223be73-00da-400e-a910-3871734cff2f - name: sammancoaching - tags: - - documentation - - coaching - - education - url: https://sammancoaching.org/ - description: | - Security coaches work with software development teams to help them adopt better security practices. - terraform: - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - packj: - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a - name: packj - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://github.com/ossillate-inc/packj - description: | - Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. - apiMyth: - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 - name: Top 5 API Security Myths That Are Crushing Your Business - tags: - - documentation - - waf - url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html - description: | - There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business - backstage: - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - image-metadata-collector: - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - jira: - uuid: 889444eb-de68-4367-bada-a66f8cb9733a - name: Jira - tags: - - documentation - - issue - - proprietary - url: https://jira.atlassian.com/ - description: Jira is a bug tracking and project management tool developed - by Atlassian, used by development teams for tracking issues, planning - sprints, and managing software releases. It offers features for creating - and managing tasks, assigning them to team members, and monitoring progress - through customizable workflows and dashboards. - epss: - uuid: e39afc58-8195-4600-92c6-11922e3a141b - name: Exploit Prediction Scoring System - tags: - - vulnerability - url: https://www.first.org/epss/ - description: Estimates the likelihood that a software vulnerability will - be exploited. - cisa-kev: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 - name: Known Exploited Vulnerabilities - tags: - - vulnerability - url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - description: A catalog of vulnerabilities that have been exploited. - owasp-secure-headers: - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e - name: OWASP Secure Headers Project - tags: - - header - - documentation - url: https://owasp.org/www-project-secure-headers/ - description: "The OWASP Secure Headers Project (also called OSHP) describes - HTTP response headers that your application can use \nto increase the - security of your application. Once set, these HTTP response headers can - restrict modern browsers \nfrom running into easily preventable vulnerabilities. - The OWASP Secure Headers Project intends to raise awareness\nand use of - these headers." + - uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 + name: Citrus Fresh Integration Testing + tags: + - framework + - testing + url: https://citrusframework.org/ + description: Integration Test framework with focus on messaging applications + and Microservices. comments: "" tags: - none @@ -10607,1153 +7184,6 @@ Test and Verification: tags: - ide - sast - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - signing-of-commits: - uuid: d6d755d3-b9f1-4942-a084-e62b266541df - name: Signing of commits - tags: - - signing - url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work - description: Signing of commits in git - ci-cd-tools: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - apimaturity: - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ - container-technologi: - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - cwe25: - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 - name: CWE Top 25 Most Dangerous Software Weaknesses - tags: - - documentation - - threat - url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html - docker-content-trust: - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 - name: Docker Content Trust - tags: [] - url: https://docs.docker.com/engine/security/trust/ - in-toto: - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f - name: in-toto - tags: [] - url: https://in-toto.github.io/ - a-complete-backup-of: - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b - name: A complete backup of persisted data might be performed*. - tags: [] - a-point-in-time-reco: - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 - name: A Point in Time Recovery for databases should be implemented. - tags: [] - blue-green-deploymen: - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 - name: Blue/Green Deployments - tags: [] - url: https://martinfowler.com/bliki/BlueGreenDeployment.html - docker: - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - webserver: - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb - name: Webserver - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ - rolling-update: - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e - name: rolling update - tags: [] - kubernetes-admission: - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af - name: Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. - tags: [] - url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d - dependabot: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - renovate: - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - jenkins: - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 - name: Jenkins - tags: [] - url: https://www.jenkins.io/ - sample-concept-1: - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" - tags: [] - description: "Sample concept: \n(1) each container has a set lifetime and - is killed / replaced with a new container multiple times a day where you - have some form of a graceful replacement to ensure no (short) service - outage will occur to the end users. \n(2) twice a day a rebuild of images - is done. The rebuilds are put into a automated testing pipeline. If the - testing has no blocking issues the new images will be released for deployment - during the next \"restart\" of a container. What has to be done, is to - ensure the new containers are deployed in some canary deployment manner, - this will ensure that if (and only if) something buggy has been introduced - which breaks functionality the canary deployment will make sure the \"older - version\" is being used and not the buggy newer one." - distroless: - uuid: ef647044-b675-47d3-9720-3ebc144ef37b - name: Distroless - tags: [] - url: https://github.com/GoogleContainerTools/distroless - fedora-coreos: - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a - name: Fedora CoreOS - tags: [] - url: https://getfedora.org/coreos - distroless-usage: - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd - name: Distroless or Alpine - tags: [] - url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 - threat-modeling-play: - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - owasp-samm: - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - whiteboard: - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - miro-or-any-other-c: - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - draw-io: - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - threagile: - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c - name: Threagile - tags: - - threat-modeling - url: https://github.com/Threagile/threagile - don-t-forget-evil-user-stories: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: Don't Forget EVIL User stories - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' - libyear: - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a - single number telling you how up-to-date your dependencies are. - owasp-juice-shop: - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - owasp-cheatsheet-ser: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-juiceshop: - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] - url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - https-cheatsheetse: - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-security-champ: - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 - name: OWASP Security Champions Playbook - tags: - - security champions - url: https://github.com/c0rdis/security-champions-playbook - build-it-break-it-fi: - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f - name: Build it Break it Fix it Contest - tags: [] - url: https://builditbreakit.org/ - motivate-people: - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 - name: Motivate people - tags: - - security champions - - gamification - - nudging - url: https://github.com/wurstbrot/security-pins - description: |- - Enhance motivation can be performed with the distribution of pins - as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) - owasp-top-10-maturit: - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 - name: OWASP Top 10 Maturity Categories for Security Champions - tags: - - security champions - url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx - involve-security-sme: - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 - name: Involve Security SME - tags: [] - description: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. - damn-vulnerable-web: - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - example-all-docker: - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 - name: 'Example: All docker images used by teams need to be based on standard - images.' - tags: [] - owasp-asvs: - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - owasp-masvs: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - cis-kubernetes-bench: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - cis-docker-bench-for: - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - for-example-for-cont: - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont - tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, - ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - attack-matrix-cloud: - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - attack-matrix-contai: - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for containers - attack-matrix-kubern: - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - istio: - uuid: 9429d52c-203d-49ae-814f-1401210887cd - name: istio - tags: [] - url: https://istio.io/ - bridges: - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 - name: bridges - tags: [] - firewalls: - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - open-policy-agent: - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 - name: Open Policy Agent - tags: [] - url: https://www.openpolicyagent.org/ - gitops: - uuid: b0931397-2402-44f1-814b-63292ab4a339 - name: GitOps - tags: [] - url: https://www.redhat.com/en/topics/devops/what-is-gitops - ansible: - uuid: 73747d35-2185-4f22-94a0-723288fa283c - name: Ansible - tags: [] - url: https://github.com/ansible/ansible - chef: - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce - name: Chef - tags: [] - url: https://github.com/chef/chef - puppet: - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 - name: Puppet - tags: [] - url: https://github.com/puppetlabs/puppet - jenkinsfile: - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 - name: Jenkinsfile - tags: [] - url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ - seccomp: - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd - name: seccomp - tags: [] - url: https://man7.org/linux/man-pages/man2/seccomp.2.html - strace: - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff - name: strace - tags: [] - url: https://man7.org/linux/man-pages/man1/strace.1.html - remove-direct-access: - uuid: b206481f-9c66-45e2-843c-37c5730580cd - name: Remove direct access to infrastructure - tags: [] - directory-service: - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 - name: Directory Service - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ - plugins: - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e - name: Plugins - tags: [] - smartcard: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - yubikey: - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - sms: - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS - tags: [] - totp: - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP - tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ - http-basic-authentic: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 - name: HTTP-Basic Authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ - vpn: - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e - name: VPN - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ - for-applications-ch: - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c - name: 'For applications: Check default encoding' - tags: [] - managing-secrets: - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf - name: managing secrets - tags: [] - url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ - crypto: - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 - name: crypto - tags: [] - authentication: - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 - name: authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ - rsyslog: - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 - name: rsyslog - url: https://www.rsyslog.com/ - tags: - - tool - - logging - logstash: - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - fluentd: - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 - name: fluentd - tags: - - tool - url: https://www.fluentd.org/ - bash: - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 - name: bash - tags: - - tool - url: https://www.gnu.org/software/bash/ - owasp-logging-cheats: - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - elk-stack: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 - name: ELK-Stack - tags: [] - url: https://www.elastic.co/elk-stack - https-ht-transpare: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf - prometheus: - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c - name: Prometheus - tags: [] - url: https://prometheus.io/ - collected: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - httpunit: - uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 - name: HttpUnit - tags: [] - url: http://httpunit.sourceforge.net/ - junit: - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d - name: JUnit - tags: - - unittest - url: https://junit.org/junit5/ - karma: - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 - name: Karma - tags: [] - url: https://karma-runner.github.io - owasp-defectdojo: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - purify: - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - SecObserve: - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 - name: SecObserve - tags: - - vulnerability management system - url: https://github.com/MaibornWolff/SecObserve - description: | - The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. - see-other-actions-e: - uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 - name: See other actions, e.g. "Treatment of defects with severity high". - tags: [] - sast: - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a - name: SAST - tags: [] - description: 'At SAST (Static Application Security Testing): Server-side - / client-side teams can easily be recorded. With microservice architecture - individual microservices can be used usually Teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ - dast: - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 - name: DAST - tags: [] - description: 'At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - owasp-defect-dojo: - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] - url: https://github.com/DefectDojo/django-DefectDojo - owasp-dependency-che: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - logparser-jenkins-pl: - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 - name: LogParser Jenkins Plugins - tags: [] - owasp-code-pulse: - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 - name: OWASP Code Pulse - tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse - ajax-spider: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb - name: Ajax Spider - tags: [] - url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ - curl: - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - openapi: - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 - name: OpenAPI Specifications - tags: [] - url: https://spec.openapis.org/ - owasp-zap: - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - arachni: - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 - name: Arachni - url: https://github.com/Arachni/arachni - zest: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 - name: Zest - url: https://www.zaproxy.org/docs/desktop/addons/zest/ - tags: - - zap - description: | - Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - owasp-securecodebox: - uuid: f220b299-0917-4750-96c5-d81cd402b4df - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - kube-hunter: - uuid: 2af7204c-a25c-4625-9775-889978386407 - name: kube-hunter - tags: [] - url: https://github.com/aquasecurity/kube-hunter - openvas: - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f - name: openVAS - tags: [] - url: https://www.openvas.org/ - htc-hydra: - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce - name: HTC Hydra - tags: - - password - url: https://www.htc-cs.com/en/products/htc-hydra/ - netassert: - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c - name: netassert - tags: [] - url: https://github.com/controlplaneio/netassert - nmap: - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 - name: nmap - tags: [] - url: https://nmap.org/ - owasp-amass: - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a - name: OWASP Amass - tags: [] - url: https://github.com/OWASP/Amass - k8spurger: - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - pmd: - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - eslint: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - findsecuritybugs: - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - jsprime: - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - bdd-mobile-security: - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - retire-js: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - npm-audit: - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - sigmahq: - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - dive-to-inspect-a-co: - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 - name: Dive to inspect a container images - tags: [] - url: https://github.com/wagoodman/dive - clusterscanner: - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - dockerfile-with-hado: - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 - name: Dockerfile with hadolint - tags: [] - url: https://github.com/hadolint/hadolint - deployment-with-kube: - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b - name: Deployment with kube-score - tags: [] - url: https://github.com/zegl/kube-score - kubesec: - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba - name: kubesec - tags: [] - url: https://kubesec.io - anchore-io: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - clair: - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - openscap: - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - vuls: - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - kube-bench: - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 - name: kube-bench - tags: [] - url: https://github.com/aquasecurity/kube-bench - trufflehog: - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - go-pillage-registrie: - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - https-github-com-a: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - registries-like-quay: - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay - tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - dockerfilelint: - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 - name: dockerfilelint - tags: - - sast - - docker - - dockerfile - url: https://github.com/replicatedhq/dockerfilelint - description: dockerfilelint is an node module that analyzes a Dockerfile - and looks for common traps, mistakes and helps enforce best practices. - threat-matrix-for-storage: - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - defend-the-core-kubernetes: - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes - business-friendly-vulnerability-metrics: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - kubescape: - uuid: 893d9f37-2142-4490-996c-e43b55064d3d - name: kubescape - url: https://github.com/armosec/kubescape - tags: - - kubernetes - - vulnerability - - misconfiguration - description: _Testing if Kubernetes is deployed securely as defined in Kubernetes - Hardening Guidance by to NSA and CISA_ - azuredevops: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - github-policies: - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - sonarqube: - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - stylecop: - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - fortify-vscode-extension: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - appscan-vscode-extension: - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - checkmarx-vscode-extension: - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - pre-commit-microsoft: - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 - name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop - tags: - - pre-commit - pre-commit-synopsis: - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb - name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ - tags: - - pre-commit - dependencyTrack: - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach - by leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - juice-shop: - uuid: c021aa72-c71c-43e4-9573-717b74d6c19d - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - dvwa: - uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - loggingCheatSheet: - uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - zap: - uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - secureCodeBox: - uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - K8sPurger: - uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - hashicorp-vault: - uuid: e3a2ffc8-313f-437e-9663-b24591568209 - name: Hashicorp Vault - tags: - - authentication - - authorization - - secrets - - infrastructure - url: https://github.com/hashicorp/vault - description: | - A tool for secrets management, encryption as a service, and privileged access management. - stoplight-spectral: - uuid: 261f243e-f89c-4169-b076-b22a03ec00be - name: Spectral - tags: - - linting - - api - - documentation - url: https://github.com/stoplightio/spectral - description: | - Spectral is a flexible JSON/YAML linter built with extensibility in mind. - It uses JSON/YAML path rules to describe the problems you want to find. - api-oas-checker: - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f - name: API OAS Checker - tags: - - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. - coveragepy: - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 - name: Coverage.py - tags: - - testing - - coverage - url: https://github.com/nedbat/coveragepy - description: | - Code coverage measurement for Python - github-dependabot: - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - github-super-linter: - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f - name: Super-Linter - tags: - - linting - - scm - url: https://github.com/github/super-linter - description: | - Lint code bases to catch common errors and enforce code style - schemathesis: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b - name: Schemathesis - tags: - - testing - - api - - documentation - url: https://github.com/schemathesis/schemathesis - description: | - Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - martin-feature-toggles: - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 - name: Feature Toggles - tags: - - development - - architecture - url: https://martinfowler.com/articles/feature-toggles.html - description: | - Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) - defectdojo-client: - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - falco: - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. - sammancoaching: - uuid: 9223be73-00da-400e-a910-3871734cff2f - name: sammancoaching - tags: - - documentation - - coaching - - education - url: https://sammancoaching.org/ - description: | - Security coaches work with software development teams to help them adopt better security practices. - terraform: - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - packj: - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a - name: packj - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://github.com/ossillate-inc/packj - description: | - Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. - apiMyth: - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 - name: Top 5 API Security Myths That Are Crushing Your Business - tags: - - documentation - - waf - url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html - description: | - There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business - backstage: - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - image-metadata-collector: - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - jira: - uuid: 889444eb-de68-4367-bada-a66f8cb9733a - name: Jira - tags: - - documentation - - issue - - proprietary - url: https://jira.atlassian.com/ - description: Jira is a bug tracking and project management tool developed - by Atlassian, used by development teams for tracking issues, planning - sprints, and managing software releases. It offers features for creating - and managing tasks, assigning them to team members, and monitoring progress - through customizable workflows and dashboards. - epss: - uuid: e39afc58-8195-4600-92c6-11922e3a141b - name: Exploit Prediction Scoring System - tags: - - vulnerability - url: https://www.first.org/epss/ - description: Estimates the likelihood that a software vulnerability will - be exploited. - cisa-kev: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 - name: Known Exploited Vulnerabilities - tags: - - vulnerability - url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - description: A catalog of vulnerabilities that have been exploited. - owasp-secure-headers: - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e - name: OWASP Secure Headers Project - tags: - - header - - documentation - url: https://owasp.org/www-project-secure-headers/ - description: "The OWASP Secure Headers Project (also called OSHP) describes - HTTP response headers that your application can use \nto increase the - security of your application. Once set, these HTTP response headers can - restrict modern browsers \nfrom running into easily preventable vulnerabilities. - The OWASP Secure Headers Project intends to raise awareness\nand use of - these headers." - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 name: DevSecOps control Pre-commit url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop @@ -11901,1153 +7331,10 @@ Test and Verification: url: https://github.com/dependabot/dependabot-core description: | Dependabot creates pull requests to keep your dependencies secure and up-to-date. - - argocd: - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - signing-of-commits-protection: - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - signing-of-commits: - uuid: d6d755d3-b9f1-4942-a084-e62b266541df - name: Signing of commits - tags: - - signing - url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work - description: Signing of commits in git - ci-cd-tools: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - apimaturity: - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ - container-technologi: - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - cwe25: - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 - name: CWE Top 25 Most Dangerous Software Weaknesses - tags: - - documentation - - threat - url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html - docker-content-trust: - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 - name: Docker Content Trust - tags: [] - url: https://docs.docker.com/engine/security/trust/ - in-toto: - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f - name: in-toto - tags: [] - url: https://in-toto.github.io/ - a-complete-backup-of: - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b - name: A complete backup of persisted data might be performed*. - tags: [] - a-point-in-time-reco: - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 - name: A Point in Time Recovery for databases should be implemented. - tags: [] - blue-green-deploymen: - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 - name: Blue/Green Deployments - tags: [] - url: https://martinfowler.com/bliki/BlueGreenDeployment.html - docker: - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - webserver: - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb - name: Webserver - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ - rolling-update: - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e - name: rolling update - tags: [] - kubernetes-admission: - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af - name: Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. - tags: [] - url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d - dependabot: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - renovate: - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - jenkins: - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 - name: Jenkins - tags: [] - url: https://www.jenkins.io/ - sample-concept-1: - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" - tags: [] - description: "Sample concept: \n(1) each container has a set lifetime and - is killed / replaced with a new container multiple times a day where you - have some form of a graceful replacement to ensure no (short) service - outage will occur to the end users. \n(2) twice a day a rebuild of images - is done. The rebuilds are put into a automated testing pipeline. If the - testing has no blocking issues the new images will be released for deployment - during the next \"restart\" of a container. What has to be done, is to - ensure the new containers are deployed in some canary deployment manner, - this will ensure that if (and only if) something buggy has been introduced - which breaks functionality the canary deployment will make sure the \"older - version\" is being used and not the buggy newer one." - distroless: - uuid: ef647044-b675-47d3-9720-3ebc144ef37b - name: Distroless - tags: [] - url: https://github.com/GoogleContainerTools/distroless - fedora-coreos: - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a - name: Fedora CoreOS - tags: [] - url: https://getfedora.org/coreos - distroless-usage: - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd - name: Distroless or Alpine - tags: [] - url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 - threat-modeling-play: - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - owasp-samm: - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - whiteboard: - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - miro-or-any-other-c: - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - draw-io: - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - threagile: - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c - name: Threagile - tags: - - threat-modeling - url: https://github.com/Threagile/threagile - don-t-forget-evil-user-stories: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: Don't Forget EVIL User stories - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' - libyear: - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a - single number telling you how up-to-date your dependencies are. - owasp-juice-shop: - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - owasp-cheatsheet-ser: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-juiceshop: - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] - url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - https-cheatsheetse: - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - owasp-security-champ: - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 - name: OWASP Security Champions Playbook - tags: - - security champions - url: https://github.com/c0rdis/security-champions-playbook - build-it-break-it-fi: - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f - name: Build it Break it Fix it Contest - tags: [] - url: https://builditbreakit.org/ - motivate-people: - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 - name: Motivate people - tags: - - security champions - - gamification - - nudging - url: https://github.com/wurstbrot/security-pins - description: |- - Enhance motivation can be performed with the distribution of pins - as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) - owasp-top-10-maturit: - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 - name: OWASP Top 10 Maturity Categories for Security Champions - tags: - - security champions - url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx - involve-security-sme: - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 - name: Involve Security SME - tags: [] - description: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. - damn-vulnerable-web: - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - example-all-docker: - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 - name: 'Example: All docker images used by teams need to be based on standard - images.' - tags: [] - owasp-asvs: - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - owasp-masvs: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - cis-kubernetes-bench: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - cis-docker-bench-for: - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security - tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - for-example-for-cont: - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont - tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, - ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - attack-matrix-cloud: - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - attack-matrix-contai: - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for containers - attack-matrix-kubern: - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - istio: - uuid: 9429d52c-203d-49ae-814f-1401210887cd - name: istio - tags: [] - url: https://istio.io/ - bridges: - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 - name: bridges - tags: [] - firewalls: - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - open-policy-agent: - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 - name: Open Policy Agent - tags: [] - url: https://www.openpolicyagent.org/ - gitops: - uuid: b0931397-2402-44f1-814b-63292ab4a339 - name: GitOps - tags: [] - url: https://www.redhat.com/en/topics/devops/what-is-gitops - ansible: - uuid: 73747d35-2185-4f22-94a0-723288fa283c - name: Ansible - tags: [] - url: https://github.com/ansible/ansible - chef: - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce - name: Chef - tags: [] - url: https://github.com/chef/chef - puppet: - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 - name: Puppet - tags: [] - url: https://github.com/puppetlabs/puppet - jenkinsfile: - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 - name: Jenkinsfile - tags: [] - url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ - seccomp: - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd - name: seccomp - tags: [] - url: https://man7.org/linux/man-pages/man2/seccomp.2.html - strace: - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff - name: strace - tags: [] - url: https://man7.org/linux/man-pages/man1/strace.1.html - remove-direct-access: - uuid: b206481f-9c66-45e2-843c-37c5730580cd - name: Remove direct access to infrastructure - tags: [] - directory-service: - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 - name: Directory Service - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ - plugins: - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e - name: Plugins - tags: [] - smartcard: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - yubikey: - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - sms: - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS - tags: [] - totp: - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP - tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ - http-basic-authentic: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 - name: HTTP-Basic Authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ - vpn: - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e - name: VPN - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ - for-applications-ch: - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c - name: 'For applications: Check default encoding' - tags: [] - managing-secrets: - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf - name: managing secrets - tags: [] - url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ - crypto: - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 - name: crypto - tags: [] - authentication: - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 - name: authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ - rsyslog: - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 - name: rsyslog - url: https://www.rsyslog.com/ - tags: - - tool - - logging - logstash: - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - fluentd: - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 - name: fluentd - tags: - - tool - url: https://www.fluentd.org/ - bash: - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 - name: bash - tags: - - tool - url: https://www.gnu.org/software/bash/ - owasp-logging-cheats: - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - elk-stack: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 - name: ELK-Stack - tags: [] - url: https://www.elastic.co/elk-stack - https-ht-transpare: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf - prometheus: - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c - name: Prometheus - tags: [] - url: https://prometheus.io/ - collected: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - httpunit: - uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 - name: HttpUnit - tags: [] - url: http://httpunit.sourceforge.net/ - junit: - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d - name: JUnit - tags: - - unittest - url: https://junit.org/junit5/ - karma: - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 - name: Karma - tags: [] - url: https://karma-runner.github.io - owasp-defectdojo: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - purify: - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - SecObserve: - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 - name: SecObserve - tags: - - vulnerability management system - url: https://github.com/MaibornWolff/SecObserve - description: | - The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. - see-other-actions-e: - uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 - name: See other actions, e.g. "Treatment of defects with severity high". - tags: [] - sast: - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a - name: SAST - tags: [] - description: 'At SAST (Static Application Security Testing): Server-side - / client-side teams can easily be recorded. With microservice architecture - individual microservices can be used usually Teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ - dast: - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 - name: DAST - tags: [] - description: 'At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - owasp-defect-dojo: - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] - url: https://github.com/DefectDojo/django-DefectDojo - owasp-dependency-che: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - logparser-jenkins-pl: - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 - name: LogParser Jenkins Plugins - tags: [] - owasp-code-pulse: - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 - name: OWASP Code Pulse - tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse - ajax-spider: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb - name: Ajax Spider - tags: [] - url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ - curl: - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - openapi: - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 - name: OpenAPI Specifications - tags: [] - url: https://spec.openapis.org/ - owasp-zap: - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - arachni: - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 - name: Arachni - url: https://github.com/Arachni/arachni - zest: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 - name: Zest - url: https://www.zaproxy.org/docs/desktop/addons/zest/ - tags: - - zap - description: | - Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - owasp-securecodebox: - uuid: f220b299-0917-4750-96c5-d81cd402b4df - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - kube-hunter: - uuid: 2af7204c-a25c-4625-9775-889978386407 - name: kube-hunter - tags: [] - url: https://github.com/aquasecurity/kube-hunter - openvas: - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f - name: openVAS - tags: [] - url: https://www.openvas.org/ - htc-hydra: - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce - name: HTC Hydra - tags: - - password - url: https://www.htc-cs.com/en/products/htc-hydra/ - netassert: - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c - name: netassert - tags: [] - url: https://github.com/controlplaneio/netassert - nmap: - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 - name: nmap - tags: [] - url: https://nmap.org/ - owasp-amass: - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a - name: OWASP Amass - tags: [] - url: https://github.com/OWASP/Amass - k8spurger: - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - pmd: - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - eslint: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - findsecuritybugs: - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - jsprime: - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - bdd-mobile-security: - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - retire-js: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - npm-audit: - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - sigmahq: - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - dive-to-inspect-a-co: - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 - name: Dive to inspect a container images - tags: [] - url: https://github.com/wagoodman/dive - clusterscanner: - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - dockerfile-with-hado: - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 - name: Dockerfile with hadolint - tags: [] - url: https://github.com/hadolint/hadolint - deployment-with-kube: - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b - name: Deployment with kube-score - tags: [] - url: https://github.com/zegl/kube-score - kubesec: - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba - name: kubesec - tags: [] - url: https://kubesec.io - anchore-io: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - clair: - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - openscap: - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - vuls: - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - kube-bench: - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 - name: kube-bench - tags: [] - url: https://github.com/aquasecurity/kube-bench - trufflehog: - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - go-pillage-registrie: - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - https-github-com-a: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - registries-like-quay: - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay - tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - dockerfilelint: - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 - name: dockerfilelint - tags: - - sast - - docker - - dockerfile - url: https://github.com/replicatedhq/dockerfilelint - description: dockerfilelint is an node module that analyzes a Dockerfile - and looks for common traps, mistakes and helps enforce best practices. - threat-matrix-for-storage: - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - defend-the-core-kubernetes: - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes - business-friendly-vulnerability-metrics: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - kubescape: - uuid: 893d9f37-2142-4490-996c-e43b55064d3d - name: kubescape - url: https://github.com/armosec/kubescape - tags: - - kubernetes - - vulnerability - - misconfiguration - description: _Testing if Kubernetes is deployed securely as defined in Kubernetes - Hardening Guidance by to NSA and CISA_ - azuredevops: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - github-policies: - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - sonarqube: - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - stylecop: - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - fortify-vscode-extension: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - appscan-vscode-extension: - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - checkmarx-vscode-extension: - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - pre-commit-microsoft: - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 - name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop - tags: - - pre-commit - pre-commit-synopsis: - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb - name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ - tags: - - pre-commit - dependencyTrack: - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach - by leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - juice-shop: - uuid: c021aa72-c71c-43e4-9573-717b74d6c19d - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - dvwa: - uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - loggingCheatSheet: - uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - zap: - uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - secureCodeBox: - uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - K8sPurger: - uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - hashicorp-vault: - uuid: e3a2ffc8-313f-437e-9663-b24591568209 - name: Hashicorp Vault - tags: - - authentication - - authorization - - secrets - - infrastructure - url: https://github.com/hashicorp/vault - description: | - A tool for secrets management, encryption as a service, and privileged access management. - stoplight-spectral: - uuid: 261f243e-f89c-4169-b076-b22a03ec00be - name: Spectral - tags: - - linting - - api - - documentation - url: https://github.com/stoplightio/spectral - description: | - Spectral is a flexible JSON/YAML linter built with extensibility in mind. - It uses JSON/YAML path rules to describe the problems you want to find. - api-oas-checker: - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f - name: API OAS Checker - tags: - - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. - coveragepy: - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 - name: Coverage.py - tags: - - testing - - coverage - url: https://github.com/nedbat/coveragepy - description: | - Code coverage measurement for Python - github-dependabot: - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - github-super-linter: - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f - name: Super-Linter - tags: - - linting - - scm - url: https://github.com/github/super-linter - description: | - Lint code bases to catch common errors and enforce code style - schemathesis: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b - name: Schemathesis - tags: - - testing - - api - - documentation - url: https://github.com/schemathesis/schemathesis - description: | - Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - martin-feature-toggles: - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 - name: Feature Toggles - tags: - - development - - architecture - url: https://martinfowler.com/articles/feature-toggles.html - description: | - Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) - defectdojo-client: - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - falco: - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. - sammancoaching: - uuid: 9223be73-00da-400e-a910-3871734cff2f - name: sammancoaching - tags: - - documentation - - coaching - - education - url: https://sammancoaching.org/ - description: | - Security coaches work with software development teams to help them adopt better security practices. - terraform: - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - packj: - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a - name: packj - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://github.com/ossillate-inc/packj - description: | - Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. - apiMyth: - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 - name: Top 5 API Security Myths That Are Crushing Your Business - tags: - - documentation - - waf - url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html - description: | - There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business - backstage: - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - image-metadata-collector: - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - jira: - uuid: 889444eb-de68-4367-bada-a66f8cb9733a - name: Jira - tags: - - documentation - - issue - - proprietary - url: https://jira.atlassian.com/ - description: Jira is a bug tracking and project management tool developed - by Atlassian, used by development teams for tracking issues, planning - sprints, and managing software releases. It offers features for creating - and managing tasks, assigning them to team members, and monitoring progress - through customizable workflows and dashboards. - epss: - uuid: e39afc58-8195-4600-92c6-11922e3a141b - name: Exploit Prediction Scoring System - tags: - - vulnerability - url: https://www.first.org/epss/ - description: Estimates the likelihood that a software vulnerability will - be exploited. - cisa-kev: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 - name: Known Exploited Vulnerabilities - tags: - - vulnerability - url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - description: A catalog of vulnerabilities that have been exploited. - owasp-secure-headers: - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e - name: OWASP Secure Headers Project - tags: - - header - - documentation - url: https://owasp.org/www-project-secure-headers/ - description: "The OWASP Secure Headers Project (also called OSHP) describes - HTTP response headers that your application can use \nto increase the - security of your application. Once set, these HTTP response headers can - restrict modern browsers \nfrom running into easily preventable vulnerabilities. - The OWASP Secure Headers Project intends to raise awareness\nand use of - these headers." + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy references: samm2: - V-ST-2-A From 21b2381a66e6da199c51132af134245893a569d7 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 23 Feb 2025 13:24:46 +0100 Subject: [PATCH 049/370] Remove incorrect \ --- .../YAML/default/Implementation/ApplicationHardening.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml index fbee841..3a9e6f2 100755 --- a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml +++ b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml @@ -54,11 +54,11 @@ Implementation: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 description: | **Input validation** stops malicious data from entering your system. \ - **Output encoding** neutralizes malicious data before rendering to user, or the next system. \ + **Output encoding** neutralizes malicious data before rendering to user, or the next system. Input validation and output encoding work together. Apply both. - **Context-aware output encoding** encodes data differently, depending on its context. In the following example, the `{{bad_data}}` must be encoded differently, depending on its context, to render safe HTML. + **Context-aware output encoding** encodes data differently, depending on its context. In the sample below the `{{bad_data}}` must be encoded differently, depending on its context, to render safe HTML. ```html
{{bad_data}}
From 76245991f476b25fd98a729530c535b8893430fa Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 23 Feb 2025 13:25:13 +0100 Subject: [PATCH 050/370] Fix reference to Context-aware output encoding --- .../YAML/default/Implementation/InfrastructureHardening.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index cb85064..44210c1 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -701,7 +701,7 @@ Implementation: description: | Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. dependsOn: - - Contextualized encoding + - Context-aware output encoding implementation: [] references: samm2: From 19db69c8a4e00fa543935911b1f30b2a1a577ba9 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 23 Feb 2025 16:20:01 +0100 Subject: [PATCH 051/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 12 ++ src/assets/YAML/generated/generated.yaml | 203 +++++++++++++++-------- 2 files changed, 146 insertions(+), 69 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 4502792..58e8e50 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,15 @@ +# [1.15.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.14.3...v1.15.0) (2025-02-23) + + +### Bug Fixes + +* add meta.yaml via download ([95d8577](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/95d8577b248fb7d56c1e49b7adbd49280255dd14)) + + +### Features + +* enhance descriptions ([2bc6246](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/2bc6246e0adb2db2ceb05ac8d975ac3be2418aeb)) + # [1.14.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.13.0...v1.14.0) (2024-11-07) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 8b35b2f..6de7f42 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -52,14 +52,15 @@ Build and Deployment: C: false Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b + description: "A *build process* include more than just compiling your source + code. \nIt also includes steps such as managing (third party) dependencies, + \nenvironment configuration, running the unit tests, etc. \n\nA *defined build + process* has automated these steps to ensure consistency.\n\nThis can be done + with a Jenkinsfile, Maven, or similar tools.\n" risk: Performing builds without a defined process is error prone; for example, as a result of incorrect security related configuration. measure: A well defined build process lowers the possibility of errors during the build process. - description: | - Sample evidence as an attribute in the yaml: The build process is defined in [REPLACE-ME Pipeline](https://replace-me/jenkins/job) - in the folder _vars_. Projects are using a _Jenkinsfile_ to use the - defined process. difficultyOfImplementation: knowledge: 2 time: 3 @@ -2429,13 +2430,17 @@ Culture and Organization: C: false Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 - risk: In case of an emergency, like a power outage, DR actions to perform are - not clear. This leads to reaction and remediation delays. + description: A _Business Continuity and Disaster Recovery_ (BCDR) is a plan + and a process that helps a business to return to normal operations if a disaster + occurs. + risk: If the disaster recovery actions are not clear, you risk slow reaction + and remediation delays. This applies to cyber attacks as well as natural emergencies, + such as a power outage. measure: By understanding and documenting a business continuity and disaster recovery (BCDR) plan, the overall availability of systems and applications is increased. Success factors like responsibilities, Service Level Agreements, Recovery Point Objectives, Recovery Time Objectives or Failover must be fully - documented and understood. + documented and understood by the people involved in the recovery. difficultyOfImplementation: knowledge: 4 time: 3 @@ -2859,21 +2864,40 @@ Implementation: Default: false B: false C: false - Contextualized Encoding: + Context-aware output encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 - risk: The generation of interpreter directives from user-provided data poses - difficulties and can introduce vulnerabilities to injection attacks. - measure: | - Implementing contextualized encoding, such as employing object-relational mapping tools or utilizing prepared statements, nearly removes the threat of injection vulnerabilities. + description: "**Input validation** stops malicious data from entering your system. + \\\n**Output encoding** neutralizes malicious data before rendering to user, + or the next system.\n\nInput validation and output encoding work together. + Apply both. \n\n**Context-aware output encoding** encodes data differently, + depending on its context. In the sample below the `{{bad_data}}` must be encoded + differently, depending on its context, to render safe HTML.\n\n```html\n
{{bad_data}}
\nClick me\n\n\n``` \n" + risk: If an attacker manages to slip though your input validation, the attacker + may gain control over the user session or execute arbitrary actions. + measure: "* Use modern secure frameworks such as React/Angular/Vue/Svelte. The + default method here renders data in a safe way.\n* Use established and well-maintained + encoding libraries such as OWASP\u2019s Java Encoder and Microsoft\u2019s + AntiXSS.\n* Implement content security policies (CSP) to restrict the types + of content that can be loaded and executed.\n" difficultyOfImplementation: - knowledge: 2 + knowledge: 1 time: 2 resources: 1 usefulness: 3 level: 1 - description: | - Bear in mind that utilizing frameworks is a recommended approach; however, they can develop known security weaknesses over time. Diligent and regular patching is crucial. - implementation: [] + implementation: + - uuid: 2d61e48f-bade-4332-a383-adc50c29673a + name: OWASP DOM based XSS Prevention CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html + tags: [] + - uuid: ae97c9b0-308c-4dab-bff9-bf3330a897dc + name: CWE-838 Inappropriate Encoding for Output Context + tags: + - documentation + - cwe + url: https://cwe.mitre.org/data/definitions/838.html references: samm2: - D-SR-1-A @@ -2886,6 +2910,58 @@ Implementation: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application Hardening/e1f37abb-d848-4a3a-b3df-65e91a89dcb7 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Parametrization: + uuid: 00e91a8a-3972-4692-8679-674ab8547486 + description: | + By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well. + + This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed. + + Pay attention to these two lines of code. They seem similar, but behave very differently. + + * `sql.execute("SELECT * FROM table WHERE ID = " + id);` + * `sql.execute("SELECT * FROM table WHERE ID = ?", id);` + The second line is parameterized. The same principle applies to other types, such as command line execution, etc. + risk: "Systems vulnerable to injections may lead to data breaches, loss of data, + \nunauthorized alteration of data, or complete database compromise or downtime.\n\nThis + applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc. \n" + measure: | + * Identify which of the types your application is using. Check that you use: + * Use _parametrized queries_ (or _prepared statements_) + * For database queries, you may also use: + * Use _stored procedures_ () + * Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: d880fa0f-9dbb-454e-a003-d844fad31ab4 + name: OWASP Parameterization CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html + tags: [] + references: + samm2: + - D-SR-1-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/00e91a8a-3972-4692-8679-674ab8547486 + comments: "" tags: - none teamsImplemented: @@ -4025,9 +4101,12 @@ Implementation: Usage of edge encryption at transit: uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 risk: Evil actors might be able to perform a man in the middle attack and sniff - confidential information (e.g. authentication factors like passwords) - measure: By using encryption at the edge of traffic in transit, it is impossible - or at least harder to sniff credentials being outside of the organization. + confidential information (e.g. authentication factors like passwords). + measure: |- + By using encryption at the edge of traffic in transit, it is impossible + or at least harder to sniff credentials or information being outside of the organization. + + Using standard secure protocols like HTTPS is recommended. difficultyOfImplementation: knowledge: 2 time: 2 @@ -4287,7 +4366,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - Contextualized encoding + - Context-aware output encoding implementation: [] references: samm2: @@ -4986,8 +5065,19 @@ Information Gathering: Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 risk: Attacks on an application are not recognized. - measure: Gathering of application metrics helps to identify incidents like brute - force attacks, login/logout. + measure: |- + Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: + - Authentication attempts (successful/failed logins) + - Transaction volumes and patterns (e.g. orders, payments) + - API call rates and response times + - User session metrics + - Resource utilization + + Example: An e-commerce application normally processes 100 orders per hour. A sudden spike to 1000 orders per hour could indicate either: + - A legitimate event (unannounced marketing campaign, viral social media post) + - A security incident (automated bulk purchase bots, credential stuffing attack) + + By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. difficultyOfImplementation: knowledge: 2 time: 2 @@ -5729,7 +5819,7 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - 38d1bd10-7b5f-4ae1-868c-0ec813285425 + - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: ~ references: @@ -5754,43 +5844,6 @@ Test and Verification: Default: false B: false C: false - Fix based on severity: - uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425 - risk: Overwhelming volume of security findings from automated testing tools. - This might lead to ignorance of findings. - measure: | - Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings. - - On level one, fix only critical findings. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 1 - implementation: ~ - references: - samm2: - - I-DM-3-B - iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/38d1bd10-7b5f-4ae1-868c-0ec813285425 - tags: - - vuln-action - - defect-management - teamsImplemented: - Default: false - B: false - C: false Integration in development process: uuid: 123e4567-e89b-12d3-a456-426614174000 risk: "Not integrating vulnerability handling into the development process may @@ -5961,10 +6014,19 @@ Test and Verification: Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 risk: As false positive occur during each test, all vulnerabilities might be - ignored. - measure: False positives are suppressed so they will not show up on the next - tests again. Most security tools have the possibility to suppress false positives. - A Vulnerability Management System might be used. + ignored. Specially, if tests are automated an run daily. + measure: |- + Findings from security tests must be triaged and outcomes persisted/documented to: + - Prevent re-analysis of known issues in subsequent test runs + - Track accepted risks vs false positives + - Enable consistent decision-making across teams + + At this maturity level, a simple tracking system suffices - tools need only distinguish between "triaged" and "untriaged" findings, without complex categorization. Some tools refer to this as "suppression" of findings. + + Samples for false positive handling: + - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) + - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) + - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) difficultyOfImplementation: knowledge: 1 time: 1 @@ -6095,9 +6157,10 @@ Test and Verification: - 5.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d - comments: "" tags: - - none + - vuln-action + - defect-management + comments: "" teamsImplemented: Default: false B: false @@ -6198,7 +6261,8 @@ Test and Verification: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 implementation: [] tags: - - none + - vuln-action + - defect-management teamsImplemented: Default: false B: false @@ -6227,7 +6291,8 @@ Test and Verification: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 implementation: [] tags: - - none + - vuln-action + - defect-management teamsImplemented: Default: false B: false @@ -8421,7 +8486,7 @@ Test and Verification: uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d risk: Time pressure and ignorance might lead to false predictions for the test intensity. - measure: The intensity of the used tools are not modified to safe time. + measure: The intensity of the used tools are not modified to save time. difficultyOfImplementation: knowledge: 1 time: 1 From db4cf6545ea68ce43c46eeb2ed6cfdc89094393f Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 23 Feb 2025 20:57:53 +0100 Subject: [PATCH 052/370] Moving implementation to implementations.yaml --- .../YAML/default/BuildAndDeployment/Build.yaml | 6 ++---- src/assets/YAML/default/implementations.yaml | 12 ++++++++++++ 2 files changed, 14 insertions(+), 4 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 3b93af8..df0d82c 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -106,10 +106,8 @@ Build and Deployment: usefulness: 3 level: 2 implementation: - - Container technology automatically creates a hash for images, which can be - used. - - Immutable images are an other way, e.g. by using a registry, which doesn't - allow overriding of images. + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/signing-of-containers + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/immutable-images dependsOn: - Defined build process references: diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index d8b8a2e..f2a4940 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -1007,3 +1007,15 @@ implementations: url: https://citrusframework.org/ description: |- Integration Test framework with focus on messaging applications and Microservices. + signing-of-containers: + uuid: 9368abfb-cf37-477a-9091-a804d2de9148 + name: Signing of containers + tags: [signing, container, build] + url: https://www.aquasec.com/cloud-native-academy/supply-chain-security/container-image-signing/ + description: Container technology automatically creates a hash for images, which can be used. + immutable-images: + uuid: 638b3691-c9a5-45fa-9ba8-e40aeea32766 + name: Immutable images + tags: [deployment, container, build] + url: https://kubernetes.io/blog/2022/09/29/enforce-immutability-using-cel/#immutablility-after-first-modification + description: Immutable images are an other way, e.g. by using a registry, which doesn't allow overriding of images. From d4b781b124e9fe3d37d7c901149114de84712fdc Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Garc=C3=ADa?= <128594036+Rafael-Garcia-NTT@users.noreply.github.com> Date: Tue, 11 Mar 2025 14:23:12 +0100 Subject: [PATCH 053/370] Update Process.yaml Replaced duplicated UUID with a new UUID --- src/assets/YAML/default/CultureAndOrganization/Process.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index 825e1c1..ce8292b 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -84,7 +84,7 @@ Culture and Organization: iso27001-2022: - 5.29 Determining the protection requirement: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: 72737130-472c-4984-80f8-9ab2f1c2ed5d risk: |- Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of critical security issues, increasing the risk of exploitation and potential damage to the organization. @@ -119,4 +119,4 @@ Culture and Organization: tags: - vulnerability-mgmt - metrics - - vmm-measurements \ No newline at end of file + - vmm-measurements From 793856c8fc0c2c05f851e231c5bfa96c510b1c4c Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Garc=C3=ADa?= <128594036+Rafael-Garcia-NTT@users.noreply.github.com> Date: Tue, 11 Mar 2025 14:28:08 +0100 Subject: [PATCH 054/370] Update Consolidation.yaml Replaced two duplicated UUIDs with new UUIDs --- .../YAML/default/TestAndVerification/Consolidation.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index d7e4252..f98d005 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -319,7 +319,7 @@ Test and Verification: - 5.26 - 5.27 Integration in development process: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d risk: |- Not integrating vulnerability handling into the development process may result in product teams ignoring findings. @@ -366,7 +366,7 @@ Test and Verification: - vulnerability-mgmt - vmm-measurements Treatment of defects per protection requirement: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: 2b7cc923-bdaf-43e3-8fb4-a995b7783969 risk: |- Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of critical security issues, increasing the risk of exploitation and potential damage to the organization. From f00e216b665d61dc6c2f85c59f833992d83c3132 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Garc=C3=ADa?= <128594036+Rafael-Garcia-NTT@users.noreply.github.com> Date: Tue, 11 Mar 2025 14:30:09 +0100 Subject: [PATCH 055/370] Update TestKPI.yaml Replaced two duplicated UUIDs with new UUIDs --- src/assets/YAML/default/InformationGathering/TestKPI.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml index da50dd6..65ca485 100644 --- a/src/assets/YAML/default/InformationGathering/TestKPI.yaml +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -105,7 +105,7 @@ Information Gathering: - metrics - vmm-measurements SLA per criticality: # is this the definition of SLAs or the measurement? - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: 51f3fce5-b5c8-4683-8c41-e785fe4f3b5f risk: |- Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of critical security issues, increasing the risk of exploitation and potential damage to the organization. @@ -197,7 +197,7 @@ Information Gathering: - vmm-measurements comments: "The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results)." Fix rate per repo/product: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: cf0d600e-114d-4887-9059-d81c53805f0d risk: |- Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of critical security issues, increasing the risk of exploitation and potential damage to the organization. From 2b21e145be43cfd7eeab353f8531ac8833346e66 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 11 Mar 2025 18:06:11 +0100 Subject: [PATCH 056/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 34 +++++++++++++++++------- 1 file changed, 24 insertions(+), 10 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 6de7f42..daa6b92 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -124,10 +124,24 @@ Build and Deployment: usefulness: 3 level: 2 implementation: - - Container technology automatically creates a hash for images, which can be - used. - - Immutable images are an other way, e.g. by using a registry, which doesn't - allow overriding of images. + - uuid: 9368abfb-cf37-477a-9091-a804d2de9148 + name: Signing of containers + tags: + - signing + - container + - build + url: https://www.aquasec.com/cloud-native-academy/supply-chain-security/container-image-signing/ + description: Container technology automatically creates a hash for images, + which can be used. + - uuid: 638b3691-c9a5-45fa-9ba8-e40aeea32766 + name: Immutable images + tags: + - deployment + - container + - build + url: https://kubernetes.io/blog/2022/09/29/enforce-immutability-using-cel/#immutablility-after-first-modification + description: Immutable images are an other way, e.g. by using a registry, + which doesn't allow overriding of images. dependsOn: - Defined build process references: @@ -2463,7 +2477,7 @@ Culture and Organization: B: false C: false Determining the protection requirement: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: 72737130-472c-4984-80f8-9ab2f1c2ed5d risk: "Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of \ncritical security issues, increasing the risk of exploitation and potential damage to the organization." @@ -2519,7 +2533,7 @@ Culture and Organization: - 5.13 - 5.1 openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/123e4567-e89b-12d3-a456-426614174000 + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/72737130-472c-4984-80f8-9ab2f1c2ed5d tags: - vulnerability-mgmt - metrics @@ -5845,7 +5859,7 @@ Test and Verification: B: false C: false Integration in development process: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d risk: "Not integrating vulnerability handling into the development process may result in product teams ignoring findings. \n\nSecurity joke: We will gain 100% false negatives." @@ -5919,7 +5933,7 @@ Test and Verification: - 5.13 - 5.1 openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/123e4567-e89b-12d3-a456-426614174000 + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/aaffa73f-59f6-4267-b0ab-732f3d13e90d tags: - vulnerability-mgmt - vmm-measurements @@ -6166,7 +6180,7 @@ Test and Verification: B: false C: false Treatment of defects per protection requirement: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: 2b7cc923-bdaf-43e3-8fb4-a995b7783969 risk: "Not defining the protection requirement of applications can lead to wrong prioritization, delayed remediation of \ncritical security issues, increasing the risk of exploitation and potential damage to the organization." @@ -6227,7 +6241,7 @@ Test and Verification: - 5.13 - 5.1 openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/123e4567-e89b-12d3-a456-426614174000 + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/2b7cc923-bdaf-43e3-8fb4-a995b7783969 tags: - vulnerability-mgmt - metrics From f4dbf52f1bd208302c1bfd1bfbb2fe7146e8293f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Rafael=20Garc=C3=ADa?= <128594036+Rafael-Garcia-NTT@users.noreply.github.com> Date: Wed, 12 Mar 2025 09:19:50 +0100 Subject: [PATCH 057/370] Update TestKPI.yaml Removed dependency to an unknown item as the UUID was duplicated in 5 items, including the item with the dependency itself (self-dependant). --- src/assets/YAML/default/InformationGathering/TestKPI.yaml | 2 -- 1 file changed, 2 deletions(-) diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml index 65ca485..fe45bcf 100644 --- a/src/assets/YAML/default/InformationGathering/TestKPI.yaml +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -210,8 +210,6 @@ Information Gathering: resources: 2 usefulness: 3 level: 3 - dependsOn: - - uuid:123e4567-e89b-12d3-a456-426614174000 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify From 3cd26613e731d529ac4b63270986d7e298560d7d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 14 Mar 2025 10:53:51 +0100 Subject: [PATCH 058/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 10 ++++------ 1 file changed, 4 insertions(+), 6 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index daa6b92..2d51f08 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -5251,7 +5251,7 @@ Information Gathering: C: false Test KPI: Fix rate per repo/product: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: cf0d600e-114d-4887-9059-d81c53805f0d risk: "Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of \ncritical security issues, increasing the risk of exploitation and potential damage @@ -5266,8 +5266,6 @@ Information Gathering: resources: 2 usefulness: 3 level: 3 - dependsOn: - - 123e4567-e89b-12d3-a456-426614174000 implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -5309,7 +5307,7 @@ Information Gathering: - 5.1 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/123e4567-e89b-12d3-a456-426614174000 + KPI/cf0d600e-114d-4887-9059-d81c53805f0d tags: - vulnerability-mgmt - metrics @@ -5550,7 +5548,7 @@ Information Gathering: B: false C: false SLA per criticality: - uuid: 123e4567-e89b-12d3-a456-426614174000 + uuid: 51f3fce5-b5c8-4683-8c41-e785fe4f3b5f risk: "Not communicating how many applications are adhering to SLAs based on the criticality of vulnerabilities can lead to delayed remediation of \ncritical security issues, increasing the risk of exploitation and potential damage @@ -5607,7 +5605,7 @@ Information Gathering: - 5.1 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/123e4567-e89b-12d3-a456-426614174000 + KPI/51f3fce5-b5c8-4683-8c41-e785fe4f3b5f tags: - vulnerability-mgmt - metrics From 80ff0f9b8100c2e43a543323b36a5bacfd47fe03 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 16 Mar 2025 10:52:22 +0100 Subject: [PATCH 059/370] Test: Duplicate activity uuids and names --- yaml-generation/functions.php | 32 ++++++++++++++++++++++++++ yaml-generation/generateDimensions.php | 28 ++++++++++++++++++++-- 2 files changed, 58 insertions(+), 2 deletions(-) diff --git a/yaml-generation/functions.php b/yaml-generation/functions.php index c9fa0b1..8d40f4c 100644 --- a/yaml-generation/functions.php +++ b/yaml-generation/functions.php @@ -213,6 +213,38 @@ function getActivityNameByUuid($uuid, $dimensionsAggregated) { } +function getUuidByActivityName($activityName, $dimensionsAggregated) { + $activity = getActivityByActivityName($activityName, $dimensionsAggregated); + if ($activity) { + return $activity["uuid"]; + } else { + return null; + } +} + + +function getActivityByActivityName($activityName, $dimensionsAggregated) { + foreach ($dimensionsAggregated as $dimension => $subdimensions) { + ksort($subdimensions); + foreach ($subdimensions as $subdimension => $elements) { + if (sizeof($elements) == 0) { + echo "unsetting $subdimension\n"; + unset($dimensionsAggregated[$dimension][$subdimension]); + continue; + } + if (substr($subdimension, 0, 1) == "_") { + continue; + } + + if (array_key_exists($activityName, $elements)) { + return $elements[$activityName]; + } + } + } + return null; +} + + /** * * @param unknown $headings diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 5e29a9a..6e32f3c 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -48,7 +48,7 @@ } else { $dimensionsAggregated = $dimensions; } - +$errorMsg = array(); foreach ($dimensionsAggregated as $dimension => $subdimensions) { ksort($subdimensions); foreach ($subdimensions as $subdimension => $elements) { @@ -68,8 +68,23 @@ var_dump($activity); echo ""; exit; - } + } + if (!array_key_exists("uuid", $activity)) { + array_push($errorMsg, "$activityName is missing an uuid in $dimension"); + } else { + $uuid = $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; + $tmp_activityName = getActivityNameByUuid($uuid, $dimensionsAggregated); + if ($tmp_activityName != $activityName) { + array_push($errorMsg, "Duplicate UUID: $uuid in '$dimension'\n - ". $tmp_activityName ."\n - " . $activityName); + } + + if ($uuid != getUuidByActivityName($activityName, $dimensionsAggregated)) { + array_push($errorMsg, "Duplicate activity name: ". $activityName .""); + } + } + + if (!array_key_exists("tags", $activity)) { $dimensionsAggregated[$dimension][$subdimension][$activityName]["tags"] = ["none"]; } @@ -126,6 +141,15 @@ } } } +if (count($errorMsg) > 0) { + echo "\n\nFound " . count($errorMsg) . " errors:\n"; + foreach ($errorMsg as $e) { + echo "ERROR: $e\n"; + } + exit("Please fix the errors"); +} + + foreach ($dimensionsAggregated as $dimension => $subdimensions) { if (sizeof($subdimensions) == 0) { echo "unsetting $dimension\n"; From 29d98e950ddff42c68c2fd31225556f4527caaa0 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 16 Mar 2025 17:11:44 +0100 Subject: [PATCH 060/370] Fix dependsOn uuid --- yaml-generation/generateDimensions.php | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 6e32f3c..b4bd892 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -134,7 +134,7 @@ $dependsOnUuid = str_replace("uuid:", "", $dependingElement); $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOnUuid; $dependsOnActivityName = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); - echo "exchanged $dependingElement to name $dependsOnActivityName"; + $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOnActivityName; } } } From 5f7f2067a0ebb916928828412845c003b73111be Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 16 Mar 2025 17:37:05 +0100 Subject: [PATCH 061/370] Alert on non-existing dependsOn --- yaml-generation/functions.php | 2 +- yaml-generation/generateDimensions.php | 23 ++++++++++++++++------- 2 files changed, 17 insertions(+), 8 deletions(-) diff --git a/yaml-generation/functions.php b/yaml-generation/functions.php index 8d40f4c..13ea484 100644 --- a/yaml-generation/functions.php +++ b/yaml-generation/functions.php @@ -209,7 +209,7 @@ function getActivityNameByUuid($uuid, $dimensionsAggregated) { } } } - return "TODO:Mapping"; + return null; } diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index b4bd892..a183b49 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -16,7 +16,7 @@ $files = glob("src/assets/YAML/default/*/*.yaml"); $dimensions = array(); foreach ($files as $filename) { - //echo "Found $filename"; + //echo "Found $filename\n"; if (preg_match("/_meta.yaml/", $filename)) continue; $dimension = getDimensions($filename); if (array_key_exists("_yaml_references", $dimension)) { @@ -125,16 +125,25 @@ if (array_key_exists("dependsOn", $activity)) { foreach($activity['dependsOn'] as $index => $dependingElement) { if(!is_string($dependingElement)) { - echo "$dependingElement is not a string in $activityName"; - var_dump($dependingElement); + array_push($errorMsg, "The 'dependsOn' is not a string in $activityName: $dependingElement"); continue; } - if(str_starts_with($dependingElement, "uuid:" )) { - echo "$dependingElement is having a uuuid\n"; - $dependsOnUuid = str_replace("uuid:", "", $dependingElement); - $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOnUuid; + $uuidRegExp = "/(uuid:)?\s*([0-9a-f]{6,}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{6,})/"; + if (preg_match($uuidRegExp, $dependingElement, $matches)) { + $dependsOnUuid = $matches[2]; $dependsOnActivityName = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); + if (is_null($dependsOnActivityName)) { + array_push($errorMsg,"DependsOn non-existing activity uuid: $dependsOnUuid (in activity: $activityName)"); + } else if ($matches[1] == "") { + echo "WARNING: DependsOn is not prefixed by 'uuid:' for $dependsOnUuid (in activity: $activityName)\n"; + } + $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOnActivityName; + // echo "exchanged $dependingElement to name $dependsOnActivityName\n"; + } else { + if (is_null(getUuidByActivityName($dependingElement, $dimensionsAggregated))) { + array_push($errorMsg,"DependsOn non-existing activity: '$dependingElement' (in activity: $activityName)"); + } } } } From 26d36f5d7b1af8d6a320db0e7f9aa411897e2216 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Wed, 19 Mar 2025 22:02:10 +0100 Subject: [PATCH 062/370] Remove not-needed code --- yaml-generation/functions.php | 5 ----- 1 file changed, 5 deletions(-) diff --git a/yaml-generation/functions.php b/yaml-generation/functions.php index 13ea484..509fa50 100644 --- a/yaml-generation/functions.php +++ b/yaml-generation/functions.php @@ -227,11 +227,6 @@ function getActivityByActivityName($activityName, $dimensionsAggregated) { foreach ($dimensionsAggregated as $dimension => $subdimensions) { ksort($subdimensions); foreach ($subdimensions as $subdimension => $elements) { - if (sizeof($elements) == 0) { - echo "unsetting $subdimension\n"; - unset($dimensionsAggregated[$dimension][$subdimension]); - continue; - } if (substr($subdimension, 0, 1) == "_") { continue; } From 066c497b0722cd1233b3bafe03a707b5bedff0fb Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Wed, 19 Mar 2025 22:25:47 +0100 Subject: [PATCH 063/370] Fix dependsOn exchange, when not prefixed with uuid --- yaml-generation/generateDimensions.php | 30 +++++++++++++++----------- 1 file changed, 17 insertions(+), 13 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index a183b49..046f4a4 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -70,6 +70,7 @@ exit; } + echo "$subdimension | $activityName\n"; if (!array_key_exists("uuid", $activity)) { array_push($errorMsg, "$activityName is missing an uuid in $dimension"); } else { @@ -123,26 +124,29 @@ unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["evidence"]); } if (array_key_exists("dependsOn", $activity)) { - foreach($activity['dependsOn'] as $index => $dependingElement) { - if(!is_string($dependingElement)) { - array_push($errorMsg, "The 'dependsOn' is not a string in $activityName: $dependingElement"); + foreach($activity['dependsOn'] as $index => $dependsOn) { + if(!is_string($dependsOn)) { + array_push($errorMsg, "The 'dependsOn' is not a string '" . json_encode($dependsOn) . "' (in $activityName)"); continue; - } + } + + // Swap uuids with activity name $uuidRegExp = "/(uuid:)?\s*([0-9a-f]{6,}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{6,})/"; - if (preg_match($uuidRegExp, $dependingElement, $matches)) { + if (preg_match($uuidRegExp, $dependsOn, $matches)) { $dependsOnUuid = $matches[2]; - $dependsOnActivityName = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); - if (is_null($dependsOnActivityName)) { + $dependsOn = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); + if (is_null($dependsOn)) { array_push($errorMsg,"DependsOn non-existing activity uuid: $dependsOnUuid (in activity: $activityName)"); } else if ($matches[1] == "") { echo "WARNING: DependsOn is not prefixed by 'uuid:' for $dependsOnUuid (in activity: $activityName)\n"; - } - - $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOnActivityName; - // echo "exchanged $dependingElement to name $dependsOnActivityName\n"; + } + + // echo "exchanged $dependsOnUuid with name $dependsOnActivityName\n"; + $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOn; + } else { - if (is_null(getUuidByActivityName($dependingElement, $dimensionsAggregated))) { - array_push($errorMsg,"DependsOn non-existing activity: '$dependingElement' (in activity: $activityName)"); + if (is_null(getUuidByActivityName($dependsOn, $dimensionsAggregated))) { + array_push($errorMsg,"DependsOn non-existing activity: '$dependsOn' (in activity: $activityName)"); } } } From aa6102a0dca36827b2efecdec35ebbd00116eede Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Wed, 19 Mar 2025 23:48:55 +0100 Subject: [PATCH 064/370] Align error message for missing level attr --- yaml-generation/generateDimensions.php | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 046f4a4..68718b9 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -63,11 +63,7 @@ foreach ($elements as $activityName => $activity) { if (!array_key_exists("level", $activity)) { - echo "'$activityName' is not complete!"; - echo "
";
-                var_dump($activity);
-                echo "
"; - exit; + array_push($errorMsg,"Missing 'level' attribute in activity: $activityName"); } echo "$subdimension | $activityName\n"; From 943f10cb6693af573d9f792f028e5da79797aa0a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 20 Mar 2025 07:11:53 +0100 Subject: [PATCH 065/370] fix: dependsOn uuid ref --- src/assets/YAML/default/BuildAndDeployment/Deployment.yaml | 2 +- .../TestAndVerification/DynamicDepthForInfrastructure.yaml | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index ce242a7..8882ab2 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -83,7 +83,7 @@ Build and Deployment: usefulness: 4 level: 1 dependsOn: - - Continuous Integration + - uuid:f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools - $ref: src/assets/YAML/default/implementations.yaml#/implementations/docker diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml index f0859e6..362c570 100755 --- a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml @@ -142,7 +142,7 @@ Test and Verification: implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/netassert dependsOn: - - Segmented networks for virtual environments + - uuid:4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments references: samm2: - V-ST-2-A @@ -154,8 +154,6 @@ Test and Verification: - 8.22 - 8.32 - 8.29 - isImplemented: false - evidence: "" comments: "" Test of the configuration of cloud environments: uuid: 7bb70764-9392-4462-935d-e55b2e148199 From ba528a038c3ab4e3dbb2395f27ef38bfd8314ea3 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 20 Mar 2025 07:15:29 +0100 Subject: [PATCH 066/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 ++++ src/assets/YAML/generated/generated.yaml | 50 ++++++++++++------------ 2 files changed, 32 insertions(+), 25 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 58e8e50..2b70714 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [1.15.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.15.0...v1.15.1) (2025-03-20) + + +### Bug Fixes + +* dependsOn uuid ref ([943f10c](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/943f10cb6693af573d9f792f028e5da79797aa0a)) + # [1.15.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.14.3...v1.15.0) (2025-02-23) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 2d51f08..ee98e56 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -388,7 +388,7 @@ Build and Deployment: usefulness: 4 level: 1 dependsOn: - - Continuous Integration + - Defined build process implementation: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 name: CI/CD tools @@ -564,7 +564,7 @@ Build and Deployment: exists (gathered manually or automatically). dependsOn: - Defined deployment process - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Inventory of production components difficultyOfImplementation: knowledge: 2 time: 2 @@ -690,7 +690,7 @@ Build and Deployment: measure: A documented inventory of dependencies used in artifacts like container images and containers exists. dependsOn: - - 83057028-0b77-4d2e-8135-40969768ae88 + - Inventory of production artifacts - SBOM of components difficultyOfImplementation: knowledge: 2 @@ -2492,7 +2492,7 @@ Culture and Organization: usefulness: 3 level: 2 dependsOn: - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Inventory of production components implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -3100,7 +3100,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + - Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -3146,7 +3146,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + - Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -3288,7 +3288,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + - Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -5489,7 +5489,7 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 + - Automated PRs for patches implementation: [] references: samm2: @@ -5526,8 +5526,8 @@ Information Gathering: usefulness: 3 level: 4 dependsOn: - - 86d490b9-d798-4a5b-a011-ab9688014c46 - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 + - Patching mean time to resolution via PR + - Automated PRs for patches implementation: [] references: samm2: @@ -5831,8 +5831,8 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Treatment of defects with severity high or higher + - Inventory of production components implementation: ~ references: samm2: @@ -6322,9 +6322,9 @@ Test and Verification: resources: 2 usefulness: 2 dependsOn: - - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad - - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 - - 185d5a74-19dc-4422-be07-44ea35226783 + - Exploit likelihood estimation + - Each team has a security champion + - Office Hours level: 3 description: "For known vulnerabilities a processes to estimate the exploit ability of a vulnerability is recommended.\n\nTo implement a security culture @@ -6946,7 +6946,7 @@ Test and Verification: tags: [] url: https://github.com/controlplaneio/netassert dependsOn: - - Segmented networks for virtual environments + - Isolated networks for virtual environments references: samm2: - V-ST-2-A @@ -7104,7 +7104,7 @@ Test and Verification: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 dependsOn: - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Inventory of production components tags: - none teamsImplemented: @@ -7199,7 +7199,7 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - d918cd44-a972-43e9-a974-eff3f4a5dcfe + - Software Composition Analysis (server side) implementation: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 name: Known Exploited Vulnerabilities @@ -7303,8 +7303,8 @@ Test and Verification: level: 3 dependsOn: - Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f - - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + - Inventory of production components + - Exploit likelihood estimation implementation: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js @@ -7369,7 +7369,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Inventory of production components implementation: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 name: OWASP Dependency Check @@ -7441,7 +7441,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Inventory of production components implementation: [] references: samm2: @@ -7505,7 +7505,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Inventory of production components references: samm2: - V-ST-2-A @@ -7572,7 +7572,7 @@ Test and Verification: - sast dependsOn: - Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Inventory of production components references: samm2: - V-ST-2-A @@ -7634,7 +7634,7 @@ Test and Verification: - sast dependsOn: - Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f + - Inventory of production components references: samm2: - V-ST-2-A From f97f77aecf66d2c9d3361ade5b96afbdc62f5897 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Thu, 20 Mar 2025 21:43:15 +0100 Subject: [PATCH 067/370] Alert on duplicate reference values --- yaml-generation/generateDimensions.php | 57 +++++++++++++++++++++----- 1 file changed, 46 insertions(+), 11 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 68718b9..5f1518b 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -2,7 +2,10 @@ require_once "functions.php"; +$errorMsg = array(); +$implementationReferenceFile = "src/assets/YAML/default/implementations.yaml"; $metadata = readYaml("src/assets/YAML/meta.yaml"); + $teams = $metadata["teams"]; if (sizeof($teams) == 0) { echo "Warning: No teams defined"; @@ -12,11 +15,10 @@ $teamsImplemented[$team] = false; } - $files = glob("src/assets/YAML/default/*/*.yaml"); $dimensions = array(); foreach ($files as $filename) { - //echo "Found $filename\n"; + echo "Reading $filename\n"; if (preg_match("/_meta.yaml/", $filename)) continue; $dimension = getDimensions($filename); if (array_key_exists("_yaml_references", $dimension)) { @@ -29,7 +31,7 @@ $dimensionsCustom = array(); $dimensionsAggregated = array(); foreach ($files as $filename) { - //echo "Found $filename"; + echo "Reading custom $filename\n"; $dimensionCustom = getDimensions($filename); $dimensionsCustom = array_merge_recursive_ex($dimensionsCustom, $dimensionCustom); } @@ -48,7 +50,7 @@ } else { $dimensionsAggregated = $dimensions; } -$errorMsg = array(); + foreach ($dimensionsAggregated as $dimension => $subdimensions) { ksort($subdimensions); foreach ($subdimensions as $subdimension => $elements) { @@ -150,13 +152,6 @@ } } } -if (count($errorMsg) > 0) { - echo "\n\nFound " . count($errorMsg) . " errors:\n"; - foreach ($errorMsg as $e) { - echo "ERROR: $e\n"; - } - exit("Please fix the errors"); -} foreach ($dimensionsAggregated as $dimension => $subdimensions) { @@ -166,14 +161,54 @@ } } + +$implementationReferences = readYaml($implementationReferenceFile)['implementations']; +assert_unique_refs($implementationReferences, $errorMsg); + resolve_json_ref($dimensionsAggregated); + +if (count($errorMsg) > 0) { + echo "\n\nFound " . count($errorMsg) . " errors:\n"; + foreach ($errorMsg as $e) { + echo "ERROR: $e\n"; + } + exit("Please fix the errors"); +} + + + + $dimensionsString = yaml_emit($dimensionsAggregated); $targetGeneratedFile = getcwd() . "/src/assets/YAML/generated/generated.yaml"; echo "\nStoring to $targetGeneratedFile\n"; file_put_contents($targetGeneratedFile, $dimensionsString); + +function assert_unique_refs($implementationReferences, &$errorMsg) { + assert_unique_ref_by_key($implementationReferences, 'uuid', $errorMsg); + assert_unique_ref_by_key($implementationReferences, 'name', $errorMsg); + assert_unique_ref_by_key($implementationReferences, 'url', $errorMsg); +} + +function assert_unique_ref_by_key($implementationReferences, $keyToAssert, &$errorMsg) { + $all_values = array(); + + foreach ($implementationReferences as $key => $reference) { + if (array_key_exists($keyToAssert, $reference)) { + $value = $reference[$keyToAssert]; + // echo "$key: $value\n"; + if (array_key_exists($value, $all_values)) { + array_push($errorMsg, "Duplicate '$keyToAssert' in reference: " . $all_values[$value] . " and $key: '$value'"); + } else { + $all_values[$value] = $key; + } + } + } +} + + /** * * @param unknown $dimensions From ce1f8e0b519ac5a5967285ae9df6094ae6187f8b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 21 Mar 2025 07:11:35 +0100 Subject: [PATCH 068/370] fix: app logging does not depends on visualiziation --- src/assets/YAML/default/InformationGathering/Logging.yaml | 1 - 1 file changed, 1 deletion(-) diff --git a/src/assets/YAML/default/InformationGathering/Logging.yaml b/src/assets/YAML/default/InformationGathering/Logging.yaml index 041b871..54ef2cf 100755 --- a/src/assets/YAML/default/InformationGathering/Logging.yaml +++ b/src/assets/YAML/default/InformationGathering/Logging.yaml @@ -18,7 +18,6 @@ Information Gathering: usefulness: 5 level: 3 dependsOn: - - Visualized logging - Alerting implementation: [] references: From 8ad8117dd3bd068b7b1e5df359a5419bbc0ba5f3 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 21 Mar 2025 07:14:55 +0100 Subject: [PATCH 069/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ src/assets/YAML/generated/generated.yaml | 1 - 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2b70714..f46574b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [1.15.2](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.15.1...v1.15.2) (2025-03-21) + + +### Bug Fixes + +* app logging does not depends on visualiziation ([ce1f8e0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/ce1f8e0b519ac5a5967285ae9df6094ae6187f8b)) + ## [1.15.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.15.0...v1.15.1) (2025-03-20) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index ee98e56..22a495d 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -4455,7 +4455,6 @@ Information Gathering: usefulness: 5 level: 3 dependsOn: - - Visualized logging - Alerting implementation: [] references: From 3bbea5d7bc6f254219f67abdc8653b1c432773d2 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 22 Mar 2025 17:17:41 +0100 Subject: [PATCH 070/370] Swap references based on pre-loaded values --- yaml-generation/generateDimensions.php | 88 +++++++++++++++----------- 1 file changed, 52 insertions(+), 36 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 5f1518b..393e10f 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -161,13 +161,15 @@ } } - +// Identify any issues regarding the references $implementationReferences = readYaml($implementationReferenceFile)['implementations']; -assert_unique_refs($implementationReferences, $errorMsg); +$references = array("implementations" => $implementationReferences); +assertUniqueRefs($references, $errorMsg); -resolve_json_ref($dimensionsAggregated); +resolveYamlReferences($dimensionsAggregated, $references, $errorMsg); +// Inform of any errors detected if (count($errorMsg) > 0) { echo "\n\nFound " . count($errorMsg) . " errors:\n"; foreach ($errorMsg as $e) { @@ -177,8 +179,7 @@ } - - +// Store generated data $dimensionsString = yaml_emit($dimensionsAggregated); $targetGeneratedFile = getcwd() . "/src/assets/YAML/generated/generated.yaml"; echo "\nStoring to $targetGeneratedFile\n"; @@ -186,21 +187,26 @@ -function assert_unique_refs($implementationReferences, &$errorMsg) { - assert_unique_ref_by_key($implementationReferences, 'uuid', $errorMsg); - assert_unique_ref_by_key($implementationReferences, 'name', $errorMsg); - assert_unique_ref_by_key($implementationReferences, 'url', $errorMsg); +function assertUniqueRefs($all_references, &$errorMsg) { + foreach ($all_references as $references) { + assertUniqueRefByKey($references, 'uuid', $errorMsg); + assertUniqueRefByKey($references, 'name', $errorMsg); + assertUniqueRefByKey($references, 'url', $errorMsg); + assertUniqueRefByKey($references, "\n description", $errorMsg); + } } -function assert_unique_ref_by_key($implementationReferences, $keyToAssert, &$errorMsg) { +function assertUniqueRefByKey($references, $keyToAssert, &$errorMsg) { $all_values = array(); + $printable_keyToAssert = $keyToAssert; + $keyToAssert = trim($keyToAssert); - foreach ($implementationReferences as $key => $reference) { + foreach ($references as $key => $reference) { if (array_key_exists($keyToAssert, $reference)) { $value = $reference[$keyToAssert]; // echo "$key: $value\n"; if (array_key_exists($value, $all_values)) { - array_push($errorMsg, "Duplicate '$keyToAssert' in reference: " . $all_values[$value] . " and $key: '$value'"); + array_push($errorMsg, "Duplicate '$keyToAssert' in reference file: " . $all_values[$value] . " and $key: $printable_keyToAssert='$value'"); } else { $all_values[$value] = $key; } @@ -254,42 +260,52 @@ function array_merge_recursive_ex(array $array1, array $array2) } -/** - * Traverse in-place an array and replaces json-pointers. - * - * @param unknown $data (reference) +/* +* Traverse an array in-place and replaces yaml pointers. */ -function resolve_json_ref(&$data) +function resolveYamlReferences(&$data, $references, &$errorMsg) { - - - /** - * - * @param unknown $value (reference) - * @param unknown $key - * @param unknown $ctx - */ - function resolve_json_ref_cb(&$value, $key, $ctx) + function resolveYamlReferencesCallback(&$value, $key, $payload) { if (!is_array($value)) { return; } if (!array_key_exists('$ref', $value)) { - $ctx["ctx"] = &$value; - array_walk($value, "resolve_json_ref_cb", $ctx); + // Call recursively until $value contains a '$ref' child + array_walk($value, "resolveYamlReferencesCallback", $payload); + return; + } else { + list($context, $ref) = extractReference($value['$ref']); + if (is_null($context) || is_null($ref)) { + array_push($payload['errorMsg'],"Invalid syntax in reference file: '" . $value['$ref'] . "'"); return; } + if (!array_key_exists($context, $payload['references']) || + !array_key_exists($ref, $payload['references'][$context]) ) { + array_push($payload['errorMsg'],"Reference does not exist: '$context/$ref'"); + return; + } - // echo "key: $key\nvalue: ".var_dump($ctx). "\n"; - $ctx["ctx"][$key] = readYaml($value['$ref']); - + // Insert the actual reference object, instead of the reference link + $value = $payload['references'][$context][$ref]; + } } - // Create a context variable to store - // the reference to the actual data, so that - // resolve_reference can replace them. - $ctx = array("ctx" => null); - array_walk($data, "resolve_json_ref_cb", $ctx); + // Call resolve_yaml_references_cb for each and every node in the data array + $payload = array('references' => &$references, 'errorMsg' => &$errorMsg); + array_walk($data, "resolveYamlReferencesCallback", $payload); +} + + +/* + * Extract the context id and the reference id from the '$ref' value in the yaml + */ +function extractReference($str) { + $regExp = "~#/([\w-]+)/([\w-]+)~"; + if (preg_match($regExp, $str, $matches)) { + return array($matches[1], $matches[2]); + } + return null; } From a45b1ba3fa11a2450b107f2b94860f5788ec027c Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 22 Mar 2025 17:19:11 +0100 Subject: [PATCH 071/370] Report unused references --- yaml-generation/generateDimensions.php | 14 +++++++++++++- 1 file changed, 13 insertions(+), 1 deletion(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 393e10f..03d7c60 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -289,13 +289,25 @@ function resolveYamlReferencesCallback(&$value, $key, $payload) // Insert the actual reference object, instead of the reference link $value = $payload['references'][$context][$ref]; + $payload['usedRefs']["$context/$ref"] = true; } } // Call resolve_yaml_references_cb for each and every node in the data array - $payload = array('references' => &$references, 'errorMsg' => &$errorMsg); + $usedRefs = array(); + $payload = array('references' => &$references, 'errorMsg' => &$errorMsg, 'usedRefs' => &$usedRefs); array_walk($data, "resolveYamlReferencesCallback", $payload); + + // Inform of unused references + echo "\n"; + foreach ($references as $context => $refs) { + foreach ($refs as $ref => $refData) { + if (!array_key_exists("$context/$ref", $usedRefs)) { + echo "INFO: Reference never used: $context: $ref\n"; + } + } + } } From 31db1d1c97f15492d7e59e97618615ef4d5d1f4a Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 22 Mar 2025 17:24:02 +0100 Subject: [PATCH 072/370] Remove unused/duplicated references --- .../EducationAndGuidance.yaml | 4 +- .../TestAndVerification/Consolidation.yaml | 2 +- src/assets/YAML/default/implementations.yaml | 69 +------------------ 3 files changed, 4 insertions(+), 71 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index 30f8d79..7f46ceb 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -272,7 +272,7 @@ Culture and Organization: [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-juiceshop + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-juice-shop - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-ser references: samm2: @@ -297,7 +297,7 @@ Culture and Organization: usefulness: 4 level: 4 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-juiceshop + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-juice-shop - $ref: src/assets/YAML/default/implementations.yaml#/implementations/https-cheatsheetse references: samm2: diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index f98d005..d2eb5fc 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -159,7 +159,7 @@ Test and Verification: usefulness: 4 level: 1 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defect-dojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify references: samm2: diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index f2a4940..f3a8f73 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -191,20 +191,6 @@ implementations: owasp-cheatsheet-ser: uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series - tags: [secure coding] - url: https://cheatsheetseries.owasp.org/ - owasp-juiceshop: - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] - url: https://github.com/bkimminich/juice-shop - description: - "In case you do not have the budget to hire an external security\ - \ expert, an option\nis to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop)\ - \ on a \"hacking Friday\"" - https-cheatsheetse: - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ tags: [training, secure coding] url: https://cheatsheetseries.owasp.org/ owasp-security-champ: @@ -286,7 +272,7 @@ implementations: uuid: 59881520-4c69-4922-a44e-99044a77de2b name: Attack Matrix Containers tags: [mitre] - url: https://attack.mitre.org/matrices/enterprise/cloud/ + url: https://attack.mitre.org/matrices/enterprise/containers/ description: |- Attack matrix for containers attack-matrix-kubern: @@ -465,11 +451,6 @@ implementations: uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 name: collected tags: [] - httpunit: - uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 - name: HttpUnit - tags: [] - url: http://httpunit.sourceforge.net/ junit: uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d name: JUnit @@ -501,10 +482,6 @@ implementations: url: https://github.com/MaibornWolff/SecObserve description: | The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. - see-other-actions-e: - uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 - name: See other actions, e.g. "Treatment of defects with severity high". - tags: [] sast: uuid: aaad322e-806e-4c51-b78d-6551f7dc376a name: SAST @@ -522,11 +499,6 @@ implementations: "At DAST (Dynamic Application Security Testing): vulnerabilities are classified and can be assigned to server-side and client-side teams." url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - owasp-defect-dojo: - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] - url: https://github.com/DefectDojo/django-DefectDojo owasp-dependency-che: uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 name: OWASP Dependency Check @@ -816,45 +788,6 @@ implementations: name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: [sca, inventory, OpenSource, "Supply Chain", vulnerability, inventory] - juice-shop: - uuid: c021aa72-c71c-43e4-9573-717b74d6c19d - name: OWASP Juice Shop - tags: [training] - url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - dvwa: - uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d - name: Damn Vulnerable Web Application - tags: [training] - description: |- - Simple Application with intended vulnerabilities. HTML based. - loggingCheatSheet: - uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: [logging, documentation] - zap: - uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 - name: OWASP Zap - tags: [vulnerability, scanner] - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - secureCodeBox: - uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab - name: OWASP secureCodeBox - tags: [vulnerability, scanner-orchestration] - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - K8sPurger: - uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb - name: K8sPurger - tags: [vulnerability, scanner, dast, infrastructure] - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. hashicorp-vault: uuid: e3a2ffc8-313f-437e-9663-b24591568209 name: Hashicorp Vault From e3c028071a8dcffe3d42233f57846f6122512702 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 22 Mar 2025 17:27:39 +0100 Subject: [PATCH 073/370] Minor: Extended short reference id --- .../CultureAndOrganization/EducationAndGuidance.yaml | 10 +++++----- .../Implementation/InfrastructureHardening.yaml | 4 ++-- src/assets/YAML/default/implementations.yaml | 4 ++-- 3 files changed, 9 insertions(+), 9 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index 7f46ceb..cccb6db 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -19,7 +19,7 @@ Culture and Organization: level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-juice-shop - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-ser + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - G-EG-1-A @@ -273,7 +273,7 @@ Culture and Organization: [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-juice-shop - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-ser + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - G-EG-1-A @@ -298,7 +298,7 @@ Culture and Organization: level: 4 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-juice-shop - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/https-cheatsheetse + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - G-EG-3-A @@ -323,7 +323,7 @@ Culture and Organization: usefulness: 5 level: 2 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-ser + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series dependsOn: - Each team has a security champion references: @@ -420,7 +420,7 @@ Culture and Organization: usefulness: 3 level: 1 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-ser + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - G-EG-1-A diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 44210c1..20f7117 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -406,7 +406,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-docker-bench-for - $ref: src/assets/YAML/default/implementations.yaml#/implementations/for-example-for-cont - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-cloud - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-contai + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-containers - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-kubern - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defend-the-core-kubernetes references: @@ -439,7 +439,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-docker-bench-for - $ref: src/assets/YAML/default/implementations.yaml#/implementations/for-example-for-cont - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-cloud - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-contai + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-containers - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-kubern - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defend-the-core-kubernetes references: diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index f3a8f73..f24ac28 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -188,7 +188,7 @@ implementations: url: https://github.com/bkimminich/juice-shop description: |- In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - owasp-cheatsheet-ser: + owasp-cheatsheet-series: uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: [training, secure coding] @@ -268,7 +268,7 @@ implementations: url: https://attack.mitre.org/matrices/enterprise/cloud/ description: |- Attack matrix for cloud - attack-matrix-contai: + attack-matrix-containers: uuid: 59881520-4c69-4922-a44e-99044a77de2b name: Attack Matrix Containers tags: [mitre] From 5827c21c7ec21a8c9d43132007e209d9e0ad389d Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 22 Mar 2025 17:41:55 +0100 Subject: [PATCH 074/370] Test URLs that are referenced --- yaml-generation/bib.php | 16 ++++--- yaml-generation/generateDimensions.php | 58 ++++++++++++++++++++++++++ 2 files changed, 69 insertions(+), 5 deletions(-) diff --git a/yaml-generation/bib.php b/yaml-generation/bib.php index 53e0ef7..c844ef2 100644 --- a/yaml-generation/bib.php +++ b/yaml-generation/bib.php @@ -14,11 +14,17 @@ ini_set('display_startup_errors', 1); error_reporting(E_ALL); define('NUMBER_LEVELS', 4); -if (isset($_ENV["IS_IMPLEMENTED_WHEN_EVIDENCE"])) { - $enforce=boolval($_ENV["IS_IMPLEMENTED_WHEN_EVIDENCE"]); - define('IS_IMPLEMENTED_WHEN_EVIDENCE', $enforce); -}else { - define('IS_IMPLEMENTED_WHEN_EVIDENCE', false); +defineConstFromEnv("IS_IMPLEMENTED_WHEN_EVIDENCE"); +defineConstFromEnv("TEST_REFERENCED_URLS"); + + +function defineConstFromEnv($envVar) { + if (isset($_ENV[$envVar])) { + $value = boolval($_ENV[$envVar]); + define($envVar, $value); + }else { + define($envVar, false); + } } /** diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 03d7c60..a9d7bfb 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -165,6 +165,7 @@ $implementationReferences = readYaml($implementationReferenceFile)['implementations']; $references = array("implementations" => $implementationReferences); assertUniqueRefs($references, $errorMsg); +assertLiveUrlsInRefs($references, $errorMsg); resolveYamlReferences($dimensionsAggregated, $references, $errorMsg); @@ -215,6 +216,63 @@ function assertUniqueRefByKey($references, $keyToAssert, &$errorMsg) { } +function assertLiveUrlsInRefs($all_references, &$errorMsg) { + if (TEST_REFERENCED_URLS) { + echo "\nTesting referenced URLs:\n"; + foreach ($all_references as $references) { + foreach ($references as $key => $reference) { + if (array_key_exists('url', $reference)) { + $url = $reference['url']; + echo " $key: $url\n"; + $err = assertLiveUrl($reference['url']); + if ($err) { + echo " # $err\n"; + array_push($errorMsg, "Dead ref URL ($key): $err"); + } + } + } + } + echo "\n"; + } +} + + +function assertLiveUrl($url):string { + $useragent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0'; + + $curl = curl_init($url); + curl_setopt($curl, CURLOPT_USERAGENT, $useragent); + curl_setopt($curl, CURLOPT_NOBODY, true); + curl_setopt($curl, CURLOPT_HEADER, true); + curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false); + curl_setopt($curl, CURLOPT_RETURNTRANSFER, true); + curl_setopt($curl, CURLOPT_TIMEOUT, 5); + curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5); + $response = curl_exec($curl); + + if (curl_errno($curl)) { + echo curl_error($curl); + curl_close($curl); + return "No reply"; + } + + // Extract header info + $statusCode = curl_getinfo($curl, CURLINFO_HTTP_CODE); + $redirectUrl = curl_getinfo($curl, CURLINFO_REDIRECT_URL ); + + curl_close($curl); + + if ($statusCode == 200) { + return ""; + } + if ($statusCode == 301 || $statusCode == 302) { + return "Status code $statusCode redirects to: $redirectUrl"; + } + return "Status code: $statusCode: $url"; +} + + + /** * * @param unknown $dimensions From bcf31cce54f56779b3919b918898181c5bc9dd8d Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 22 Mar 2025 18:07:14 +0100 Subject: [PATCH 075/370] Alert of insecure urls --- yaml-generation/generateDimensions.php | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index a9d7bfb..2755686 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -165,6 +165,7 @@ $implementationReferences = readYaml($implementationReferenceFile)['implementations']; $references = array("implementations" => $implementationReferences); assertUniqueRefs($references, $errorMsg); +assertSecureUrlsInRefs($references, $errorMsg); assertLiveUrlsInRefs($references, $errorMsg); resolveYamlReferences($dimensionsAggregated, $references, $errorMsg); @@ -216,6 +217,22 @@ function assertUniqueRefByKey($references, $keyToAssert, &$errorMsg) { } +function assertSecureUrlsInRefs($all_references, &$errorMsg) { + foreach ($all_references as $references) { + foreach ($references as $id => $reference) { + foreach ($reference as $key => $value) { + if (is_string($value)) { + // echo "KEY: $key VAL: " . var_dump($value) . "\n"; + if (str_contains($value,'http://')) { + array_push($errorMsg, "Insecure url in '$key' of $id: " . $reference[$key]); + } + } + } + } + } +} + + function assertLiveUrlsInRefs($all_references, &$errorMsg) { if (TEST_REFERENCED_URLS) { echo "\nTesting referenced URLs:\n"; From 9c30d04c4aaa8791b69a2897694040f94a55fe44 Mon Sep 17 00:00:00 2001 From: sergiomarotco <29877074+sergiomarotco@users.noreply.github.com> Date: Sat, 26 Apr 2025 16:15:23 +0300 Subject: [PATCH 076/370] Divided the search for secrets into two practices Searching for secrets in git and CD/CD are completely different processes --- .../StaticDepthForInfrastructure.yaml | 35 +++++++++++++++++-- 1 file changed, 32 insertions(+), 3 deletions(-) diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index 3038fb5..a1db779 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -157,12 +157,41 @@ Test and Verification: isImplemented: false evidence: "" comments: "" - Test for stored secrets: + Test for stored secrets in code: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c risk: - Stored secrets in git history, in container images or directly in code + Stored secrets in git history or directly in code shouldn't exists because they might be exposed to unauthorized parties. - measure: Test for secrets in code, container images and history + measure: Test for secrets in code and git history + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trufflehog + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/go-pillage-registrie + references: + samm2: + - V-ST-1-A + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + isImplemented: false + evidence: "" + comments: "" + Test for stored secrets in build artifacts: + uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c + risk: + Stored secrets in container images or other buil artifacts + shouldn't exists because they might be exposed to unauthorized parties. + measure: Test for secrets in container images and other artifacts difficultyOfImplementation: knowledge: 2 time: 1 From 6bf7960c05b072a522fa508674610edd9e796a4d Mon Sep 17 00:00:00 2001 From: sergiomarotco <29877074+sergiomarotco@users.noreply.github.com> Date: Sat, 26 Apr 2025 16:17:44 +0300 Subject: [PATCH 077/370] Fix --- .../TestAndVerification/StaticDepthForInfrastructure.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index a1db779..0dad9f5 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -189,7 +189,7 @@ Test and Verification: Test for stored secrets in build artifacts: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c risk: - Stored secrets in container images or other buil artifacts + Stored secrets in container images or other build artifacts shouldn't exists because they might be exposed to unauthorized parties. measure: Test for secrets in container images and other artifacts difficultyOfImplementation: From 84927c85d3409c17a1e762db9fabfde96b7438fe Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 5 May 2025 08:23:50 +0200 Subject: [PATCH 078/370] fix: douplicate uuid --- .../TestAndVerification/StaticDepthForInfrastructure.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index 0dad9f5..780f01a 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -187,7 +187,7 @@ Test and Verification: evidence: "" comments: "" Test for stored secrets in build artifacts: - uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c + uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f risk: Stored secrets in container images or other build artifacts shouldn't exists because they might be exposed to unauthorized parties. From 4459ea9e3c4f81cc9e44b1073026168f732f3ebd Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 5 May 2025 08:26:39 +0200 Subject: [PATCH 079/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index f46574b..7e64f55 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [1.15.3](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.15.2...v1.15.3) (2025-05-05) + + +### Bug Fixes + +* douplicate uuid ([84927c8](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/84927c85d3409c17a1e762db9fabfde96b7438fe)) + ## [1.15.2](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.15.1...v1.15.2) (2025-03-21) From b7620b7fc2c2306e08787657e1c1cf8af42ccda9 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 31 May 2025 09:18:19 +0200 Subject: [PATCH 080/370] feat: differenciate handling of findings --- .../TestAndVerification/Consolidation.yaml | 80 +++++++++++++++++++ 1 file changed, 80 insertions(+) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index d2eb5fc..5de7094 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -173,6 +173,45 @@ Test and Verification: isImplemented: false evidence: "" comments: "" + Artifact-based false positive treatment: + uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + risk: + Without artifact-specific false positive handling, teams must repeatedly + triage the same findings across different versions or deployments of the + same component, leading to inefficient use of security resources. + measure: |- + Implement false positive marking and temporary acceptance of findings + based on specific artifacts (applications, components, or repositories). + This allows teams to suppress findings for specific versions or builds + while maintaining visibility for future releases. + description: |- + Artifact-based false positive treatment enables more granular control + over finding suppression by linking decisions to specific code artifacts, + container images, or application versions. This approach helps maintain + security oversight while reducing repeated analysis overhead. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - uuid: c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack + references: + samm2: + - I-DM-2-A + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 5.25 + - 5.27 + tags: ["false-positive", "defect-management"] Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: @@ -276,6 +315,47 @@ Test and Verification: - 5.25 implementation: [] tags: ["vuln-action", "defect-management"] + Global false positive treatment: + uuid: 9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + risk: + Without centralized false positive management across environments, + organizations face inconsistent security decisions, duplicated analysis + efforts, and potential security gaps when the same findings are handled + differently across applications and teams. + measure: |- + Implement global false positive and acceptance management that applies + consistently across all applications. This enables organization-wide security decisions and reduces redundant + analysis of common false positives. + description: |- + Global false positive treatment allows (security) teams to make + organization-wide decisions about specific vulnerabilities or finding + patterns. When a finding is marked as a false positive or temporarily + accepted at the global level, this decision automatically applies to + all applications in the specified environment, ensuring consistency + and operational efficiency. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment + - uuid: 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system + implementation: + references: + samm2: + - I-DM-2-B + - I-DM-3-A + iso27001-2017: + - 16.1.3 + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 6.8 + - 5.25 + - 5.27 + tags: ["false-positive", "defect-management"] Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: From 4e8c4de70a206dd105521fb4647273d97e77d89b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 4 Jun 2025 19:07:52 +0200 Subject: [PATCH 081/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7e64f55..451df54 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [1.16.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.15.3...v1.16.0) (2025-06-04) + + +### Features + +* differenciate handling of findings ([b7620b7](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/b7620b7fc2c2306e08787657e1c1cf8af42ccda9)) + ## [1.15.3](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.15.2...v1.15.3) (2025-05-05) From 037af912ef88f44309ee39949fc960bc451a1a8d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 19 Jul 2025 13:14:03 +0200 Subject: [PATCH 082/370] bump version --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index c4b712e..eada63e 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,4 @@ -FROM php:apache-buster +FROM php:apache-bullseye RUN apt-get update && apt-get -y install apt-utils libyaml-dev wget unzip && wget -O composer-setup.php https://getcomposer.org/installer && php composer-setup.php --install-dir=/usr/local/bin --filename=composer COPY yaml-generation /var/www/html/yaml-generation COPY src /var/www/html/src From d1cf0615a30bc6965172700ab6c6905708010961 Mon Sep 17 00:00:00 2001 From: sergiomarotco <29877074+sergiomarotco@users.noreply.github.com> Date: Wed, 30 Jul 2025 12:37:29 +0300 Subject: [PATCH 083/370] fix chaos monkey --- .../default/Implementation/InfrastructureHardening.yaml | 7 ++++--- src/assets/YAML/default/implementations.yaml | 7 +++++++ 2 files changed, 11 insertions(+), 3 deletions(-) diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 20f7117..799dbbf 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -454,7 +454,7 @@ Implementation: isImplemented: false evidence: "" comments: "" - Usage of a chaos monkey: + Usage of a chaos technology: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In @@ -469,7 +469,8 @@ Implementation: resources: 5 usefulness: 3 level: 4 - implementation: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/chaosmonkey references: samm2: - O-EM-1-A @@ -480,7 +481,7 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.29 isImplemented: false - evidence: "" + evidence: "Test execution report, logs in test automation system" comments: "" Usage of an security account: uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index f24ac28..2e2a098 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -19,6 +19,13 @@ implementations: url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work description: |- Signing of commits in git + chaosmonkey: + uuid: c117e79b-8223-4e55-9da5-efbf5d741c15 + name: chaosmonkey + tags: [chaos, testing] + url: https://github.com/Netflix/chaosmonkey + description: |- + CI/CD tools such as jenkins, gitlab-ci or github-actions ci-cd-tools: uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 name: CI/CD tools From bb4a8fa0f9b47186e6d059af6f2e179ef3118486 Mon Sep 17 00:00:00 2001 From: sergiomarotco <29877074+sergiomarotco@users.noreply.github.com> Date: Wed, 30 Jul 2025 12:41:16 +0300 Subject: [PATCH 084/370] add description --- src/assets/YAML/default/implementations.yaml | 3 +-- 1 file changed, 1 insertion(+), 2 deletions(-) diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 2e2a098..8aa4dfd 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -24,8 +24,7 @@ implementations: name: chaosmonkey tags: [chaos, testing] url: https://github.com/Netflix/chaosmonkey - description: |- - CI/CD tools such as jenkins, gitlab-ci or github-actions + description: Chaos Monkey is a resiliency tool that helps applications tolerate random instance failures. Chaos Monkey randomly terminates virtual machine instances and containers that run inside of your production environment. Exposing engineers to failures more frequently incentivizes them to build resilient services. ci-cd-tools: uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 name: CI/CD tools From 2fe73d35db821c883b3cf3db339f217eb0f41a11 Mon Sep 17 00:00:00 2001 From: sergiomarotco <29877074+sergiomarotco@users.noreply.github.com> Date: Sun, 3 Aug 2025 00:20:15 +0300 Subject: [PATCH 085/370] Fix name --- src/assets/YAML/default/implementations.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 8aa4dfd..533e3ee 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -21,7 +21,7 @@ implementations: Signing of commits in git chaosmonkey: uuid: c117e79b-8223-4e55-9da5-efbf5d741c15 - name: chaosmonkey + name: Chaos Monkey tags: [chaos, testing] url: https://github.com/Netflix/chaosmonkey description: Chaos Monkey is a resiliency tool that helps applications tolerate random instance failures. Chaos Monkey randomly terminates virtual machine instances and containers that run inside of your production environment. Exposing engineers to failures more frequently incentivizes them to build resilient services. From aea9e55d2292228a57f905a2d67ad4e3f8dd60e2 Mon Sep 17 00:00:00 2001 From: sergiomarotco <29877074+sergiomarotco@users.noreply.github.com> Date: Sun, 3 Aug 2025 00:23:48 +0300 Subject: [PATCH 086/370] Blank evidence --- .../YAML/default/Implementation/InfrastructureHardening.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 799dbbf..84fbc33 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -481,7 +481,7 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.29 isImplemented: false - evidence: "Test execution report, logs in test automation system" + evidence: "" comments: "" Usage of an security account: uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 From 68f92964b3b489ba330737289a6385dca43d88f7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 13 Sep 2025 20:30:31 +0200 Subject: [PATCH 087/370] Update references in Design.yaml for samm2 --- src/assets/YAML/default/CultureAndOrganization/Design.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/Design.yaml b/src/assets/YAML/default/CultureAndOrganization/Design.yaml index 7b205d7..057c3bf 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Design.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Design.yaml @@ -287,7 +287,8 @@ Culture and Organization: level: 2 implementation: [] references: - samm2: [] + samm2: + - G-PS-2 iso27001-2017: - 5.1.1 - 7.2.1 From 471c7fce17e02ef63675047a6620beaf5aa96d2c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 14 Sep 2025 09:53:38 +0200 Subject: [PATCH 088/370] feat: adjust mappings for SAMM Secure Build --- .../YAML/default/BuildAndDeployment/Deployment.yaml | 8 +++++--- src/assets/YAML/default/InformationGathering/TestKPI.yaml | 5 +++++ .../YAML/default/TestAndVerification/Consolidation.yaml | 8 ++++++++ .../TestAndVerification/StaticDepthForApplications.yaml | 6 ++++++ .../YAML/default/TestAndVerification/Test-Intensity.yaml | 1 + 5 files changed, 25 insertions(+), 3 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 8882ab2..88ad4d8 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -196,7 +196,9 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - - I-SD-2-A + - I-SB-3-B + - I-SB-2-B + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -228,7 +230,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - - I-SD-2-A + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -259,7 +261,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - - I-SD-2-A + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml index fe45bcf..5618c45 100644 --- a/src/assets/YAML/default/InformationGathering/TestKPI.yaml +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -24,6 +24,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -64,6 +65,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -128,6 +130,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -185,6 +188,7 @@ Information Gathering: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.3 @@ -218,6 +222,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 5de7094..9015366 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -28,6 +28,7 @@ Test and Verification: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.1 @@ -122,6 +123,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.1 @@ -205,6 +207,7 @@ Test and Verification: samm2: - I-DM-2-A - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 16.1.6 @@ -260,6 +263,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 12.6.1 @@ -307,6 +311,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 12.6.1 @@ -347,6 +352,7 @@ Test and Verification: samm2: - I-DM-2-B - I-DM-3-A + - I-SB-3-B iso27001-2017: - 16.1.3 - 16.1.4 @@ -386,6 +392,8 @@ Test and Verification: references: samm2: - I-DM-1-B + - I-SB-2-B + - I-SB-3-B iso27001-2017: - 12.6.1 - 16.1.3 diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index c828142..df7da59 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -178,6 +178,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -212,6 +213,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -279,6 +281,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -336,6 +339,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -362,6 +366,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-2-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -395,6 +400,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-2-B iso27001-2017: - 12.6.1 iso27001-2022: diff --git a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml index 668c649..c8b0c89 100755 --- a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml +++ b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml @@ -139,6 +139,7 @@ Test and Verification: references: samm2: - I-SB-3-A + - V-ST-3-A iso27001-2017: - 14.2.3 - 14.2.8 From e59dc1f2607d28062c54725fbb6691b57b116fc2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 14 Sep 2025 18:49:45 +0200 Subject: [PATCH 089/370] adjust samm mapping --- src/assets/YAML/default/BuildAndDeployment/Build.yaml | 3 ++- src/assets/YAML/default/BuildAndDeployment/Deployment.yaml | 5 +++-- src/assets/YAML/default/InformationGathering/Monitoring.yaml | 4 ++-- 3 files changed, 7 insertions(+), 5 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index df0d82c..69d18a7 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -144,7 +144,8 @@ Build and Deployment: level: 2 implementation: [] references: - samm2: [] + samm2: + - I-SB-1-A iso27001-2017: - 8.1 - 8.2 diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 8882ab2..7a0be2f 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -20,7 +20,7 @@ Build and Deployment: - Smoke Test references: samm2: - - TODO + - I-SD-2-A iso27001-2017: - 17.2.1 # Availability of information processing facilities - 12.1.1 # Documented operational procedures @@ -350,7 +350,8 @@ Build and Deployment: dependsOn: - Same artifact for environments references: - samm2: [] + samm2: + - I-SD-2-A iso27001-2017: - 14.3.1 - 14.2.8 diff --git a/src/assets/YAML/default/InformationGathering/Monitoring.yaml b/src/assets/YAML/default/InformationGathering/Monitoring.yaml index 510ef8f..86f45cb 100755 --- a/src/assets/YAML/default/InformationGathering/Monitoring.yaml +++ b/src/assets/YAML/default/InformationGathering/Monitoring.yaml @@ -94,7 +94,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-A 3 + - O-IM-2-A iso27001-2017: - 16.1.2 - 16.1.4 @@ -398,7 +398,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-A 3 + - O-IM-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 From 35f0255f81941f3da120174841952b9c0c5bc0b8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 14 Sep 2025 19:00:57 +0200 Subject: [PATCH 090/370] adjust --- src/assets/YAML/default/InformationGathering/Monitoring.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/src/assets/YAML/default/InformationGathering/Monitoring.yaml b/src/assets/YAML/default/InformationGathering/Monitoring.yaml index 86f45cb..f326543 100755 --- a/src/assets/YAML/default/InformationGathering/Monitoring.yaml +++ b/src/assets/YAML/default/InformationGathering/Monitoring.yaml @@ -95,6 +95,7 @@ Information Gathering: references: samm2: - O-IM-2-A + - I-DM-3-A iso27001-2017: - 16.1.2 - 16.1.4 @@ -399,6 +400,7 @@ Information Gathering: references: samm2: - O-IM-2-A + - I-DM-3-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 From 2adca56bbcdd4370415a095f9779ce5ad510d0dd Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Sep 2025 19:54:03 +0200 Subject: [PATCH 091/370] fix master->main --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index eada63e..471116f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,8 +10,8 @@ RUN cd /var/www/html/yaml-generation && composer install \ --prefer-dist RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml -RUN curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/master/src/assets/YAML/meta.yaml -o /var/www/html/src/assets/YAML/meta.yaml +RUN curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/main/src/assets/YAML/meta.yaml -o /var/www/html/src/assets/YAML/meta.yaml +RUN echo "test" ; cat /var/www/html/src/assets/YAML/meta.yaml RUN cd /var/www/html && php yaml-generation/generateDimensions.php -RUN curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/master/src/assets/YAML/meta.yaml -o /var/www/html/src/assets/YAML/meta.yaml workdir /var/www/html CMD php yaml-generation/generateDimensions.php From 37721553f28b1f8508deff617468e51dee6bbaa5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Sep 2025 20:08:37 +0200 Subject: [PATCH 092/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 451df54..0fe0c88 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [1.17.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.16.0...v1.17.0) (2025-09-15) + + +### Features + +* adjust mappings for SAMM Secure Build ([471c7fc](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/471c7fce17e02ef63675047a6620beaf5aa96d2c)) + # [1.16.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.15.3...v1.16.0) (2025-06-04) From 532bb72debcd93f98f07dc7d4b28d799da6e155d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 16 Sep 2025 08:24:58 +0200 Subject: [PATCH 093/370] feat: update SAMM mapping based on arams feedback --- .../CultureAndOrganization/Process.yaml | 6 +- .../Implementation/ApplicationHardening.yaml | 16 ++-- .../DevelopmentAndSourceControl.yaml | 1 + .../InfrastructureHardening.yaml | 73 +++++++------------ .../default/InformationGathering/Logging.yaml | 21 +++++- .../default/InformationGathering/TestKPI.yaml | 16 ++-- .../TestAndVerification/ApplicationTests.yaml | 8 +- .../TestAndVerification/Consolidation.yaml | 30 +++----- .../DynamicDepthForApplications.yaml | 2 +- .../DynamicDepthForInfrastructure.yaml | 2 +- .../StaticDepthForInfrastructure.yaml | 23 +----- 11 files changed, 83 insertions(+), 115 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index ce8292b..bf02f07 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -78,7 +78,8 @@ Culture and Organization: level: 1 implementation: [] references: - samm2: [] + samm2: + - O-IM-2-B iso27001-2017: - 17.1.1 iso27001-2022: @@ -110,7 +111,8 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-3-B + - O-OM-2-A + - G-PC-2-B iso27001-2022: - 5.25 - 5.12 diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml index 3a9e6f2..5043eef 100755 --- a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml +++ b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml @@ -42,7 +42,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/apimaturity references: samm2: - - D-SR-1-A + - D-SR-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -65,7 +65,7 @@ Implementation: Click me - ``` + ``` risk: If an attacker manages to slip though your input validation, the attacker may gain control over the user session or execute arbitrary actions. measure: | @@ -107,7 +107,7 @@ Implementation: Systems vulnerable to injections may lead to data breaches, loss of data, unauthorized alteration of data, or complete database compromise or downtime. - This applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc. + This applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc. measure: | * Identify which of the types your application is using. Check that you use: * Use _parametrized queries_ (or _prepared statements_) @@ -120,7 +120,7 @@ Implementation: resources: 1 usefulness: 3 level: 1 - implementation: + implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-parameterization-cheats references: samm2: @@ -174,7 +174,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/apimaturity references: samm2: - - D-SR-1-A + - D-SR-3-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -204,7 +204,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-masvs references: samm2: - - D-SR-2-A + - D-SR-3-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -319,7 +319,7 @@ Implementation: - Referrer-Policy: Control information in the Referrer header references: samm2: - - D-SR-3-A + - O-EM-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -383,4 +383,4 @@ Implementation: - 13.1.3 iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 8.22 \ No newline at end of file + - 8.22 diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index 3005ec0..b029516 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -102,6 +102,7 @@ Implementation: references: samm2: - O-EM-1-A + - I-SB-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 84fbc33..a736989 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -146,7 +146,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/firewalls references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -172,7 +172,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/remove-direct-access references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 17.2.1 @@ -205,7 +205,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkinsfile references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 @@ -268,7 +268,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/falco references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -276,29 +276,6 @@ Implementation: isImplemented: false evidence: "" comments: "" - Microservice-architecture: - uuid: 118b869b-3850-456e-98d9-1abdb85cbc5a - risk: Monolithic applications are hard to test. - measure: - A microservice-architecture helps to have small components, which are - more easy to test. - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 5 - usefulness: 1 - level: 5 - implementation: [] - references: - samm2: - - O-EM-1-A - iso27001-2017: - - Not explicitly covered by ISO 27001 - iso27001-2022: - - ISO 27001:2022 mapping is missing - isImplemented: false - evidence: "" - comments: "" Production near environments are used by developers: uuid: e14de741-94b3-447c-8b07-eea947d82e61 risk: @@ -322,7 +299,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - 12.1.4 - 17.2.1 @@ -339,7 +316,7 @@ Implementation: or to modify information unauthorized on systems. measure: The usage of a (role based) access control helps to restrict system - access to authorized users. + access to authorized users. And enhancement is to use attribute based access control. difficultyOfImplementation: knowledge: 2 time: 3 @@ -354,7 +331,7 @@ Implementation: - Defined build process references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - 9.4.1 iso27001-2022: @@ -444,7 +421,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defend-the-core-kubernetes references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -473,7 +450,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/chaosmonkey references: samm2: - - O-EM-1-A + - O-EM-3-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 17.1.3 @@ -607,7 +584,7 @@ Implementation: - Defined build process references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -676,13 +653,15 @@ Implementation: - 8.14 isImplemented: false evidence: "" - comments: "" + comments: "" WAF baseline: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: Vulnerable input, such as exploits, can infiltrate the application via numerous entry points, posing a significant security threat. measure: Implementing a web application firewall (WAF) is a critical security control. At a baseline level, the objective is to finely balance the reduction of false positives, maintaining user experience, against a potential increase in the less noticeable false negatives. + + Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. description: | A baseline WAF configuration provides essential defense against common vulnerabilities, acting as a first line of automated threat detection and response. Steps: @@ -699,27 +678,27 @@ Implementation: resources: 3 usefulness: 3 level: 3 - description: | - Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. dependsOn: - Context-aware output encoding implementation: [] references: samm2: - - D-SR-3-A + - O-EM-1-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - comments: + comments: WAF medium: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium risk: The threat from malicious inputs remains high, with exploits seeking to exploit any vulnerabilities present at the various points of entry to the application. measure: A WAF deployed with a medium level of protection strengthens the security posture by striking a more advanced balance between the detection of genuine threats and the minimization of false alarms. + + Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. description: | A medium-level WAF configuration builds upon the baseline to offer a more nuanced and responsive defense mechanism against a wider array of threats. @@ -737,28 +716,28 @@ Implementation: resources: 4 usefulness: 3 level: 4 - description: | - Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. dependsOn: - WAF baseline implementation: [] references: samm2: - - D-SR-3-A + - O-EM-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - comments: - + comments: + WAF Advanced: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced risk: The presence of sophisticated threats necessitates a robust defense strategy where application inputs are meticulously scrutinized for security breaches, including advanced persistent threats and zero-day vulnerabilities. measure: An advanced WAF protection level includes rigorous input validation, rejecting any parameters not explicitly required, and custom rule sets that are dynamically updated in response to emerging threats. + + The advanced WAF setup is designed to ensure all data is in the correct format and any superfluous input parameters are automatically rejected. It includes machine learning algorithms to detect anomalies, custom-developed rules for real-time traffic analysis, and seamless integration with existing security infrastructures to adapt to the ever-changing threat landscape. description: | This advanced configuration goes beyond typical WAF implementations by enforcing strict input format checks and parameter validation to prevent any unauthorized or malformed data from compromising the application. @@ -780,22 +759,20 @@ Implementation: resources: 5 usefulness: 4 level: 5 - description: | - The advanced WAF setup is designed to ensure all data is in the correct format and any superfluous input parameters are automatically rejected. It includes machine learning algorithms to detect anomalies, custom-developed rules for real-time traffic analysis, and seamless integration with existing security infrastructures to adapt to the ever-changing threat landscape. dependsOn: - WAF medium implementation: [] references: samm2: - - D-SR-3-A + - O-EM-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - comments: - + comments: + diff --git a/src/assets/YAML/default/InformationGathering/Logging.yaml b/src/assets/YAML/default/InformationGathering/Logging.yaml index 54ef2cf..47b9079 100755 --- a/src/assets/YAML/default/InformationGathering/Logging.yaml +++ b/src/assets/YAML/default/InformationGathering/Logging.yaml @@ -150,7 +150,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/bash references: samm2: - - O-IM-1-A + - O-OM-1-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -195,3 +195,22 @@ Information Gathering: isImplemented: false evidence: "" comments: "" + Analyze logs: + uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 + risk: Not aware of attacks happening. + measure: Check logs for keywords. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sigmahq + references: + samm2: + - O-IM-1-A + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml index 5618c45..8ddf2a0 100644 --- a/src/assets/YAML/default/InformationGathering/TestKPI.yaml +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -23,8 +23,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-3-B - - I-SB-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -64,8 +63,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-3-B - - I-SB-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -96,7 +94,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -129,8 +127,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-3-B - - I-SB-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -159,7 +156,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-3-B + - I-DM-2-B iso27001-2017: - 16.1.4 iso27001-2022: @@ -221,8 +218,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-3-B - - I-SB-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 diff --git a/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml b/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml index 4efbe99..eff8bd3 100755 --- a/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml +++ b/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml @@ -19,7 +19,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-3-B + - V-RT-3-B iso27001-2017: - 14.2.3 - 14.2.8 @@ -45,7 +45,7 @@ Test and Verification: level: 3 references: samm2: - - V-ST-3-B + - V-RT-3-A iso27001-2017: - 14.2.3 - 14.2.8 @@ -75,7 +75,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/karma references: samm2: - - V-ST-3-B + - V-RT-3-A iso27001-2017: - 14.2.3 - 14.2.8 @@ -103,7 +103,7 @@ Test and Verification: - Defined deployment process references: samm2: - - V-ST-3-B + - V-RT-3-A iso27001-2017: - 14.2.3 - 14.2.8 diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 9015366..a6dd015 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -27,8 +27,7 @@ Test and Verification: implementation: references: samm2: - - I-DM-3-B - - I-SB-3-B + - I-DM-3-A iso27001-2017: - 16.1.4 - 8.2.1 @@ -58,7 +57,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics references: samm2: - - I-DM-3-B + - I-DM-3-A iso27001-2017: - 16.1.4 - 8.2.1 @@ -90,7 +89,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dast references: samm2: - - I-DM-2-B + - I-DM-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.4 @@ -122,8 +121,7 @@ Test and Verification: implementation: [] references: samm2: - - I-DM-2-B - - I-SB-3-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 8.2.1 @@ -165,7 +163,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify references: samm2: - - I-DM-2-A + - I-DM-1-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.6 @@ -235,7 +233,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify references: samm2: - - I-DM-1-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 8.2.1 @@ -262,8 +260,7 @@ Test and Verification: implementation: [] references: samm2: - - I-DM-2-B - - I-SB-3-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 12.6.1 @@ -287,7 +284,7 @@ Test and Verification: comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - - I-DM-2-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 12.6.1 @@ -310,8 +307,7 @@ Test and Verification: comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - - I-DM-2-B - - I-SB-3-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 12.6.1 @@ -391,9 +387,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/SecObserve references: samm2: - - I-DM-1-B - - I-SB-2-B - - I-SB-3-B + - I-DM-3-A iso27001-2017: - 12.6.1 - 16.1.3 @@ -444,7 +438,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-3-B + - I-DM-2-A iso27001-2022: - 5.25 - 5.12 @@ -482,7 +476,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-3-B + - I-DM-2-A iso27001-2022: - 5.25 - 5.12 diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml index daa188f..a7bb61a 100755 --- a/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml @@ -106,7 +106,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-ST-2-A + - V-RT-1-B iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml index 362c570..4d07f79 100755 --- a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml @@ -19,7 +19,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-1-A + - V-RT-1-AB iso27001-2017: - 12.1.3 - 14.2.3 diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index 780f01a..e15bd8d 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -2,27 +2,6 @@ --- Test and Verification: Static depth for infrastructure: - Analyze logs: - uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 - risk: Not aware of attacks happening. - measure: Check logs for keywords. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sigmahq - references: - samm2: [] - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - isImplemented: false - evidence: "" - comments: "" Test for image lifetime: uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b risk: @@ -185,7 +164,7 @@ Test and Verification: - 8.24 isImplemented: false evidence: "" - comments: "" + comments: "" Test for stored secrets in build artifacts: uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f risk: From 719192dc00b61216fac287a22f0de031156ac1ff Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 18 Sep 2025 14:13:11 +0200 Subject: [PATCH 094/370] fix errors --- .../default/BuildAndDeployment/Build.yaml | 7 +- .../BuildAndDeployment/Deployment.yaml | 8 +- .../BuildAndDeployment/PatchManagement.yaml | 2 +- .../CultureAndOrganization/Design.yaml | 7 +- .../EducationAndGuidance.yaml | 8 +- .../TestAndVerification/Consolidation.yaml | 6 +- src/assets/YAML/default/implementations.yaml | 6 +- src/assets/YAML/generated/generated.yaml | 538 ++++++++++++------ 8 files changed, 400 insertions(+), 182 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 69d18a7..72b7515 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -105,6 +105,8 @@ Build and Deployment: resources: 2 usefulness: 3 level: 2 + tags: + - inventory implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/signing-of-containers - $ref: src/assets/YAML/default/implementations.yaml#/implementations/immutable-images @@ -112,7 +114,7 @@ Build and Deployment: - Defined build process references: samm2: - - I-SB-1-A + - I-SB-1-B iso27001-2017: - 14.2.6 iso27001-2022: @@ -145,7 +147,8 @@ Build and Deployment: implementation: [] references: samm2: - - I-SB-1-A + - I-SB-1-B + - D-TA-1-A iso27001-2017: - 8.1 - 8.2 diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 52d4f73..ada0eb9 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -20,7 +20,7 @@ Build and Deployment: - Smoke Test references: samm2: - - I-SD-2-A + - I-SD-3-A iso27001-2017: - 17.2.1 # Availability of information processing facilities - 12.1.1 # Documented operational procedures @@ -231,6 +231,7 @@ Build and Deployment: references: samm2: - I-SB-1-B + - D-TA-1-B iso27001-2017: - 8.1 - 8.2 @@ -262,6 +263,7 @@ Build and Deployment: references: samm2: - I-SB-1-B + - D-TA-1-B iso27001-2017: - 8.1 - 8.2 @@ -288,7 +290,8 @@ Build and Deployment: - Defined deployment process references: samm2: - - I-SD-1-A + - I-SD-2-A + - I-SD-3-A iso27001-2017: - 12.5.1 - 14.2.2 @@ -321,6 +324,7 @@ Build and Deployment: references: samm2: - I-SD-2-A + - I-SD-3-A iso27001-2017: - 14.3.1 - 14.2.8 diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index 7264c31..87a5553 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -93,7 +93,7 @@ Build and Deployment: implementation: [] references: samm2: - - O-EM-1-B + - O-EM-2-B iso27001-2017: - 12.6.1 iso27001-2022: diff --git a/src/assets/YAML/default/CultureAndOrganization/Design.yaml b/src/assets/YAML/default/CultureAndOrganization/Design.yaml index 057c3bf..2121e8a 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Design.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Design.yaml @@ -71,7 +71,8 @@ Culture and Organization: implementation: [] references: samm2: - - D-TA-2-B + - D-TA-1-B + - D-TA-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -185,6 +186,7 @@ Culture and Organization: references: samm2: - D-TA-2-B + - V-RT-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of project management @@ -257,6 +259,7 @@ Culture and Organization: references: samm2: - D-TA-3-B + - D-TA-2-B iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -288,7 +291,7 @@ Culture and Organization: implementation: [] references: samm2: - - G-PS-2 + - G-SM-2-A iso27001-2017: - 5.1.1 - 7.2.1 diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index cccb6db..37b4afc 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -143,6 +143,7 @@ Culture and Organization: references: samm2: - G-EG-2-A + - G-EG-2-B iso27001-2017: - Mutual review of source code is not explicitly required in ISO 27001 may be @@ -201,6 +202,7 @@ Culture and Organization: references: samm2: - G-EG-2-A + - O-IM-B-2 iso27001-2017: - War games are not explicitly required in ISO 27001 may be - 7.2.2 @@ -301,7 +303,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - - G-EG-3-A + - G-EG-2-A iso27001-2017: - 7.2.2 iso27001-2022: @@ -424,6 +426,7 @@ Culture and Organization: references: samm2: - G-EG-1-A + - G-EG-1-B iso27001-2017: - security consulting is missing in ISO 27001 may be - 6.1.1 @@ -453,6 +456,7 @@ Culture and Organization: implementation: [] references: samm2: + - G-EG-3-B - O-IM-3-B iso27001-2017: - 16.1.6 @@ -493,7 +497,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/damn-vulnerable-web references: samm2: - - G-EG-1-A + - G-EG-2-A iso27001-2017: - 7.2.2 iso27001-2022: diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index a6dd015..a8d1f51 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -196,7 +196,7 @@ Test and Verification: usefulness: 3 level: 2 dependsOn: - - uuid: c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment + - uuid:c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify @@ -341,8 +341,8 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment - - uuid: 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system + - uuid:8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment + - uuid:85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system implementation: references: samm2: diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 533e3ee..f1465be 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -179,7 +179,7 @@ implementations: url: https://www.owasp.org/index.php/Agile_Software_Development description: "[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories)\ - \ and [Practical Security Stories and Security Tasks for Agile Development Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)" + \ and [Practical Security Stories and Security Tasks for Agile Development Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)" libyear: uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 name: libyear @@ -253,7 +253,7 @@ implementations: uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff name: CIS Kubernetes Bench for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ + url: https://www.cisecurity.org/cis-benchmarks/# cis-docker-bench-for: uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f name: CIS Docker Bench for Security @@ -359,7 +359,7 @@ implementations: uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 name: Smartcard tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/# yubikey: uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 name: YubiKey diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 22a495d..6f630ea 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -123,6 +123,8 @@ Build and Deployment: resources: 2 usefulness: 3 level: 2 + tags: + - inventory implementation: - uuid: 9368abfb-cf37-477a-9091-a804d2de9148 name: Signing of containers @@ -146,7 +148,7 @@ Build and Deployment: - Defined build process references: samm2: - - I-SB-1-A + - I-SB-1-B iso27001-2017: - 14.2.6 iso27001-2022: @@ -154,8 +156,6 @@ Build and Deployment: openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 comments: "" - tags: - - none teamsImplemented: Default: false B: false @@ -182,7 +182,9 @@ Build and Deployment: level: 2 implementation: [] references: - samm2: [] + samm2: + - I-SB-1-B + - D-TA-1-A iso27001-2017: - 8.1 - 8.2 @@ -316,7 +318,7 @@ Build and Deployment: - Smoke Test references: samm2: - - TODO + - I-SD-3-A iso27001-2017: - 17.2.1 - 12.1.1 @@ -604,7 +606,8 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-1-B + - D-TA-1-B iso27001-2017: - 8.1 - 8.2 @@ -667,7 +670,8 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-1-B + - D-TA-1-B iso27001-2017: - 8.1 - 8.2 @@ -731,7 +735,9 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-3-B + - I-SB-2-B + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -774,7 +780,8 @@ Build and Deployment: - Defined deployment process references: samm2: - - I-SD-1-A + - I-SD-2-A + - I-SD-3-A iso27001-2017: - 12.5.1 - 14.2.2 @@ -814,6 +821,7 @@ Build and Deployment: references: samm2: - I-SD-2-A + - I-SD-3-A iso27001-2017: - 14.3.1 - 14.2.8 @@ -860,7 +868,8 @@ Build and Deployment: dependsOn: - Same artifact for environments references: - samm2: [] + samm2: + - I-SD-2-A iso27001-2017: - 14.3.1 - 14.2.8 @@ -1086,7 +1095,7 @@ Build and Deployment: implementation: [] references: samm2: - - O-EM-1-B + - O-EM-2-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -1364,7 +1373,8 @@ Culture and Organization: implementation: [] references: samm2: - - D-TA-2-B + - D-TA-1-B + - D-TA-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -1529,10 +1539,11 @@ Culture and Organization: url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' references: samm2: - D-TA-2-B + - V-RT-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of project management @@ -1572,7 +1583,7 @@ Culture and Organization: url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' dependsOn: - Conduction of simple threat modeling on technical level - Creation of threat modeling processes and standards @@ -1634,6 +1645,7 @@ Culture and Organization: references: samm2: - D-TA-3-B + - D-TA-2-B iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -1668,7 +1680,8 @@ Culture and Organization: level: 2 implementation: [] references: - samm2: [] + samm2: + - G-SM-2-A iso27001-2017: - 5.1.1 - 7.2.1 @@ -1709,6 +1722,7 @@ Culture and Organization: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: @@ -1816,6 +1830,7 @@ Culture and Organization: references: samm2: - G-EG-2-A + - G-EG-2-B iso27001-2017: - Mutual review of source code is not explicitly required in ISO 27001 may be @@ -1886,6 +1901,7 @@ Culture and Organization: references: samm2: - G-EG-2-A + - O-IM-B-2 iso27001-2017: - War games are not explicitly required in ISO 27001 may be - 7.2.2 @@ -2001,16 +2017,17 @@ Culture and Organization: [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) implementation: - - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: @@ -2042,22 +2059,22 @@ Culture and Organization: usefulness: 4 level: 4 implementation: - - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series tags: - training - secure coding url: https://cheatsheetseries.owasp.org/ references: samm2: - - G-EG-3-A + - G-EG-2-A iso27001-2017: - 7.2.2 iso27001-2022: @@ -2089,6 +2106,7 @@ Culture and Organization: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ dependsOn: @@ -2266,11 +2284,13 @@ Culture and Organization: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: samm2: - G-EG-1-A + - G-EG-1-B iso27001-2017: - security consulting is missing in ISO 27001 may be - 6.1.1 @@ -2306,6 +2326,7 @@ Culture and Organization: implementation: [] references: samm2: + - G-EG-3-B - O-IM-3-B iso27001-2017: - 16.1.6 @@ -2363,7 +2384,7 @@ Culture and Organization: description: Simple Application with intended vulnerabilities. HTML based. references: samm2: - - G-EG-1-A + - G-EG-2-A iso27001-2017: - 7.2.2 iso27001-2022: @@ -2463,7 +2484,8 @@ Culture and Organization: level: 1 implementation: [] references: - samm2: [] + samm2: + - O-IM-2-B iso27001-2017: - 17.1.1 iso27001-2022: @@ -2526,7 +2548,8 @@ Culture and Organization: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-3-B + - O-OM-2-A + - G-PC-2-B iso27001-2022: - 5.25 - 5.12 @@ -2595,7 +2618,7 @@ Implementation: url: https://curity.io/resources/learn/the-api-security-maturity-model/ references: samm2: - - D-SR-1-A + - D-SR-3-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2661,7 +2684,7 @@ Implementation: url: https://curity.io/resources/learn/the-api-security-maturity-model/ references: samm2: - - D-SR-1-A + - D-SR-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2751,7 +2774,7 @@ Implementation: url: https://github.com/OWASP/owasp-masvs references: samm2: - - D-SR-2-A + - D-SR-3-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2887,7 +2910,7 @@ Implementation: depending on its context. In the sample below the `{{bad_data}}` must be encoded differently, depending on its context, to render safe HTML.\n\n```html\n
{{bad_data}}
\nClick me\n\n\n``` \n" + Comment {{bad_data}} */\n```\n" risk: If an attacker manages to slip though your input validation, the attacker may gain control over the user session or execute arbitrary actions. measure: "* Use modern secure frameworks such as React/Angular/Vue/Svelte. The @@ -2945,7 +2968,7 @@ Implementation: The second line is parameterized. The same principle applies to other types, such as command line execution, etc. risk: "Systems vulnerable to injections may lead to data breaches, loss of data, \nunauthorized alteration of data, or complete database compromise or downtime.\n\nThis - applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc. \n" + applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc.\n" measure: | * Identify which of the types your application is using. Check that you use: * Use _parametrized queries_ (or _prepared statements_) @@ -3033,7 +3056,7 @@ Implementation: - Referrer-Policy: Control information in the Referrer header references: samm2: - - D-SR-3-A + - O-EM-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3344,6 +3367,7 @@ Implementation: references: samm2: - O-EM-1-A + - I-SB-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 @@ -3451,7 +3475,7 @@ Implementation: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff name: CIS Kubernetes Bench for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ + url: https://www.cisecurity.org/cis-benchmarks/# - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f name: CIS Docker Bench for Security tags: [] @@ -3472,7 +3496,7 @@ Implementation: name: Attack Matrix Containers tags: - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ + url: https://attack.mitre.org/matrices/enterprise/containers/ description: Attack matrix for containers - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 name: Attack Matrix Kubernetes @@ -3528,7 +3552,7 @@ Implementation: url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3562,7 +3586,7 @@ Implementation: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff name: CIS Kubernetes Bench for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ + url: https://www.cisecurity.org/cis-benchmarks/# - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f name: CIS Docker Bench for Security tags: [] @@ -3583,7 +3607,7 @@ Implementation: name: Attack Matrix Containers tags: - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ + url: https://attack.mitre.org/matrices/enterprise/containers/ description: Attack matrix for containers - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 name: Attack Matrix Kubernetes @@ -3600,7 +3624,7 @@ Implementation: - kubernetes references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3635,7 +3659,7 @@ Implementation: tags: [] references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 17.2.1 @@ -3688,7 +3712,7 @@ Implementation: url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 @@ -3785,7 +3809,7 @@ Implementation: Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -3818,7 +3842,7 @@ Implementation: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 name: Smartcard tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/# - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 name: YubiKey tags: [] @@ -3869,7 +3893,7 @@ Implementation: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 name: Smartcard tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/# - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 name: YubiKey tags: [] @@ -3904,35 +3928,6 @@ Implementation: Default: false B: false C: false - Microservice-architecture: - uuid: 118b869b-3850-456e-98d9-1abdb85cbc5a - risk: Monolithic applications are hard to test. - measure: A microservice-architecture helps to have small components, which are - more easy to test. - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 5 - usefulness: 1 - level: 5 - implementation: [] - references: - samm2: - - O-EM-1-A - iso27001-2017: - - Not explicitly covered by ISO 27001 - iso27001-2022: - - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/118b869b-3850-456e-98d9-1abdb85cbc5a - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false Production near environments are used by developers: uuid: e14de741-94b3-447c-8b07-eea947d82e61 risk: In case an errors occurs in production, the developer need to be able @@ -3954,7 +3949,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - 12.1.4 - 17.2.1 @@ -3976,7 +3971,8 @@ Implementation: risk: Everyone is able to get unauthorized access to information on systems or to modify information unauthorized on systems. measure: The usage of a (role based) access control helps to restrict system - access to authorized users. + access to authorized users. And enhancement is to use attribute based access + control. difficultyOfImplementation: knowledge: 2 time: 3 @@ -3996,7 +3992,7 @@ Implementation: - Defined build process references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - 9.4.1 iso27001-2022: @@ -4049,7 +4045,7 @@ Implementation: Default: false B: false C: false - Usage of a chaos monkey: + Usage of a chaos technology: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In case of a crash it might happen that a planned redundant system is unavailable. @@ -4062,10 +4058,21 @@ Implementation: resources: 5 usefulness: 3 level: 4 - implementation: [] + implementation: + - uuid: c117e79b-8223-4e55-9da5-efbf5d741c15 + name: Chaos Monkey + tags: + - chaos + - testing + url: https://github.com/Netflix/chaosmonkey + description: Chaos Monkey is a resiliency tool that helps applications tolerate + random instance failures. Chaos Monkey randomly terminates virtual machine + instances and containers that run inside of your production environment. + Exposing engineers to failures more frequently incentivizes them to build + resilient services. references: samm2: - - O-EM-1-A + - O-EM-3-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 17.1.3 @@ -4237,7 +4244,7 @@ Implementation: - Defined build process references: samm2: - - O-EM-1-A + - O-EM-2-A iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -4330,11 +4337,24 @@ Implementation: risk: The presence of sophisticated threats necessitates a robust defense strategy where application inputs are meticulously scrutinized for security breaches, including advanced persistent threats and zero-day vulnerabilities. - measure: An advanced WAF protection level includes rigorous input validation, - rejecting any parameters not explicitly required, and custom rule sets that - are dynamically updated in response to emerging threats. - description: | + measure: |- + An advanced WAF protection level includes rigorous input validation, rejecting any parameters not explicitly required, and custom rule sets that are dynamically updated in response to emerging threats. The advanced WAF setup is designed to ensure all data is in the correct format and any superfluous input parameters are automatically rejected. It includes machine learning algorithms to detect anomalies, custom-developed rules for real-time traffic analysis, and seamless integration with existing security infrastructures to adapt to the ever-changing threat landscape. + description: | + This advanced configuration goes beyond typical WAF implementations by enforcing strict input format checks and parameter validation to prevent any unauthorized or malformed data from compromising the application. + + Sample Steps: + - Implement strict data type and format validation rules to ensure only correctly formatted data is processed. + - Establish a denylist for all parameters that are not explicitly required, blocking them by default. + - Develop and continuously refine custom rulesets based on the application's traffic patterns, user behavior, and known vulnerabilities. + - Integrate machine learning algorithms to enhance anomaly detection and automatic rule adjustment. + - Correlate and analyze WAF logs with other security systems like SIEM for comprehensive threat intelligence. + - Conduct regular red team exercises to test and validate the effectiveness of the WAF configurations against simulated advanced attack scenarios. + - Activate automated threat response mechanisms to immediately neutralize detected threats. + + Embracing an advanced WAF setup requires a proactive approach, with continuous improvement and updating of security measures to ensure all inputs are scrutinized and validated, thus maintaining a resilient security posture against sophisticated attacks. + + There are debates on how useful a WAF is for APIs. difficultyOfImplementation: knowledge: 5 time: 5 @@ -4346,7 +4366,7 @@ Implementation: implementation: [] references: samm2: - - D-SR-3-A + - O-EM-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -4367,12 +4387,19 @@ Implementation: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: Vulnerable input, such as exploits, can infiltrate the application via numerous entry points, posing a significant security threat. - measure: Implementing a web application firewall (WAF) is a critical security - control. At a baseline level, the objective is to finely balance the reduction - of false positives, maintaining user experience, against a potential increase - in the less noticeable false negatives. - description: | + measure: |- + Implementing a web application firewall (WAF) is a critical security control. At a baseline level, the objective is to finely balance the reduction of false positives, maintaining user experience, against a potential increase in the less noticeable false negatives. Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. + description: | + A baseline WAF configuration provides essential defense against common vulnerabilities, acting as a first line of automated threat detection and response. + Steps: + - Configure WAF in alert mode to establish traffic patterns + - Analyze alerts and adjust sensitivity to optimize for fewer false positives + - Gradually switch to a proactive blocking stance as confidence in the accuracy of the rules increases + + It's crucial to monitor and update the WAF configuration to adapt to evolving threats and minimize the potential for both false positives and false negatives. + + There are debates on how useful a WAF is for APIs. difficultyOfImplementation: knowledge: 3 time: 4 @@ -4384,7 +4411,7 @@ Implementation: implementation: [] references: samm2: - - D-SR-3-A + - O-EM-1-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -4406,11 +4433,17 @@ Implementation: risk: The threat from malicious inputs remains high, with exploits seeking to exploit any vulnerabilities present at the various points of entry to the application. - measure: A WAF deployed with a medium level of protection strengthens the security - posture by striking a more advanced balance between the detection of genuine - threats and the minimization of false alarms. - description: | + measure: |- + A WAF deployed with a medium level of protection strengthens the security posture by striking a more advanced balance between the detection of genuine threats and the minimization of false alarms. Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. + description: "A medium-level WAF configuration builds upon the baseline to offer + a more nuanced and responsive defense mechanism against a wider array of threats.\n\nSample + steps:\n - Implement an enhanced set of WAF rules based on baseline data\n + \ - Continuous monitoring and fine-tuning of the WAF configuration\n - Develop + a strategic incident response plan utilizing WAF insights \n \nThe + medium configuration requires diligent management and continuous improvement + to address new vulnerabilities while maintaining the integrity of application + access.\n\nThere are debates on how useful a WAF is for APIs.\n" difficultyOfImplementation: knowledge: 4 time: 5 @@ -4422,7 +4455,7 @@ Implementation: implementation: [] references: samm2: - - D-SR-3-A + - O-EM-2-A iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -4441,6 +4474,36 @@ Implementation: C: false Information Gathering: Logging: + Analyze logs: + uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 + risk: Not aware of attacks happening. + measure: Check logs for keywords. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + references: + samm2: + - O-IM-1-A + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/b217c8bb-5d61-4b41-a675-1083993f83b1 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false Centralized application logging: uuid: fe875e17-ae4a-45f8-a359-244aa4fcbc04 risk: Local stored logs can be unauthorized manipulated by attackers with system @@ -4653,7 +4716,7 @@ Information Gathering: url: https://www.gnu.org/software/bash/ references: samm2: - - O-IM-1-A + - O-OM-1-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -4790,7 +4853,8 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-A 3 + - O-IM-2-A + - I-DM-3-A iso27001-2017: - 16.1.2 - 16.1.4 @@ -5202,7 +5266,8 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-A 3 + - O-IM-2-A + - I-DM-3-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 @@ -5298,7 +5363,7 @@ Information Gathering: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -5363,6 +5428,7 @@ Information Gathering: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.3 @@ -5402,7 +5468,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -5451,7 +5517,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -5492,7 +5558,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -5530,7 +5596,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-3-B + - I-DM-2-B iso27001-2017: - 16.1.4 iso27001-2022: @@ -5596,7 +5662,7 @@ Information Gathering: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-3-B + - I-DM-2-B iso27001-2022: - 5.25 - 5.12 @@ -5630,7 +5696,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-3-B + - V-RT-3-B iso27001-2017: - 14.2.3 - 14.2.8 @@ -5661,7 +5727,7 @@ Test and Verification: level: 3 references: samm2: - - V-ST-3-B + - V-RT-3-A iso27001-2017: - 14.2.3 - 14.2.8 @@ -5704,7 +5770,7 @@ Test and Verification: url: https://karma-runner.github.io references: samm2: - - V-ST-3-B + - V-RT-3-A iso27001-2017: - 14.2.3 - 14.2.8 @@ -5737,7 +5803,7 @@ Test and Verification: - Defined deployment process references: samm2: - - V-ST-3-B + - V-RT-3-A iso27001-2017: - 14.2.3 - 14.2.8 @@ -5791,7 +5857,7 @@ Test and Verification: - vulnerability management system references: samm2: - - I-DM-3-B + - I-DM-3-A iso27001-2017: - 16.1.4 - 8.2.1 @@ -5811,6 +5877,77 @@ Test and Verification: Default: false B: false C: false + Artifact-based false positive treatment: + uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + risk: Without artifact-specific false positive handling, teams must repeatedly + triage the same findings across different versions or deployments of the same + component, leading to inefficient use of security resources. + measure: "Implement false positive marking and temporary acceptance of findings + \nbased on specific artifacts (applications, components, or repositories).\nThis + allows teams to suppress findings for specific versions or builds\nwhile maintaining + visibility for future releases." + description: |- + Artifact-based false positive treatment enables more granular control + over finding suppression by linking decisions to specific code artifacts, + container images, or application versions. This approach helps maintain + security oversight while reducing repeated analysis overhead. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Simple false positive treatment + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + references: + samm2: + - I-DM-2-A + - I-DM-2-B + - I-SB-3-B + iso27001-2017: + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + tags: + - false-positive + - defect-management + teamsImplemented: + Default: false + B: false + C: false Fix based on accessibility: uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed risk: Overwhelming volume of security findings from automated testing tools. @@ -5835,7 +5972,7 @@ Test and Verification: implementation: ~ references: samm2: - - I-DM-3-B + - I-DM-3-A iso27001-2017: - 16.1.4 - 8.2.1 @@ -5855,6 +5992,52 @@ Test and Verification: Default: false B: false C: false + Global false positive treatment: + uuid: 9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + risk: Without centralized false positive management across environments, organizations + face inconsistent security decisions, duplicated analysis efforts, and potential + security gaps when the same findings are handled differently across applications + and teams. + measure: "Implement global false positive and acceptance management that applies + \nconsistently across all applications. This enables organization-wide security + decisions and reduces redundant \nanalysis of common false positives." + description: "Global false positive treatment allows (security) teams to make + \norganization-wide decisions about specific vulnerabilities or finding \npatterns. + When a finding is marked as a false positive or temporarily \naccepted at + the global level, this decision automatically applies to \nall applications + in the specified environment, ensuring consistency \nand operational efficiency." + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Artifact-based false positive treatment + - Usage of a vulnerability management system + implementation: ~ + references: + samm2: + - I-DM-2-B + - I-DM-3-A + - I-SB-3-B + iso27001-2017: + - 16.1.3 + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 6.8 + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + tags: + - false-positive + - defect-management + teamsImplemented: + Default: false + B: false + C: false Integration in development process: uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d risk: "Not integrating vulnerability handling into the development process may @@ -5923,7 +6106,7 @@ Test and Verification: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-3-B + - I-DM-2-A iso27001-2022: - 5.25 - 5.12 @@ -5966,7 +6149,7 @@ Test and Verification: url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ references: samm2: - - I-DM-2-B + - I-DM-2-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.4 @@ -6002,7 +6185,7 @@ Test and Verification: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 8.2.1 @@ -6045,10 +6228,14 @@ Test and Verification: usefulness: 4 level: 1 implementation: - - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 name: Purify tags: @@ -6058,7 +6245,7 @@ Test and Verification: The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. references: samm2: - - I-DM-2-A + - I-DM-1-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.6 @@ -6126,7 +6313,7 @@ Test and Verification: The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. references: samm2: - - I-DM-1-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 8.2.1 @@ -6159,7 +6346,7 @@ Test and Verification: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 12.6.1 @@ -6231,7 +6418,7 @@ Test and Verification: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-3-B + - I-DM-2-A iso27001-2022: - 5.25 - 5.12 @@ -6261,7 +6448,7 @@ Test and Verification: comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - - I-DM-2-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 12.6.1 @@ -6291,7 +6478,7 @@ Test and Verification: comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - - I-DM-2-B + - I-DM-2-A iso27001-2017: - 16.1.4 - 12.6.1 @@ -6355,7 +6542,7 @@ Test and Verification: The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. references: samm2: - - I-DM-1-B + - I-DM-3-A iso27001-2017: - 12.6.1 - 16.1.3 @@ -6530,7 +6717,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-ST-2-A + - V-RT-1-B iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -6780,7 +6967,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-1-A + - V-RT-1-AB iso27001-2017: - 12.1.3 - 14.2.3 @@ -7216,6 +7403,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7338,6 +7526,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-2-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7414,6 +7603,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-2-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7445,6 +7635,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7508,6 +7699,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7637,6 +7829,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7890,37 +8083,6 @@ Test and Verification: B: false C: false Static depth for infrastructure: - Analyze logs: - uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 - risk: Not aware of attacks happening. - measure: Check logs for keywords. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - references: - samm2: [] - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/b217c8bb-5d61-4b41-a675-1083993f83b1 - comments: "" - tags: - - none - teamsImplemented: - Default: false - B: false - C: false Correlate known vulnerabilities in infrastructure with new image versions: uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 risk: TODO. @@ -8183,11 +8345,52 @@ Test and Verification: Default: false B: false C: false - Test for stored secrets: + Test for stored secrets in build artifacts: + uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f + risk: Stored secrets in container images or other build artifacts shouldn't + exists because they might be exposed to unauthorized parties. + measure: Test for secrets in container images and other artifacts + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + references: + samm2: + - V-ST-1-A + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/d5e6303c-d5c6-4d59-b258-a3b9de38a07f + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for stored secrets in code: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c - risk: Stored secrets in git history, in container images or directly in code - shouldn't exists because they might be exposed to unauthorized parties. - measure: Test for secrets in code, container images and history + risk: Stored secrets in git history or directly in code shouldn't exists because + they might be exposed to unauthorized parties. + measure: Test for secrets in code and git history difficultyOfImplementation: knowledge: 2 time: 1 @@ -8574,6 +8777,7 @@ Test and Verification: references: samm2: - I-SB-3-A + - V-ST-3-A iso27001-2017: - 14.2.3 - 14.2.8 From 20a98da058fee1052e672e7ac32b304d559df9be Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 18 Sep 2025 14:48:04 +0200 Subject: [PATCH 095/370] fix samm ref --- src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index 87a5553..20d1bba 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -129,7 +129,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/distroless-usage references: samm2: - - I-SB-2 + - I-SB-2-B iso27001-2017: - hardening is missing in ISO 27001 - 14.2.1 From 057778acb03996c71c2e92f11fec4f967c7d6488 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 18 Sep 2025 16:22:43 +0200 Subject: [PATCH 096/370] chore: fix readme --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 2f90329..5a3d944 100644 --- a/README.md +++ b/README.md @@ -7,7 +7,7 @@ To test changes to the yaml-files, please run: docker run -ti -v $(pwd)/src/assets/YAML/default:/var/www/html/src/assets/YAML/default -v $(pwd)/src/assets/YAML/generated:/var/www/html/src/assets/YAML/generated -v $(pwd)/src/assets/YAML/schema:/var/www/html/src/assets/YAML/schema wurstbrot/dsomm-yaml-generation # Afterwards, you can use the generated.yaml in a container -docker run -v $(pwd)/src/assets/YAML/generated/generated.yaml:/usr/share/nginx/html/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm +docker run -v $(pwd)/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm ``` ## Credits From c57b96ca9c3f6f9f38cb4dfb52498b46b725e4ca Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 18 Sep 2025 17:12:33 +0200 Subject: [PATCH 097/370] flip samm ref --- .../default/BuildAndDeployment/Build.yaml | 14 +- .../BuildAndDeployment/Deployment.yaml | 36 +- .../BuildAndDeployment/PatchManagement.yaml | 14 +- .../CultureAndOrganization/Design.yaml | 18 +- .../EducationAndGuidance.yaml | 46 +- .../CultureAndOrganization/Process.yaml | 6 +- .../Implementation/ApplicationHardening.yaml | 18 +- .../DevelopmentAndSourceControl.yaml | 14 +- .../InfrastructureHardening.yaml | 48 +- .../default/InformationGathering/Logging.yaml | 14 +- .../InformationGathering/Monitoring.yaml | 36 +- .../default/InformationGathering/TestKPI.yaml | 16 +- .../TestAndVerification/ApplicationTests.yaml | 8 +- .../TestAndVerification/Consolidation.yaml | 36 +- .../DynamicDepthForApplications.yaml | 18 +- .../DynamicDepthForInfrastructure.yaml | 10 +- .../StaticDepthForApplications.yaml | 36 +- .../StaticDepthForInfrastructure.yaml | 24 +- .../TestAndVerification/Test-Intensity.yaml | 12 +- src/assets/YAML/generated/generated.yaml | 432 +++++++++--------- 20 files changed, 428 insertions(+), 428 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 72b7515..39f7bdd 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -31,7 +31,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technologi references: samm2: - - I-SB-2-A + - I-SB-A-2 iso27001-2017: - 14.2.6 iso27001-2022: @@ -72,7 +72,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technologi references: samm2: - - I-SB-1-A + - I-SB-A-1 iso27001-2017: - 12.1.1 - 14.2.2 @@ -114,7 +114,7 @@ Build and Deployment: - Defined build process references: samm2: - - I-SB-1-B + - I-SB-B-1 iso27001-2017: - 14.2.6 iso27001-2022: @@ -147,8 +147,8 @@ Build and Deployment: implementation: [] references: samm2: - - I-SB-1-B - - D-TA-1-A + - I-SB-B-1 + - D-TA-A-1 iso27001-2017: - 8.1 - 8.2 @@ -186,7 +186,7 @@ Build and Deployment: - Pinning of artifacts references: samm2: - - I-SB-1-A + - I-SB-A-1 iso27001-2017: - 14.2.6 iso27001-2022: @@ -213,7 +213,7 @@ Build and Deployment: - Defined build process references: samm2: - - I-SB-2-A + - I-SB-A-2 iso27001-2017: - 14.2.6 iso27001-2022: diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index ada0eb9..efa825a 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -20,7 +20,7 @@ Build and Deployment: - Smoke Test references: samm2: - - I-SD-3-A + - I-SD-A-3 iso27001-2017: - 17.2.1 # Availability of information processing facilities - 12.1.1 # Documented operational procedures @@ -59,7 +59,7 @@ Build and Deployment: level: 2 references: samm2: - - O-OM-2-B + - O-OM-B-2 iso27001-2017: - 11.2.7 iso27001-2022: @@ -89,7 +89,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/docker references: samm2: - - I-SD-1-A + - I-SD-A-1 iso27001-2017: - 12.1.1 - 14.2.2 @@ -120,7 +120,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/hashicorp-vault references: samm2: - - I-SD-1-B + - I-SD-B-1 iso27001-2017: - 9.4.5 - 14.2.6 @@ -154,7 +154,7 @@ Build and Deployment: - Environment depending configuration parameters (secrets) references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 14.1.3 - 13.1.3 @@ -196,9 +196,9 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - - I-SB-3-B - - I-SB-2-B - - I-SB-1-B + - I-SB-B-3 + - I-SB-B-2 + - I-SB-B-1 iso27001-2017: - 8.1 - 8.2 @@ -230,8 +230,8 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - - I-SB-1-B - - D-TA-1-B + - I-SB-B-1 + - D-TA-B-1 iso27001-2017: - 8.1 - 8.2 @@ -262,8 +262,8 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/image-metadata-collector references: samm2: - - I-SB-1-B - - D-TA-1-B + - I-SB-B-1 + - D-TA-B-1 iso27001-2017: - 8.1 - 8.2 @@ -290,8 +290,8 @@ Build and Deployment: - Defined deployment process references: samm2: - - I-SD-2-A - - I-SD-3-A + - I-SD-A-2 + - I-SD-A-3 iso27001-2017: - 12.5.1 - 14.2.2 @@ -323,8 +323,8 @@ Build and Deployment: - Defined build process references: samm2: - - I-SD-2-A - - I-SD-3-A + - I-SD-A-2 + - I-SD-A-3 iso27001-2017: - 14.3.1 - 14.2.8 @@ -357,7 +357,7 @@ Build and Deployment: - Same artifact for environments references: samm2: - - I-SD-2-A + - I-SD-A-2 iso27001-2017: - 14.3.1 - 14.2.8 @@ -391,7 +391,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/packj references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 14.2.1 diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index 20d1bba..321ac62 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -17,7 +17,7 @@ Build and Deployment: implementation: [] references: samm2: - - O-EM-1-B + - O-EM-B-1 iso27001-2017: - 12.6.1 - 12.5.1 @@ -58,7 +58,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/renovate references: samm2: - - O-EM-1-B + - O-EM-B-1 iso27001-2017: - 12.6.1 - 14.2.5 @@ -93,7 +93,7 @@ Build and Deployment: implementation: [] references: samm2: - - O-EM-2-B + - O-EM-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -129,7 +129,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/distroless-usage references: samm2: - - I-SB-2-B + - I-SB-B-2 iso27001-2017: - hardening is missing in ISO 27001 - 14.2.1 @@ -169,7 +169,7 @@ Build and Deployment: implementation: [] references: samm2: - - O-EM-1-B + - O-EM-B-1 iso27001-2017: - 12.6.1 iso27001-2022: @@ -204,7 +204,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sample-concept-1 references: samm2: - - O-EM-2-B + - O-EM-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -237,7 +237,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/renovate references: samm2: - - O-EM-2-B + - O-EM-B-2 iso27001-2017: - 12.6.1 iso27001-2022: diff --git a/src/assets/YAML/default/CultureAndOrganization/Design.yaml b/src/assets/YAML/default/CultureAndOrganization/Design.yaml index 2121e8a..5925ae9 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Design.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Design.yaml @@ -40,7 +40,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-matrix-for-storage references: samm2: - - D-TA-2-B + - D-TA-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -71,8 +71,8 @@ Culture and Organization: implementation: [] references: samm2: - - D-TA-1-B - - D-TA-2-A + - D-TA-B-1 + - D-TA-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -152,7 +152,7 @@ Culture and Organization: Source: OWASP Project Integration Project references: samm2: - - D-TA-2-B + - D-TA-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -185,7 +185,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/don-t-forget-evil-user-stories references: samm2: - - D-TA-2-B + - D-TA-B-2 - V-RT-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 @@ -221,7 +221,7 @@ Culture and Organization: - Creation of threat modeling processes and standards references: samm2: - - D-TA-2-B + - D-TA-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of project management @@ -258,8 +258,8 @@ Culture and Organization: - Conduction of simple threat modeling on technical level references: samm2: - - D-TA-3-B - - D-TA-2-B + - D-TA-B-3 + - D-TA-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -291,7 +291,7 @@ Culture and Organization: implementation: [] references: samm2: - - G-SM-2-A + - G-SM-A-2 iso27001-2017: - 5.1.1 - 7.2.1 diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index 37b4afc..3e1cd42 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -22,7 +22,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - - G-EG-1-A + - G-EG-A-1 iso27001-2017: - 7.2.2 iso27001-2022: @@ -42,7 +42,7 @@ Culture and Organization: implementation: references: samm2: - - G-EG-1-A + - G-EG-A-1 iso27001-2017: - 7.2.2 iso27001-2022: @@ -61,7 +61,7 @@ Culture and Organization: level: 3 references: samm2: - - G-EG-3-B + - G-EG-B-3 iso27001-2017: - 7.1.1 iso27001-2022: @@ -88,7 +88,7 @@ Culture and Organization: level: 4 references: samm2: - - G-EG-3-B + - G-EG-B-3 iso27001-2017: - 7.1.1 iso27001-2022: @@ -116,7 +116,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/build-it-break-it-fi references: samm2: - - G-EG-2-A + - G-EG-A-2 iso27001-2017: - 7.2.2 iso27001-2022: @@ -142,8 +142,8 @@ Culture and Organization: implementation: [] references: samm2: - - G-EG-2-A - - G-EG-2-B + - G-EG-A-2 + - G-EG-B-2 iso27001-2017: - Mutual review of source code is not explicitly required in ISO 27001 may be @@ -174,8 +174,8 @@ Culture and Organization: implementation: [] references: samm2: - - G-EG-1-A - - G-EG-2-A + - G-EG-A-1 + - G-EG-A-2 iso27001-2017: - Mutual security testing is not explicitly required in ISO 27001 may be - 7.2.2 @@ -201,7 +201,7 @@ Culture and Organization: implementation: [] references: samm2: - - G-EG-2-A + - G-EG-A-2 - O-IM-B-2 iso27001-2017: - War games are not explicitly required in ISO 27001 may be @@ -240,8 +240,8 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-security-champ references: samm2: - - G-EG-1-B - - G-EG-2-B + - G-EG-B-1 + - G-EG-B-2 iso27001-2017: - Security champions are missing in ISO 27001 most likely - 7.2.1 @@ -278,7 +278,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - - G-EG-1-A + - G-EG-A-1 iso27001-2017: - 7.2.2 iso27001-2022: @@ -303,7 +303,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - - G-EG-2-A + - G-EG-A-2 iso27001-2017: - 7.2.2 iso27001-2022: @@ -330,8 +330,8 @@ Culture and Organization: - Each team has a security champion references: samm2: - - D-TA-2-B - - G-EG-1-A + - D-TA-B-2 + - G-EG-A-1 iso27001-2017: - Security champions are missing in ISO 27001 - 7.2.2 @@ -359,7 +359,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-top-10-maturit references: samm2: - - G-EG-1-B + - G-EG-B-1 iso27001-2017: - not required by ISO 27001 - interestingly enough A7.2.3 is requiring a process to handle misconduct @@ -399,7 +399,7 @@ Culture and Organization: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) references: samm2: - - V-ST-1-B + - V-ST-B-1 iso27001-2017: - ISO 27001:2017 mapping is missing iso27001-2022: @@ -425,8 +425,8 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: samm2: - - G-EG-1-A - - G-EG-1-B + - G-EG-A-1 + - G-EG-B-1 iso27001-2017: - security consulting is missing in ISO 27001 may be - 6.1.1 @@ -456,8 +456,8 @@ Culture and Organization: implementation: [] references: samm2: - - G-EG-3-B - - O-IM-3-B + - G-EG-B-3 + - O-IM-B-3 iso27001-2017: - 16.1.6 iso27001-2022: @@ -497,7 +497,7 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/damn-vulnerable-web references: samm2: - - G-EG-2-A + - G-EG-A-2 iso27001-2017: - 7.2.2 iso27001-2022: diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index bf02f07..2769b16 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -79,7 +79,7 @@ Culture and Organization: implementation: [] references: samm2: - - O-IM-2-B + - O-IM-B-2 iso27001-2017: - 17.1.1 iso27001-2022: @@ -111,8 +111,8 @@ Culture and Organization: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - O-OM-2-A - - G-PC-2-B + - O-OM-A-2 + - G-PC-B-2 iso27001-2022: - 5.25 - 5.12 diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml index 5043eef..d1e9555 100755 --- a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml +++ b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml @@ -42,7 +42,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/apimaturity references: samm2: - - D-SR-2-A + - D-SR-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -83,7 +83,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cwe-838 references: samm2: - - D-SR-1-A + - D-SR-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -124,7 +124,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-parameterization-cheats references: samm2: - - D-SR-1-A + - D-SR-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -174,7 +174,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/apimaturity references: samm2: - - D-SR-3-A + - D-SR-A-3 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -204,7 +204,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-masvs references: samm2: - - D-SR-3-A + - D-SR-A-3 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -237,7 +237,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-masvs references: samm2: - - D-SR-2-A + - D-SR-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -270,7 +270,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-masvs references: samm2: - - D-SR-3-A + - D-SR-A-3 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -319,7 +319,7 @@ Implementation: - Referrer-Policy: Control information in the Referrer header references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -377,7 +377,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index b029516..dfed1aa 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -19,7 +19,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sonarqube references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - ISO 27001:2017 mapping is missing iso27001-2022: @@ -47,7 +47,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 6.1.2 @@ -75,7 +75,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/signing-of-commits-protection references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 6.1.2 @@ -101,7 +101,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 - I-SB-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific @@ -127,7 +127,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 @@ -156,7 +156,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/signing-of-commits-protection references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 6.1.2 - 14.2.1 @@ -187,7 +187,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 6.1.2 - 14.2.1 diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index a736989..c1f317a 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -23,7 +23,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/totp references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 9.2.4 - 6.1.2 # Segregation of duties. @@ -60,7 +60,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/totp references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 9.2.4 - 6.1.2 # Segregation of duties. @@ -89,7 +89,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -146,7 +146,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/firewalls references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -172,7 +172,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/remove-direct-access references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 17.2.1 @@ -205,7 +205,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkinsfile references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 @@ -239,7 +239,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/firewalls references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -268,7 +268,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/falco references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -299,7 +299,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - 12.1.4 - 17.2.1 @@ -331,7 +331,7 @@ Implementation: - Defined build process references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - 9.4.1 iso27001-2022: @@ -356,7 +356,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/vpn references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 9.4.1 iso27001-2022: @@ -388,7 +388,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defend-the-core-kubernetes references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - system hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -421,7 +421,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defend-the-core-kubernetes references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -450,7 +450,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/chaosmonkey references: samm2: - - O-EM-3-A + - O-EM-A-3 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 17.1.3 @@ -476,7 +476,7 @@ Implementation: implementation: "" references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 10.1 iso27001-2022: @@ -503,7 +503,7 @@ Implementation: implementation: "" references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 10.1 iso27001-2022: @@ -528,7 +528,7 @@ Implementation: implementation: "" references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 10.1 iso27001-2022: @@ -554,7 +554,7 @@ Implementation: implementation: "" references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 10.1 iso27001-2022: @@ -584,7 +584,7 @@ Implementation: - Defined build process references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -609,7 +609,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.4 @@ -640,7 +640,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 12.1.3 @@ -683,7 +683,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -721,7 +721,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -764,7 +764,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 diff --git a/src/assets/YAML/default/InformationGathering/Logging.yaml b/src/assets/YAML/default/InformationGathering/Logging.yaml index 47b9079..92aafd5 100755 --- a/src/assets/YAML/default/InformationGathering/Logging.yaml +++ b/src/assets/YAML/default/InformationGathering/Logging.yaml @@ -22,7 +22,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -49,7 +49,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/logstash references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -79,7 +79,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -120,7 +120,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-logging-cheats references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - 12.4.1 iso27001-2022: @@ -150,7 +150,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/bash references: samm2: - - O-OM-1-A + - O-OM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -185,7 +185,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/elk-stack references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -209,7 +209,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sigmahq references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - ISO 27001:2017 mapping is missing iso27001-2022: diff --git a/src/assets/YAML/default/InformationGathering/Monitoring.yaml b/src/assets/YAML/default/InformationGathering/Monitoring.yaml index f326543..c1e4fce 100755 --- a/src/assets/YAML/default/InformationGathering/Monitoring.yaml +++ b/src/assets/YAML/default/InformationGathering/Monitoring.yaml @@ -20,7 +20,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.1.3 iso27001-2022: @@ -46,7 +46,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -70,7 +70,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/falco references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -94,8 +94,8 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A - - I-DM-3-A + - O-IM-A-2 + - I-DM-A-3 iso27001-2017: - 16.1.2 - 16.1.4 @@ -131,7 +131,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/https-ht-transpare references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -154,7 +154,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.3 @@ -184,7 +184,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.4.1 - 13.1.1 @@ -207,7 +207,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.3 @@ -232,7 +232,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - not explicitly covered by ISO 27001 iso27001-2022: @@ -260,7 +260,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.1.3 iso27001-2022: @@ -285,7 +285,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 @@ -319,7 +319,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/prometheus references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - 12.4.1 iso27001-2022: @@ -343,7 +343,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/collected references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - 12.1.3 iso27001-2022: @@ -372,7 +372,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/collected references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - 12.1.3 iso27001-2022: @@ -399,8 +399,8 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A - - I-DM-3-A + - O-IM-A-2 + - I-DM-A-3 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 @@ -426,7 +426,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.1.3 iso27001-2022: diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml index 8ddf2a0..80cc016 100644 --- a/src/assets/YAML/default/InformationGathering/TestKPI.yaml +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -23,7 +23,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -63,7 +63,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -94,7 +94,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -127,7 +127,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -156,7 +156,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2017: - 16.1.4 iso27001-2022: @@ -184,8 +184,8 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-2-B - - I-SB-3-B + - I-DM-B-2 + - I-SB-B-3 iso27001-2017: - 16.1.4 - 8.2.3 @@ -218,7 +218,7 @@ Information Gathering: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 diff --git a/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml b/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml index eff8bd3..b4bb808 100755 --- a/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml +++ b/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml @@ -19,7 +19,7 @@ Test and Verification: implementation: [] references: samm2: - - V-RT-3-B + - V-RT-B-3 iso27001-2017: - 14.2.3 - 14.2.8 @@ -45,7 +45,7 @@ Test and Verification: level: 3 references: samm2: - - V-RT-3-A + - V-RT-A-3 iso27001-2017: - 14.2.3 - 14.2.8 @@ -75,7 +75,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/karma references: samm2: - - V-RT-3-A + - V-RT-A-3 iso27001-2017: - 14.2.3 - 14.2.8 @@ -103,7 +103,7 @@ Test and Verification: - Defined deployment process references: samm2: - - V-RT-3-A + - V-RT-A-3 iso27001-2017: - 14.2.3 - 14.2.8 diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index a8d1f51..0929226 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -27,7 +27,7 @@ Test and Verification: implementation: references: samm2: - - I-DM-3-A + - I-DM-A-3 iso27001-2017: - 16.1.4 - 8.2.1 @@ -57,7 +57,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/business-friendly-vulnerability-metrics references: samm2: - - I-DM-3-A + - I-DM-A-3 iso27001-2017: - 16.1.4 - 8.2.1 @@ -89,7 +89,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dast references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.4 @@ -121,7 +121,7 @@ Test and Verification: implementation: [] references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 8.2.1 @@ -163,7 +163,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify references: samm2: - - I-DM-1-A + - I-DM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.6 @@ -203,9 +203,9 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack references: samm2: - - I-DM-2-A - - I-DM-2-B - - I-SB-3-B + - I-DM-A-2 + - I-DM-B-2 + - I-SB-B-3 iso27001-2017: - 16.1.4 - 16.1.6 @@ -233,7 +233,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 8.2.1 @@ -260,7 +260,7 @@ Test and Verification: implementation: [] references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 12.6.1 @@ -284,7 +284,7 @@ Test and Verification: comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 12.6.1 @@ -307,7 +307,7 @@ Test and Verification: comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 12.6.1 @@ -346,9 +346,9 @@ Test and Verification: implementation: references: samm2: - - I-DM-2-B - - I-DM-3-A - - I-SB-3-B + - I-DM-B-2 + - I-DM-A-3 + - I-SB-B-3 iso27001-2017: - 16.1.3 - 16.1.4 @@ -387,7 +387,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/SecObserve references: samm2: - - I-DM-3-A + - I-DM-A-3 iso27001-2017: - 12.6.1 - 16.1.3 @@ -438,7 +438,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2022: - 5.25 - 5.12 @@ -476,7 +476,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/defectdojo-client references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2022: - 5.25 - 5.12 diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml index a7bb61a..c3cded1 100755 --- a/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/DynamicDepthForApplications.yaml @@ -17,7 +17,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/coveragepy references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - part of periodic review, PDCA @@ -46,7 +46,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 14.2.3 - 14.2.8 @@ -79,7 +79,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -106,7 +106,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-RT-1-B + - V-RT-B-1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -136,7 +136,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 14.2.8 - 14.2.3 @@ -160,7 +160,7 @@ Test and Verification: - Simple Scan references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 14.2.3 - 14.2.8 @@ -195,7 +195,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/arachni references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 14.2.3 - 14.2.8 @@ -221,7 +221,7 @@ Test and Verification: - Simple Scan references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 14.2.3 @@ -255,7 +255,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-securecodebox references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.5 diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml index 4d07f79..d8b921c 100755 --- a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml @@ -19,7 +19,7 @@ Test and Verification: implementation: [] references: samm2: - - V-RT-1-AB + - V-RT-AB-1 iso27001-2017: - 12.1.3 - 14.2.3 @@ -54,7 +54,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-amass references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 13.1.3 - 14.2.3 @@ -113,7 +113,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/k8spurger references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 13.1.3 - 14.2.3 @@ -145,7 +145,7 @@ Test and Verification: - uuid:4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 13.1.3 - 14.2.3 @@ -206,7 +206,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/htc-hydra references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 9.4.3 iso27001-2022: diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index df7da59..5de1bef 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -18,7 +18,7 @@ Test and Verification: - Defined build process references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 14.2.1 @@ -121,7 +121,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/pre-commit-synopsis references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -149,7 +149,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-oas-checker references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 14.2.1 - 14.2.5 @@ -177,8 +177,8 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A - - I-SB-3-B + - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -212,8 +212,8 @@ Test and Verification: - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - - V-ST-2-A - - I-SB-3-B + - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -247,7 +247,7 @@ Test and Verification: - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -280,8 +280,8 @@ Test and Verification: - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - - V-ST-2-A - - I-SB-3-B + - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -308,7 +308,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-super-linter references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.1 @@ -338,8 +338,8 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/epss references: samm2: - - V-ST-2-A - - I-SB-3-B + - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -365,8 +365,8 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-dependabot references: samm2: - - V-ST-2-A - - I-SB-2-B + - V-ST-A-2 + - I-SB-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -399,8 +399,8 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy references: samm2: - - V-ST-2-A - - I-SB-2-B + - V-ST-A-2 + - I-SB-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -426,7 +426,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-3-A + - V-ST-A-3 iso27001-2017: - 12.6.1 - 14.2.1 diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index e15bd8d..c0d569d 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -18,7 +18,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/clusterscanner references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 12.6.1 - 14.2.5 @@ -47,7 +47,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -74,7 +74,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/clusterscanner references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.2.1 iso27001-2022: @@ -95,7 +95,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.5 @@ -126,7 +126,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/vuls references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 12.6.1 - 14.2.1 @@ -153,7 +153,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/go-pillage-registrie references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - vcs usage is not explicitly covered by ISO 27001 - too specific - 9.4.3 @@ -182,7 +182,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/go-pillage-registrie references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - vcs usage is not explicitly covered by ISO 27001 - too specific - 9.4.3 @@ -212,7 +212,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/kubesec references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - System hardening is not explicitly covered by ISO 27001 - too specific - 12.6.1 @@ -250,7 +250,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/vuls references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 12.6.1 - 14.2.1 @@ -277,7 +277,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/clusterscanner references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - ISO 27001:2017 mapping is missing iso27001-2022: @@ -303,7 +303,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/kube-bench references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - System hardening is not explicitly covered by ISO 27001 - too specific - 12.6.1 @@ -339,7 +339,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dockerfilelint references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - System hardening, virtual environments are not explicitly covered by ISO 27001 - too specific diff --git a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml index c8b0c89..d9f1566 100755 --- a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml +++ b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml @@ -19,7 +19,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 14.2.2 - 14.2.3 @@ -53,7 +53,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.1 @@ -80,7 +80,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 12.6.1 - 14.2.1 @@ -109,7 +109,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.1 @@ -138,8 +138,8 @@ Test and Verification: implementation: [] references: samm2: - - I-SB-3-A - - V-ST-3-A + - I-SB-A-3 + - V-ST-A-3 iso27001-2017: - 14.2.3 - 14.2.8 diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 6f630ea..39e21e7 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -36,7 +36,7 @@ Build and Deployment: url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ references: samm2: - - I-SB-2-A + - I-SB-A-2 iso27001-2017: - 14.2.6 iso27001-2022: @@ -86,7 +86,7 @@ Build and Deployment: url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ references: samm2: - - I-SB-1-A + - I-SB-A-1 iso27001-2017: - 12.1.1 - 14.2.2 @@ -148,7 +148,7 @@ Build and Deployment: - Defined build process references: samm2: - - I-SB-1-B + - I-SB-B-1 iso27001-2017: - 14.2.6 iso27001-2022: @@ -183,8 +183,8 @@ Build and Deployment: implementation: [] references: samm2: - - I-SB-1-B - - D-TA-1-A + - I-SB-B-1 + - D-TA-A-1 iso27001-2017: - 8.1 - 8.2 @@ -239,7 +239,7 @@ Build and Deployment: - Pinning of artifacts references: samm2: - - I-SB-1-A + - I-SB-A-1 iso27001-2017: - 14.2.6 iso27001-2022: @@ -282,7 +282,7 @@ Build and Deployment: - Defined build process references: samm2: - - I-SB-2-A + - I-SB-A-2 iso27001-2017: - 14.2.6 iso27001-2022: @@ -318,7 +318,7 @@ Build and Deployment: - Smoke Test references: samm2: - - I-SD-3-A + - I-SD-A-3 iso27001-2017: - 17.2.1 - 12.1.1 @@ -363,7 +363,7 @@ Build and Deployment: level: 2 references: samm2: - - O-OM-2-B + - O-OM-B-2 iso27001-2017: - 11.2.7 iso27001-2022: @@ -404,7 +404,7 @@ Build and Deployment: tags: [] references: samm2: - - I-SD-1-A + - I-SD-A-1 iso27001-2017: - 12.1.1 - 14.2.2 @@ -446,7 +446,7 @@ Build and Deployment: A tool for secrets management, encryption as a service, and privileged access management. references: samm2: - - I-SD-1-B + - I-SD-B-1 iso27001-2017: - 9.4.5 - 14.2.6 @@ -497,7 +497,7 @@ Build and Deployment: Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 14.2.1 @@ -534,7 +534,7 @@ Build and Deployment: - Environment depending configuration parameters (secrets) references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 14.1.3 - 13.1.3 @@ -606,8 +606,8 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SB-1-B - - D-TA-1-B + - I-SB-B-1 + - D-TA-B-1 iso27001-2017: - 8.1 - 8.2 @@ -670,8 +670,8 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SB-1-B - - D-TA-1-B + - I-SB-B-1 + - D-TA-B-1 iso27001-2017: - 8.1 - 8.2 @@ -735,9 +735,9 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SB-3-B - - I-SB-2-B - - I-SB-1-B + - I-SB-B-3 + - I-SB-B-2 + - I-SB-B-1 iso27001-2017: - 8.1 - 8.2 @@ -780,8 +780,8 @@ Build and Deployment: - Defined deployment process references: samm2: - - I-SD-2-A - - I-SD-3-A + - I-SD-A-2 + - I-SD-A-3 iso27001-2017: - 12.5.1 - 14.2.2 @@ -820,8 +820,8 @@ Build and Deployment: - Defined build process references: samm2: - - I-SD-2-A - - I-SD-3-A + - I-SD-A-2 + - I-SD-A-3 iso27001-2017: - 14.3.1 - 14.2.8 @@ -869,7 +869,7 @@ Build and Deployment: - Same artifact for environments references: samm2: - - I-SD-2-A + - I-SD-A-2 iso27001-2017: - 14.3.1 - 14.2.8 @@ -905,7 +905,7 @@ Build and Deployment: implementation: [] references: samm2: - - O-EM-1-B + - O-EM-B-1 iso27001-2017: - 12.6.1 - 12.5.1 @@ -963,7 +963,7 @@ Build and Deployment: url: https://github.com/renovatebot/renovate references: samm2: - - O-EM-1-B + - O-EM-B-1 iso27001-2017: - 12.6.1 - 14.2.5 @@ -1011,7 +1011,7 @@ Build and Deployment: url: https://argo-cd.readthedocs.io/en/stable/ references: samm2: - - O-EM-2-B + - O-EM-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -1057,7 +1057,7 @@ Build and Deployment: url: https://github.com/renovatebot/renovate references: samm2: - - O-EM-2-B + - O-EM-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -1095,7 +1095,7 @@ Build and Deployment: implementation: [] references: samm2: - - O-EM-2-B + - O-EM-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -1187,7 +1187,7 @@ Build and Deployment: implementation: [] references: samm2: - - O-EM-1-B + - O-EM-B-1 iso27001-2017: - 12.6.1 iso27001-2022: @@ -1240,7 +1240,7 @@ Build and Deployment: is being used and not the buggy newer one." references: samm2: - - O-EM-2-B + - O-EM-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -1338,7 +1338,7 @@ Culture and Organization: - kubernetes references: samm2: - - D-TA-2-B + - D-TA-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -1373,8 +1373,8 @@ Culture and Organization: implementation: [] references: samm2: - - D-TA-1-B - - D-TA-2-A + - D-TA-B-1 + - D-TA-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -1498,7 +1498,7 @@ Culture and Organization: Source: OWASP Project Integration Project references: samm2: - - D-TA-2-B + - D-TA-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -1542,7 +1542,7 @@ Culture and Organization: Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' references: samm2: - - D-TA-2-B + - D-TA-B-2 - V-RT-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 @@ -1589,7 +1589,7 @@ Culture and Organization: - Creation of threat modeling processes and standards references: samm2: - - D-TA-2-B + - D-TA-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of project management @@ -1644,8 +1644,8 @@ Culture and Organization: - Conduction of simple threat modeling on technical level references: samm2: - - D-TA-3-B - - D-TA-2-B + - D-TA-B-3 + - D-TA-B-2 iso27001-2017: - Not explicitly covered by ISO 27001 - May be part of risk assessment @@ -1681,7 +1681,7 @@ Culture and Organization: implementation: [] references: samm2: - - G-SM-2-A + - G-SM-A-2 iso27001-2017: - 5.1.1 - 7.2.1 @@ -1727,7 +1727,7 @@ Culture and Organization: url: https://cheatsheetseries.owasp.org/ references: samm2: - - G-EG-1-A + - G-EG-A-1 iso27001-2017: - 7.2.2 iso27001-2022: @@ -1762,7 +1762,7 @@ Culture and Organization: level: 4 references: samm2: - - G-EG-3-B + - G-EG-B-3 iso27001-2017: - 7.1.1 iso27001-2022: @@ -1798,7 +1798,7 @@ Culture and Organization: url: https://builditbreakit.org/ references: samm2: - - G-EG-2-A + - G-EG-A-2 iso27001-2017: - 7.2.2 iso27001-2022: @@ -1829,8 +1829,8 @@ Culture and Organization: implementation: [] references: samm2: - - G-EG-2-A - - G-EG-2-B + - G-EG-A-2 + - G-EG-B-2 iso27001-2017: - Mutual review of source code is not explicitly required in ISO 27001 may be @@ -1867,8 +1867,8 @@ Culture and Organization: implementation: [] references: samm2: - - G-EG-1-A - - G-EG-2-A + - G-EG-A-1 + - G-EG-A-2 iso27001-2017: - Mutual security testing is not explicitly required in ISO 27001 may be - 7.2.2 @@ -1900,7 +1900,7 @@ Culture and Organization: implementation: [] references: samm2: - - G-EG-2-A + - G-EG-A-2 - O-IM-B-2 iso27001-2017: - War games are not explicitly required in ISO 27001 may be @@ -1948,8 +1948,8 @@ Culture and Organization: url: https://github.com/c0rdis/security-champions-playbook references: samm2: - - G-EG-1-B - - G-EG-2-B + - G-EG-B-1 + - G-EG-B-2 iso27001-2017: - Security champions are missing in ISO 27001 most likely - 7.2.1 @@ -1983,7 +1983,7 @@ Culture and Organization: implementation: ~ references: samm2: - - G-EG-1-A + - G-EG-A-1 iso27001-2017: - 7.2.2 iso27001-2022: @@ -2032,7 +2032,7 @@ Culture and Organization: url: https://cheatsheetseries.owasp.org/ references: samm2: - - G-EG-1-A + - G-EG-A-1 iso27001-2017: - 7.2.2 iso27001-2022: @@ -2074,7 +2074,7 @@ Culture and Organization: url: https://cheatsheetseries.owasp.org/ references: samm2: - - G-EG-2-A + - G-EG-A-2 iso27001-2017: - 7.2.2 iso27001-2022: @@ -2113,8 +2113,8 @@ Culture and Organization: - Each team has a security champion references: samm2: - - D-TA-2-B - - G-EG-1-A + - D-TA-B-2 + - G-EG-A-1 iso27001-2017: - Security champions are missing in ISO 27001 - 7.2.2 @@ -2161,7 +2161,7 @@ Culture and Organization: url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx references: samm2: - - G-EG-1-B + - G-EG-B-1 iso27001-2017: - not required by ISO 27001 - interestingly enough A7.2.3 is requiring a process to handle misconduct @@ -2203,7 +2203,7 @@ Culture and Organization: level: 3 references: samm2: - - G-EG-3-B + - G-EG-B-3 iso27001-2017: - 7.1.1 iso27001-2022: @@ -2253,7 +2253,7 @@ Culture and Organization: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) references: samm2: - - V-ST-1-B + - V-ST-B-1 iso27001-2017: - ISO 27001:2017 mapping is missing iso27001-2022: @@ -2289,8 +2289,8 @@ Culture and Organization: url: https://cheatsheetseries.owasp.org/ references: samm2: - - G-EG-1-A - - G-EG-1-B + - G-EG-A-1 + - G-EG-B-1 iso27001-2017: - security consulting is missing in ISO 27001 may be - 6.1.1 @@ -2326,8 +2326,8 @@ Culture and Organization: implementation: [] references: samm2: - - G-EG-3-B - - O-IM-3-B + - G-EG-B-3 + - O-IM-B-3 iso27001-2017: - 16.1.6 iso27001-2022: @@ -2384,7 +2384,7 @@ Culture and Organization: description: Simple Application with intended vulnerabilities. HTML based. references: samm2: - - G-EG-2-A + - G-EG-A-2 iso27001-2017: - 7.2.2 iso27001-2022: @@ -2485,7 +2485,7 @@ Culture and Organization: implementation: [] references: samm2: - - O-IM-2-B + - O-IM-B-2 iso27001-2017: - 17.1.1 iso27001-2022: @@ -2548,8 +2548,8 @@ Culture and Organization: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - O-OM-2-A - - G-PC-2-B + - O-OM-A-2 + - G-PC-B-2 iso27001-2022: - 5.25 - 5.12 @@ -2618,7 +2618,7 @@ Implementation: url: https://curity.io/resources/learn/the-api-security-maturity-model/ references: samm2: - - D-SR-3-A + - D-SR-A-3 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2684,7 +2684,7 @@ Implementation: url: https://curity.io/resources/learn/the-api-security-maturity-model/ references: samm2: - - D-SR-2-A + - D-SR-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2728,7 +2728,7 @@ Implementation: url: https://github.com/OWASP/owasp-masvs references: samm2: - - D-SR-2-A + - D-SR-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2774,7 +2774,7 @@ Implementation: url: https://github.com/OWASP/owasp-masvs references: samm2: - - D-SR-3-A + - D-SR-A-3 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2820,7 +2820,7 @@ Implementation: url: https://github.com/OWASP/owasp-masvs references: samm2: - - D-SR-3-A + - D-SR-A-3 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2885,7 +2885,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2937,7 +2937,7 @@ Implementation: url: https://cwe.mitre.org/data/definitions/838.html references: samm2: - - D-SR-1-A + - D-SR-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2988,7 +2988,7 @@ Implementation: tags: [] references: samm2: - - D-SR-1-A + - D-SR-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3056,7 +3056,7 @@ Implementation: - Referrer-Policy: Control information in the Referrer header references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3087,7 +3087,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 @@ -3139,7 +3139,7 @@ Implementation: - scm references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 6.1.2 - 14.2.1 @@ -3191,7 +3191,7 @@ Implementation: description: Usage of branch protection rules references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 6.1.2 @@ -3235,7 +3235,7 @@ Implementation: - linting references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - ISO 27001:2017 mapping is missing iso27001-2022: @@ -3280,7 +3280,7 @@ Implementation: - scm references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 6.1.2 @@ -3333,7 +3333,7 @@ Implementation: description: Usage of branch protection rules references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 6.1.2 - 14.2.1 @@ -3366,7 +3366,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 - I-SB-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific @@ -3401,7 +3401,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3513,7 +3513,7 @@ Implementation: - kubernetes references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - system hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3552,7 +3552,7 @@ Implementation: url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3624,7 +3624,7 @@ Implementation: - kubernetes references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3659,7 +3659,7 @@ Implementation: tags: [] references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 17.2.1 @@ -3712,7 +3712,7 @@ Implementation: url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 @@ -3760,7 +3760,7 @@ Implementation: url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3809,7 +3809,7 @@ Implementation: Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -3856,7 +3856,7 @@ Implementation: url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 9.2.4 - 6.1.2 @@ -3907,7 +3907,7 @@ Implementation: url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 9.2.4 - 6.1.2 @@ -3949,7 +3949,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - 12.1.4 - 17.2.1 @@ -3992,7 +3992,7 @@ Implementation: - Defined build process references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - 9.4.1 iso27001-2022: @@ -4030,7 +4030,7 @@ Implementation: url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - 9.4.1 iso27001-2022: @@ -4072,7 +4072,7 @@ Implementation: resilient services. references: samm2: - - O-EM-3-A + - O-EM-A-3 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 17.1.3 @@ -4104,7 +4104,7 @@ Implementation: implementation: "" references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 10.1 iso27001-2022: @@ -4137,7 +4137,7 @@ Implementation: implementation: "" references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 10.1 iso27001-2022: @@ -4167,7 +4167,7 @@ Implementation: implementation: "" references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 10.1 iso27001-2022: @@ -4198,7 +4198,7 @@ Implementation: implementation: "" references: samm2: - - I-SD-2-B + - I-SD-B-2 iso27001-2017: - 10.1 iso27001-2022: @@ -4244,7 +4244,7 @@ Implementation: - Defined build process references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -4275,7 +4275,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.4 @@ -4311,7 +4311,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 12.1.3 @@ -4366,7 +4366,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -4411,7 +4411,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-1-A + - O-EM-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -4455,7 +4455,7 @@ Implementation: implementation: [] references: samm2: - - O-EM-2-A + - O-EM-A-2 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -4491,7 +4491,7 @@ Information Gathering: url: https://github.com/SigmaHQ/sigma references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - ISO 27001:2017 mapping is missing iso27001-2022: @@ -4522,7 +4522,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -4565,7 +4565,7 @@ Information Gathering: - logging references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -4599,7 +4599,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -4663,7 +4663,7 @@ Information Gathering: - documentation references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - 12.4.1 iso27001-2022: @@ -4716,7 +4716,7 @@ Information Gathering: url: https://www.gnu.org/software/bash/ references: samm2: - - O-OM-1-A + - O-OM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -4758,7 +4758,7 @@ Information Gathering: url: https://www.elastic.co/elk-stack references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 @@ -4792,7 +4792,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -4823,7 +4823,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.1.3 iso27001-2022: @@ -4853,8 +4853,8 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A - - I-DM-3-A + - O-IM-A-2 + - I-DM-A-3 iso27001-2017: - 16.1.2 - 16.1.4 @@ -4896,7 +4896,7 @@ Information Gathering: Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -4936,7 +4936,7 @@ Information Gathering: description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -4965,7 +4965,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.3 @@ -5000,7 +5000,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.4.1 - 13.1.1 @@ -5029,7 +5029,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.3 @@ -5060,7 +5060,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - not explicitly covered by ISO 27001 iso27001-2022: @@ -5093,7 +5093,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.1.3 iso27001-2022: @@ -5123,7 +5123,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 @@ -5168,7 +5168,7 @@ Information Gathering: url: https://prometheus.io/ references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - 12.4.1 iso27001-2022: @@ -5200,7 +5200,7 @@ Information Gathering: tags: [] references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - 12.1.3 iso27001-2022: @@ -5235,7 +5235,7 @@ Information Gathering: tags: [] references: samm2: - - O-IM-1-A + - O-IM-A-1 iso27001-2017: - 12.1.3 iso27001-2022: @@ -5266,8 +5266,8 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A - - I-DM-3-A + - O-IM-A-2 + - I-DM-A-3 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 @@ -5299,7 +5299,7 @@ Information Gathering: implementation: [] references: samm2: - - O-IM-2-A + - O-IM-A-2 iso27001-2017: - 12.1.3 iso27001-2022: @@ -5363,7 +5363,7 @@ Information Gathering: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -5427,8 +5427,8 @@ Information Gathering: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-2-B - - I-SB-3-B + - I-DM-B-2 + - I-SB-B-3 iso27001-2017: - 16.1.4 - 8.2.3 @@ -5468,7 +5468,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -5517,7 +5517,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -5558,7 +5558,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -5596,7 +5596,7 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2017: - 16.1.4 iso27001-2022: @@ -5662,7 +5662,7 @@ Information Gathering: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-2-B + - I-DM-B-2 iso27001-2022: - 5.25 - 5.12 @@ -5696,7 +5696,7 @@ Test and Verification: implementation: [] references: samm2: - - V-RT-3-B + - V-RT-B-3 iso27001-2017: - 14.2.3 - 14.2.8 @@ -5727,7 +5727,7 @@ Test and Verification: level: 3 references: samm2: - - V-RT-3-A + - V-RT-A-3 iso27001-2017: - 14.2.3 - 14.2.8 @@ -5770,7 +5770,7 @@ Test and Verification: url: https://karma-runner.github.io references: samm2: - - V-RT-3-A + - V-RT-A-3 iso27001-2017: - 14.2.3 - 14.2.8 @@ -5803,7 +5803,7 @@ Test and Verification: - Defined deployment process references: samm2: - - V-RT-3-A + - V-RT-A-3 iso27001-2017: - 14.2.3 - 14.2.8 @@ -5857,7 +5857,7 @@ Test and Verification: - vulnerability management system references: samm2: - - I-DM-3-A + - I-DM-A-3 iso27001-2017: - 16.1.4 - 8.2.1 @@ -5930,9 +5930,9 @@ Test and Verification: - inventory references: samm2: - - I-DM-2-A - - I-DM-2-B - - I-SB-3-B + - I-DM-A-2 + - I-DM-B-2 + - I-SB-B-3 iso27001-2017: - 16.1.4 - 16.1.6 @@ -5972,7 +5972,7 @@ Test and Verification: implementation: ~ references: samm2: - - I-DM-3-A + - I-DM-A-3 iso27001-2017: - 16.1.4 - 8.2.1 @@ -6018,9 +6018,9 @@ Test and Verification: implementation: ~ references: samm2: - - I-DM-2-B - - I-DM-3-A - - I-SB-3-B + - I-DM-B-2 + - I-DM-A-3 + - I-SB-B-3 iso27001-2017: - 16.1.3 - 16.1.4 @@ -6106,7 +6106,7 @@ Test and Verification: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2022: - 5.25 - 5.12 @@ -6149,7 +6149,7 @@ Test and Verification: url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.4 @@ -6185,7 +6185,7 @@ Test and Verification: implementation: [] references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 8.2.1 @@ -6245,7 +6245,7 @@ Test and Verification: The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. references: samm2: - - I-DM-1-A + - I-DM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.6 @@ -6313,7 +6313,7 @@ Test and Verification: The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 8.2.1 @@ -6346,7 +6346,7 @@ Test and Verification: implementation: [] references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 12.6.1 @@ -6418,7 +6418,7 @@ Test and Verification: This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2022: - 5.25 - 5.12 @@ -6448,7 +6448,7 @@ Test and Verification: comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 12.6.1 @@ -6478,7 +6478,7 @@ Test and Verification: comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - - I-DM-2-A + - I-DM-A-2 iso27001-2017: - 16.1.4 - 12.6.1 @@ -6542,7 +6542,7 @@ Test and Verification: The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. references: samm2: - - I-DM-3-A + - I-DM-A-3 iso27001-2017: - 12.6.1 - 16.1.3 @@ -6589,7 +6589,7 @@ Test and Verification: Code coverage measurement for Python references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - part of periodic review, PDCA @@ -6622,7 +6622,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 14.2.3 - 14.2.8 @@ -6685,7 +6685,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -6717,7 +6717,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-RT-1-B + - V-RT-B-1 iso27001-2017: - not explicitly covered by ISO 27001 - too specific iso27001-2022: @@ -6763,7 +6763,7 @@ Test and Verification: - Usage of different roles references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 14.2.8 - 14.2.3 @@ -6794,7 +6794,7 @@ Test and Verification: - Simple Scan references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 14.2.3 - 14.2.8 @@ -6850,7 +6850,7 @@ Test and Verification: url: https://github.com/Arachni/arachni references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 14.2.3 - 14.2.8 @@ -6882,7 +6882,7 @@ Test and Verification: - Simple Scan references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - not explicitly covered by ISO 27001 - too specific - 14.2.3 @@ -6934,7 +6934,7 @@ Test and Verification: secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.5 @@ -6967,7 +6967,7 @@ Test and Verification: implementation: [] references: samm2: - - V-RT-1-AB + - V-RT-AB-1 iso27001-2017: - 12.1.3 - 14.2.3 @@ -7013,7 +7013,7 @@ Test and Verification: url: https://github.com/OWASP/Amass references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 13.1.3 - 14.2.3 @@ -7095,7 +7095,7 @@ Test and Verification: Hunt Unused Resources In Kubernetes. references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 13.1.3 - 14.2.3 @@ -7135,7 +7135,7 @@ Test and Verification: - Isolated networks for virtual environments references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 13.1.3 - 14.2.3 @@ -7226,7 +7226,7 @@ Test and Verification: url: https://www.htc-cs.com/en/products/htc-hydra/ references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 9.4.3 iso27001-2022: @@ -7278,7 +7278,7 @@ Test and Verification: on API best practices. references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 14.2.1 - 14.2.5 @@ -7316,7 +7316,7 @@ Test and Verification: - Defined build process references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 14.2.1 @@ -7353,7 +7353,7 @@ Test and Verification: - Defined build process references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 14.2.1 @@ -7402,8 +7402,8 @@ Test and Verification: exploited. references: samm2: - - V-ST-2-A - - I-SB-3-B + - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -7460,7 +7460,7 @@ Test and Verification: - pre-commit references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -7525,8 +7525,8 @@ Test and Verification: Dependabot creates pull requests to keep your dependencies secure and up-to-date. references: samm2: - - V-ST-2-A - - I-SB-2-B + - V-ST-A-2 + - I-SB-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -7602,8 +7602,8 @@ Test and Verification: url: https://github.com/aquasecurity/trivy references: samm2: - - V-ST-2-A - - I-SB-2-B + - V-ST-A-2 + - I-SB-B-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -7634,8 +7634,8 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A - - I-SB-3-B + - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -7698,8 +7698,8 @@ Test and Verification: - Inventory of production components references: samm2: - - V-ST-2-A - - I-SB-3-B + - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -7766,7 +7766,7 @@ Test and Verification: - Inventory of production components references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -7828,8 +7828,8 @@ Test and Verification: - Inventory of production components references: samm2: - - V-ST-2-A - - I-SB-3-B + - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -7881,7 +7881,7 @@ Test and Verification: Lint code bases to catch common errors and enforce code style references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.1 @@ -7922,7 +7922,7 @@ Test and Verification: - Defined build process references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 14.2.1 @@ -7975,7 +7975,7 @@ Test and Verification: - Automated PRs for patches references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 14.2.1 @@ -8022,7 +8022,7 @@ Test and Verification: - Defined build process references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 14.2.1 @@ -8063,7 +8063,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-3-A + - V-ST-A-3 iso27001-2017: - 12.6.1 - 14.2.1 @@ -8114,7 +8114,7 @@ Test and Verification: url: https://github.com/future-architect/vuls references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 12.6.1 - 14.2.1 @@ -8170,7 +8170,7 @@ Test and Verification: - inventory references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 iso27001-2022: @@ -8204,7 +8204,7 @@ Test and Verification: url: https://kubesec.io references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - System hardening is not explicitly covered by ISO 27001 - too specific - 12.6.1 @@ -8252,7 +8252,7 @@ Test and Verification: in production environments. references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 12.6.1 - 14.2.5 @@ -8298,7 +8298,7 @@ Test and Verification: in production environments. references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.2.1 iso27001-2022: @@ -8326,7 +8326,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.5 @@ -8367,7 +8367,7 @@ Test and Verification: url: https://github.com/nccgroup/go-pillage-registries references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - vcs usage is not explicitly covered by ISO 27001 - too specific - 9.4.3 @@ -8408,7 +8408,7 @@ Test and Verification: url: https://github.com/nccgroup/go-pillage-registries references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - vcs usage is not explicitly covered by ISO 27001 - too specific - 9.4.3 @@ -8462,7 +8462,7 @@ Test and Verification: url: https://github.com/future-architect/vuls references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 12.6.1 - 14.2.1 @@ -8510,7 +8510,7 @@ Test and Verification: in production environments. references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - ISO 27001:2017 mapping is missing iso27001-2022: @@ -8544,7 +8544,7 @@ Test and Verification: url: https://github.com/aquasecurity/kube-bench references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - System hardening is not explicitly covered by ISO 27001 - too specific - 12.6.1 @@ -8599,7 +8599,7 @@ Test and Verification: looks for common traps, mistakes and helps enforce best practices. references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - System hardening, virtual environments are not explicitly covered by ISO 27001 - too specific @@ -8640,7 +8640,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 14.2.2 - 14.2.3 @@ -8678,7 +8678,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.1 @@ -8710,7 +8710,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-1-A + - V-ST-A-1 iso27001-2017: - 12.6.1 - 14.2.1 @@ -8743,7 +8743,7 @@ Test and Verification: implementation: [] references: samm2: - - V-ST-2-A + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.1 @@ -8776,8 +8776,8 @@ Test and Verification: implementation: [] references: samm2: - - I-SB-3-A - - V-ST-3-A + - I-SB-A-3 + - V-ST-A-3 iso27001-2017: - 14.2.3 - 14.2.8 From 8cd0cf9e25b56f14caea31b97da9743237577195 Mon Sep 17 00:00:00 2001 From: "EMEAAD\\vbakke" Date: Sun, 21 Sep 2025 22:33:49 +0200 Subject: [PATCH 098/370] Review Build & Deployment, level 1 --- .../default/BuildAndDeployment/Build.yaml | 37 ++++++++++-------- .../BuildAndDeployment/Deployment.yaml | 22 +++++++++-- .../BuildAndDeployment/PatchManagement.yaml | 39 ++++++++++++------- src/assets/YAML/default/implementations.yaml | 2 +- 4 files changed, 66 insertions(+), 34 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 69d18a7..9b05949 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -28,7 +28,7 @@ Build and Deployment: level: 2 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technologi + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology references: samm2: - I-SB-2-A @@ -42,37 +42,42 @@ Build and Deployment: Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b description: | - A *build process* include more than just compiling your source code. - It also includes steps such as managing (third party) dependencies, - environment configuration, running the unit tests, etc. - - A *defined build process* has automated these steps to ensure consistency. + A *build process* includes more than just compiling your source code. It also covers: + - Managing (third party) dependencies + - Environment configuration + - Running unit and integration tests + - Security scanning and compliance checks + - Artifact creation and storage + - Deployment preparation - This can be done with a Jenkinsfile, Maven, or similar tools. + A *defined build process* automates these steps to ensure consistency, reproducibility, and security. Automation reduces human error and enforces security controls. Use tools such as Jenkins, GitHub Actions, GitLab CI, or Maven to codify the process. risk: - Performing builds without a defined process is error prone; for example, - as a result of incorrect security related configuration. + Performing builds without a defined and automated process is error-prone and increases the risk of security misconfigurations, unauthorized changes, and supply chain attacks. measure: - A well defined build process lowers the possibility of errors during - the build process. + A well-defined, automated, and auditable build process lowers the possibility of errors and unauthorized changes during the build process. It also enables traceability and rapid response to incidents. + level: 1 difficultyOfImplementation: knowledge: 2 time: 3 resources: 2 usefulness: 4 - level: 1 assessment: | - - Show your build pipeline and an exemplary job (build + test). - - Show that every team member has access. - - Show that failed jobs are fixed. + - Show your build pipeline configuration (e.g., Jenkinsfile, GitHub Actions workflow) and an exemplary job (build + test + security scan). + - Demonstrate that every team member has appropriate access (least privilege). + - Show that failed jobs are investigated and fixed promptly. + - Provide audit logs or evidence of build runs and changes. + - Document how security controls are enforced in the build process. Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technologi + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology references: samm2: - I-SB-1-A + nist-csf: + - PR.IP-1 + - PR.DS-1 iso27001-2017: - 12.1.1 - 14.2.2 diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 52d4f73..6332019 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -69,19 +69,21 @@ Build and Deployment: comments: "" Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a + description: | + A defined deployment process is a documented and automated set of steps for releasing software into production. It ensures that deployments are consistent, secure, and auditable, reducing the risk of errors and unauthorized changes. This process should include validation, approval, and rollback mechanisms. risk: >- - Deployment of insecure or malfunctioning artifacts. + Deployment based human routines are error prone, and of insecure or malfunctioning artifacts. measure: >- Defining a deployment process ensures that there are established criteria in terms of functionalities, security, compliance, and performance, and that the artifacts meet them. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 usefulness: 4 - level: 1 dependsOn: - uuid:f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process implementation: @@ -96,6 +98,12 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + assessment: | + - Deployment process is documented and available to relevant staff + - All deployment steps are automated and version-controlled + - Approvals and access controls are enforced for production deployments + - Rollback procedures are defined and tested + - Deployment logs and evidence are retained for audit purposes isImplemented: false evidence: "" comments: "" @@ -211,6 +219,8 @@ Build and Deployment: - sbom Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + description: | + An inventory of production components is a complete, up-to-date list of all applications and services running in production. This enables effective vulnerability management, incident response, and compliance. Without it, organizations risk running unmaintained or unauthorized software. risk: |- An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it. measure: |- @@ -218,12 +228,12 @@ Build and Deployment: In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. dependsOn: - Defined deployment process + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 4 - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack @@ -237,6 +247,12 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + assessment: | + - Inventory of all production components exists and is regularly updated + - Inventory includes key metadata (e.g., version, owner, deployment date) + - Inventory is accessible to security and operations teams + - There is a process for adding, updating, and removing components + - Inventory reviews are performed and documented tags: - inventory Inventory of production artifacts: diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index 7264c31..39e35bd 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -4,16 +4,23 @@ Build and Deployment: Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d - risk: Vulnerabilities in running artifacts stay for long and might get exploited. + description: | + A patch policy defines how and when software components, images, and dependencies are updated. A patch policy ensures that all these artifacts are regularly reviewed and updated, reducing the window of exposure to known threats. The policy should specify the frequency, responsibilities, and documentation requirements for patching. + risk: Vulnerabilities in running artifacts may persist for a long time and might be exploited. measure: - A patch policy for all artifacts (e.g. in images) is defined. How often + Define a patch policy for all artifacts (e.g. in images) is defined. How often is an image rebuilt? + assessment: | + - Patch policy is documented and accessible to relevant staff. + - The policy defines patch frequency and responsible roles. + - Patch actions and exceptions are logged and reviewed. + - Evidence of regular patching and policy review is available. + level: 1 difficultyOfImplementation: knowledge: 3 time: 1 resources: 2 usefulness: 4 - level: 1 implementation: [] references: samm2: @@ -33,23 +40,27 @@ Build and Deployment: - patching Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 - risk: - Components with known (or unknown) vulnerabilities might stay for long and get exploited, - even when a patch is available. - measure: - Fast patching of third party component is needed. The DevOps way is - to have an automated pull request for new components. This includes - + description: | + Automated PRs for patches ensure that updates for outdated or vulnerable dependencies are created and proposed without manual intervention. Tools continuously monitor for new versions or security advisories and immediately generate pull requests to update affected components in code, container images, or infrastructure. This process ensures that available patches are quickly visible to developers and can be reviewed and merged with minimal delay, reducing the risk window for known vulnerabilities. + risk: | + Components with known (or unknown) vulnerabilities might persist for a long time and be exploited, even when a patch is available. + measure: | + Fast patching of third-party components is needed. The DevOps way is to have an automated pull request for new components. This includes: * Applications - * Virtualized operating system components (e.g. container images) - * Operating Systems - * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform) + * Virtualized operating system components (e.g., container images) + * Operating systems + * Infrastructure as Code/GitOps (e.g., ArgoCD based on a git repository or Terraform) + assessment: | + - Automated PR tooling is enabled for all relevant repositories. + - PRs are created automatically for outdated or vulnerable dependencies. + - PRs are reviewed and merged in a timely manner. + - Evidence of automated PRs and patching activity is available. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 4 - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependabot - $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkins diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 533e3ee..cd94429 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -37,7 +37,7 @@ implementations: name: API Security Maturity Model for Authorization tags: [api] url: https://curity.io/resources/learn/the-api-security-maturity-model/ - container-technologi: + container-technology: uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 name: Container technologies and orchestration like Docker, Kubernetes tags: [] From e5258910d389e1426a42e0d7c209e85b116a4c71 Mon Sep 17 00:00:00 2001 From: "EMEAAD\\vbakke" Date: Sun, 21 Sep 2025 22:34:41 +0200 Subject: [PATCH 099/370] Review Culture & Organization, level 1 --- .../CultureAndOrganization/Design.yaml | 39 ++++++++++--------- .../EducationAndGuidance.yaml | 36 ++++++++++------- .../CultureAndOrganization/Process.yaml | 21 +++++----- 3 files changed, 51 insertions(+), 45 deletions(-) diff --git a/src/assets/YAML/default/CultureAndOrganization/Design.yaml b/src/assets/YAML/default/CultureAndOrganization/Design.yaml index 057c3bf..5e53f5f 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Design.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Design.yaml @@ -87,25 +87,6 @@ Culture and Organization: comments: "" Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e - risk: - Technical related threats are discovered too late in the development and - deployment process. - measure: - Threat modeling of technical features is performed during the product - sprint planning. - difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 - usefulness: 3 - level: 1 - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/whiteboard - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/miro-or-any-other-c - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/draw-io - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-modeling-play - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-samm - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-matrix-for-storage description: | # OWASP SAMM Description Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. @@ -149,6 +130,26 @@ Culture and Organization: GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. Source: OWASP Project Integration Project + risk: + Technical related threats are discovered too late in the development and deployment process. + measure: | + Perform threat modeling of technical features during product sprint planning using simple checklists and diagrams. Document identified threats and mitigations for new or changed functionality. + assessment: | + - Evidence of threat modeling activities exists for high-risk applications, including annotated diagrams and documented threats/mitigations. + - Activities are performed during sprint planning and involve relevant stakeholders. Outcomes are recorded and accessible for review. + level: 1 + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/whiteboard + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/miro-or-any-other-c + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/draw-io + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-modeling-play + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-samm + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-matrix-for-storage references: samm2: - D-TA-2-B diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index cccb6db..ac9a941 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -4,19 +4,23 @@ Culture and Organization: Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 - risk: - Understanding security is hard and personnel needs to be trained on it. - Otherwise, flaws like an SQL Injection might be introduced into the software - which might get exploited. - measure: - Provide security awareness training for all personnel involved in software - development Ad-Hoc. + description: | + Ad-hoc security training provides basic awareness of software security risks and best practices to developers and other personnel involved in software development. These trainings are delivered as needed, without a fixed schedule, to address immediate knowledge gaps or respond to emerging threats. + risk: | + Without any security training, personnel may lack awareness of common software vulnerabilities (such as SQL Injection and vulnerable dependencies), increasing the risk of introducing exploitable flaws into applications. + measure: | + Provide security awareness training for all personnel involved in software development on an ad-hoc basis, ensuring that relevant topics are covered when new risks or needs are identified. + assessment: | + - Conduct security training for developers and relevant personnel + - Participants can identify common software security risks addressed in the training + - Training materials are available + - Attendance records are available + level: 1 difficultyOfImplementation: knowledge: 2 time: 1 resources: 1 usefulness: 3 - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-juice-shop - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series @@ -407,18 +411,20 @@ Culture and Organization: comments: "" Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 - risk: - Not asking a security expert when questions regarding security appear - might lead to flaws. - measure: - Security consulting to teams is given on request. The security consultants - can be internal or external. + level: 1 + description: | + Security consulting on request allows teams to seek expert advice on security-related questions or challenges as they arise. This support can be provided by internal or external security consultants and helps address specific concerns during software development. + risk: | + If teams do not consult security experts when questions arise, security flaws may be introduced or remain undetected, increasing the risk of vulnerabilities in the software. + measure: | + Make security consulting available to teams on request, ensuring that expert advice is accessible when needed to address security concerns during development. + assessment: | + Records show that teams have access to security consulting services and have used them when needed. Documentation of consultations and resulting actions is available for review. difficultyOfImplementation: knowledge: 3 time: 1 resources: 1 usefulness: 3 - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-cheatsheet-series references: diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index ce8292b..2f768df 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -58,24 +58,23 @@ Culture and Organization: comments: "" Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 - description: - A _Business Continuity and Disaster Recovery_ (BCDR) is a plan and a process - that helps a business to return to normal operations if a disaster occurs. - risk: + description: | + Business Continuity and Disaster Recovery (BCDR) is a plan and a process that enable an organization to quickly restore normal operations after a disruptive event, such as a cyberattack or natural disaster. + risk: | If the disaster recovery actions are not clear, you risk slow reaction and remediation delays. This applies to cyber attacks as well as natural emergencies, such as a power outage. - measure: - By understanding and documenting a business continuity and disaster - recovery (BCDR) plan, the overall availability of systems and applications - is increased. Success factors like responsibilities, Service Level Agreements, - Recovery Point Objectives, Recovery Time Objectives or Failover must be fully - documented and understood by the people involved in the recovery. + measure: | + Develop, document, and communicate a BCDR plan for all critical components. The plan must define roles and responsibilities, Service Level Agreements (SLAs), Recovery Point Objectives (RPOs), Recovery Time Objectives (RTOs), and failover procedures. Ensure all relevant personnel are trained and the plan is reviewed and updated regularly. + assessment: | + - The organization has a documented BCDR plan covering all critical components. + - The plan clearly defines responsibilities, SLAs, RPOs, RTOs, and failover steps. + - Relevant staff are aware of the plan, and evidence of regular review and testing is available. + level: 1 difficultyOfImplementation: knowledge: 4 time: 3 resources: 2 usefulness: 4 - level: 1 implementation: [] references: samm2: [] From 653ea74fe93c3db160672f5c1fc123082bafa2a0 Mon Sep 17 00:00:00 2001 From: "EMEAAD\\vbakke" Date: Sun, 21 Sep 2025 22:59:40 +0200 Subject: [PATCH 100/370] Review Information gathering, level 1 --- .../default/InformationGathering/Logging.yaml | 17 ++++--- .../InformationGathering/Monitoring.yaml | 50 +++++++++++-------- 2 files changed, 38 insertions(+), 29 deletions(-) diff --git a/src/assets/YAML/default/InformationGathering/Logging.yaml b/src/assets/YAML/default/InformationGathering/Logging.yaml index 54ef2cf..ad1afe9 100755 --- a/src/assets/YAML/default/InformationGathering/Logging.yaml +++ b/src/assets/YAML/default/InformationGathering/Logging.yaml @@ -31,19 +31,20 @@ Information Gathering: - 8.15 Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 - risk: - Local stored system logs can be unauthorized manipulated by attackers - or might be corrupt after an incident. In addition, it is hard to perform - a aggregation of logs. - measure: - By using centralized logging logs are protected against unauthorized - modification. + description: | + Centralized system logging involves collecting and storing system logs from multiple sources in a secure, central location. This approach improves log integrity, simplifies monitoring, and enables efficient incident response. + risk: | + Locally stored system logs can be manipulated by attackers unauthorized or might be corrupt or lost after an incident. In addition, it is hard to perform aggregation of logs. + measure: | + - Implement a centralized logging solution for all critical systems. + - System logs must be securely transmitted and stored in a central repository, protected from unauthorized access and modification. + - Ensure that log collection is automated and covers all relevant system events. + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 2 - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/rsyslog - $ref: src/assets/YAML/default/implementations.yaml#/implementations/logstash diff --git a/src/assets/YAML/default/InformationGathering/Monitoring.yaml b/src/assets/YAML/default/InformationGathering/Monitoring.yaml index f326543..c4f7571 100755 --- a/src/assets/YAML/default/InformationGathering/Monitoring.yaml +++ b/src/assets/YAML/default/InformationGathering/Monitoring.yaml @@ -295,8 +295,11 @@ Information Gathering: comments: "" Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 - risk: Attacks on an application are not recognized. - measure: |- + description: | + Collecting basic operational data from applications, such as authentication attempts, transaction volumes, and resource usage, will help detect abnormal patterns that may indicate security incidents or system issues. + risk: | + Without monitoring application metrics, attacks or abnormal behaviors may go undetected, increasing the risk of successful exploitation, data breaches, and delayed incident response. + measure: | Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: - Authentication attempts (successful/failed logins) - Transaction volumes and patterns (e.g. orders, payments) @@ -307,14 +310,16 @@ Information Gathering: Example: An e-commerce application normally processes 100 orders per hour. A sudden spike to 1000 orders per hour could indicate either: - A legitimate event (unannounced marketing campaign, viral social media post) - A security incident (automated bulk purchase bots, credential stuffing attack) - + By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. + assessment: | + - Basic application metrics are collected and reviewed. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 5 - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/prometheus references: @@ -327,18 +332,21 @@ Information Gathering: comments: "" Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 - risk: - Not getting notified about reaching the end of the budget (e.g. due to - a denial of service) creates unexpected costs. - measure: - Cloud providers often provide insight into budgets. A threshold and - alarming for the budget is set. + description: | + Monitoring resource usage and costs to prevent unexpected expenses. This is especially important in cloud environments where resource consumption can quickly exceed planned budgets. + risk: | + Failure to monitor budget metrics can result in unexpected costs, financial loss, and potential service disruption due to resource exhaustion or denial-of-service attacks. + measure: | + Set up budget monitoring and alerting for all critical resources. Use provider tools to track spending and configure alerts when thresholds are reached. Implement hard limits where possible to prevent budget overruns. + assessment: | + - The organization regularly monitors budget metrics + - Alerting outside given thresholds are implemented + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 5 - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/collected references: @@ -353,21 +361,21 @@ Information Gathering: comments: "" Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 - risk: - Without simple metrics analysis of incidents are hard. In case an application - uses a lot of CPU from time to time, it is hard for a developer to find out - the source with Linux commands. - measure: - Gathering of system metrics helps to identify incidents and specially - bottlenecks like in CPU usage, memory usage and hard disk usage. + description: | + Monitoring basic system performance data, such as CPU, memory, and disk usage, will help identify performance bottlenecks and potential security incidents. + risk: | + Without monitoring system metrics, it is difficult to detect incidents or performance issues, leading to delayed response, reduced availability, and increased risk of undetected attacks. + measure: | + Collect and monitor key system metrics, including CPU, memory, and disk usage. Set up alerts for abnormal resource consumption or patterns that may indicate incidents or attacks. + assessment: | + - Basic system metrics are monitored and reviewed regularly + - Alerting outside given thresholds are implemented + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 5 - assessment: | - Are system metrics gathered? - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/collected references: From 9dd70c34ad4f8f93a0a39b0bf07cdd5a6e419175 Mon Sep 17 00:00:00 2001 From: "EMEAAD\\vbakke" Date: Sun, 21 Sep 2025 23:50:21 +0200 Subject: [PATCH 101/370] Review Test & Verification, level 1 --- .../TestAndVerification/Consolidation.yaml | 42 +++++++++++++------ src/assets/YAML/default/implementations.yaml | 5 +++ 2 files changed, 35 insertions(+), 12 deletions(-) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 9015366..9b1c2c9 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -139,10 +139,17 @@ Test and Verification: comments: "" Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 - risk: - As false positive occur during each test, all vulnerabilities might be - ignored. Specially, if tests are automated an run daily. - measure: |- + description: | + Security tests may produce false positives—findings that are incorrectly identified as vulnerabilities. + + It is important distinguish these from true vulnerabilities to avoid wasting time and resources on non-issues. + + False positive treatment ensures that findings from security tests are triaged and documented, allowing teams to distinguish between real vulnerabilities and false positives. This reduces unnecessary work and helps maintain focus on true risks. + + Some positive findings might be considered an accepted risk by the organization. This must also be documented. + risk: | + If false positives are not managed, teams may ignore all findings, leading to real vulnerabilities being overlooked and increasing the risk of exploitation. Specially, if tests are automated an run daily. + measure: | Findings from security tests must be triaged and outcomes persisted/documented to: - Prevent re-analysis of known issues in subsequent test runs - Track accepted risks vs false positives @@ -154,12 +161,14 @@ Test and Verification: - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) + assessment: | + The organization has a process for triaging and documenting false positives and accepted risks + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 4 - level: 1 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify @@ -274,17 +283,23 @@ Test and Verification: comments: "" Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 - risk: Vulnerabilities with severity high or higher are not visible. - measure: - Vulnerabilities with severity high or higher are added to the quality - gate. + description: | + All security problems that are rated as "high" or "critical" must be fixed before the software can be released or used in production. This means that if a serious vulnerability is found, it cannot be ignored or postponed. + risk: | + If serious security problems are not fixed, attackers could exploit them to steal data, disrupt services, or cause other harm. Ignoring these issues puts the organization, its customers, and its reputation at risk. + measure: | + - Make it a rule that all high or critical security findings must be fixed before the software is approved for release or use. + - Track these issues and make sure they are resolved quickly. + - Pay extra attention to Known Exploited Vulnerabilities (KEV) from CISA and EPSS scores when prioritizing fixes. + assessment: | + There is clear evidence that all high or critical security issues are tracked and fixed before release. No high or critical issues remain open in production systems. + comments: False positive analysis, specially for static analysis, is time consuming. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 usefulness: 4 - level: 1 - comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - I-DM-2-B @@ -294,7 +309,10 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 - implementation: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cisa-kev + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/grype tags: ["vuln-action", "defect-management"] evidence: "" Treatment of defects with severity middle: diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index cd94429..1ebd07c 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -710,6 +710,11 @@ implementations: name: https://github.com/aquasecurity/trivy tags: [] url: https://github.com/aquasecurity/trivy + grype: + uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: Grype + tags: [sbom, dependency, vulnerability] + url: https://github.com/anchore/grype registries-like-quay: uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 name: Registries like quay From 5eb5aad521f45c1ae1687cafbb28ed41f8ecd325 Mon Sep 17 00:00:00 2001 From: "EMEAAD\\vbakke" Date: Sun, 21 Sep 2025 23:51:22 +0200 Subject: [PATCH 102/370] SBOM references to Trivy and Syft --- src/assets/YAML/default/BuildAndDeployment/Build.yaml | 4 +++- src/assets/YAML/default/implementations.yaml | 7 ++++++- 2 files changed, 9 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 9b05949..67add83 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -147,7 +147,9 @@ Build and Deployment: resources: 3 usefulness: 3 level: 2 - implementation: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/syft references: samm2: - I-SB-1-A diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 1ebd07c..b0f0659 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -707,9 +707,14 @@ implementations: url: https://github.com/nccgroup/go-pillage-registries trivy: uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy + name: Trivy tags: [] url: https://github.com/aquasecurity/trivy + syft: + uuid: 7543a6f2-3850-47a9-bb2f-0987e2af6f6a + name: Syft + tags: [sbom, dependency] + url: https://github.com/anchore/syft grype: uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b name: Grype From 65d1dcb658ec025a56a198f38688c0a9f9a59849 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 22 Sep 2025 07:55:05 +0200 Subject: [PATCH 103/370] Fixed syntax problem --- .../YAML/default/TestAndVerification/Consolidation.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 9b1c2c9..267fa40 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -207,7 +207,7 @@ Test and Verification: usefulness: 3 level: 2 dependsOn: - - uuid: c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment + - uuid:c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify @@ -363,8 +363,8 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment - - uuid: 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system + - uuid:8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment + - uuid:85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system implementation: references: samm2: From b20e6711d1a06a438e43ca7cd4241278923195d2 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 22 Sep 2025 07:55:31 +0200 Subject: [PATCH 104/370] Added new generated.yaml --- src/assets/YAML/generated/generated.yaml | 699 +++++++++++++++++------ 1 file changed, 510 insertions(+), 189 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 22a495d..4ebdca3 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -52,25 +52,34 @@ Build and Deployment: C: false Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b - description: "A *build process* include more than just compiling your source - code. \nIt also includes steps such as managing (third party) dependencies, - \nenvironment configuration, running the unit tests, etc. \n\nA *defined build - process* has automated these steps to ensure consistency.\n\nThis can be done - with a Jenkinsfile, Maven, or similar tools.\n" - risk: Performing builds without a defined process is error prone; for example, - as a result of incorrect security related configuration. - measure: A well defined build process lowers the possibility of errors during - the build process. + description: | + A *build process* includes more than just compiling your source code. It also covers: + - Managing (third party) dependencies + - Environment configuration + - Running unit and integration tests + - Security scanning and compliance checks + - Artifact creation and storage + - Deployment preparation + + A *defined build process* automates these steps to ensure consistency, reproducibility, and security. Automation reduces human error and enforces security controls. Use tools such as Jenkins, GitHub Actions, GitLab CI, or Maven to codify the process. + risk: Performing builds without a defined and automated process is error-prone + and increases the risk of security misconfigurations, unauthorized changes, + and supply chain attacks. + measure: A well-defined, automated, and auditable build process lowers the possibility + of errors and unauthorized changes during the build process. It also enables + traceability and rapid response to incidents. + level: 1 difficultyOfImplementation: knowledge: 2 time: 3 resources: 2 usefulness: 4 - level: 1 assessment: | - - Show your build pipeline and an exemplary job (build + test). - - Show that every team member has access. - - Show that failed jobs are fixed. + - Show your build pipeline configuration (e.g., Jenkinsfile, GitHub Actions workflow) and an exemplary job (build + test + security scan). + - Demonstrate that every team member has appropriate access (least privilege). + - Show that failed jobs are investigated and fixed promptly. + - Provide audit logs or evidence of build runs and changes. + - Document how security controls are enforced in the build process. Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) implementation: @@ -87,6 +96,9 @@ Build and Deployment: references: samm2: - I-SB-1-A + nist-csf: + - PR.IP-1 + - PR.DS-1 iso27001-2017: - 12.1.1 - 14.2.2 @@ -180,9 +192,20 @@ Build and Deployment: resources: 3 usefulness: 3 level: 2 - implementation: [] + implementation: + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: Trivy + tags: [] + url: https://github.com/aquasecurity/trivy + - uuid: 7543a6f2-3850-47a9-bb2f-0987e2af6f6a + name: Syft + tags: + - sbom + - dependency + url: https://github.com/anchore/syft references: - samm2: [] + samm2: + - I-SB-1-A iso27001-2017: - 8.1 - 8.2 @@ -316,7 +339,7 @@ Build and Deployment: - Smoke Test references: samm2: - - TODO + - I-SD-2-A iso27001-2017: - 17.2.1 - 12.1.1 @@ -377,18 +400,21 @@ Build and Deployment: C: false Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a - risk: Deployment of insecure or malfunctioning artifacts. + description: | + A defined deployment process is a documented and automated set of steps for releasing software into production. It ensures that deployments are consistent, secure, and auditable, reducing the risk of errors and unauthorized changes. This process should include validation, approval, and rollback mechanisms. + risk: Deployment based human routines are error prone, and of insecure or malfunctioning + artifacts. measure: Defining a deployment process ensures that there are established criteria in terms of functionalities, security, compliance, and performance, and that the artifacts meet them. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 usefulness: 4 - level: 1 dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b implementation: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 name: CI/CD tools @@ -411,6 +437,12 @@ Build and Deployment: - 8.32 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a + assessment: | + - Deployment process is documented and available to relevant staff + - All deployment steps are automated and version-controlled + - Approvals and access controls are enforced for production deployments + - Rollback procedures are defined and tested + - Deployment logs and evidence are retained for audit purposes comments: "" tags: - none @@ -564,7 +596,7 @@ Build and Deployment: exists (gathered manually or automatically). dependsOn: - Defined deployment process - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f difficultyOfImplementation: knowledge: 2 time: 2 @@ -604,7 +636,7 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -621,6 +653,8 @@ Build and Deployment: C: false Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + description: | + An inventory of production components is a complete, up-to-date list of all applications and services running in production. This enables effective vulnerability management, incident response, and compliance. Without it, organizations risk running unmaintained or unauthorized software. risk: An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it. measure: |- @@ -628,12 +662,12 @@ Build and Deployment: In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. dependsOn: - Defined deployment process + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 4 - level: 1 implementation: - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca name: Backstage @@ -667,7 +701,7 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -676,6 +710,12 @@ Build and Deployment: - 5.12 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/2a44b708-734f-4463-b0cb-86dc46344b2f + assessment: | + - Inventory of all production components exists and is regularly updated + - Inventory includes key metadata (e.g., version, owner, deployment date) + - Inventory is accessible to security and operations teams + - There is a process for adding, updating, and removing components + - Inventory reviews are performed and documented tags: - inventory teamsImplemented: @@ -690,7 +730,7 @@ Build and Deployment: measure: A documented inventory of dependencies used in artifacts like container images and containers exists. dependsOn: - - Inventory of production artifacts + - 83057028-0b77-4d2e-8135-40969768ae88 - SBOM of components difficultyOfImplementation: knowledge: 2 @@ -731,7 +771,9 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-3-B + - I-SB-2-B + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -860,7 +902,8 @@ Build and Deployment: dependsOn: - Same artifact for environments references: - samm2: [] + samm2: + - I-SD-2-A iso27001-2017: - 14.3.1 - 14.2.8 @@ -884,15 +927,23 @@ Build and Deployment: Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d - risk: Vulnerabilities in running artifacts stay for long and might get exploited. - measure: A patch policy for all artifacts (e.g. in images) is defined. How often - is an image rebuilt? + description: | + A patch policy defines how and when software components, images, and dependencies are updated. A patch policy ensures that all these artifacts are regularly reviewed and updated, reducing the window of exposure to known threats. The policy should specify the frequency, responsibilities, and documentation requirements for patching. + risk: Vulnerabilities in running artifacts may persist for a long time and might + be exploited. + measure: Define a patch policy for all artifacts (e.g. in images) is defined. + How often is an image rebuilt? + assessment: | + - Patch policy is documented and accessible to relevant staff. + - The policy defines patch frequency and responsible roles. + - Patch actions and exceptions are logged and reviewed. + - Evidence of regular patching and policy review is available. + level: 1 difficultyOfImplementation: knowledge: 3 time: 1 resources: 2 usefulness: 4 - level: 1 implementation: [] references: samm2: @@ -917,17 +968,27 @@ Build and Deployment: C: false Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 - risk: Components with known (or unknown) vulnerabilities might stay for long - and get exploited, even when a patch is available. - measure: |- - Fast patching of third party component is needed. The DevOps way is to have an automated pull request for new components. This includes - * Applications * Virtualized operating system components (e.g. container images) * Operating Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform) + description: | + Automated PRs for patches ensure that updates for outdated or vulnerable dependencies are created and proposed without manual intervention. Tools continuously monitor for new versions or security advisories and immediately generate pull requests to update affected components in code, container images, or infrastructure. This process ensures that available patches are quickly visible to developers and can be reviewed and merged with minimal delay, reducing the risk window for known vulnerabilities. + risk: | + Components with known (or unknown) vulnerabilities might persist for a long time and be exploited, even when a patch is available. + measure: | + Fast patching of third-party components is needed. The DevOps way is to have an automated pull request for new components. This includes: + * Applications + * Virtualized operating system components (e.g., container images) + * Operating systems + * Infrastructure as Code/GitOps (e.g., ArgoCD based on a git repository or Terraform) + assessment: | + - Automated PR tooling is enabled for all relevant repositories. + - PRs are created automatically for outdated or vulnerable dependencies. + - PRs are reviewed and merged in a timely manner. + - Evidence of automated PRs and patching activity is available. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 4 - level: 1 implementation: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 name: dependabot @@ -1386,16 +1447,62 @@ Culture and Organization: C: false Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e + description: | + # OWASP SAMM Description + Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. + + Threat modeling is a team exercise, including product owners, architects, security champions, and security testers. At this maturity level, expose teams and stakeholders to threat modeling to increase security awareness and to create a shared vision on the security of the system. + + At maturity level 1, you perform threat modeling ad-hoc for high-risk applications and use simple threat checklists, such as STRIDE. Avoid lengthy workshops and overly detailed lists of low-relevant threats. Perform threat modeling iteratively to align to more iterative development paradigms. If you add new functionality to an existing application, look only into the newly added functions instead of trying to cover the entire scope. A good starting point is the existing diagrams that you annotate during discussion workshops. Always make sure to persist the outcome of a threat modeling discussion for later use. + + Your most important tool to start threat modeling is a whiteboard, smartboard, or a piece of paper. Aim for security awareness, a simple process, and actionable outcomes that you agree upon with your team. Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. + + Source: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + # OWASP Project Integration Description + There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. + + A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). + + OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). + + There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. + + > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ + + ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") + + Last, if the organizations maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. + + ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") + + This practice has the side effect that it trains non-security specialists to think like attackers. + + The outcomes of this stage should help lay the foundation of secure design and considerations. + + **Example Low Maturity Scenario:** + + Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. + + Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. + + Frontend serves data over GraphQL as a thin layer between caching system and end user. + + GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. + + Source: OWASP Project Integration Project risk: Technical related threats are discovered too late in the development and deployment process. - measure: Threat modeling of technical features is performed during the product - sprint planning. + measure: | + Perform threat modeling of technical features during product sprint planning using simple checklists and diagrams. Document identified threats and mitigations for new or changed functionality. + assessment: | + - Evidence of threat modeling activities exists for high-risk applications, including annotated diagrams and documented threats/mitigations. + - Activities are performed during sprint planning and involve relevant stakeholders. Outcomes are recorded and accessible for review. + level: 1 difficultyOfImplementation: knowledge: 2 time: 3 resources: 1 usefulness: 3 - level: 1 implementation: - uuid: c0533602-11b7-4838-93cc-a40556398163 name: Whiteboard @@ -1443,49 +1550,6 @@ Culture and Organization: - storage - cluster - kubernetes - description: | - # OWASP SAMM Description - Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. - - Threat modeling is a team exercise, including product owners, architects, security champions, and security testers. At this maturity level, expose teams and stakeholders to threat modeling to increase security awareness and to create a shared vision on the security of the system. - - At maturity level 1, you perform threat modeling ad-hoc for high-risk applications and use simple threat checklists, such as STRIDE. Avoid lengthy workshops and overly detailed lists of low-relevant threats. Perform threat modeling iteratively to align to more iterative development paradigms. If you add new functionality to an existing application, look only into the newly added functions instead of trying to cover the entire scope. A good starting point is the existing diagrams that you annotate during discussion workshops. Always make sure to persist the outcome of a threat modeling discussion for later use. - - Your most important tool to start threat modeling is a whiteboard, smartboard, or a piece of paper. Aim for security awareness, a simple process, and actionable outcomes that you agree upon with your team. Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. - - Source: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - # OWASP Project Integration Description - There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. - - A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). - - OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). - - There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. - - > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ - - ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") - - Last, if the organizations maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. - - ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") - - This practice has the side effect that it trains non-security specialists to think like attackers. - - The outcomes of this stage should help lay the foundation of secure design and considerations. - - **Example Low Maturity Scenario:** - - Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. - - Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. - - Frontend serves data over GraphQL as a thin layer between caching system and end user. - - GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. - - Source: OWASP Project Integration Project references: samm2: - D-TA-2-B @@ -1668,7 +1732,8 @@ Culture and Organization: level: 2 implementation: [] references: - samm2: [] + samm2: + - G-PS-2 iso27001-2017: - 5.1.1 - 7.2.1 @@ -1687,17 +1752,23 @@ Culture and Organization: Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 - risk: Understanding security is hard and personnel needs to be trained on it. - Otherwise, flaws like an SQL Injection might be introduced into the software - which might get exploited. - measure: Provide security awareness training for all personnel involved in software - development Ad-Hoc. + description: | + Ad-hoc security training provides basic awareness of software security risks and best practices to developers and other personnel involved in software development. These trainings are delivered as needed, without a fixed schedule, to address immediate knowledge gaps or respond to emerging threats. + risk: | + Without any security training, personnel may lack awareness of common software vulnerabilities (such as SQL Injection and vulnerable dependencies), increasing the risk of introducing exploitable flaws into applications. + measure: | + Provide security awareness training for all personnel involved in software development on an ad-hoc basis, ensuring that relevant topics are covered when new risks or needs are identified. + assessment: | + - Conduct security training for developers and relevant personnel + - Participants can identify common software security risks addressed in the training + - Training materials are available + - Attendance records are available + level: 1 difficultyOfImplementation: knowledge: 2 time: 1 resources: 1 usefulness: 3 - level: 1 implementation: - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a name: OWASP Juice Shop @@ -1709,6 +1780,7 @@ Culture and Organization: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: @@ -2001,16 +2073,17 @@ Culture and Organization: [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) implementation: - - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: @@ -2042,15 +2115,15 @@ Culture and Organization: usefulness: 4 level: 4 implementation: - - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series tags: - training - secure coding @@ -2089,6 +2162,7 @@ Culture and Organization: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ dependsOn: @@ -2252,20 +2326,25 @@ Culture and Organization: C: false Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 - risk: Not asking a security expert when questions regarding security appear - might lead to flaws. - measure: Security consulting to teams is given on request. The security consultants - can be internal or external. + level: 1 + description: | + Security consulting on request allows teams to seek expert advice on security-related questions or challenges as they arise. This support can be provided by internal or external security consultants and helps address specific concerns during software development. + risk: | + If teams do not consult security experts when questions arise, security flaws may be introduced or remain undetected, increasing the risk of vulnerabilities in the software. + measure: | + Make security consulting available to teams on request, ensuring that expert advice is accessible when needed to address security concerns during development. + assessment: | + Records show that teams have access to security consulting services and have used them when needed. Documentation of consultations and resulting actions is available for review. difficultyOfImplementation: knowledge: 3 time: 1 resources: 1 usefulness: 3 - level: 1 implementation: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: @@ -2444,23 +2523,23 @@ Culture and Organization: C: false Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 - description: A _Business Continuity and Disaster Recovery_ (BCDR) is a plan - and a process that helps a business to return to normal operations if a disaster - occurs. - risk: If the disaster recovery actions are not clear, you risk slow reaction - and remediation delays. This applies to cyber attacks as well as natural emergencies, - such as a power outage. - measure: By understanding and documenting a business continuity and disaster - recovery (BCDR) plan, the overall availability of systems and applications - is increased. Success factors like responsibilities, Service Level Agreements, - Recovery Point Objectives, Recovery Time Objectives or Failover must be fully - documented and understood by the people involved in the recovery. + description: | + Business Continuity and Disaster Recovery (BCDR) is a plan and a process that enable an organization to quickly restore normal operations after a disruptive event, such as a cyberattack or natural disaster. + risk: | + If the disaster recovery actions are not clear, you risk slow reaction and remediation delays. + This applies to cyber attacks as well as natural emergencies, such as a power outage. + measure: | + Develop, document, and communicate a BCDR plan for all critical components. The plan must define roles and responsibilities, Service Level Agreements (SLAs), Recovery Point Objectives (RPOs), Recovery Time Objectives (RTOs), and failover procedures. Ensure all relevant personnel are trained and the plan is reviewed and updated regularly. + assessment: "- The organization has a documented BCDR plan covering all critical + components.\n- The plan clearly defines responsibilities, SLAs, RPOs, RTOs, + and failover steps. \n- Relevant staff are aware of the plan, and evidence + of regular review and testing is available.\n" + level: 1 difficultyOfImplementation: knowledge: 4 time: 3 resources: 2 usefulness: 4 - level: 1 implementation: [] references: samm2: [] @@ -2492,7 +2571,7 @@ Culture and Organization: usefulness: 3 level: 2 dependsOn: - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -3100,7 +3179,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -3146,7 +3225,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -3288,7 +3367,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -3472,7 +3551,7 @@ Implementation: name: Attack Matrix Containers tags: - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ + url: https://attack.mitre.org/matrices/enterprise/containers/ description: Attack matrix for containers - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 name: Attack Matrix Kubernetes @@ -3583,7 +3662,7 @@ Implementation: name: Attack Matrix Containers tags: - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ + url: https://attack.mitre.org/matrices/enterprise/containers/ description: Attack matrix for containers - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 name: Attack Matrix Kubernetes @@ -4049,7 +4128,7 @@ Implementation: Default: false B: false C: false - Usage of a chaos monkey: + Usage of a chaos technology: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In case of a crash it might happen that a planned redundant system is unavailable. @@ -4062,7 +4141,18 @@ Implementation: resources: 5 usefulness: 3 level: 4 - implementation: [] + implementation: + - uuid: c117e79b-8223-4e55-9da5-efbf5d741c15 + name: Chaos Monkey + tags: + - chaos + - testing + url: https://github.com/Netflix/chaosmonkey + description: Chaos Monkey is a resiliency tool that helps applications tolerate + random instance failures. Chaos Monkey randomly terminates virtual machine + instances and containers that run inside of your production environment. + Exposing engineers to failures more frequently incentivizes them to build + resilient services. references: samm2: - O-EM-1-A @@ -4476,17 +4566,20 @@ Information Gathering: C: false Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 - risk: Local stored system logs can be unauthorized manipulated by attackers - or might be corrupt after an incident. In addition, it is hard to perform - a aggregation of logs. - measure: By using centralized logging logs are protected against unauthorized - modification. + description: | + Centralized system logging involves collecting and storing system logs from multiple sources in a secure, central location. This approach improves log integrity, simplifies monitoring, and enables efficient incident response. + risk: | + Locally stored system logs can be manipulated by attackers unauthorized or might be corrupt or lost after an incident. In addition, it is hard to perform aggregation of logs. + measure: | + - Implement a centralized logging solution for all critical systems. + - System logs must be securely transmitted and stored in a central repository, protected from unauthorized access and modification. + - Ensure that log collection is automated and covers all relevant system events. + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 2 - level: 1 implementation: - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 name: rsyslog @@ -4790,7 +4883,8 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-A 3 + - O-IM-2-A + - I-DM-3-A iso27001-2017: - 16.1.2 - 16.1.4 @@ -5077,8 +5171,11 @@ Information Gathering: C: false Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 - risk: Attacks on an application are not recognized. - measure: |- + description: | + Collecting basic operational data from applications, such as authentication attempts, transaction volumes, and resource usage, will help detect abnormal patterns that may indicate security incidents or system issues. + risk: | + Without monitoring application metrics, attacks or abnormal behaviors may go undetected, increasing the risk of successful exploitation, data breaches, and delayed incident response. + measure: | Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: - Authentication attempts (successful/failed logins) - Transaction volumes and patterns (e.g. orders, payments) @@ -5091,12 +5188,14 @@ Information Gathering: - A security incident (automated bulk purchase bots, credential stuffing attack) By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. + assessment: | + - Basic application metrics are collected and reviewed. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 5 - level: 1 implementation: - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c name: Prometheus @@ -5120,16 +5219,21 @@ Information Gathering: C: false Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 - risk: Not getting notified about reaching the end of the budget (e.g. due to - a denial of service) creates unexpected costs. - measure: Cloud providers often provide insight into budgets. A threshold and - alarming for the budget is set. + description: | + Monitoring resource usage and costs to prevent unexpected expenses. This is especially important in cloud environments where resource consumption can quickly exceed planned budgets. + risk: | + Failure to monitor budget metrics can result in unexpected costs, financial loss, and potential service disruption due to resource exhaustion or denial-of-service attacks. + measure: | + Set up budget monitoring and alerting for all critical resources. Use provider tools to track spending and configure alerts when thresholds are reached. Implement hard limits where possible to prevent budget overruns. + assessment: | + - The organization regularly monitors budget metrics + - Alerting outside given thresholds are implemented + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 5 - level: 1 implementation: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 name: collected @@ -5152,19 +5256,21 @@ Information Gathering: C: false Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 - risk: Without simple metrics analysis of incidents are hard. In case an application - uses a lot of CPU from time to time, it is hard for a developer to find out - the source with Linux commands. - measure: Gathering of system metrics helps to identify incidents and specially - bottlenecks like in CPU usage, memory usage and hard disk usage. + description: | + Monitoring basic system performance data, such as CPU, memory, and disk usage, will help identify performance bottlenecks and potential security incidents. + risk: | + Without monitoring system metrics, it is difficult to detect incidents or performance issues, leading to delayed response, reduced availability, and increased risk of undetected attacks. + measure: | + Collect and monitor key system metrics, including CPU, memory, and disk usage. Set up alerts for abnormal resource consumption or patterns that may indicate incidents or attacks. + assessment: | + - Basic system metrics are monitored and reviewed regularly + - Alerting outside given thresholds are implemented + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 5 - assessment: | - Are system metrics gathered? - level: 1 implementation: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 name: collected @@ -5202,7 +5308,8 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-A 3 + - O-IM-2-A + - I-DM-3-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 @@ -5299,6 +5406,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -5363,6 +5471,7 @@ Information Gathering: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.3 @@ -5403,6 +5512,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -5452,6 +5562,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -5488,7 +5599,7 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - Automated PRs for patches + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 implementation: [] references: samm2: @@ -5525,8 +5636,8 @@ Information Gathering: usefulness: 3 level: 4 dependsOn: - - Patching mean time to resolution via PR - - Automated PRs for patches + - 86d490b9-d798-4a5b-a011-ab9688014c46 + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 implementation: [] references: samm2: @@ -5597,6 +5708,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -5811,6 +5923,77 @@ Test and Verification: Default: false B: false C: false + Artifact-based false positive treatment: + uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + risk: Without artifact-specific false positive handling, teams must repeatedly + triage the same findings across different versions or deployments of the same + component, leading to inefficient use of security resources. + measure: "Implement false positive marking and temporary acceptance of findings + \nbased on specific artifacts (applications, components, or repositories).\nThis + allows teams to suppress findings for specific versions or builds\nwhile maintaining + visibility for future releases." + description: |- + Artifact-based false positive treatment enables more granular control + over finding suppression by linking decisions to specific code artifacts, + container images, or application versions. This approach helps maintain + security oversight while reducing repeated analysis overhead. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Simple false positive treatment + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + references: + samm2: + - I-DM-2-A + - I-DM-2-B + - I-SB-3-B + iso27001-2017: + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + tags: + - false-positive + - defect-management + teamsImplemented: + Default: false + B: false + C: false Fix based on accessibility: uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed risk: Overwhelming volume of security findings from automated testing tools. @@ -5830,12 +6013,13 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - Treatment of defects with severity high or higher - - Inventory of production components + - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: ~ references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.1 @@ -5855,6 +6039,52 @@ Test and Verification: Default: false B: false C: false + Global false positive treatment: + uuid: 9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + risk: Without centralized false positive management across environments, organizations + face inconsistent security decisions, duplicated analysis efforts, and potential + security gaps when the same findings are handled differently across applications + and teams. + measure: "Implement global false positive and acceptance management that applies + \nconsistently across all applications. This enables organization-wide security + decisions and reduces redundant \nanalysis of common false positives." + description: "Global false positive treatment allows (security) teams to make + \norganization-wide decisions about specific vulnerabilities or finding \npatterns. + When a finding is marked as a false positive or temporarily \naccepted at + the global level, this decision automatically applies to \nall applications + in the specified environment, ensuring consistency \nand operational efficiency." + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + - 85ba5623-84be-4219-8892-808837be582d + implementation: ~ + references: + samm2: + - I-DM-2-B + - I-DM-3-A + - I-SB-3-B + iso27001-2017: + - 16.1.3 + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 6.8 + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + tags: + - false-positive + - defect-management + teamsImplemented: + Default: false + B: false + C: false Integration in development process: uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d risk: "Not integrating vulnerability handling into the development process may @@ -6003,6 +6233,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.1 @@ -6024,9 +6255,17 @@ Test and Verification: C: false Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 - risk: As false positive occur during each test, all vulnerabilities might be - ignored. Specially, if tests are automated an run daily. - measure: |- + description: "Security tests may produce false positives\u2014findings that + are incorrectly identified as vulnerabilities.\n\nIt is important distinguish + these from true vulnerabilities to avoid wasting time and resources on non-issues.\n\nFalse + positive treatment ensures that findings from security tests are triaged and + documented, allowing teams to distinguish between real vulnerabilities and + false positives. This reduces unnecessary work and helps maintain focus on + true risks.\n\nSome positive findings might be considered an accepted risk + by the organization. This must also be documented.\n" + risk: | + If false positives are not managed, teams may ignore all findings, leading to real vulnerabilities being overlooked and increasing the risk of exploitation. Specially, if tests are automated an run daily. + measure: | Findings from security tests must be triaged and outcomes persisted/documented to: - Prevent re-analysis of known issues in subsequent test runs - Track accepted risks vs false positives @@ -6038,17 +6277,23 @@ Test and Verification: - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) + assessment: | + The organization has a process for triaging and documenting false positives and accepted risks + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 4 - level: 1 implementation: - - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 name: Purify tags: @@ -6160,6 +6405,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 12.6.1 @@ -6249,16 +6495,23 @@ Test and Verification: C: false Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 - risk: Vulnerabilities with severity high or higher are not visible. - measure: Vulnerabilities with severity high or higher are added to the quality - gate. + description: | + All security problems that are rated as "high" or "critical" must be fixed before the software can be released or used in production. This means that if a serious vulnerability is found, it cannot be ignored or postponed. + risk: | + If serious security problems are not fixed, attackers could exploit them to steal data, disrupt services, or cause other harm. Ignoring these issues puts the organization, its customers, and its reputation at risk. + measure: | + - Make it a rule that all high or critical security findings must be fixed before the software is approved for release or use. + - Track these issues and make sure they are resolved quickly. + - Pay extra attention to Known Exploited Vulnerabilities (KEV) from CISA and EPSS scores when prioritizing fixes. + assessment: | + There is clear evidence that all high or critical security issues are tracked and fixed before release. No high or critical issues remain open in production systems. + comments: False positive analysis, specially for static analysis, is time consuming. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 usefulness: 4 - level: 1 - comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - I-DM-2-B @@ -6270,7 +6523,24 @@ Test and Verification: - 5.25 openCRE: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 - implementation: [] + implementation: + - uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: Trivy + tags: [] + url: https://github.com/aquasecurity/trivy + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: Grype + tags: + - sbom + - dependency + - vulnerability + url: https://github.com/anchore/grype tags: - vuln-action - defect-management @@ -6292,6 +6562,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 12.6.1 @@ -6321,9 +6592,9 @@ Test and Verification: resources: 2 usefulness: 2 dependsOn: - - Exploit likelihood estimation - - Each team has a security champion - - Office Hours + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 + - 185d5a74-19dc-4422-be07-44ea35226783 level: 3 description: "For known vulnerabilities a processes to estimate the exploit ability of a vulnerability is recommended.\n\nTo implement a security culture @@ -6356,6 +6627,8 @@ Test and Verification: references: samm2: - I-DM-1-B + - I-SB-2-B + - I-SB-3-B iso27001-2017: - 12.6.1 - 16.1.3 @@ -6945,7 +7218,7 @@ Test and Verification: tags: [] url: https://github.com/controlplaneio/netassert dependsOn: - - Isolated networks for virtual environments + - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 references: samm2: - V-ST-2-A @@ -7103,7 +7376,7 @@ Test and Verification: - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 dependsOn: - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f tags: - none teamsImplemented: @@ -7198,7 +7471,7 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - Software Composition Analysis (server side) + - d918cd44-a972-43e9-a974-eff3f4a5dcfe implementation: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 name: Known Exploited Vulnerabilities @@ -7216,6 +7489,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7302,8 +7576,8 @@ Test and Verification: level: 3 dependsOn: - Defined build process - - Inventory of production components - - Exploit likelihood estimation + - 2a44b708-734f-4463-b0cb-86dc46344b2f + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad implementation: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js @@ -7338,6 +7612,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-2-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7368,7 +7643,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 name: OWASP Dependency Check @@ -7408,12 +7683,13 @@ Test and Verification: description: | Dependabot creates pull requests to keep your dependencies secure and up-to-date. - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy + name: Trivy tags: [] url: https://github.com/aquasecurity/trivy references: samm2: - V-ST-2-A + - I-SB-2-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7440,11 +7716,12 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f implementation: [] references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7504,10 +7781,11 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7571,7 +7849,7 @@ Test and Verification: - sast dependsOn: - Defined build process - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A @@ -7633,10 +7911,11 @@ Test and Verification: - sast dependsOn: - Defined build process - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7985,7 +8264,7 @@ Test and Verification: often too fine-granular. implementation: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy + name: Trivy tags: [] url: https://github.com/aquasecurity/trivy - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 @@ -8183,11 +8462,52 @@ Test and Verification: Default: false B: false C: false - Test for stored secrets: + Test for stored secrets in build artifacts: + uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f + risk: Stored secrets in container images or other build artifacts shouldn't + exists because they might be exposed to unauthorized parties. + measure: Test for secrets in container images and other artifacts + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + references: + samm2: + - V-ST-1-A + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/d5e6303c-d5c6-4d59-b258-a3b9de38a07f + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for stored secrets in code: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c - risk: Stored secrets in git history, in container images or directly in code - shouldn't exists because they might be exposed to unauthorized parties. - measure: Test for secrets in code, container images and history + risk: Stored secrets in git history or directly in code shouldn't exists because + they might be exposed to unauthorized parties. + measure: Test for secrets in code and git history difficultyOfImplementation: knowledge: 2 time: 1 @@ -8574,6 +8894,7 @@ Test and Verification: references: samm2: - I-SB-3-A + - V-ST-3-A iso27001-2017: - 14.2.3 - 14.2.8 From 066263c00f8ebe418d7da9abb9b4bf1540747301 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 22 Sep 2025 17:07:14 +0200 Subject: [PATCH 105/370] Remove obsolete mapping --- src/assets/YAML/default/BuildAndDeployment/Build.yaml | 3 --- src/assets/YAML/generated/generated.yaml | 5 +---- 2 files changed, 1 insertion(+), 7 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 67add83..87c78d3 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -75,9 +75,6 @@ Build and Deployment: references: samm2: - I-SB-1-A - nist-csf: - - PR.IP-1 - - PR.DS-1 iso27001-2017: - 12.1.1 - 14.2.2 diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 4ebdca3..3985e4d 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -96,9 +96,6 @@ Build and Deployment: references: samm2: - I-SB-1-A - nist-csf: - - PR.IP-1 - - PR.DS-1 iso27001-2017: - 12.1.1 - 14.2.2 @@ -5944,7 +5941,7 @@ Test and Verification: usefulness: 3 level: 2 dependsOn: - - Simple false positive treatment + - c1acc8af-312e-4503-a817-a26220c993a0 implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo From 4098348b360c2c73cbb92153d0af33718cf577bd Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 22 Sep 2025 22:03:52 +0200 Subject: [PATCH 106/370] Windows bat file for starting php in docker --- yaml-generation/generateDimensions.bat | 15 +++++++++++++++ 1 file changed, 15 insertions(+) create mode 100644 yaml-generation/generateDimensions.bat diff --git a/yaml-generation/generateDimensions.bat b/yaml-generation/generateDimensions.bat new file mode 100644 index 0000000..38f8e26 --- /dev/null +++ b/yaml-generation/generateDimensions.bat @@ -0,0 +1,15 @@ +@echo off +REM Usage: generateDimensions.bat [--test-urls] +REM If --test-urls is provided, the script will check if referenced URLs are live. + +setlocal +SET var=DUMMY= +if "%~1"=="--test-urls" SET var=TEST_REFERENCED_URLS=true + + +REM Change working directory to the project root +cd %~dp0\.. + +REM Run the php script in the Docker container +docker run -e %var% -e IS_IMPLEMENTED_WHEN_EVIDENCE=true -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" + From 5185a97af3dff1d919fea5bf86f0d6578fa4a5c7 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 22 Sep 2025 22:12:11 +0200 Subject: [PATCH 107/370] Fixed: Insecure URL --- src/assets/YAML/default/implementations.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 533e3ee..208b118 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -179,7 +179,7 @@ implementations: url: https://www.owasp.org/index.php/Agile_Software_Development description: "[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories)\ - \ and [Practical Security Stories and Security Tasks for Agile Development Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)" + \ and [Practical Security Stories and Security Tasks for Agile Development Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)" libyear: uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 name: libyear From fb337a1ed21d01a8728420f404bd102324ace9a7 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 22 Sep 2025 22:13:30 +0200 Subject: [PATCH 108/370] Fixed: Duplicate URL in two references --- .../Implementation/InfrastructureHardening.yaml | 8 ++++---- src/assets/YAML/default/implementations.yaml | 12 ++++++------ 2 files changed, 10 insertions(+), 10 deletions(-) diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 84fbc33..b4864af 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -402,8 +402,8 @@ Implementation: usefulness: 4 level: 2 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-kubernetes-bench - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-docker-bench-for + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-kubernetes-benchmark + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-docker-benchmark - $ref: src/assets/YAML/default/implementations.yaml#/implementations/for-example-for-cont - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-cloud - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-containers @@ -435,8 +435,8 @@ Implementation: usefulness: 3 level: 4 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-kubernetes-bench - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-docker-bench-for + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-kubernetes-benchmark + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cis-docker-benchmark - $ref: src/assets/YAML/default/implementations.yaml#/implementations/for-example-for-cont - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-cloud - $ref: src/assets/YAML/default/implementations.yaml#/implementations/attack-matrix-containers diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 208b118..8d5ad7e 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -249,16 +249,16 @@ implementations: name: OWASP MASVS tags: [] url: https://github.com/OWASP/owasp-masvs - cis-kubernetes-bench: + cis-kubernetes-benchmark: uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security + name: CIS Kubernetes Benchmark for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ - cis-docker-bench-for: + url: https://www.cisecurity.org/benchmark/kubernetes + cis-docker-benchmark: uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security + name: CIS Docker Benchmark for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ + url: https://www.cisecurity.org/benchmark/docker for-example-for-cont: uuid: f4d7c796-8574-4a88-ab00-98d245a115ef name: For example for Cont From 549a9a723a8a282c107d16f1bf0d11ca625c665c Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 22 Sep 2025 22:14:48 +0200 Subject: [PATCH 109/370] Fixed: Duplicate reference for Yubikey and Smartcard --- .../default/Implementation/InfrastructureHardening.yaml | 2 -- src/assets/YAML/default/implementations.yaml | 7 +------ 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index b4864af..acb7295 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -17,7 +17,6 @@ Implementation: usefulness: 4 level: 1 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/smartcard - $ref: src/assets/YAML/default/implementations.yaml#/implementations/yubikey - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sms - $ref: src/assets/YAML/default/implementations.yaml#/implementations/totp @@ -54,7 +53,6 @@ Implementation: dependsOn: - MFA for admins implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/smartcard - $ref: src/assets/YAML/default/implementations.yaml#/implementations/yubikey - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sms - $ref: src/assets/YAML/default/implementations.yaml#/implementations/totp diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 8d5ad7e..d4b0cdb 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -355,14 +355,9 @@ implementations: uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e name: Plugins tags: [] - smartcard: - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ yubikey: uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey + name: YubiKey - Smartcard tags: [] url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ sms: From ffa8cf263869fcde222a26af2bc9f500932ea943 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 22 Sep 2025 22:35:09 +0200 Subject: [PATCH 110/370] Renumbered the levels --- src/assets/YAML/default/InformationGathering/Logging.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/InformationGathering/Logging.yaml b/src/assets/YAML/default/InformationGathering/Logging.yaml index 54ef2cf..a92a76f 100755 --- a/src/assets/YAML/default/InformationGathering/Logging.yaml +++ b/src/assets/YAML/default/InformationGathering/Logging.yaml @@ -16,7 +16,7 @@ Information Gathering: time: 1 resources: 1 usefulness: 5 - level: 3 + level: 2 dependsOn: - Alerting implementation: [] @@ -177,7 +177,7 @@ Information Gathering: time: 3 resources: 3 usefulness: 4 - level: 2 + level: 3 dependsOn: - Centralized system logging - Centralized application logging From 21dd7a622e85a7ec8a65bb8874d61038cf4b501a Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 27 Sep 2025 17:28:26 +0200 Subject: [PATCH 111/370] Fixed typo in dependsOn reference --- .../YAML/default/TestAndVerification/Consolidation.yaml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 9015366..297fee3 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -198,7 +198,7 @@ Test and Verification: usefulness: 3 level: 2 dependsOn: - - uuid: c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment + - c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify @@ -345,8 +345,8 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment - - uuid: 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system + - 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system implementation: references: samm2: From 40fde98a67f47a5dfd2ea54b81ac0b7b0e8815c1 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 27 Sep 2025 18:49:28 +0200 Subject: [PATCH 112/370] Generate dependency tree as markdown --- yaml-generation/functions.php | 10 +++++ yaml-generation/generateDimensions.php | 56 +++++++++++++++++++++++++- 2 files changed, 65 insertions(+), 1 deletion(-) diff --git a/yaml-generation/functions.php b/yaml-generation/functions.php index 509fa50..4bd5030 100644 --- a/yaml-generation/functions.php +++ b/yaml-generation/functions.php @@ -319,6 +319,16 @@ function getReferences($references) { } +/** + * Push item to array at key, creating array if needed. + */ +function array_push_item_to(array &$array, $key, $value) { + if (!isset($array[$key])) { + $array[$key] = []; + } + array_push($array[$key], $value); +} + // TODO create testcases diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 2755686..71d5c20 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -51,6 +51,8 @@ $dimensionsAggregated = $dimensions; } +$dependencies = array(); +$activityIndex = array(); foreach ($dimensionsAggregated as $dimension => $subdimensions) { ksort($subdimensions); foreach ($subdimensions as $subdimension => $elements) { @@ -68,7 +70,7 @@ array_push($errorMsg,"Missing 'level' attribute in activity: $activityName"); } - echo "$subdimension | $activityName\n"; + // echo "$subdimension | $activityName\n"; if (!array_key_exists("uuid", $activity)) { array_push($errorMsg, "$activityName is missing an uuid in $dimension"); } else { @@ -147,6 +149,16 @@ array_push($errorMsg,"DependsOn non-existing activity: '$dependsOn' (in activity: $activityName)"); } } + + // Build dependency graph + if (!array_key_exists($activityName, $activityIndex)) { + $activityIndex[$activityName] = count($activityIndex); + } + if (!array_key_exists($dependsOn, $activityIndex)) { + $activityIndex[$dependsOn] = count($activityIndex); + } + array_push_item_to($dependencies, $activityIndex[$dependsOn], $activityIndex[$activityName]); + } } } @@ -188,6 +200,48 @@ file_put_contents($targetGeneratedFile, $dimensionsString); +// Store dependency graph +$graphFilename = getcwd() . "/src/assets/YAML/generated/dependency-tree.md"; +$graphFile = fopen($graphFilename, "w"); +fwrite($graphFile, "```mermaid\n\n"); +fwrite($graphFile, "graph LR\n\n"); +// List all nodes +foreach ($activityIndex as $activityName => $key) { + $level = getActivityByActivityName($activityName, $dimensionsAggregated)["level"]; + $activityName = "L$level $activityName"; + $activityName = str_replace('(', '', $activityName); + $activityName = str_replace(')', '', $activityName); + fwrite($graphFile, "$key($activityName)\n"); +} +// Add links between nodes +fwrite($graphFile, "\n\n"); +foreach ($dependencies as $dad => $children) { + foreach ($children as $child) { + fwrite($graphFile, "$dad --> $child\n"); + } +} +// Tie all orphans to a common start node +fwrite($graphFile, "\n"); +foreach ($activityIndex as $activityName => $key) { + $isOrphan = true; + foreach ($dependencies as $dad => $children) { + if ($dad == $key) continue; + if (in_array($key, $children)) { + $isOrphan = false; + break; + } + } + if ($isOrphan) { + fwrite($graphFile, "O --> $key\n"); + } +} + +// Close the file +fwrite($graphFile, "```\n"); +fclose($graphFile); +echo "\nSaved dependency graph '$graphFilename'\n\n"; + + function assertUniqueRefs($all_references, &$errorMsg) { foreach ($all_references as $references) { From 70fe4396eee2ef25b94deb53686f12a682aaf00a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 28 Sep 2025 10:53:19 +0200 Subject: [PATCH 113/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 306 ++++++++++++++++++----- 1 file changed, 250 insertions(+), 56 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 22a495d..def6a19 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -182,7 +182,8 @@ Build and Deployment: level: 2 implementation: [] references: - samm2: [] + samm2: + - I-SB-1-A iso27001-2017: - 8.1 - 8.2 @@ -316,7 +317,7 @@ Build and Deployment: - Smoke Test references: samm2: - - TODO + - I-SD-2-A iso27001-2017: - 17.2.1 - 12.1.1 @@ -604,7 +605,7 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -667,7 +668,7 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -731,7 +732,9 @@ Build and Deployment: Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-2-A + - I-SB-3-B + - I-SB-2-B + - I-SB-1-B iso27001-2017: - 8.1 - 8.2 @@ -860,7 +863,8 @@ Build and Deployment: dependsOn: - Same artifact for environments references: - samm2: [] + samm2: + - I-SD-2-A iso27001-2017: - 14.3.1 - 14.2.8 @@ -1529,7 +1533,7 @@ Culture and Organization: url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' references: samm2: - D-TA-2-B @@ -1572,7 +1576,7 @@ Culture and Organization: url: https://www.owasp.org/index.php/Agile_Software_Development description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) and [Practical Security Stories and Security Tasks for Agile Development - Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' dependsOn: - Conduction of simple threat modeling on technical level - Creation of threat modeling processes and standards @@ -1668,7 +1672,8 @@ Culture and Organization: level: 2 implementation: [] references: - samm2: [] + samm2: + - G-PS-2 iso27001-2017: - 5.1.1 - 7.2.1 @@ -1709,6 +1714,7 @@ Culture and Organization: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: @@ -2001,16 +2007,17 @@ Culture and Organization: [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) implementation: - - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: @@ -2042,15 +2049,15 @@ Culture and Organization: usefulness: 4 level: 4 implementation: - - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 - name: OWASP JuiceShop - tags: [] + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training url: https://github.com/bkimminich/juice-shop - description: |- - In case you do not have the budget to hire an external security expert, an option - is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" - - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba - name: https://cheatsheetseries.owasp.org/ + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series tags: - training - secure coding @@ -2089,6 +2096,7 @@ Culture and Organization: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ dependsOn: @@ -2266,6 +2274,7 @@ Culture and Organization: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series tags: + - training - secure coding url: https://cheatsheetseries.owasp.org/ references: @@ -3449,13 +3458,13 @@ Implementation: level: 2 implementation: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security + name: CIS Kubernetes Benchmark for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ + url: https://www.cisecurity.org/benchmark/kubernetes - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security + name: CIS Docker Benchmark for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ + url: https://www.cisecurity.org/benchmark/docker - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef name: For example for Cont tags: [] @@ -3472,7 +3481,7 @@ Implementation: name: Attack Matrix Containers tags: - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ + url: https://attack.mitre.org/matrices/enterprise/containers/ description: Attack matrix for containers - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 name: Attack Matrix Kubernetes @@ -3560,13 +3569,13 @@ Implementation: level: 4 implementation: - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Bench for Security + name: CIS Kubernetes Benchmark for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ + url: https://www.cisecurity.org/benchmark/kubernetes - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Bench for Security + name: CIS Docker Benchmark for Security tags: [] - url: https://www.cisecurity.org/cis-benchmarks/ + url: https://www.cisecurity.org/benchmark/docker - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef name: For example for Cont tags: [] @@ -3583,7 +3592,7 @@ Implementation: name: Attack Matrix Containers tags: - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ + url: https://attack.mitre.org/matrices/enterprise/containers/ description: Attack matrix for containers - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 name: Attack Matrix Kubernetes @@ -3815,12 +3824,8 @@ Implementation: dependsOn: - MFA for admins implementation: - - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey + name: YubiKey - Smartcard tags: [] url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 @@ -3866,12 +3871,8 @@ Implementation: usefulness: 4 level: 1 implementation: - - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 - name: Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey + name: YubiKey - Smartcard tags: [] url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 @@ -4049,7 +4050,7 @@ Implementation: Default: false B: false C: false - Usage of a chaos monkey: + Usage of a chaos technology: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In case of a crash it might happen that a planned redundant system is unavailable. @@ -4062,7 +4063,18 @@ Implementation: resources: 5 usefulness: 3 level: 4 - implementation: [] + implementation: + - uuid: c117e79b-8223-4e55-9da5-efbf5d741c15 + name: Chaos Monkey + tags: + - chaos + - testing + url: https://github.com/Netflix/chaosmonkey + description: Chaos Monkey is a resiliency tool that helps applications tolerate + random instance failures. Chaos Monkey randomly terminates virtual machine + instances and containers that run inside of your production environment. + Exposing engineers to failures more frequently incentivizes them to build + resilient services. references: samm2: - O-EM-1-A @@ -4453,7 +4465,7 @@ Information Gathering: time: 1 resources: 1 usefulness: 5 - level: 3 + level: 2 dependsOn: - Alerting implementation: [] @@ -4684,7 +4696,7 @@ Information Gathering: time: 3 resources: 3 usefulness: 4 - level: 2 + level: 3 dependsOn: - Centralized system logging - Centralized application logging @@ -4790,7 +4802,8 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-A 3 + - O-IM-2-A + - I-DM-3-A iso27001-2017: - 16.1.2 - 16.1.4 @@ -5202,7 +5215,8 @@ Information Gathering: implementation: [] references: samm2: - - I-DM-A 3 + - O-IM-2-A + - I-DM-3-A iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 @@ -5299,6 +5313,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -5363,6 +5378,7 @@ Information Gathering: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.3 @@ -5403,6 +5419,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -5452,6 +5469,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -5597,6 +5615,7 @@ Information Gathering: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2022: - 5.25 - 5.12 @@ -5811,6 +5830,77 @@ Test and Verification: Default: false B: false C: false + Artifact-based false positive treatment: + uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + risk: Without artifact-specific false positive handling, teams must repeatedly + triage the same findings across different versions or deployments of the same + component, leading to inefficient use of security resources. + measure: "Implement false positive marking and temporary acceptance of findings + \nbased on specific artifacts (applications, components, or repositories).\nThis + allows teams to suppress findings for specific versions or builds\nwhile maintaining + visibility for future releases." + description: |- + Artifact-based false positive treatment enables more granular control + over finding suppression by linking decisions to specific code artifacts, + container images, or application versions. This approach helps maintain + security oversight while reducing repeated analysis overhead. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Simple false positive treatment + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + references: + samm2: + - I-DM-2-A + - I-DM-2-B + - I-SB-3-B + iso27001-2017: + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + tags: + - false-positive + - defect-management + teamsImplemented: + Default: false + B: false + C: false Fix based on accessibility: uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed risk: Overwhelming volume of security findings from automated testing tools. @@ -5836,6 +5926,7 @@ Test and Verification: references: samm2: - I-DM-3-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.1 @@ -5855,6 +5946,52 @@ Test and Verification: Default: false B: false C: false + Global false positive treatment: + uuid: 9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + risk: Without centralized false positive management across environments, organizations + face inconsistent security decisions, duplicated analysis efforts, and potential + security gaps when the same findings are handled differently across applications + and teams. + measure: "Implement global false positive and acceptance management that applies + \nconsistently across all applications. This enables organization-wide security + decisions and reduces redundant \nanalysis of common false positives." + description: "Global false positive treatment allows (security) teams to make + \norganization-wide decisions about specific vulnerabilities or finding \npatterns. + When a finding is marked as a false positive or temporarily \naccepted at + the global level, this decision automatically applies to \nall applications + in the specified environment, ensuring consistency \nand operational efficiency." + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Artifact-based false positive treatment + - Usage of a vulnerability management system + implementation: ~ + references: + samm2: + - I-DM-2-B + - I-DM-3-A + - I-SB-3-B + iso27001-2017: + - 16.1.3 + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 6.8 + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + tags: + - false-positive + - defect-management + teamsImplemented: + Default: false + B: false + C: false Integration in development process: uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d risk: "Not integrating vulnerability handling into the development process may @@ -6003,6 +6140,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 8.2.1 @@ -6045,10 +6183,14 @@ Test and Verification: usefulness: 4 level: 1 implementation: - - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c - name: OWASP Defect Dojo - tags: [] + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 name: Purify tags: @@ -6160,6 +6302,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 12.6.1 @@ -6292,6 +6435,7 @@ Test and Verification: references: samm2: - I-DM-2-B + - I-SB-3-B iso27001-2017: - 16.1.4 - 12.6.1 @@ -6356,6 +6500,8 @@ Test and Verification: references: samm2: - I-DM-1-B + - I-SB-2-B + - I-SB-3-B iso27001-2017: - 12.6.1 - 16.1.3 @@ -7216,6 +7362,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7338,6 +7485,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-2-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7414,6 +7562,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-2-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7445,6 +7594,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7508,6 +7658,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -7637,6 +7788,7 @@ Test and Verification: references: samm2: - V-ST-2-A + - I-SB-3-B iso27001-2017: - 12.6.1 iso27001-2022: @@ -8183,11 +8335,52 @@ Test and Verification: Default: false B: false C: false - Test for stored secrets: + Test for stored secrets in build artifacts: + uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f + risk: Stored secrets in container images or other build artifacts shouldn't + exists because they might be exposed to unauthorized parties. + measure: Test for secrets in container images and other artifacts + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + references: + samm2: + - V-ST-1-A + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/d5e6303c-d5c6-4d59-b258-a3b9de38a07f + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for stored secrets in code: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c - risk: Stored secrets in git history, in container images or directly in code - shouldn't exists because they might be exposed to unauthorized parties. - measure: Test for secrets in code, container images and history + risk: Stored secrets in git history or directly in code shouldn't exists because + they might be exposed to unauthorized parties. + measure: Test for secrets in code and git history difficultyOfImplementation: knowledge: 2 time: 1 @@ -8574,6 +8767,7 @@ Test and Verification: references: samm2: - I-SB-3-A + - V-ST-3-A iso27001-2017: - 14.2.3 - 14.2.8 From 75babf00f6725a8572f2cef27f06dbe399a9c271 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Wed, 8 Oct 2025 23:40:45 +0200 Subject: [PATCH 114/370] Revision after feedback --- .../default/BuildAndDeployment/Build.yaml | 22 +++++++++---------- .../BuildAndDeployment/Deployment.yaml | 18 ++++++--------- .../BuildAndDeployment/PatchManagement.yaml | 4 ++-- .../EducationAndGuidance.yaml | 1 - .../CultureAndOrganization/Process.yaml | 2 +- .../InfrastructureHardening.yaml | 2 ++ .../TestAndVerification/Consolidation.yaml | 2 +- .../TestAndVerification/Test-Intensity.yaml | 2 +- src/assets/YAML/default/implementations.yaml | 9 ++++++-- 9 files changed, 32 insertions(+), 30 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index 87c78d3..ba70824 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -50,26 +50,26 @@ Build and Deployment: - Artifact creation and storage - Deployment preparation - A *defined build process* automates these steps to ensure consistency, reproducibility, and security. Automation reduces human error and enforces security controls. Use tools such as Jenkins, GitHub Actions, GitLab CI, or Maven to codify the process. + Basing the build process on human memory may lead to inconsistencies and security misconfigurations. + + A *defined build process* can automate these steps to ensure consistency, avoiding accidental omissions or misconfigurations. Use tools such as Jenkins, GitHub Actions, GitLab CI, or Maven to codify the process. + + A simplified, but still a *defined build process*, may be a checklist of the steps to be performed. risk: - Performing builds without a defined and automated process is error-prone and increases the risk of security misconfigurations, unauthorized changes, and supply chain attacks. + Without a defined and automated build process the risk increase for accidental mistakes, forgetting test activities, and insecure misconfigurations. measure: - A well-defined, automated, and auditable build process lowers the possibility of errors and unauthorized changes during the build process. It also enables traceability and rapid response to incidents. + Find a tool that suits your environment. Add your manual build steps, include steps for running tests, scanning and preparation for deployment. + assessment: | + - Show your build pipeline configuration (e.g., Jenkinsfile, GitHub Actions workflow) and an exemplary job (build + test + security scan). level: 1 difficultyOfImplementation: knowledge: 2 time: 3 resources: 2 usefulness: 4 - assessment: | - - Show your build pipeline configuration (e.g., Jenkinsfile, GitHub Actions workflow) and an exemplary job (build + test + security scan). - - Demonstrate that every team member has appropriate access (least privilege). - - Show that failed jobs are investigated and fixed promptly. - - Provide audit logs or evidence of build runs and changes. - - Document how security controls are enforced in the build process. - - Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkins + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/maven - $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools - $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology references: diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 6332019..4432c12 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -100,10 +100,9 @@ Build and Deployment: - 8.32 assessment: | - Deployment process is documented and available to relevant staff - - All deployment steps are automated and version-controlled - - Approvals and access controls are enforced for production deployments - - Rollback procedures are defined and tested - - Deployment logs and evidence are retained for audit purposes + - All deployment steps are automated + - Rollback procedures are defined and tested [Keep??? Delete???] + - Provide audit logs or evidence of deployments isImplemented: false evidence: "" comments: "" @@ -220,12 +219,15 @@ Build and Deployment: Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f description: | - An inventory of production components is a complete, up-to-date list of all applications and services running in production. This enables effective vulnerability management, incident response, and compliance. Without it, organizations risk running unmaintained or unauthorized software. + An inventory of production components is a complete, up-to-date list of all applications running in production. This enables effective vulnerability management, incident response, and compliance. Without it, organizations risk running unmaintained or unauthorized software. risk: |- An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it. measure: |- A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. + assessment: | + - Inventory of all production applications with application name, owner, and date of last review + - Inventory is accessible to development, security and operations teams dependsOn: - Defined deployment process level: 1 @@ -247,12 +249,6 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - assessment: | - - Inventory of all production components exists and is regularly updated - - Inventory includes key metadata (e.g., version, owner, deployment date) - - Inventory is accessible to security and operations teams - - There is a process for adding, updating, and removing components - - Inventory reviews are performed and documented tags: - inventory Inventory of production artifacts: diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index 39e35bd..0cc6452 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -43,7 +43,7 @@ Build and Deployment: description: | Automated PRs for patches ensure that updates for outdated or vulnerable dependencies are created and proposed without manual intervention. Tools continuously monitor for new versions or security advisories and immediately generate pull requests to update affected components in code, container images, or infrastructure. This process ensures that available patches are quickly visible to developers and can be reviewed and merged with minimal delay, reducing the risk window for known vulnerabilities. risk: | - Components with known (or unknown) vulnerabilities might persist for a long time and be exploited, even when a patch is available. + Components with known vulnerabilities might persist for a long time and be exploited, even when a patch is available. measure: | Fast patching of third-party components is needed. The DevOps way is to have an automated pull request for new components. This includes: * Applications @@ -53,7 +53,7 @@ Build and Deployment: assessment: | - Automated PR tooling is enabled for all relevant repositories. - PRs are created automatically for outdated or vulnerable dependencies. - - PRs are reviewed and merged in a timely manner. + - PRs are reviewed and merged according to the defined patch policy. - Evidence of automated PRs and patching activity is available. level: 1 difficultyOfImplementation: diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index ac9a941..8c12389 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -12,7 +12,6 @@ Culture and Organization: Provide security awareness training for all personnel involved in software development on an ad-hoc basis, ensuring that relevant topics are covered when new risks or needs are identified. assessment: | - Conduct security training for developers and relevant personnel - - Participants can identify common software security risks addressed in the training - Training materials are available - Attendance records are available level: 1 diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index 2f768df..2c49c82 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -66,7 +66,7 @@ Culture and Organization: measure: | Develop, document, and communicate a BCDR plan for all critical components. The plan must define roles and responsibilities, Service Level Agreements (SLAs), Recovery Point Objectives (RPOs), Recovery Time Objectives (RTOs), and failover procedures. Ensure all relevant personnel are trained and the plan is reviewed and updated regularly. assessment: | - - The organization has a documented BCDR plan covering all critical components. + - There is a documented BCDR plan covering all critical components of the application(s). - The plan clearly defines responsibilities, SLAs, RPOs, RTOs, and failover steps. - Relevant staff are aware of the plan, and evidence of regular review and testing is available. level: 1 diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 84fbc33..2759837 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -366,6 +366,8 @@ Implementation: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 risk: Attackers a gaining access to internal systems and application interfaces measure: All internal systems are using simple authentication + assessment: | + - Demonstrate that every team member has appropriate access (least privilege). difficultyOfImplementation: knowledge: 3 time: 3 diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 267fa40..a09223b 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -162,7 +162,7 @@ Test and Verification: - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) assessment: | - The organization has a process for triaging and documenting false positives and accepted risks + A process is defined for triaging and documenting false positives and accepted risks level: 1 difficultyOfImplementation: knowledge: 1 diff --git a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml index c8b0c89..ffbcf52 100755 --- a/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml +++ b/src/assets/YAML/default/TestAndVerification/Test-Intensity.yaml @@ -1,7 +1,7 @@ # yaml-language-server: $schema=../../schemas/dsomm-schema-test-and-verification.json --- Test and Verification: - Test-Intensity: + Test Intensity: Creation and application of a testing concept: uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe risk: Scans might use a too small or too high test intensity. diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index b0f0659..bbecf0c 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -111,9 +111,14 @@ implementations: name: Jenkins tags: [] url: https://www.jenkins.io/ + maven: + uuid: eb6de6b9-e060-4902-ae6f-604ffc386b63 + name: Maven + tags: [] + url: https://maven.apache.org/ sample-concept-1: uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" + name: "Sample concept" tags: [] description: "Sample concept: \n(1) each container has a set lifetime and is\ @@ -716,7 +721,7 @@ implementations: tags: [sbom, dependency] url: https://github.com/anchore/syft grype: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + uuid: 7970af6e-a7d3-4359-a6ea-301d26b16329 name: Grype tags: [sbom, dependency, vulnerability] url: https://github.com/anchore/grype From 953d06d595a9b2571435f9a7b91c80b30ecd7e7e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 13 Oct 2025 13:29:21 +0200 Subject: [PATCH 115/370] Enhance versioning description in YAML file Updated description for version control system usage and clarified the types of code to version. --- .../default/Implementation/DevelopmentAndSourceControl.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index dfed1aa..6c497cd 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -87,9 +87,10 @@ Implementation: Versioning: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f risk: Deployment of untracked artifacts. + description: Use a version control system platform like Github, Gitlab, Bitbucket, gittea,... to version your code. measure: >- Version artifacts in order to identify deployed features and issues. - This includes application and infrastructure code, jenkins configuration, container and virtual machine images. + This includes application and infrastructure code, jenkins configuration, container and virtual machine images definitions. difficultyOfImplementation: knowledge: 3 time: 3 From 140684a418f9d9c4f5611d82801cdbc17217ec1c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 13 Oct 2025 13:32:44 +0200 Subject: [PATCH 116/370] Enhance measure description for exploit likelihood Clarify measure description and add detail to the explanation. --- .../TestAndVerification/StaticDepthForApplications.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 5de1bef..2009526 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -324,7 +324,8 @@ Test and Verification: uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad risk: |- Without proper prioritization, organizations may waste time and effort on low-risk vulnerabilities while neglecting critical ones. - measure: Estimate the likelihood of exploitation by using data (CISA KEV) from the past or prediction models (EPSS). + measure: Estimate the likelihood of exploitation by using data (CISA KEV) from the past or prediction models (e.g. Exploit Prediction Scoring System, EPSS). + description: Severity-based vulnerability triage alone generates a lot false positives, requiring a more refined approach. difficultyOfImplementation: knowledge: 2 time: 2 From db5477f2dbe9e4faa35490d2e126cd58d6c13f58 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 19 Oct 2025 22:22:20 +0200 Subject: [PATCH 117/370] Improve dependencyTrack --- src/assets/YAML/default/implementations.yaml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index d4b0cdb..53ce558 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -786,7 +786,9 @@ implementations: tags: [pre-commit] dependencyTrack: uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: [sca, inventory, OpenSource, "Supply Chain", vulnerability, inventory] hashicorp-vault: From 1fc2e2900090ea624b8ca2e3d9e69ffde443d9de Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Wed, 22 Oct 2025 22:29:26 +0200 Subject: [PATCH 118/370] Fixed OpenCRE urls --- yaml-generation/generateDimensions.php | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 71d5c20..6660db4 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -114,7 +114,7 @@ ); if (!array_key_exists("openCRE", $activity["references"])) { $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"] = array(); - $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = "https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/" . $subdimension . "/" . $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; + $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = buildOpenCreUrl($dimension, $subdimension, $activityName); } // can be removed in 2025 if (array_key_exists("isImplemented", $activity)) { @@ -241,7 +241,14 @@ fclose($graphFile); echo "\nSaved dependency graph '$graphFilename'\n\n"; - +function buildOpenCreUrl($dimension, $subdimension, $activityName) { + $baseUrl = "https://www.opencre.org/node/standard/"; + $DSOMM = "DevSecOps Maturity Model (DSOMM)"; + $url = $baseUrl . rawurlencode($DSOMM) . + "/section/" . rawurlencode($subdimension) . + "/subsection/" . rawurlencode($activityName); + return $url; +} function assertUniqueRefs($all_references, &$errorMsg) { foreach ($all_references as $references) { From 9ada9fafe959b2ad8d8fe24a76550a702e8e6c16 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 6 Nov 2025 18:14:23 +0100 Subject: [PATCH 119/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 + src/assets/YAML/generated/generated.yaml | 8793 ++++++++++++++++++++++ 2 files changed, 8800 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0fe0c88..e8f5beb 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [1.18.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.17.0...v1.18.0) (2025-11-06) + + +### Features + +* update SAMM mapping based on arams feedback ([532bb72](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/532bb72debcd93f98f07dc7d4b28d799da6e155d)) + # [1.17.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.16.0...v1.17.0) (2025-09-15) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index e69de29..6810bc1 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -0,0 +1,8793 @@ +--- +Build and Deployment: + Build: + Building and testing of artifacts in virtual environments: + uuid: a340f46b-6360-4cb8-847b-a0d3483d09d3 + description: |- + While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of + vulnerable libraries or because they are altered during the delivery phase. + risk: |- + While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of + vulnerable libraries or because they are altered during the delivery phase. + measure: Each step during within the build and testing phase is performed in + a separate virtual environments, which is destroyed afterward. + meta: + implementationGuide: Depending on your environment, usage of virtual machines + or container technology is a good way. After the build, the filesystem should + not be used again in other builds. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 2 + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + references: + samm2: + - I-SB-A-2 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/a340f46b-6360-4cb8-847b-a0d3483d09d3 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Defined build process: + uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b + description: "A *build process* include more than just compiling your source + code. \nIt also includes steps such as managing (third party) dependencies, + \nenvironment configuration, running the unit tests, etc. \n\nA *defined build + process* has automated these steps to ensure consistency.\n\nThis can be done + with a Jenkinsfile, Maven, or similar tools.\n" + risk: Performing builds without a defined process is error prone; for example, + as a result of incorrect security related configuration. + measure: A well defined build process lowers the possibility of errors during + the build process. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 2 + usefulness: 4 + level: 1 + assessment: | + - Show your build pipeline and an exemplary job (build + test). + - Show that every team member has access. + - Show that failed jobs are fixed. + + Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + references: + samm2: + - I-SB-A-1 + iso27001-2017: + - 12.1.1 + - 14.2.2 + iso27001-2022: + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f6f7737f-25a9-4317-8de2-09bf59f29b5b + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Pinning of artifacts: + uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 + risk: Unauthorized manipulation of artifacts might be difficult to spot. For + example, this may result in using images with malicious code. Also, intended + major changes, which are automatically used in an image used might break the + functionality. + measure: Pinning of artifacts ensure that changes are performed only when intended. + comment: The usage of pinning requires a good processes for patching. Therefore, + choose this activity wisely. + meta: + implementationGuide: Pinning artifacts in Dockerfile refers to the practice + of using specific, immutable versions of base images and dependencies in + your build process. Instead of using the latest tag for your base image, + select a specific version or digest. For example, replace FROM node:latest, + to FROM node@sha256:abcdef12. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + tags: + - inventory + implementation: + - uuid: 9368abfb-cf37-477a-9091-a804d2de9148 + name: Signing of containers + tags: + - signing + - container + - build + url: https://www.aquasec.com/cloud-native-academy/supply-chain-security/container-image-signing/ + description: Container technology automatically creates a hash for images, + which can be used. + - uuid: 638b3691-c9a5-45fa-9ba8-e40aeea32766 + name: Immutable images + tags: + - deployment + - container + - build + url: https://kubernetes.io/blog/2022/09/29/enforce-immutability-using-cel/#immutablility-after-first-modification + description: Immutable images are an other way, e.g. by using a registry, + which doesn't allow overriding of images. + dependsOn: + - Defined build process + references: + samm2: + - I-SB-B-1 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 + comments: "" + teamsImplemented: + Default: false + B: false + C: false + SBOM of components: + uuid: 2858ac12-0179-40d9-9acf-1b839c030473 + description: |- + SBOM (Software Bill of Materials) is a document that lists all components, libraries, + and dependencies used in a software application or container image. Creating an SBOM + during the build process can help ensure transparency, security, and license compliance + for your application. + risk: In case a vulnerability of severity high or critical exists, it needs + to be known where an artifacts with that vulnerability is deployed with which + dependencies. + measure: Creation of an SBOM of components (e.g. application and container image + content) during build. + dependsOn: + - Defined build process + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - I-SB-B-1 + - D-TA-A-1 + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/2858ac12-0179-40d9-9acf-1b839c030473 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Signing of artifacts: + uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 + risk: Execution or usage of malicious code or data e.g. via executables, libraries + or container images. + measure: Digitally signing artifacts for all steps during the build and especially + docker images, helps to ensure their integrity and authenticity. + description: "To perform a push to a GitHub repository, you must be authenticated. + It's important to note that GitHub does not verify if the authenticated user's + email address matches the one in the commit.\nTo clearly identify the author + of a commit for reviewers, commit signing is recommended.\n\nGitHub actions + such as [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) + do not automatically sign commits and may encounter issues as a result. \n\nTo + address this, you can refer to a working configuration example in the [workflow + folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) + of DSOMM, which demonstrates how to use semantic release action in conjunction + with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action).\nFor + added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) + provided by your organization for a specific repository. Store the Personal + Access Token (PAT) as a secret in your project." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 5 + implementation: + - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + dependsOn: + - Defined build process + - Pinning of artifacts + references: + samm2: + - I-SB-A-1 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/5786959d-0c6f-46a6-8e1c-a32ff1a50222 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Signing of code: + uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 + risk: Execution or usage of malicious code or data e.g. via executables, libraries + or container images. + measure: Digitally signing commits helps to prevent unauthorized manipulation + of source code. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + dependsOn: + - Defined build process + references: + samm2: + - I-SB-A-2 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/9f107927-61e9-4574-85ad-3f2b4bca8665 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Deployment: + Blue/Green Deployment: + uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 + risk: A new artifact's version can have unknown defects. + measure: |- + Using a blue/green deployment strategy increases application availability + and reduces deployment risk by simplifying the rollback process if a deployment fails. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 5 + implementation: + - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + dependsOn: + - Smoke Test + references: + samm2: + - I-SD-A-3 + iso27001-2017: + - 17.2.1 + - 12.1.1 + - 12.1.2 + - 12.1.4 + - 12.5.1 + - 14.2.9 + iso27001-2022: + - 8.14 + - 5.37 + - 8.31 + - 8.32 + - 8.19 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0cb2626b-fb0d-4a0f-9688-57f787310d97 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Defined decommissioning process: + uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 + description: |- + The decommissioning process in the context of Docker and Kubernetes involves + retiring Docker containers, images, and Kubernetes resources that are no longer + needed or have been replaced. This process must be carefully executed to avoid + impacting other services and applications. + risk: Unused applications are not maintained and may contain vulnerabilities. + Once exploited they can be used to attack other applications or to perform + lateral movements within the organization. + measure: A clear decommissioning process ensures the removal of unused applications + from the `Inventory of production components` and if implemented from `Inventory + of production artifacts`. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 2 + references: + samm2: + - O-OM-B-2 + iso27001-2017: + - 11.2.7 + iso27001-2022: + - 7.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/da4ff665-dcb9-4e93-9d20-48cdedc50fc2 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Defined deployment process: + uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a + risk: Deployment of insecure or malfunctioning artifacts. + measure: Defining a deployment process ensures that there are established criteria + in terms of functionalities, security, compliance, and performance, and that + the artifacts meet them. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + dependsOn: + - Defined build process + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + references: + samm2: + - I-SD-A-1 + iso27001-2017: + - 12.1.1 + - 14.2.2 + iso27001-2022: + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Environment depending configuration parameters (secrets): + uuid: df428c9d-efa0-4226-9f47-a15bb53f822b + risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. + container images) through process listing (e.g. ps -ef). + measure: Set configuration parameters via environment variables stored using + specific platform functionalities or secrets management systems (e.g. Kubernetes + secrets or Hashicorp Vault). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. + references: + samm2: + - I-SD-B-1 + iso27001-2017: + - 9.4.5 + - 14.2.6 + iso27001-2022: + - 8.4 + - 8.31 + d3f: + - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/df428c9d-efa0-4226-9f47-a15bb53f822b + tags: + - secret + teamsImplemented: + Default: false + B: false + C: false + Evaluation of the trust of used components: + uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba + risk: Application and system components like Open Source libraries or images + can have implementation flaws or deployment flaws. Developers or operations + might start random images in the production cluster which have malicious code + or known vulnerabilities. + measure: Each components source is evaluated to be trusted. For example the + source, number of developers included, email configuration used by maintainers + to prevent maintainer account theft, typo-squatting, ... Create image assessment + criteria, perform an evaluation of images and create a whitelist of artifacts/container + images/virtual machine images. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0de465a6-55a7-4343-af79-948bb5ff10ba + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Handover of confidential parameters: + uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a + risk: Parameters are often used to set credentials, for example by starting + containers or applications; these parameters can often be seen by any one + listing running processes on the target system. + measure: Encryption ensures confidentiality of credentials e.g. from unauthorized + access on the file system. Also, the usage of a credential management system + can help protect credentials. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: "" + dependsOn: + - Environment depending configuration parameters (secrets) + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 14.1.3 + - 13.1.3 + - 9.4.3 + - 9.4.1 + - 10.1.2 + iso27001-2022: + - 8.33 + - 8.22 + - 5.17 + - 8.3 + - 8.24 + d3f: + - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/94a96f79-8bd6-4904-97c0-994ff88f176a + tags: + - secret + teamsImplemented: + Default: false + B: false + C: false + Inventory of production artifacts: + uuid: 83057028-0b77-4d2e-8135-40969768ae88 + risk: In case a vulnerability of severity high or critical exists, it needs + to be known where an artifacts (e.g. container image) with that vulnerability + is deployed. + measure: A documented inventory of artifacts in production like container images + exists (gathered manually or automatically). + dependsOn: + - Defined deployment process + - Inventory of production components + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + references: + samm2: + - I-SB-B-1 + - D-TA-B-1 + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/83057028-0b77-4d2e-8135-40969768ae88 + tags: + - inventory + teamsImplemented: + Default: false + B: false + C: false + Inventory of production components: + uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + risk: An organization is unaware of components like applications in production. + Not knowing existing applications in production leads to not assessing it. + measure: |- + A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. + In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. + dependsOn: + - Defined deployment process + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + references: + samm2: + - I-SB-B-1 + - D-TA-B-1 + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/2a44b708-734f-4463-b0cb-86dc46344b2f + tags: + - inventory + teamsImplemented: + Default: false + B: false + C: false + Inventory of production dependencies: + uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 + risk: Delayed identification of components and their vulnerabilities in production. + In case a vulnerability is known by the organization, it needs to be known + where an artifacts with that vulnerability is deployed with which dependencies. + measure: A documented inventory of dependencies used in artifacts like container + images and containers exists. + dependsOn: + - Inventory of production artifacts + - SBOM of components + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 3 + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + references: + samm2: + - I-SB-B-3 + - I-SB-B-2 + - I-SB-B-1 + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/13e9757e-58e2-4277-bc0f-eadc674891e6 + comments: "" + tags: + - inventory + - sbom + teamsImplemented: + Default: false + B: false + C: false + Rolling update on deployment: + uuid: 85d52588-f542-4225-a338-20dc22a5508d + risk: While a deployment is performed, the application can not be reached. + measure: A deployment without downtime is performed*. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 3 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + dependsOn: + - Defined deployment process + references: + samm2: + - I-SD-A-2 + - I-SD-A-3 + iso27001-2017: + - 12.5.1 + - 14.2.2 + - 17.2.1 + iso27001-2022: + - 8.19 + - 8.32 + - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/85d52588-f542-4225-a338-20dc22a5508d + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Same artifact for environments: + uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f + risk: Building of an artifact for different environments means that an untested + artifact might reach the production environment. + measure: Building an artifact once and deploying it to different environments + means that only tested artifacts are allowed to reach the production environment + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 4 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + dependsOn: + - Defined build process + references: + samm2: + - I-SD-A-2 + - I-SD-A-3 + iso27001-2017: + - 14.3.1 + - 14.2.8 + - 12.1.4 + iso27001-2022: + - 8.33 + - 8.29 + - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a854b48d-83bd-4f8d-8621-a0bdd470837f + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of feature toggles: + uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad + risk: Using environment variables to enable or disable features can lead to + a situation where a feature is accidentally enabled in the production environment. + measure: Usage of environment independent configuration parameter, called static + feature toggles, mitigates the risk of accidentally enabling insecure features + in production. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 2 + level: 4 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + dependsOn: + - Same artifact for environments + references: + samm2: + - I-SD-A-2 + iso27001-2017: + - 14.3.1 + - 14.2.8 + - 14.2.9 + - 12.1.4 + iso27001-2022: + - 8.33 + - 8.29 + - 8.31 + d3f: + - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a511799b-045e-4b96-9843-7d63d8c1e2ad + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Patch Management: + A patch policy is defined: + uuid: 99415139-6b50-441b-89e1-0aa59accd43d + risk: Vulnerabilities in running artifacts stay for long and might get exploited. + measure: A patch policy for all artifacts (e.g. in images) is defined. How often + is an image rebuilt? + difficultyOfImplementation: + knowledge: 3 + time: 1 + resources: 2 + usefulness: 4 + level: 1 + implementation: [] + references: + samm2: + - O-EM-B-1 + iso27001-2017: + - 12.6.1 + - 12.5.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.19 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/99415139-6b50-441b-89e1-0aa59accd43d + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Automated PRs for patches: + uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 + risk: Components with known (or unknown) vulnerabilities might stay for long + and get exploited, even when a patch is available. + measure: |- + Fast patching of third party component is needed. The DevOps way is to have an automated pull request for new components. This includes + * Applications * Virtualized operating system components (e.g. container images) * Operating Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform) + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 1 + implementation: + - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + references: + samm2: + - O-EM-B-1 + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - "8.8" + - "8.27" + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Automated deployment of automated PRs: + uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d + description: Automated merges of automated created PRs for outdated dependencies. + risk: Even if automated dependencies PRs are merged, they might not be deployed. + This results in vulnerabilities in running artifacts stay for too long and + might get exploited. + measure: | + After merging of an automated dependency PR, automated deployment is needed, + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + dependsOn: + - Automated merge of automated PRs + implementation: + - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/08f27c26-2c6a-47fe-9458-5e88f188085d + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Automated merge of automated PRs: + uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb + description: Automated merges of automated created PRs for outdated dependencies. + risk: Vulnerabilities in running artifacts stay for too long and might get exploited. + measure: | + A good practice is to merge trusted dependencies (e.g. spring boot) after a grace period like one week. + Often, patches, fixes and minor updates are automatically merged. Be aware that automated merging requires a high + automated test coverage. Enforcement of merging of pull requests after a grace period. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + dependsOn: + - Automated PRs for patches + implementation: + - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/f2594f8f-1cd6-45f9-af29-eaf3315698eb + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Nightly build of images (base images): + uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 + description: |- + A base image is a pre-built image that serves as a starting point for building + new images or containers. These base images usually include an operating system, + necessary dependencies, libraries, and other components that are required to run + a specific application or service. Nightly builds of custom base images refer to + an automated process that occurs daily or on a scheduled basis, usually during + nighttime or off-peak hours, to create updated versions of custom base images. + risk: Vulnerabilities in running containers stay for too long and might get + exploited. + measure: Custom base images are getting build at least nightly. In case the + packages in the base image e.g. centos has changed, the build server + triggers the build of depending images. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/34869eaf-f2e1-4926-b0bd-28c43402f057 + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Reduction of the attack surface: + uuid: 16e39c8f-5336-4001-88ed-a552d2447531 + description: |- + Distroless images are minimal, stripped-down base images that contain only the + essential components required to run your application. They do not include package + managers, shells, or any other tools that are commonly found in standard Linux + distributions. Using distroless images can help reduce the attack surface and + overall size of your container images. + risk: Components, dependencies, files or file access rights might have vulnerabilities, + but the they are not needed. + measure: Removal of unneeded components, dependencies, files or file access + rights. For container images the usage of distroless images is recommended. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + references: + samm2: + - I-SB-B-2 + iso27001-2017: + - hardening is missing in ISO 27001 + - 14.2.1 + iso27001-2022: + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/16e39c8f-5336-4001-88ed-a552d2447531 + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Usage of a maximum lifetime for images: + uuid: 485a3383-7f2e-4dba-bb84-479377070904 + description: |- + The maximum lifetime for a Docker container refers to the duration a container + should be allowed to run before it is considered outdated, stale, or insecure. + There is not a fixed, universally applicable maximum lifetime for a Docker + container, as it varies depending on the specific use case, application + requirements, and security needs. As a best practice, it is essential to define + a reasonable maximum lifetime for containers to ensure that you consistently + deploy the most recent, patched, and secure versions of both your custom base + images and third-party images. + risk: Vulnerabilities in images of running containers stay for too long and + might get exploited. Long running containers have potential memory leaks. + A compromised container might get killed by restarting the container (e.g. + in case the attacker has not reached the persistence layer). + measure: A short maximum lifetime for images is defined, e.g. 30 days. The project + images, based on the nightly builded images, are deployed at leased once within + the defined lifetime. Third Party images are deployed at leased once within + the defined lifetime. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-B-1 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/485a3383-7f2e-4dba-bb84-479377070904 + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Usage of a short maximum lifetime for images: + uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e + description: |- + The maximum lifetime for a Docker container refers to the duration a container + should be allowed to run before it is considered outdated, stale, or insecure. + There is not a fixed, universally applicable maximum lifetime for a Docker + container, as it varies depending on the specific use case, application + requirements, and security needs. As a best practice, it is essential to define + a reasonable maximum lifetime for containers to ensure that you consistently + deploy the most recent, patched, and secure versions of both your custom base + images and third-party images. + risk: Vulnerabilities in running containers stay for too long and might get + exploited. + measure: | + A good practice is to perform the build and deployment daily or even just-in-time, when a new component (e.g. package) for the image is available. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service outage + will occur to the end users. \n(2) twice a day a rebuild of images is done. + The rebuilds are put into a automated testing pipeline. If the testing has + no blocking issues the new images will be released for deployment during + the next \"restart\" of a container. What has to be done, is to ensure the + new containers are deployed in some canary deployment manner, this will + ensure that if (and only if) something buggy has been introduced which breaks + functionality the canary deployment will make sure the \"older version\" + is being used and not the buggy newer one." + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch + Management/6b96e5a0-ce34-4ea4-a88f-469d3b84546e + comments: "" + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false +Culture and Organization: + Design: + Conduction of advanced threat modeling: + uuid: ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 + risk: Inadequate identification of business and technical risks. + measure: Threat modeling is performed by using reviewing user stories and producing + security driven data flow diagrams. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 3 + level: 4 + dependsOn: + - Conduction of simple threat modeling on technical level + - Creation of threat modeling processes and standards + description: | + **Example High Maturity Scenario:** + + Based on a detailed threat model defined and updated through code, the team decides the following: + + * Local encrypted caches need to expire and auto-purged. + * Communication channels encrypted and authenticated. + * All secrets persisted in shared secrets store. + * Frontend designed with permissions model integration. + * Permissions matrix defined. + * Input is escaped output is encoded appropriately using well established libraries. + + Source: OWASP Project Integration Project + implementation: + - uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + - uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + references: + samm2: + - D-TA-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Conduction of simple threat modeling on business level: + uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 + risk: Business related threats are discovered too late in the development and + deployment process. + measure: Threat modeling of business functionality is performed during the product + backlog creation to facilitate early detection of security defects. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - D-TA-B-1 + - D-TA-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/48f97f31-931c-46eb-9b3e-e2fec0cd0426 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Conduction of simple threat modeling on technical level: + uuid: 47419324-e263-415b-815d-e7161b6b905e + risk: Technical related threats are discovered too late in the development and + deployment process. + measure: Threat modeling of technical features is performed during the product + sprint planning. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + - uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + description: | + # OWASP SAMM Description + Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. + + Threat modeling is a team exercise, including product owners, architects, security champions, and security testers. At this maturity level, expose teams and stakeholders to threat modeling to increase security awareness and to create a shared vision on the security of the system. + + At maturity level 1, you perform threat modeling ad-hoc for high-risk applications and use simple threat checklists, such as STRIDE. Avoid lengthy workshops and overly detailed lists of low-relevant threats. Perform threat modeling iteratively to align to more iterative development paradigms. If you add new functionality to an existing application, look only into the newly added functions instead of trying to cover the entire scope. A good starting point is the existing diagrams that you annotate during discussion workshops. Always make sure to persist the outcome of a threat modeling discussion for later use. + + Your most important tool to start threat modeling is a whiteboard, smartboard, or a piece of paper. Aim for security awareness, a simple process, and actionable outcomes that you agree upon with your team. Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. + + Source: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + # OWASP Project Integration Description + There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. + + A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). + + OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). + + There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. + + > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ + + ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") + + Last, if the organizations maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. + + ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") + + This practice has the side effect that it trains non-security specialists to think like attackers. + + The outcomes of this stage should help lay the foundation of secure design and considerations. + + **Example Low Maturity Scenario:** + + Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. + + Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. + + Frontend serves data over GraphQL as a thin layer between caching system and end user. + + GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. + + Source: OWASP Project Integration Project + references: + samm2: + - D-TA-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/47419324-e263-415b-815d-e7161b6b905e + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Creation of advanced abuse stories: + uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e + risk: Simple user stories are not going deep enough. Relevant security considerations + are performed. Security flaws are discovered too late in the development and + deployment process + measure: Advanced abuse stories are created as part of threat modeling activities. + difficultyOfImplementation: + knowledge: 4 + time: 2 + resources: 1 + usefulness: 4 + level: 5 + dependsOn: + - Creation of simple abuse stories + implementation: + - uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: Don't Forget EVIL User stories + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + references: + samm2: + - D-TA-B-2 + - V-RT-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 6.1.5 + - May be part of risk assessment + - 8.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 5.8 + - May be part of risk assessment + - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/0a929c3e-ab9a-4206-8761-adf84b74622e + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Creation of simple abuse stories: + uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 + risk: User stories mostly don't consider security implications. Security flaws + are discovered too late in the development and deployment process. + measure: Abuse stories are created during the creation of user stories. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: Don't Forget EVIL User stories + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + dependsOn: + - Conduction of simple threat modeling on technical level + - Creation of threat modeling processes and standards + references: + samm2: + - D-TA-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 6.1.5 + - May be part of risk assessment + - 8.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 5.8 + - May be part of risk assessment + - 5.9 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/bacf85b6-5bc0-405d-b5ba-a5d971467cc1 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Creation of threat modeling processes and standards: + uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e + risk: Inadequate identification of business and technical risks. + measure: Creation of threat modeling processes and standards through the organization + helps to enhance the security culture and provide more structure to the threat + model exercises. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 3 + level: 3 + description: "" + implementation: + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + dependsOn: + - Conduction of simple threat modeling on technical level + references: + samm2: + - D-TA-B-3 + - D-TA-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Information security targets are communicated: + uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 + risk: Employees don't know their organizations security targets. Therefore security + is not considered during development and administration as much as it should + be. + measure: Transparent and timely communication of the security targets by senior + management is essential to ensure teams' buy-in and support. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - G-SM-A-2 + iso27001-2017: + - 5.1.1 + - 7.2.1 + iso27001-2022: + - 5.1 + - 5.4 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/1b9281b9-48e2-4c01-9ac6-9db9931c4885 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Education and Guidance: + Ad-Hoc Security trainings for software developers: + uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 + risk: Understanding security is hard and personnel needs to be trained on it. + Otherwise, flaws like an SQL Injection might be introduced into the software + which might get exploited. + measure: Provide security awareness training for all personnel involved in software + development Ad-Hoc. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-1 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Aligning security in teams: + uuid: f994a55d-71bb-45a4-a887-0a213d72c504 + risk: The concept of Security Champions might suggest that only he/she is responsible + for security. However, everyone in the project team should be responsible + for security. + measure: By aligning security Subject Matter Experts with project teams, a higher + security standard can be achieved. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 1 + usefulness: 5 + implementation: + - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + level: 4 + references: + samm2: + - G-EG-B-3 + iso27001-2017: + - 7.1.1 + iso27001-2022: + - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f994a55d-71bb-45a4-a887-0a213d72c504 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Conduction of build-it, break-it, fix-it contests: + uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 + risk: Understanding security is hard, even for security champions and the conduction + of security training often focuses on breaking a component instead of building + a component secure. + measure: The build-it, break-it, fix-it contest allows to train people with + security related roles like security champions the build, break and fix part + of a secure application. This increases the learning of building secure components. + difficultyOfImplementation: + knowledge: 5 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + references: + samm2: + - G-EG-A-2 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/bfdb576e-a416-4ec6-96fe-a078d58b2ff8 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Conduction of collaborative security checks with developers and system administrators: + uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 + risk: Security checks by external companies do not increase the understanding + of an application/system for internal employees. + measure: Periodically security reviews of source code (SCA), in which security + SME, developers and operations are involved, are effective at increasing the + robustness of software and the security knowledge of the teams involved. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 5 + implementation: [] + references: + samm2: + - G-EG-A-2 + - G-EG-B-2 + iso27001-2017: + - Mutual review of source code is not explicitly required in ISO 27001 may + be + - 7.2.2 + - 12.6.1 + - 12.7.1 + iso27001-2022: + - Mutual review of source code is not explicitly required in ISO 27001 may + be + - 6.3 + - 8.8 + - 8.34 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/95caef96-36ed-458c-a087-5c35d4f9dec2 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Conduction of collaborative team security checks: + uuid: 35446784-7610-40d9-af9e-d43f3173bf8c + risk: Development teams limited insight over security practices. + measure: Mutual security testing the security of other teams project enhances + security awareness and knowledge. + difficultyOfImplementation: + resources: 2 + knowledge: 4 + time: 4 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - G-EG-A-1 + - G-EG-A-2 + iso27001-2017: + - Mutual security testing is not explicitly required in ISO 27001 may be + - 7.2.2 + iso27001-2022: + - Mutual security testing is not explicitly required in ISO 27001 may be + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/35446784-7610-40d9-af9e-d43f3173bf8c + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Conduction of war games: + uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 + risk: Understanding incident response plans during an incident is hard and ineffective. + measure: War Games like activities help train for incidents. Security SMEs create + attack scenarios in a testing environment enabling the trainees to learn how + to react in case of an incident. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 4 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - G-EG-A-2 + - O-IM-B-2 + iso27001-2017: + - War games are not explicitly required in ISO 27001 may be + - 7.2.2 + - 16.1 + - 16.1.5 + iso27001-2022: + - War games are not explicitly required in ISO 27001 may be + - 6.3 + - 5.24 + - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/534f60bf-0995-4314-bb9c-f0f2bf204694 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Each team has a security champion: + uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 + risk: No one feels directly responsible for security and the security champion + does not have enough time to allocate to each team. + measure: Each team defines an individual to be responsible for security. These + individuals are often referred to as 'security champions' + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + description: | + Implement a program where each software development team has a member considered a "Security Champion" who is the liaison between Information Security and developers. Depending on the size and structure of the team the "Security Champion" may be a software developer, tester, or a product manager. The "Security Champion" has a set number of hours per week for Information Security related activities. They participate in periodic briefings to increase awareness and expertise in different security disciplines. "Security Champions" have additional training to help develop these roles as Software Security subject-matter experts. You may need to customize the way you create and support "Security Champions" for cultural reasons. + + The goals of the position are to increase effectiveness and efficiency of application security and compliance and to strengthen the relationship between various teams and Information Security. To achieve these objectives, "Security Champions" assist with researching, verifying, and prioritizing security and compliance related software defects. They are involved in all Risk Assessments, Threat Assessments, and Architectural Reviews to help identify opportunities to remediate security defects by making the architecture of the application more resilient and reducing the attack threat surface. + + [Source: OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/) + implementation: + - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + references: + samm2: + - G-EG-B-1 + - G-EG-B-2 + iso27001-2017: + - Security champions are missing in ISO 27001 most likely + - 7.2.1 + - 7.2.2 + iso27001-2022: + - Security champions are missing in ISO 27001 most likely + - 5.4 + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Office Hours: + uuid: 185d5a74-19dc-4422-be07-44ea35226783 + risk: Developers and Operations are not in contact with the security team and + therefore do not ask prior implementation of (known or unknown) threats- + measure: As a security team, be open for questions and hints during defined + office hours. x x d + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 3 + implementation: ~ + references: + samm2: + - G-EG-A-1 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/185d5a74-19dc-4422-be07-44ea35226783 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Regular security training for all: + uuid: 9768f154-357a-4c06-af6f-d66570677c9b + risk: Understanding security is hard. + measure: Provide security awareness training for all internal personnel involved + in software development on a regular basis like twice in a year for 1-3 days. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 4 + level: 2 + description: | + Conduct security awareness training for all roles currently involved in the management, development, testing, or auditing of the software. The goal is to increase the awareness of application security threats and risks, security best practices, and secure software design principles. Develop training internally or procure it externally. Ideally, deliver training in person so participants can have discussions as a team, but Computer-Based Training (CBT) is also an option. + + Course content should include a range of topics relevant to application security and privacy, while remaining accessible to a non-technical audience. Suitable concepts are secure design principles including Least Privilege, Defense-in-Depth, Fail Secure (Safe), Complete Mediation, Session Management, Open Design, and Psychological Acceptability. Additionally, the training should include references to any organization-wide standards, policies, and procedures defined to improve application security. The OWASP Top 10 vulnerabilities should be covered at a high level. + + Training is mandatory for all employees and contractors involved with software development and includes an auditable sign-off to demonstrate compliance. Consider incorporating innovative ways of delivery (such as gamification) to maximize its effectiveness and combat desensitization. + + [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-1 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/9768f154-357a-4c06-af6f-d66570677c9b + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Regular security training for externals: + uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 + risk: Understanding security is hard. + measure: Provide security awareness training for all personnel including externals + involved in software development on a regular basis. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 + usefulness: 4 + level: 4 + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-2 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/31833d56-35af-4ef3-9300-f23d27646ce7 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Regular security training of security champions: + uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 + risk: Understanding security is hard, even for security champions. + measure: Regular security training of security champions. + assessment: | + - Process Documentation: TODO + - Training Content: TOODO + difficultyOfImplementation: + knowledge: 4 + time: 2 + resources: 2 + usefulness: 5 + level: 2 + implementation: + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + dependsOn: + - Each team has a security champion + references: + samm2: + - D-TA-B-2 + - G-EG-A-1 + iso27001-2017: + - Security champions are missing in ISO 27001 + - 7.2.2 + iso27001-2022: + - Security champions are missing in ISO 27001 + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Reward of good communication: + uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c + risk: Employees are not getting excited about security. + measure: Good communication and transparency encourages cross-organizational + support. Gamification of security is also known to help, examples include + T-Shirts, mugs, cups, gift cards and 'High-Fives'. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + references: + samm2: + - G-EG-B-1 + iso27001-2017: + - not required by ISO 27001 + - interestingly enough A7.2.3 is requiring a process to handle misconduct + but nothing to promote good behavior. + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/91b6f75b-9f4a-4d77-95a2-af7ad3222c7c + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Security Coaching: + uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 + risk: Training does not change behaviour. Therefore, even if security practices + are understood, it's likely that they are not performed. + measure: By coaching teams on security topics using for example the samman coaching + method, teams internalize security practices as new habits in their development + process. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + implementation: + - uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + level: 3 + references: + samm2: + - G-EG-B-3 + iso27001-2017: + - 7.1.1 + iso27001-2022: + - 6.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Security code review: + uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 + risk: Understanding security is hard. + measure: | + The following areas of code tend to have a high-risk of containing security vulnerabilities: + - Crypto implementations / usage + - Parser, unparser + - System configuration + - Authentication, authorization + - Session management + - Request throttling + - :unicorn: (self-developed code, only used in that one software) + description: | + ### Benefits + - New vulnerabilities may be found before reaching production. + - Old vulnerabilities are found and fixed. + assessment: | + - Present the performed reviews (including participants, findings, consequences) and assess whether it is reasonable. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + credits: | + AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + references: + samm2: + - V-ST-B-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/7121b0c7-6ace-4d6b-95d0-94535dbccb57 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Security consulting on request: + uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 + risk: Not asking a security expert when questions regarding security appear + might lead to flaws. + measure: Security consulting to teams is given on request. The security consultants + can be internal or external. + difficultyOfImplementation: + knowledge: 3 + time: 1 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-1 + - G-EG-B-1 + iso27001-2017: + - security consulting is missing in ISO 27001 may be + - 6.1.1 + - 6.1.4 + - 6.1.5 + iso27001-2022: + - Security consulting is missing in ISO 27001 may be + - 5.2 + - 5.6 + - 5.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/0b28367b-75a0-4bae-a926-3725c1bf9bb0 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Security-Lessoned-Learned: + uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 + risk: After an incident, a similar incident might reoccur. + measure: Running a 'lessons learned' session after an incident helps drive continuous + improvement. Regular meetings with security champions are a good place to + share and discuss lessons learned. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - G-EG-B-3 + - O-IM-B-3 + iso27001-2017: + - 16.1.6 + iso27001-2022: + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/58c46807-fee9-448b-b6dd-8050c464ab52 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Simple mob hacking: + uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de + risk: Understanding security is hard. + measure: | + Participate with your whole team in a simple mob hacking session organized by the Security Champion Guild. + In the session the guild presents a vulnerable application and together you look at possible exploits. + Just like in mob programming there is one driver and several navigators. + description: | + ### Guidelines for your simple mob hacking session + - All exploits happen via the user interface. + - No need for security/hacking tools. + - No need for deep technical or security knowledge. + - Use an insecure training app, e.g., [DVWA](https://dvwa.co.uk/) or [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/). + - Encourage active participation, e.g., use small groups. + - Allow enough time for everyone to run at least one exploit. + + ### Benefits + - The team gets an idea of how exploits can look like and how easy applications can be attacked. + - The team understands functional correct working software can be highly insecure and easy to exploit. + difficultyOfImplementation: + knowledge: 5 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + credits: | + AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + references: + samm2: + - G-EG-A-2 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education + and Guidance/535f301a-e8e8-4eda-ad77-a08b035c92de + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Process: + Approval by reviewing any new version: + uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 + risk: An individual might forget to implement security measures to protect source + code or infrastructure components. + measure: On each new version (e.g. Pull Request) of source code or infrastructure + components a security peer review of the changes is performed (two eyes principle) + and approval given by the reviewer. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: [] + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/3f63bdbc-c75f-4780-a941-e6ad42e894e1 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Definition of a change management process: + uuid: b4193d32-3948-47e2-a326-3748c48019a1 + risk: The impact of a change is not controlled because these are not recorded + or documented. + measure: Each change of a system is automatically recorded and adequately logged. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: [] + iso27001-2017: + - 14.2.2 + - 12.1.2 + - 12.4.1 + iso27001-2022: + - 8.32 + - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/b4193d32-3948-47e2-a326-3748c48019a1 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Definition of simple BCDR practices for critical components: + uuid: c72da779-86cc-45b1-a339-190ce5093171 + description: A _Business Continuity and Disaster Recovery_ (BCDR) is a plan + and a process that helps a business to return to normal operations if a disaster + occurs. + risk: If the disaster recovery actions are not clear, you risk slow reaction + and remediation delays. This applies to cyber attacks as well as natural emergencies, + such as a power outage. + measure: By understanding and documenting a business continuity and disaster + recovery (BCDR) plan, the overall availability of systems and applications + is increased. Success factors like responsibilities, Service Level Agreements, + Recovery Point Objectives, Recovery Time Objectives or Failover must be fully + documented and understood by the people involved in the recovery. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 4 + level: 1 + implementation: [] + references: + samm2: + - O-IM-B-2 + iso27001-2017: + - 17.1.1 + iso27001-2022: + - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/c72da779-86cc-45b1-a339-190ce5093171 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Determining the protection requirement: + uuid: 72737130-472c-4984-80f8-9ab2f1c2ed5d + risk: "Not defining the protection requirement of applications can lead to wrong + prioritization, delayed remediation of \ncritical security issues, increasing + the risk of exploitation and potential damage to the organization." + measure: "Defining the protection requirement. \nThe protection requirements + for an application should consider:\n- Processed data criticality\n- Application + accessibility (internal vs. external)\n- Regulatory compliance\n- Other relevant + factors" + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + dependsOn: + - Inventory of production components + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - O-OM-A-2 + - G-PC-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/72737130-472c-4984-80f8-9ab2f1c2ed5d + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false +Implementation: + Application Hardening: + App. Hardening Level 1: + uuid: cf819225-30cb-4702-8e32-60225eedc33d + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 1 + * OWASP Mobile Application Security Verification Standard + + in all applications provides a good baseline. Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + dependsOn: + - App. Hardening Level 1 (50%) + description: | + To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely. + + [...] + + ### Planning aka Requirements Gathering & Analysis + The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. + + ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) + + Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. + + These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. + + In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. + + Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + - uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + references: + samm2: + - D-SR-A-3 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/cf819225-30cb-4702-8e32-60225eedc33d + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + App. Hardening Level 1 (50%): + uuid: b597928e-54d6-48a5-a806-8003dcd56aab + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 1 + * OWASP Mobile Application Security Verification Standard + + in all applications provides a good baseline. Implement 50% of the recommendations. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + description: | + To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jumpstart the development process, but also do so securely. + + [...] + + ### Planning aka Requirements Gathering & Analysis + The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. + + ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) + + Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. + + These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. + + In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. + + Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + - uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + references: + samm2: + - D-SR-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/b597928e-54d6-48a5-a806-8003dcd56aab + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + App. Hardening Level 2: + uuid: ffe86caf-2fec-4630-b514-2db83983984d + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 2 + * OWASP Mobile Application Security Verification Standard Level 2 + + Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 4 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/ffe86caf-2fec-4630-b514-2db83983984d + comments: "" + dependsOn: + - App. Hardening Level 2 (75%) + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + App. Hardening Level 2 (75%): + uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 2 + * OWASP Mobile Application Security Verification Standard Level 2 + + Implement 75% of the recommendations. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-A-3 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/03643ca2-03c2-472b-8e19-956bf02fe9b7 + comments: "" + dependsOn: + - App. Hardening Level 1 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + App. Hardening Level 3: + uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 3 + * OWASP Mobile Application Security Verification Standard + + Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 + usefulness: 4 + level: 5 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-A-3 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a + dependsOn: + - App. Hardening Level 2 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Containers are running as non-root: + uuid: a86c1fbc-28fd-4610-89a3-a7f73acfe45f + risk: |- + There are various reasons to run a container as non-root. Samples are listed: + ## Container Escape Vectors + + - Root privileges significantly increase the chance of breaking container isolation + - Root access can be leveraged to exploit kernel vulnerabilities + - Compromised root containers provide attackers with maximum privileges inside the container + - Greater potential for escaping container boundaries to the host system + + ## Host System Vulnerabilities + + Root containers can potentially: + + - Mount sensitive host filesystems + - Access critical device files + - Modify host network settings + - Interact with host system processes + - Override security controls + + ## Resource Management Issues + + Root privileges may allow containers to: + + - Bypass resource quotas and limits + - Modify control group (cgroup) settings + - Interfere with other containers' resources + - Circumvent memory and CPU restrictions + + Security Boundary Weakening + + - Violates the principle of least privilege + - Provides unnecessary elevated permissions + - Expands the potential attack surface + - Increases the impact of a successful compromise + measure: "Containers are running as non-root. This can be enforced in the image + itself or during runtime parameters \n(e.g. `podman run --user [...]`)." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/a86c1fbc-28fd-4610-89a3-a7f73acfe45f + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Context-aware output encoding: + uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 + description: "**Input validation** stops malicious data from entering your system. + \\\n**Output encoding** neutralizes malicious data before rendering to user, + or the next system.\n\nInput validation and output encoding work together. + Apply both. \n\n**Context-aware output encoding** encodes data differently, + depending on its context. In the sample below the `{{bad_data}}` must be encoded + differently, depending on its context, to render safe HTML.\n\n```html\n
{{bad_data}}
\nClick me\n\n\n```\n" + risk: If an attacker manages to slip though your input validation, the attacker + may gain control over the user session or execute arbitrary actions. + measure: "* Use modern secure frameworks such as React/Angular/Vue/Svelte. The + default method here renders data in a safe way.\n* Use established and well-maintained + encoding libraries such as OWASP\u2019s Java Encoder and Microsoft\u2019s + AntiXSS.\n* Implement content security policies (CSP) to restrict the types + of content that can be loaded and executed.\n" + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: 2d61e48f-bade-4332-a383-adc50c29673a + name: OWASP DOM based XSS Prevention CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html + tags: [] + - uuid: ae97c9b0-308c-4dab-bff9-bf3330a897dc + name: CWE-838 Inappropriate Encoding for Output Context + tags: + - documentation + - cwe + url: https://cwe.mitre.org/data/definitions/838.html + references: + samm2: + - D-SR-A-1 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/e1f37abb-d848-4a3a-b3df-65e91a89dcb7 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Parametrization: + uuid: 00e91a8a-3972-4692-8679-674ab8547486 + description: | + By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well. + + This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed. + + Pay attention to these two lines of code. They seem similar, but behave very differently. + + * `sql.execute("SELECT * FROM table WHERE ID = " + id);` + * `sql.execute("SELECT * FROM table WHERE ID = ?", id);` + The second line is parameterized. The same principle applies to other types, such as command line execution, etc. + risk: "Systems vulnerable to injections may lead to data breaches, loss of data, + \nunauthorized alteration of data, or complete database compromise or downtime.\n\nThis + applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc.\n" + measure: | + * Identify which of the types your application is using. Check that you use: + * Use _parametrized queries_ (or _prepared statements_) + * For database queries, you may also use: + * Use _stored procedures_ () + * Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: d880fa0f-9dbb-454e-a003-d844fad31ab4 + name: OWASP Parameterization CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html + tags: [] + references: + samm2: + - D-SR-A-1 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + Hardening/00e91a8a-3972-4692-8679-674ab8547486 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Secure headers: + uuid: 29318d60-18ce-4526-80ea-f5928e49f639 + risk: | + Missing or misconfigured security headers can lead to various security vulnerabilities, e.g.: + - Cross-Site Scripting (XSS) due to missing Content Security Policy + - Clickjacking attacks due to missing X-Frame-Options + - Information disclosure through Server header exposure + - SSL/TLS downgrade attacks due to missing HSTS + - Cross-site scripting and injection due to missing security headers + measure: | + Implement and enforce security headers across all applications and services + + Implementation Methods: + 1. Reverse Proxy/Load Balancer: Configure at nginx/Apache level + 2. Web Application: Implement in the application middleware + 3. Service Mesh: Configure at the ingress controller level + 4. Standard Docker Image: Use secure base images with preset headers + + Remove or Secure: + - Server header: Hide server version information + - X-Powered-By: Remove technology stack information + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + implementation: + - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: + - header + - documentation + url: https://owasp.org/www-project-secure-headers/ + description: "The OWASP Secure Headers Project (also called OSHP) describes + HTTP response headers that your application can use \nto increase the security + of your application. Once set, these HTTP response headers can restrict + modern browsers \nfrom running into easily preventable vulnerabilities. + The OWASP Secure Headers Project intends to raise awareness\nand use of + these headers." + meta: + implementationGuide: | + Essential headers: + - Content-Security-Policy: Define trusted sources for content + - Strict-Transport-Security: Enforce HTTPS connections + - X-Frame-Options: Prevent clickjacking attacks + - X-Content-Type-Options: Prevent MIME-type sniffing + - X-XSS-Protection: Enable browser's XSS filtering + - Referrer-Policy: Control information in the Referrer header + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/cre/620-421 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Development and Source Control: + .gitignore: + uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d + risk: Unintended leakage of secrets, debug, or workstation specific data + measure: .gitignore files help prevent accidental commits of secrets, debug, + or workstation specific data + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 5 + level: 4 + dependsOn: [] + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + - 14.2.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/363a3eea-baf9-4010-88ca-bb8186a2989d + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Block force pushes: + uuid: c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 + risk: "Misuse of force push can lead to loss of work. It may overwrite remote + \nbranches without warning, potentially erasing valuable contributions from + team members. This can disrupt collaboration, \ncause data loss, and create + confusion in the development process.\n\nBypassing the pull request process + might remove an important code review step. \nThis increases the risk of merging + low-quality or buggy code into the main branch, potentially introducing bugs + in the codebase." + measure: Mandate blocking of force pushes in the version control platform. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: + - Require a PR before merging + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Dismiss stale PR approvals: + uuid: ea6f69f7-54a5-4922-ac15-a77ff0c16162 + risk: Intentional or accidental alterations in critical branches like main (or + master) through post-approval code additions. + measure: Implement a policy where any commits made after a pull request has + been approved automatically revoke that approval, necessitating a fresh review + and re-approval process. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Require a PR before merging + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/ea6f69f7-54a5-4922-ac15-a77ff0c16162 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Local development linting & style checks performed: + uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 + risk: Insecure or unmaintainable code base. + measure: Integrate static code analysis tools in IDEs. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 5 + description: "" + implementation: + - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + - uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/517b0957-4981-4ac0-b4c7-0d8d1934c474 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Require a PR before merging: + uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + risk: Intentional or accidental alterations in critical branches like main (or + master). + measure: Define source code management system policies (e.g. branch protection + rules, mandatory code reviews from at least one person, ...) to ensure that + changes to critical branches are only possible under defined conditions. These + policies can be implemented at repository level or organization level, depending + on the source code management system. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 2 + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Require status checks to pass: + uuid: ac8730a2-ccc0-465c-9550-d91edae9d5ee + risk: Organizations risk introducing broken builds, quality issues, and security + vulnerabilities into their codebase. + measure: Mandate passing of security related specified status checks, like successful + builds or static application security tests, before proceeding. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Require a PR before merging + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/ac8730a2-ccc0-465c-9550-d91edae9d5ee + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Versioning: + uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f + risk: Deployment of untracked artifacts. + description: Use a version control system platform like Github, Gitlab, Bitbucket, + gittea,... to version your code. + measure: Version artifacts in order to identify deployed features and issues. + This includes application and infrastructure code, jenkins configuration, + container and virtual machine images definitions. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 1 + dependsOn: + - Defined deployment process + implementation: [] + references: + samm2: + - O-EM-A-1 + - I-SB-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + - 14.2.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development + and Source Control/066084c6-1135-4635-9cc5-9e75c7c5459f + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Infrastructure Hardening: + Applications are running in virtualized environments: + uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 + risk: Through a vulnerability in one service on a server, the attacker gains + access to other services running on the same server. + measure: Applications are running in a dedicated and isolated virtualized environments. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/3a94d55e-fd82-4996-9eb3-20d23ff2a873 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Backup: + uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc + risk: If errors are experienced during the deployment process you want to deploy + an old release. However, due to changes in the database this is often unfeasible. + measure: Performing automated periodical backups are used. Backup before deployment + can help facilitate deployments whilst testing the backup restore processes. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + dependsOn: + - Defined deployment process + references: + samm2: + - TODO + iso27001-2017: + - 12.3 + - 14.2.6 + iso27001-2022: + - 8.13 + - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5c61fd6b-8106-4c68-ac28-a8a42f1c67dc + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Baseline Hardening of the environment: + uuid: 5992c38c-8597-4035-89db-d15820d81c3a + risk: Using default configurations for a cluster environment leads to potential + risks. + measure: Harden environments according to best practices. Level 1 and partially + level 2 from hardening practices like 'CIS Kubernetes Bench for Security' + should be considered. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 4 + level: 2 + implementation: + - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Benchmark for Security + tags: [] + url: https://www.cisecurity.org/benchmark/kubernetes + - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Benchmark for Security + tags: [] + url: https://www.cisecurity.org/benchmark/docker + - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + - uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/containers/ + description: Attack matrix for containers + - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - system hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/5992c38c-8597-4035-89db-d15820d81c3a + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Filter outgoing traffic: + uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d + risk: A compromised infrastructure component might try to send out stolen data. + measure: Having a whitelist and explicitly allowing egress traffic provides + the ability to stop unauthorized data leakage. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 2 + level: 3 + dependsOn: [] + implementation: + - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/6df508ef-86fc-4c22-bd9f-646c3127ce7d + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Hardening of the Environment: + uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 + risk: Using default configurations for a cluster environment leads to potential + risks. + measure: Harden environments according to best practices. Level 2 and partially + level 3 from hardening practices like 'CIS Kubernetes Bench for Security' + should be considered. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Benchmark for Security + tags: [] + url: https://www.cisecurity.org/benchmark/kubernetes + - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Benchmark for Security + tags: [] + url: https://www.cisecurity.org/benchmark/docker + - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + - uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/containers/ + description: Attack matrix for containers + - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/dcf9601b-b4f2-4e25-9143-e39af75f7c33 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Immutable infrastructure: + uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 + risk: The availability of IT systems might be disturbed due to components failures + measure: Redundancies in the IT systems + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + dependsOn: + - Infrastructure as Code + implementation: + - uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 17.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/48e92bb1-fdba-40e8-b6c2-35de0d431833 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Infrastructure as Code: + uuid: 8b994601-575e-4ea5-b228-accb18c8e514 + risk: No tracking of changes in systems might lead to errors in the configuration. + In additions, it might lead to unauthorized changes. An examples is jenkins. + measure: Systems are setup by code. A full environment can be provisioned. In + addition, software like Jenkins 2 can be setup and configured in in code too. + The code should be stored in a version control system. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 4 + usefulness: 4 + level: 3 + implementation: + - uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + - uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8b994601-575e-4ea5-b228-accb18c8e514 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Isolated networks for virtual environments: + uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 + risk: Virtual environments in default settings are able to access other virtual + environments on the network stack. By using virtual machines, it is often + possible to connect to other virtual machines. By using docker, one bridge + is used by default so that all containers on one host can communicate with + each other. + measure: The communication between virtual environments is controlled and regulated. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 2 + dependsOn: [] + implementation: + - uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/4ce24abd-8ba6-494c-828d-4d193e28e4a1 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Limitation of system events: + uuid: e5386abf-9154-4752-a1a8-c3a8900f732d + risk: System events (system calls) can lead to privilege escalation. + measure: System calls are limited. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 5 + level: 3 + dependsOn: + - Audit of system events + implementation: + - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e5386abf-9154-4752-a1a8-c3a8900f732d + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + MFA: + uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de + risk: One factor authentication is more vulnerable to brute force attacks and + is considered less secure. + measure: Two ore more factor authentication for all accounts on all (important) + systems and applications + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 2 + dependsOn: + - MFA for admins + implementation: + - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey - Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 9.2.4 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.17 + - 5.3 + - 8.25 + d3f: + - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/598e9f13-1ac8-4a01-b85e-8fab93ee81de + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + MFA for admins: + uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 + risk: One factor authentication is more vulnerable to brute force attacks and + is considered less secure. + measure: Two ore more factor authentication for all privileged accounts on systems + and applications + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 1 + implementation: + - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey - Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 9.2.4 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.17 + - 5.3 + - 8.25 + d3f: + - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/8098e416-e1ed-4ae4-a561-83efbe76bf57 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Production near environments are used by developers: + uuid: e14de741-94b3-447c-8b07-eea947d82e61 + risk: In case an errors occurs in production, the developer need to be able + to create a production near environment on a local development environment. + measure: Usage of infrastructure as code helps to create a production near environment. + The developer needs to be trained in order to setup a local development environment. + In addition, it should be possible to create production like test data. Often + personal identifiable information is anonymized in order to comply with data + protection laws. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 4 + level: 4 + dependsOn: + - Defined deployment process + - Infrastructure as Code + implementation: [] + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - 12.1.4 + - 17.2.1 + iso27001-2022: + - 8.31 + - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/e14de741-94b3-447c-8b07-eea947d82e61 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Role based authentication and authorization: + uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 + risk: Everyone is able to get unauthorized access to information on systems + or to modify information unauthorized on systems. + measure: The usage of a (role based) access control helps to restrict system + access to authorized users. And enhancement is to use attribute based access + control. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + dependsOn: + - Defined deployment process + - Defined build process + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - 9.4.1 + iso27001-2022: + - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/070bb14b-e04a-4f3d-896a-a08eba7a35f9 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Simple access control for systems: + uuid: 82e499d1-f463-4a4b-be90-68812a874af6 + risk: Attackers a gaining access to internal systems and application interfaces + measure: All internal systems are using simple authentication + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 1 + dependsOn: + - Defined deployment process + implementation: + - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 9.4.1 + iso27001-2022: + - 8.3 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/82e499d1-f463-4a4b-be90-68812a874af6 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of a chaos technology: + uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe + risk: Due to manual changes on a system, they are not replaceable anymore. In + case of a crash it might happen that a planned redundant system is unavailable. + In addition, it is hard to replay manual changes. + measure: A randomized periodically shutdown of systems makes sure, that nobody + will perform manual changes to a system. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 5 + usefulness: 3 + level: 4 + implementation: + - uuid: c117e79b-8223-4e55-9da5-efbf5d741c15 + name: Chaos Monkey + tags: + - chaos + - testing + url: https://github.com/Netflix/chaosmonkey + description: Chaos Monkey is a resiliency tool that helps applications tolerate + random instance failures. Chaos Monkey randomly terminates virtual machine + instances and containers that run inside of your production environment. + Exposing engineers to failures more frequently incentivizes them to build + resilient services. + references: + samm2: + - O-EM-A-3 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 17.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f8e80f18-2503-4e3e-b3bc-7f67bb28defe + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of an security account: + uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 + risk: Having security auditing in the same account as infrastructure and applications + at the cloud provide might cause evil administrators (or threat actors taking + over an account of an administrator) to alter evidence like audit logs. + measure: Usage of a separate account dedicated for security activities. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 + usefulness: 4 + level: 2 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/746025a6-dbfb-4087-a000-e46acab64ee1 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of edge encryption at transit: + uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 + risk: Evil actors might be able to perform a man in the middle attack and sniff + confidential information (e.g. authentication factors like passwords). + measure: |- + By using encryption at the edge of traffic in transit, it is impossible + or at least harder to sniff credentials or information being outside of the organization. + + Using standard secure protocols like HTTPS is recommended. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ad23be9c-5661-4f1f-81a3-5a5dc7061629 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of encryption at rest: + uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 + risk: Evil actors might be able to access data and read information, e.g. from + physical hard disks. + measure: By using encryption at rest, it is impossible or at least harder to + to read information. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/0ff45fb8-7eef-46ed-9b3a-84c955cd7060 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of internal encryption at transit: + uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 + risk: Evil actors within the organization of traffic in transit might be able + to perform a man in the middle attack and sniff confidential information (e.g. + authentication factors like passwords) + measure: By using encryption internally, e.g. inside of a cluster, it is impossible + or at least harder to sniff credentials. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 3 + usefulness: 4 + level: 3 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/ecb0184c-6bc9-45da-bbbb-a983797ffc93 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of security by default for components: + uuid: 11b3848e-e931-4146-a35d-35409ada24ee + risk: Components (images, libraries, applications) are not hardened. + measure: Hardening of components is important, specially for image on which + other teams base on. Hardening should be performed on the operation system + and on the services inside (e.g. Nginx or a Java-Application). + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + dependsOn: + - Defined build process + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/11b3848e-e931-4146-a35d-35409ada24ee + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of test and production environments: + uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 + risk: Security tests are not running regularly because test environments are + missing + measure: A test and a production like environment is used + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 4 + level: 2 + dependsOn: + - Defined deployment process + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.4 + - 17.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.31 + - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/bfdacb52-1e3f-431d-ae72-d844a5e86415 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Virtual environments are limited: + uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca + risk: Denial of service (internally by an attacker or unintentionally by a bug) + on one service effects other services + measure: All virtual environments are using resource limits on hard disks, memory + and CPU + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + dependsOn: + - Applications are running in virtualized environments + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 12.1.3 + - 13.1.3 + - 17.2.1 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.6 + - 8.22 + - 8.14 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/760f1056-b0ee-4f22-a35b-f65446f944ca + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + WAF Advanced: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced + risk: The presence of sophisticated threats necessitates a robust defense strategy + where application inputs are meticulously scrutinized for security breaches, + including advanced persistent threats and zero-day vulnerabilities. + measure: |- + An advanced WAF protection level includes rigorous input validation, rejecting any parameters not explicitly required, and custom rule sets that are dynamically updated in response to emerging threats. + The advanced WAF setup is designed to ensure all data is in the correct format and any superfluous input parameters are automatically rejected. It includes machine learning algorithms to detect anomalies, custom-developed rules for real-time traffic analysis, and seamless integration with existing security infrastructures to adapt to the ever-changing threat landscape. + description: | + This advanced configuration goes beyond typical WAF implementations by enforcing strict input format checks and parameter validation to prevent any unauthorized or malformed data from compromising the application. + + Sample Steps: + - Implement strict data type and format validation rules to ensure only correctly formatted data is processed. + - Establish a denylist for all parameters that are not explicitly required, blocking them by default. + - Develop and continuously refine custom rulesets based on the application's traffic patterns, user behavior, and known vulnerabilities. + - Integrate machine learning algorithms to enhance anomaly detection and automatic rule adjustment. + - Correlate and analyze WAF logs with other security systems like SIEM for comprehensive threat intelligence. + - Conduct regular red team exercises to test and validate the effectiveness of the WAF configurations against simulated advanced attack scenarios. + - Activate automated threat response mechanisms to immediately neutralize detected threats. + + Embracing an advanced WAF setup requires a proactive approach, with continuous improvement and updating of security measures to ensure all inputs are scrutinized and validated, thus maintaining a resilient security posture against sophisticated attacks. + + There are debates on how useful a WAF is for APIs. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 5 + usefulness: 4 + level: 5 + dependsOn: + - WAF medium + implementation: [] + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced + comments: ~ + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + WAF baseline: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b + risk: Vulnerable input, such as exploits, can infiltrate the application via + numerous entry points, posing a significant security threat. + measure: |- + Implementing a web application firewall (WAF) is a critical security control. At a baseline level, the objective is to finely balance the reduction of false positives, maintaining user experience, against a potential increase in the less noticeable false negatives. + Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. + description: | + A baseline WAF configuration provides essential defense against common vulnerabilities, acting as a first line of automated threat detection and response. + Steps: + - Configure WAF in alert mode to establish traffic patterns + - Analyze alerts and adjust sensitivity to optimize for fewer false positives + - Gradually switch to a proactive blocking stance as confidence in the accuracy of the rules increases + + It's crucial to monitor and update the WAF configuration to adapt to evolving threats and minimize the potential for both false positives and false negatives. + + There are debates on how useful a WAF is for APIs. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 3 + usefulness: 3 + level: 3 + dependsOn: + - Context-aware output encoding + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b + comments: ~ + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + WAF medium: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium + risk: The threat from malicious inputs remains high, with exploits seeking to + exploit any vulnerabilities present at the various points of entry to the + application. + measure: |- + A WAF deployed with a medium level of protection strengthens the security posture by striking a more advanced balance between the detection of genuine threats and the minimization of false alarms. + Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. + description: "A medium-level WAF configuration builds upon the baseline to offer + a more nuanced and responsive defense mechanism against a wider array of threats.\n\nSample + steps:\n - Implement an enhanced set of WAF rules based on baseline data\n + \ - Continuous monitoring and fine-tuning of the WAF configuration\n - Develop + a strategic incident response plan utilizing WAF insights \n \nThe + medium configuration requires diligent management and continuous improvement + to address new vulnerabilities while maintaining the integrity of application + access.\n\nThere are debates on how useful a WAF is for APIs.\n" + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 4 + usefulness: 3 + level: 4 + dependsOn: + - WAF baseline + implementation: [] + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure + Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium + comments: ~ + tags: + - none + teamsImplemented: + Default: false + B: false + C: false +Information Gathering: + Logging: + Analyze logs: + uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 + risk: Not aware of attacks happening. + measure: Check logs for keywords. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/b217c8bb-5d61-4b41-a675-1083993f83b1 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Centralized application logging: + uuid: fe875e17-ae4a-45f8-a359-244aa4fcbc04 + risk: Local stored logs can be unauthorized manipulated by attackers with system + access or might be corrupt after an incident. In addition, it is hard to perform + an correlation of logs. This leads attacks, which can be performed silently. + measure: A centralized logging system is used and applications logs (including + application exceptions) are shipped to it. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 5 + level: 2 + dependsOn: + - Alerting + implementation: [] + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/fe875e17-ae4a-45f8-a359-244aa4fcbc04 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Centralized system logging: + uuid: 4eced38a-7904-4c45-adb0-50b663065540 + risk: Local stored system logs can be unauthorized manipulated by attackers + or might be corrupt after an incident. In addition, it is hard to perform + a aggregation of logs. + measure: By using centralized logging logs are protected against unauthorized + modification. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 1 + implementation: + - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/4eced38a-7904-4c45-adb0-50b663065540 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Correlation of security events: + uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 + risk: Detection of security related events with hints on different systems/tools/metrics + is not possible. + measure: Events are correlated on one system. For example the correlation and + visualization of failed login attempts combined with successful login attempts. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 4 + usefulness: 3 + level: 5 + dependsOn: + - Visualized logging + - Alerting + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccf4561d-253f-4762-adcb-bc4622fd6fc5 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Logging of security events: + uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb + description: | + Implement logging of security relevant events. The following events tend to be security relevant: + - successful/failed login/logout + - creation, change, and deletion of users + - errors during input validation and output creation + - exceptions and errors with security in their name + - transactions of value (e.g., financial transactions, costly operations) + - :unicorn: (special things of your application) + measure: Security-relevant events like login/logout or creation, change, deletion + of users should be logged. + assessment: | + - Show which events are logged. + - Show a test for one event logging. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 2 + credits: | + [AppSecure-nrw](https://github.com/AppSecure-nrw/security-belts/blob/master/orange/logging-of-security-events.md) + implementation: + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - 12.4.1 + iso27001-2022: + - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccfdd0a8-991e-4269-ad77-c0a54ca655cb + risk: |- + * No track of security-relevant events makes it harder to analyze an incident. + * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + PII logging concept: + uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 + risk: Personal identifiable information (PII) is logged and the privacy law + (e.g. General Data Protection Regulation) is not followed. + measure: A concept how to log PII is documented and applied. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + references: + samm2: + - O-OM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + - 18.1.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + - 5.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/613a73dc-4f60-49db-a6ce-4fb7bf8519f9 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Visualized logging: + uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 + risk: System and application protocols are not visualized properly which leads + to no or very limited logging assessment. Specially developers might have + difficulty to read applications logs with unusually tools like the Linux tool + 'cat' + measure: Protocols are visualized in a simple to use real time monitoring system. + The GUI gives the ability to search for special attributes in the protocol. + difficultyOfImplementation: + knowledge: 1 + time: 3 + resources: 3 + usefulness: 4 + level: 3 + dependsOn: + - Centralized system logging + - Centralized application logging + implementation: + - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/7c735089-6a83-419f-8b27-c1e676cedea1 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Monitoring: + Advanced app. metrics: + uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf + risk: People are not looking into tests results. Vulnerabilities not recolonized, + even they are detected by tools. + measure: All defects from the dimension Test- and Verification are instrumented. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - Simple application metrics + - Visualized metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d03bc410-74a7-4e92-82cb-d01a020cb6bf + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Advanced availability and stability metrics: + uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 + risk: Trends and advanced attacks are not detected. + measure: Advanced metrics are gathered in relation to availability and stability. + For example unplanned downtime's per year. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Simple application metrics + - Visualized metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ed715b38-c34b-40cd-83fd-ce807f306fc1 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Alerting: + uuid: 8a442d8e-0eb1-4793-a513-571aef982edd + risk: Incidents are discovered after they happened. + measure: | + Thresholds for metrics are set. In case the thresholds are reached, alarms are send out. Which should get attention due to the critically. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 2 + dependsOn: + - Visualized metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + - I-DM-A-3 + iso27001-2017: + - 16.1.2 + - 16.1.4 + - 12.1.4 + iso27001-2022: + - 6.8 + - 5.25 + - 8.31 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8a442d8e-0eb1-4793-a513-571aef982edd + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Audit of system events: + uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 + risk: System events (system calls) trends and attacks are not detected. + measure: Gathering of system calls. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Visualized metrics + implementation: + - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/1cd5e4b8-be36-4726-adc7-d8f843f47ac8 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Coverage and control metrics: + uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d + risk: The effectiveness of configuration, patch and vulnerability management + is unknown. + measure: "Usage of Coverage- and control-metrics to show the effectiveness of + the security program. Coverage is the degree in \n which a specific + security control for a specific target group is applied with all resources.\n + \ The control degree shows the actual application of security standards + and security-guidelines. Examples are gathering information on anti-virus, + anti-rootkits, patch management, server configuration and vulnerability management." + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - Visualized metrics + implementation: + - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d0d681e7-d6de-4829-ac64-a9eb2546aa0d + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Deactivation of unused metrics: + uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 + risk: High resources are used while gathering unused metrics. + measure: Deactivation of unused metrics helps to free resources. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 3 + dependsOn: + - Visualized metrics + implementation: [] + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/7f36b9ba-bc05-4fd6-9a2a-73344c249722 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Defense metrics: + uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 + risk: IDS/IPS systems like packet- or application-firewalls detect and prevent + attacks. It is not known how many attacks has been detected and blocked. + measure: | + Gathering of defense metrics like TCP/UDP sources enables to assume the geographic location of the request. + Assuming a Kubernetes cluster with an egress-traffic filter (e.g. IP/domain based), an alert might be send out in case of every violation. For ingress-traffic, alerting might not even be considered. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - Visualized metrics + - Filter outgoing traffic + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.4.1 + - 13.1.1 + iso27001-2022: + - 8.15 + - 8.2 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e808028c-351c-42f1-bcd9-fba738d1fc55 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Grouping of metrics: + uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b + risk: The analysis of metrics takes long. + measure: Meaningful grouping of metrics helps to speed up analysis. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 + usefulness: 2 + level: 3 + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/42170a71-d4c8-47af-bd71-bf36875fd05b + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Metrics are combined with tests: + uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 + risk: Changes might cause high load due to programming errors. + measure: Metrics during tests helps to identify programming errors. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 2 + usefulness: 5 + level: 5 + dependsOn: + - Grouping of metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/71699daf-b2a4-466b-a0b2-89f7dbb18506 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Monitoring of costs: + uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e + risk: Not monitoring costs might lead to unexpected high resource consumption + and a high invoice. + measure: Implement cost budgets. Setting of an alert threshold and sending out + errors when it is reached. In the best case, a second threshold with a limit + is set so that the cost can not go higher. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Simple application metrics + - Simple system metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/10e23a8c-22ff-4487-a706-87ccc9d0798e + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Screens with metric visualization: + uuid: 8746647c-638c-473f-8e17-82c068e4c311 + risk: Security related information is discovered too late during an incident. + measure: By having an internal accessible screen with a security related dashboards + helps to visualize incidents. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 5 + level: 4 + dependsOn: + - Grouping of metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8746647c-638c-473f-8e17-82c068e4c311 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Simple application metrics: + uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 + risk: Attacks on an application are not recognized. + measure: |- + Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: + - Authentication attempts (successful/failed logins) + - Transaction volumes and patterns (e.g. orders, payments) + - API call rates and response times + - User session metrics + - Resource utilization + + Example: An e-commerce application normally processes 100 orders per hour. A sudden spike to 1000 orders per hour could indicate either: + - A legitimate event (unannounced marketing campaign, viral social media post) + - A security incident (automated bulk purchase bots, credential stuffing attack) + + By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 5 + level: 1 + implementation: + - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - 12.4.1 + iso27001-2022: + - 8.15 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e9a6d403-a467-445e-b98a-74f0c29da0b1 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Simple budget metrics: + uuid: f08a3219-6941-43ec-8762-4aff739f4664 + risk: Not getting notified about reaching the end of the budget (e.g. due to + a denial of service) creates unexpected costs. + measure: Cloud providers often provide insight into budgets. A threshold and + alarming for the budget is set. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 5 + level: 1 + implementation: + - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/f08a3219-6941-43ec-8762-4aff739f4664 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Simple system metrics: + uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 + risk: Without simple metrics analysis of incidents are hard. In case an application + uses a lot of CPU from time to time, it is hard for a developer to find out + the source with Linux commands. + measure: Gathering of system metrics helps to identify incidents and specially + bottlenecks like in CPU usage, memory usage and hard disk usage. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 5 + assessment: | + Are system metrics gathered? + level: 1 + implementation: + - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/3d1f4c3b-f713-46d9-933a-54a014a26c03 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Targeted alerting: + uuid: d6f06ae8-401a-4f44-85df-1079247fa030 + risk: People are bored (ignorant) of incident alarm messages, as they are not + responsible to react. + measure: By the definition of target groups for incidents people are only getting + alarms for incidents they are in charge for. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 3 + dependsOn: + - Alerting + implementation: [] + references: + samm2: + - O-IM-A-2 + - I-DM-A-3 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.26 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d6f06ae8-401a-4f44-85df-1079247fa030 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Visualized metrics: + uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 + risk: Not visualized metrics lead to restricted usage of metrics. + measure: Metrics are visualized in real time in a user friendly way. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Simple application metrics + - Simple system metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ded39bcf-4eaa-4c5f-9c94-09acde0a4734 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test KPI: + Fix rate per repo/product: + uuid: cf0d600e-114d-4887-9059-d81c53805f0d + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of the number of vulnerabilities handled + per severity level for components such as applications, ensuring alignment + with SLAs. \nThe rate should be broken down by team, product, application, + repository, and/or service. This analysis should be conducted at least quarterly." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/cf0d600e-114d-4887-9059-d81c53805f0d + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false + Generation of response statistics: + uuid: c922981b-65ed-40f3-a947-96fee9a0125f + risk: No or delayed reaction to findings leads to potential exploitation of + findings. + measure: Creation and response statistics (e.g. Mean Time to Resolution) of + findings. This is also referred to as _Mean Time to Resolve_. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + dependsOn: + - Usage of a vulnerability management system + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-B-2 + - I-SB-B-3 + iso27001-2017: + - 16.1.4 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/c922981b-65ed-40f3-a947-96fee9a0125f + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) + generates statistics from OWASP DefectDojo and places the results in a [Github + repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). + teamsImplemented: + Default: false + B: false + C: false + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: Failing to convey the number of vulnerabilities by severity might undermine + the effectiveness of product teams. This might lead to ignorance of findings. + measure: Measurement and communication of vulnerabilities per severity for components + like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/bc548cba-cb82-4f76-bd4b-325d9d256279 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurement + teamsImplemented: + Default: false + B: false + C: false + Number of vulnerabilities/severity/layer: + uuid: 0ec92899-a5cb-4649-984b-2fb1d6c784ad + risk: Failing to convey the number of vulnerabilities by severity and layer + (app/infra) might undermine the effectiveness of product teams. This might + lead to ignorance of findings. + measure: Measurement and communication of vulnerabilities per severity for components + like applications and split it depending on the layer (e.g. app/infra). At + least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + Layers to consider (SCA): + - Cloud provider (if insights are possible) + - Runtimes, e.g. Kubernetes nodes + - Base images and container images + - Application + + Layers to consider SAST/DAST: + - Cloud provider + - Runtime, e.g. Kubernetes + - Base images and container images + - Application + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/0ec92899-a5cb-4649-984b-2fb1d6c784ad + tags: + - vulnerability-mgmt + - metrics + - vmm-measurement + teamsImplemented: + Default: false + B: false + C: false + Patching mean time to resolution via PR: + uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 + risk: Without measuring Mean Time to Resolution (MTTR) related to patching, + it is challenging to identify delays in the patching process. Unaddressed + vulnerabilities can be exploited by attackers, leading to potential security + breaches and data loss. + measure: "Measurement and communication of patching Mean Time to Resolution + (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least + on a quarterly basis.\nThis includes the measurement of the existence of a + properly configured automated pull request (PR) tool (e.g., Dependabot or + Renovate) in a repository. \nIn addition, the measurement of the time from + opening an automated PR to merging it.\n\nAverage time to patch is visualized + per component/project/team." + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Automated PRs for patches + implementation: [] + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/86d490b9-d798-4a5b-a011-ab9688014c46 + tags: + - patching + - metrics + - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false + Patching mean time to resolution via production: + uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f + risk: Without measuring Mean Time to Resolution (MTTR) related to patching, + it is challenging to identify delays in the patching process. Unaddressed + vulnerabilities can be exploited by attackers, leading to potential security + breaches and data loss. + measure: |- + Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + Average time to patch is visualized per component/project/team. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 4 + dependsOn: + - Patching mean time to resolution via PR + - Automated PRs for patches + implementation: [] + references: + samm2: + - I-DM-B-2 + iso27001-2017: + - 16.1.4 + iso27001-2022: + - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f + tags: + - patching + - metrics + - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false + SLA per criticality: + uuid: 51f3fce5-b5c8-4683-8c41-e785fe4f3b5f + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of how many of the vulnerabilities handling + per severity for components like applications are aligned to SLAs. \nThis + is performed for the hole organization and doesn't need to be broken down + (yet) on team/product/application. \nAt least quarterly." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test + KPI/51f3fce5-b5c8-4683-8c41-e785fe4f3b5f + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false +Test and Verification: + Application tests: + High coverage of security related module and integration tests: + uuid: 67667c97-c33e-4306-a4e5-e7b1d8e10c5a + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment in not important components. + measure: Implementation of security related tests via unit tests and integration + tests. Including the test of libraries, in case the are not tested already. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 3 + usefulness: 3 + level: 5 + implementation: [] + references: + samm2: + - V-RT-B-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/67667c97-c33e-4306-a4e5-e7b1d8e10c5a + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Security integration tests for important components: + uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment. + measure: Implementation of essential security related integration tests. For + example for authentication and authorization. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 2 + level: 3 + references: + samm2: + - V-RT-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Security unit tests for important components: + uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 + risk: Vulnerabilities are rising due to code changes. + measure: Usage of unit tests to test important security related features like + authentication and authorization. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 2 + comments: | + The integration of module tests takes place during development instead, it highlights vulnerabilities in sub-routines, functions, modules, libraries etc. checked. + A sample implementation of unit tests are explained in the video [Shift-Left-Security with the Security Test Pyramid - Andreas Falk](https://www.youtube.com/watch?v=TzFZy3f7d8E) starting with minute 9. + implementation: + - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + references: + samm2: + - V-RT-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Smoke Test: + uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a + risk: During a deployment an error might happen which leads to non-availability + of the system, a part of the system or a feature. + measure: Integration tests are performed against the production environment + after each deployment. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 4 + implementation: [] + dependsOn: + - Defined deployment process + references: + samm2: + - V-RT-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application + tests/73aaae0b-5d68-4953-9fa4-fd25bf665f2a + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Consolidation: + Advanced visualization of defects: + uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 + risk: Correlation of the vulnerabilities of different tools to have an overview + of the the overall security level per component/project/team is not given. + measure: Findings are visualized per component/project/team. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 1 + usefulness: 2 + level: 4 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + references: + samm2: + - I-DM-A-3 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/7a82020c-94d1-471c-bbd3-5f7fe7df4876 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Artifact-based false positive treatment: + uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + risk: Without artifact-specific false positive handling, teams must repeatedly + triage the same findings across different versions or deployments of the same + component, leading to inefficient use of security resources. + measure: "Implement false positive marking and temporary acceptance of findings + \nbased on specific artifacts (applications, components, or repositories).\nThis + allows teams to suppress findings for specific versions or builds\nwhile maintaining + visibility for future releases." + description: |- + Artifact-based false positive treatment enables more granular control + over finding suppression by linking decisions to specific code artifacts, + container images, or application versions. This approach helps maintain + security oversight while reducing repeated analysis overhead. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Simple false positive treatment + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + references: + samm2: + - I-DM-A-2 + - I-DM-B-2 + - I-SB-B-3 + iso27001-2017: + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + tags: + - false-positive + - defect-management + teamsImplemented: + Default: false + B: false + C: false + Fix based on accessibility: + uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed + risk: Overwhelming volume of security findings from automated testing tools. + This might lead to ignorance of findings. + measure: Implement a simple risk-based prioritization framework for vulnerability + remediation based on accessibility of the applications. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + meta: + implementationGuide: |- + Develop a scoring system for asset accessibility, considering factors like: + - Whether the asset is internet-facing (highly recommended) + - The number of network hops required to reach the asset (recommended) + - Authentication requirements for access (recommended) + dependsOn: + - Treatment of defects with severity high or higher + - Inventory of production components + implementation: ~ + references: + samm2: + - I-DM-A-3 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/0c10a7f7-f78f-49f2-943d-19fdef248fed + tags: + - vuln-action + - defect-management + teamsImplemented: + Default: false + B: false + C: false + Global false positive treatment: + uuid: 9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + risk: Without centralized false positive management across environments, organizations + face inconsistent security decisions, duplicated analysis efforts, and potential + security gaps when the same findings are handled differently across applications + and teams. + measure: "Implement global false positive and acceptance management that applies + \nconsistently across all applications. This enables organization-wide security + decisions and reduces redundant \nanalysis of common false positives." + description: "Global false positive treatment allows (security) teams to make + \norganization-wide decisions about specific vulnerabilities or finding \npatterns. + When a finding is marked as a false positive or temporarily \naccepted at + the global level, this decision automatically applies to \nall applications + in the specified environment, ensuring consistency \nand operational efficiency." + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Artifact-based false positive treatment + - Usage of a vulnerability management system + implementation: ~ + references: + samm2: + - I-DM-B-2 + - I-DM-A-3 + - I-SB-B-3 + iso27001-2017: + - 16.1.3 + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 6.8 + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + tags: + - false-positive + - defect-management + teamsImplemented: + Default: false + B: false + C: false + Integration in development process: + uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d + risk: "Not integrating vulnerability handling into the development process may + result in product teams ignoring findings. \n\nSecurity joke: We will gain + 100% false negatives." + measure: Integration of findings into the development process. E.g. adding findings + to the backlog of products teams. + description: |- + Validating Findings by Security Engineers Pros: + - Ensures accuracy and relevance of findings before they reach product teams + - Reduces false positives, saving development teams time and effort + - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities + + Validating Findings by Security Engineers Cons: + - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations + - May slow down the process if security engineers are overloaded with validation tasks + - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application + + Pushing Findings Directly to Product Teams Pros: + - Accelerates the process by immediately notifying product teams of potential vulnerabilities + - Empowers product teams to take swift action in addressing security issues + Pushing Findings Directly to Product Teams Cons: + - Increases the workload on product teams, potentially leading to frustration + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning sprints, + and managing software releases. It offers features for creating and managing + tasks, assigning them to team members, and monitoring progress through customizable + workflows and dashboards. + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-A-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/aaffa73f-59f6-4267-b0ab-732f3d13e90d + tags: + - vulnerability-mgmt + - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false + Integration of vulnerability issues into the development process: + uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e + risk: To read console output of the build server to search for vulnerabilities + might be difficult. Also, to check a vulnerability management system might + not be a daily task for a developer. + measure: Vulnerabilities are tracked in the teams issue system (e.g. jira). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 2 + level: 3 + implementation: + - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side / + client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.4 + - 16.1.5 + - 16.1.6 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.25 + - 5.26 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/ce970c9b-da94-41cf-bd78-8c15357b7e8e + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Reproducible defect tickets: + uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 + risk: Vulnerability descriptions are hard to understand by staff from operations + and development. + measure: Vulnerabilities include the test procedure to give the staff from operations + and development the ability to reproduce vulnerabilities. This enhances the + understanding of vulnerabilities and therefore the fix have a higher quality. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/27337442-e4b1-4e87-8dc9-ce86fbb79a39 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Simple false positive treatment: + uuid: c1acc8af-312e-4503-a817-a26220c993a0 + risk: As false positive occur during each test, all vulnerabilities might be + ignored. Specially, if tests are automated an run daily. + measure: |- + Findings from security tests must be triaged and outcomes persisted/documented to: + - Prevent re-analysis of known issues in subsequent test runs + - Track accepted risks vs false positives + - Enable consistent decision-making across teams + + At this maturity level, a simple tracking system suffices - tools need only distinguish between "triaged" and "untriaged" findings, without complex categorization. Some tools refer to this as "suppression" of findings. + + Samples for false positive handling: + - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) + - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) + - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + references: + samm2: + - I-DM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.6 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c1acc8af-312e-4503-a817-a26220c993a0 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Simple visualization of defects: + uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 + risk: The security level of a component is not visible. Therefore, the motivation + to enhance the security is not give. + measure: Vulnerabilities are simple visualized. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/55f4c916-3a34-474d-ad96-9a9f7a4f6a83 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Treatment of all defects: + uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d + risk: Vulnerabilities with severity low are not visible. + measure: All vulnerabilities are added to the quality gate. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 1 + usefulness: 2 + level: 5 + implementation: [] + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d + tags: + - vuln-action + - defect-management + comments: "" + teamsImplemented: + Default: false + B: false + C: false + Treatment of defects per protection requirement: + uuid: 2b7cc923-bdaf-43e3-8fb4-a995b7783969 + risk: "Not defining the protection requirement of applications can lead to wrong + prioritization, delayed remediation of \ncritical security issues, increasing + the risk of exploitation and potential damage to the organization." + measure: "Defining the protection requirement and the corresponding handling + of vulnerabilities per severity for components like applications are aligned + to SLAs. \n This is performed for the hole organization and doesn't need to + be broken down (yet) on team/product/application. \n At least quarterly." + description: |- + The protection requirements for an application should consider: + - Data criticality + - Application accessibility (internal vs. external) + - Regulatory compliance + - Other relevant factors + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-A-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/2b7cc923-bdaf-43e3-8fb4-a995b7783969 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + teamsImplemented: + Default: false + B: false + C: false + Treatment of defects with severity high or higher: + uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 + risk: Vulnerabilities with severity high or higher are not visible. + measure: Vulnerabilities with severity high or higher are added to the quality + gate. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + comments: False positive analysis, specially for static analysis, is time consuming. + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 + implementation: [] + tags: + - vuln-action + - defect-management + teamsImplemented: + Default: false + B: false + C: false + Treatment of defects with severity middle: + uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 + risk: Vulnerabilities with severity middle are not visible. + measure: Vulnerabilities with severity middle are added to the quality gate. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + comments: False positive analysis, specially for static analysis, is time consuming. + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 + implementation: [] + tags: + - vuln-action + - defect-management + teamsImplemented: + Default: false + B: false + C: false + Usage of a vulnerability management system: + uuid: 85ba5623-84be-4219-8892-808837be582d + risk: Maintenance of false positives in each tool enforces a high workload. + In addition a correlation of the same finding from different tools is not + possible. + measure: Aggregation of vulnerabilities in one tool reduce the workload to handle + them, e.g. mark as false positives. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 2 + dependsOn: + - Exploit likelihood estimation + - Each team has a security champion + - Office Hours + level: 3 + description: "For known vulnerabilities a processes to estimate the exploit + ability of a vulnerability is recommended.\n\nTo implement a security culture + including training, office hours and security champions can help integrating + \nsecurity scanning at scale. Such activities help to understand why a vulnerability + is potentially critical and needs handling." + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: + - vulnerability management system + url: https://github.com/MaibornWolff/SecObserve + description: | + The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. + references: + samm2: + - I-DM-A-3 + iso27001-2017: + - 12.6.1 + - 16.1.3 + - 16.1.4 + - 16.1.5 + - 16.1.6 + iso27001-2022: + - 8.8 + - 6.8 + - 5.25 + - 5.26 + - 5.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/85ba5623-84be-4219-8892-808837be582d + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Dynamic depth for applications: + Coverage analysis: + uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 + risk: Parts of the service are not still covered by tests. + measure: Check that there are no missing paths in the application with coverage-tools. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 3 + usefulness: 4 + level: 5 + implementation: + - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + - part of periodic review, PDCA + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/d0ba0be5-c573-405f-b905-b7a8f87a9cc7 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Coverage of client side dynamic components: + uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e + risk: Parts of the service are not covered during the scan, because JavaScript + is not getting executed. Therefore, the coverage of client-side dynamic components + is limited, leading to potential security risks and undetected vulnerabilities. + measure: Usage of a spider which executes dynamic content like JavaScript, e.g. + via Selenium. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 4 + level: 2 + dependsOn: + - Usage of different roles + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/9711f871-f79d-4573-8d4f-d2c98fd0d18e + implementation: + - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Coverage of hidden endpoints: + uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 + risk: Hidden endpoints of the service are not getting tracked. + measure: Hidden endpoints are getting detected and included in the vulnerability + scan. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 5 + level: 3 + implementation: + - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + dependsOn: + - Usage of different roles + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/6a9cb303-0f98-48a8-bdcd-56d41c0012b8 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Coverage of more input vectors: + uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc + risk: Parts of the service are not covered. For example specially formatted + or coded parameters are not getting detected as parameter (e.g. parameters + in REST-like URLs, parameters in JSON-Format or base64-coded parameters). + measure: Special parameter and special encodings are defined, so that they get + fuzzed by the used vulnerability scanners. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 1 + usefulness: 4 + level: 3 + dependsOn: + - Usage of different roles + references: + samm2: + - V-RT-B-1 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5e0ff85b-ec89-4ef0-96b1-5695fa0025dc + implementation: + - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Coverage of sequential operations: + uuid: 845f06ec-148c-4c67-9755-7041911dcca5 + risk: Sequential operations like workflows (e.g. login -> put products in the + basket + measure: Sequential operations are defined and checked by the vulnerability + scanner in the defined order. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 5 + level: 3 + implementation: + - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + dependsOn: + - Usage of different roles + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 14.2.8 + - 14.2.3 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/845f06ec-148c-4c67-9755-7041911dcca5 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Coverage of service to service communication: + uuid: 22aab0ef-76ce-4b8c-979c-3699784330db + risk: Service to service communication is not covered. + measure: Service to service communication is dumped and checked. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 2 + usefulness: 3 + level: 5 + dependsOn: + - Simple Scan + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/22aab0ef-76ce-4b8c-979c-3699784330db + implementation: + - uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 + name: Citrus Fresh Integration Testing + tags: + - framework + - testing + url: https://citrusframework.org/ + description: Integration Test framework with focus on messaging applications + and Microservices. + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Simple Scan: + uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 + risk: Deficient security tests are performed. Simple vulnerabilities are not + detected and missing security configurations (e.g. headers) are not set. Fast + feedback is not given. + measure: A simple scan is performed to get a security baseline. In case the + test is done in under 10 minutes, it should be part of the build and deployment + process. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 1 + level: 2 + dependsOn: + - Defined build process + implementation: + - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/07796811-37f9-467c-9ff2-48f346e77ff3 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of different roles: + uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 + risk: Parts of the service are not covered during the scan, because a login + is not performed. + measure: Integration of authentication with all roles used in the service. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 2 + level: 2 + dependsOn: + - Simple Scan + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/65a2d7d9-5441-46bf-a4e3-f76919857750 + implementation: + - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + assessment: For REST APIs, multiple OAuth2 scopes are used. + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Usage of multiple scanners: + uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea + risk: Each vulnerability scanner has different opportunities. By using just + one scanner, some vulnerabilities might not be found. + measure: Usage of multiple spiders and scanner enhance the coverage and the + vulnerabilities. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 1 + level: 4 + dependsOn: + - Usage of different roles + implementation: + - uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for applications/5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Dynamic depth for infrastructure: + Load tests: + uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd + risk: As it is unknown how many requests the systems and applications can serve, + due to an unexpected load the availability is disturbed. + measure: Load test against the production system or a production near system + is performed. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 5 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - V-RT-AB-1 + iso27001-2017: + - 12.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.6 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/ab5725aa-4d53-47b9-96df-c14b3fa93bcd + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for exposed services: + uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 + risk: Standard network segmentation and firewalling has not been performed, + leading to world open cluster management ports. + measure: With the help of tools the network configuration of unintentional exposed + cluster(s) are tested. To identify clusters, all subdomains might need to + be identified with a tool like OWASP Amass to perform port scans based o the + result. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + dependsOn: + - Isolated networks for virtual environments + usefulness: 2 + level: 2 + implementation: + - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for unauthorized installation: + uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a + risk: Unapproved components are used. + measure: Components must be whitelisted. Regular scans on the docker infrastructure + (e.g. cluster) need to be performed, to verify that only standardized base + images are used. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + comments: By preventing teams from trying out new components, innovation might + be hampered + references: + samm2: [] + iso27001-2017: + - 12.5.1 + - 12.6.1 + iso27001-2022: + - 8.19 + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/dccf1949-b9a8-4ce8-b992-6a4a7f3a623a + dependsOn: + - Evaluation of the trust of used components + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for unused Resources: + uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 + risk: Unused resources, specially secrets, might be still valid, but are exposing + information. As an attacker, I compromise a system, gather credentials and + try to use them. + measure: Test for unused resources helps to identify unused resources. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 5 + implementation: + - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6532c1fe-9d23-4228-8722-558ddabca7d4 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test network segmentation: + uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 + risk: Wrong or no network segmentation of pods makes it easier for an attacker + to access a database and extract or modify data. + measure: Cluster internal test needs to be performed. Integration of fine granulated + network segmentation (also between pods in the same namespace). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + dependsOn: + - Isolated networks for virtual environments + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/6d2c3ac6-8afc-4af6-a5e9-6188341aca01 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test of the configuration of cloud environments: + uuid: 7bb70764-9392-4462-935d-e55b2e148199 + risk: Standard hardening practices for cloud environments are not performed + leading to vulnerabilities. + measure: With the help of tools the configuration of virtual environments are + tested. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + - uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + references: + samm2: [] + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/7bb70764-9392-4462-935d-e55b2e148199 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Weak password test: + uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f + risk: Weak passwords in components like applications or systems, specially for + privileged accounts, lead to take over of that account. + measure: Automatic brute force attacks are performed. Specially the usage of + standard accounts like 'admin' and employee user-ids is recommended. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 1 + level: 3 + implementation: + - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 9.4.3 + iso27001-2022: + - 5.17 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic + depth for infrastructure/61e10f9c-e126-4ffa-af12-fdbe0d0a831f + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Static depth for applications: + API design validation: + uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 + risk: Creation of insecure or non-compliant API. + measure: | + Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP + and validate the specification using specific tools. + Checks should be integrated in IDEs and CI/CD pipelines. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.25 + - 8.27 + - 8.28 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 + dependsOn: + - Inventory of production components + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Dead code elimination: + uuid: a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d + risk: Dead code increases the attack surface (use of hard coded credentials + and variables, sensitive information) + measure: Collection of unused code and then manual removal of unused code. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Exclusion of source code duplicates: + uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + risk: Duplicates in source code might influence the stability of the application. + measure: Automatic Detection and manual removal of duplicates in source code. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Exploit likelihood estimation: + uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + risk: Without proper prioritization, organizations may waste time and effort + on low-risk vulnerabilities while neglecting critical ones. + measure: Estimate the likelihood of exploitation by using data (CISA KEV) from + the past or prediction models (e.g. Exploit Prediction Scoring System, EPSS). + description: Severity-based vulnerability triage alone generates a lot false + positives, requiring a more refined approach. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Software Composition Analysis (server side) + implementation: + - uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. + - uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will be + exploited. + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Local development security checks performed: + uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b + risk: Creating and developing code contains code smells and quality issues. + measure: | + Integration of quality and linting plugins with interactive development environment (IDEs). + Implement pre-commit checks to prevent secrets & other security issues being commit to source code. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6e180abc-7c98-4265-b4e9-852cb91b067b + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Software Composition Analysis (client side): + uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 + risk: Client side components might have vulnerabilities. + measure: Tests for known vulnerabilities in components via Software Composition + Analysis of the frontend are performed. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 3 + dependsOn: + - Defined build process + - Inventory of production components + - Exploit likelihood estimation + implementation: + - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + references: + samm2: + - V-ST-A-2 + - I-SB-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/07fe8c4f-ae33-4409-b1b2-cf64cfccea86 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Software Composition Analysis (server side): + uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + description: Use a tool like trivy and concentrate on application related vulnerabilities. + At this stage, ignore vulnerabilities in container base images used in the + service. + risk: Server side components might have vulnerabilities. + measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) + are performed. + difficultyOfImplementation: + knowledge: 1 + time: 3 + resources: 1 + usefulness: 5 + level: 2 + dependsOn: + - Defined build process + - Inventory of production components + implementation: + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + references: + samm2: + - V-ST-A-2 + - I-SB-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/d918cd44-a972-43e9-a974-eff3f4a5dcfe + tags: + - vmm-testing + teamsImplemented: + Default: false + B: false + C: false + Static analysis for all components/libraries: + uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 + risk: Used components like libraries and legacy applications might have vulnerabilities + measure: Usage of a static analysis for all used components. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 + usefulness: 3 + level: 5 + dependsOn: + - Static analysis for important client side components + - Static analysis for important server side components + - Inventory of production components + implementation: [] + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Static analysis for all self written components: + uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 + risk: Parts in the source code of the frontend or middleware have vulnerabilities. + measure: Usage of static analysis tools for all parts of the middleware and + frontend. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 4 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - Static analysis for important client side components + - Static analysis for important server side components + - Inventory of production components + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/ee68331f-9b1d-4f61-844b-b2ea04753a84 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Static analysis for important client side components: + uuid: e237176b-bec5-447d-a926-e37d6dd60e4b + risk: Important parts in the source code of the frontend have vulnerabilities. + measure: Usage of static analysis tools for important parts of the frontend + are used. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - Defined build process + - Inventory of production components + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/e237176b-bec5-447d-a926-e37d6dd60e4b + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Static analysis for important server side components: + uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 + risk: Important parts in the source code of the middleware have vulnerabilities. + measure: Usage of static analysis tools for important parts of the middleware + are used. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - Defined build process + - Inventory of production components + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/6c05c837-8c99-46e2-828b-7c903e27dba4 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Stylistic analysis: + uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 + risk: Unclear or obfuscated code might have unexpected behavior. + measure: Analysis of compliance to style guides of the source code ensures that + source code formatting rules are met (e.g. indentation, loops, ...). + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + - uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for Patch Deployment Time: + uuid: 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 + risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities + in production artifacts. + measure: | + Test of the Patch Deployment Time. + This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - Automated PRs for patches + - Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 + comments: "" + meta: + implementationGuide: Self implementation. This activity is not repeated in + the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure + as well. + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Test for Time to Patch: + uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f + risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities + in production artifacts. + measure: |- + Test of the Time to Patch (e.g. based on Mean Time to Close automatic PRs) + This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + dependsOn: + - Automated PRs for patches + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/13af1227-3dd1-4d4f-a9e9-53deb793c18f + comments: "" + meta: + implementationGuide: Usage of a version control platform API (e.g. github + API) can be used to fetch the information. Consider that `Measure libyears` + might be an alternative to this activity. + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Test libyear: + uuid: 87b54313-fafd-4860-930f-5ef132b3e4ad + risk: Vulnerabilities in running artifacts stay for long and might get exploited. + measure: Test `libyear`, which provides a good insight how good patch management + is. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 + name: libyear + tags: + - patching + - build + url: https://libyear.com/ + description: A simple measure of software dependency freshness. It is a single + number telling you how up-to-date your dependencies are. + dependsOn: + - Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/87b54313-fafd-4860-930f-5ef132b3e4ad + comments: "" + meta: + implementationGuide: | + `libyear` can be integrated into the build process and flag or even better break the build in case the defined threshold (e.g. 30 years) is reached. + An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). + tags: + - patching + teamsImplemented: + Default: false + B: false + C: false + Usage of multiple analyzers: + uuid: 297be001-8d94-41ee-ab29-207020d423c0 + risk: Each vulnerability analyzer has different opportunities. By using just + one analyzer, some vulnerabilities might not be found. + measure: Usage of multiple static tools to find more vulnerabilities. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 1 + level: 4 + dependsOn: + - Software Composition Analysis (server side) + - Software Composition Analysis (client side) + - Static analysis for all self written components + implementation: [] + references: + samm2: + - V-ST-A-3 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for applications/297be001-8d94-41ee-ab29-207020d423c0 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Static depth for infrastructure: + Correlate known vulnerabilities in infrastructure with new image versions: + uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 + risk: TODO. + measure: TODO + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 4 + usefulness: 1 + level: 4 + dependsOn: + - Usage of a maximum lifetime for images + implementation: + - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 12.6.1 + - 14.2.1 + iso27001-2022: + - 8.8 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/7de0ae33-6538-45cd-8222-a1475647ba58 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Software Composition Analysis: + uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad + risk: Known vulnerabilities in infrastructure components like container images + might get exploited. + measure: Check for known vulnerabilities + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 4 + level: 4 + description: Subscribing to Github projects and reading release notes might + help. Software Composition Analysis for infrastructure might help, but is + often too fine-granular. + implementation: + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/26e1c6d5-5632-4ec7-80d2-e564b98732ad + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test cluster deployment resources: + uuid: 621fb6a5-5c0a-4408-826a-068868bb031b + risk: The deployment configuration (e.g. kubernetes deployment resources) might + contain unsecured configurations. + measure: Test the deployment configuration for virtualized environments for + unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/621fb6a5-5c0a-4408-826a-068868bb031b + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for image lifetime: + uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b + risk: Old container images in production indicate that patch management is not + performed and therefore vulnerabilities might exists. + measure: Check the image age of containers in production. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 2 + level: 2 + implementation: + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for malware: + uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d + risk: Third party might include malware. Ether due to the maintainer (e.g. + typo squatting of an image name and using the wrong image) or by an attacker + on behalf of the maintainer with stolen credentials. + measure: Check for malware in components (e.g. container images, VM baseline + images, libraries). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.2.1 + iso27001-2022: + - 8.7 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/837f8f90-adc2-4e6b-9ebb-60c2ee29494d + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for new image version: + uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e + risk: When a new version of an image is available, it might fix security vulnerabilities. + measure: Check for new images of containers in production. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 2 + level: 3 + implementation: [] + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.5 + - 12.2.1 + iso27001-2022: + - 8.8 + - 8.7 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/cb6321aa-0fbf-4996-9e08-05ab26ef4c1e + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for stored secrets in build artifacts: + uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f + risk: Stored secrets in container images or other build artifacts shouldn't + exists because they might be exposed to unauthorized parties. + measure: Test for secrets in container images and other artifacts + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/d5e6303c-d5c6-4d59-b258-a3b9de38a07f + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test for stored secrets in code: + uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c + risk: Stored secrets in git history or directly in code shouldn't exists because + they might be exposed to unauthorized parties. + measure: Test for secrets in code and git history + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/c6e3c812-56e2-41b0-ae01-b7afc41a004c + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test of infrastructure components for known vulnerabilities: + uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 + risk: Infrastructure components might have vulnerabilities. + measure: Test for known vulnerabilities in infrastructure components. Often, + the only way to respond to known vulnerabilities in operating system packages + is to accept the risk and wait for a patch. As the patch needs to be applied + fast when it is available, this activity depends on 'Usage of a maximum life + for images'. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 2 + usefulness: 1 + level: 4 + dependsOn: + - Usage of a maximum lifetime for images + implementation: + - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 12.6.1 + - 14.2.1 + iso27001-2022: + - 8.8 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/13367d8f-e37f-4197-a610-9ffca4fde261 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test of virtualized environments: + uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 + risk: Virtualized environments (e.g. via Container Images) might contains + unsecure configurations. + measure: Test virtualized environments for unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/58825d22-1ce6-4748-af81-0ec9956e4129 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test the cloud configuration: + uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc + risk: Standard hardening practices for cloud environments are not performed + leading to vulnerabilities. + measure: With the help of tools, the configuration of virtual environments are + tested. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test the definition of virtualized environments: + uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e + risk: The definition of virtualized environments (e.g. via Dockerfile) + might contain unsecure configurations. + measure: Test the definition of virtualized environments for unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + meta: + implementationGuide: For containier (images), test that the images are following + best practices like distroless or non-root. + implementation: + - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile and + looks for common traps, mistakes and helps enforce best practices. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - System hardening, virtual environments are not explicitly covered by ISO + 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + - 14.2.1 + iso27001-2022: + - System hardening, virtual environments are not explicitly covered by ISO + 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + - 8.25 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static + depth for infrastructure/8fc3de67-7b8d-420b-8d24-f35928cfed6e + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Test-Intensity: + Creation and application of a testing concept: + uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe + risk: Scans might use a too small or too high test intensity. + measure: A testing concept considering the amount of time per scan/intensity + is created and applied. A dynamic analysis needs more time than a static analysis. + The dynamic scan, depending on the test intensity might be performed on every + commit, every night, every week or once in a month. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 14.2.2 + - 14.2.3 + - 14.2.1 + - 14.2.5 + - 12.6.1 + iso27001-2022: + - 8.25 + - 8.32 + - 8.27 + - 8.8 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/79ef8103-e1ed-4055-8df8-fd2b2015bebe + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Deactivating of unneeded tests: + uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 + risk: As tools cover a wide range of different vulnerability tests, they might + not match the used components. Therefore, they need more time and resources + as they need and the feedback loops takes too much time. + measure: Unneeded tests are deactivated. For example in case the service is + using a Mongo database and no mysql database, the dynamic scan doesn't need + to test for sql injections. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 1 + level: 3 + implementation: [] + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Default settings for intensity: + uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d + risk: Time pressure and ignorance might lead to false predictions for the test + intensity. + measure: The intensity of the used tools are not modified to save time. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 1 + implementation: [] + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/ab0a4b51-3b18-43f1-a6fc-a98e4b28453d + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + High test intensity: + uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 + risk: A too small intensity or a too high confidence might lead to not visible + vulnerabilities. + measure: A deep scan with high test intensity and a low confidence threshold + is performed. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/2ebfc421-8c76-415c-a3b0-fa518915bd10 + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false + Regular automated tests: + uuid: 598897a2-358e-441f-984c-e12ec4f6110a + risk: After pushing source code to the version control system, any delay in + receiving feedback on defects makes them harder for the developer to remediate. + measure: On each push and/or at given intervals automatic security tests are + performed. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 2 + implementation: [] + references: + samm2: + - I-SB-A-3 + - V-ST-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + - 14.2.9 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/598897a2-358e-441f-984c-e12ec4f6110a + comments: "" + tags: + - none + teamsImplemented: + Default: false + B: false + C: false +... From 916f380125eb7dddebfd8418433faa2aaba32a7e Mon Sep 17 00:00:00 2001 From: Stefan Fleckenstein Date: Sun, 9 Nov 2025 08:44:21 +0000 Subject: [PATCH 120/370] SecObserve has been moved --- src/assets/YAML/default/implementations.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index d4b0cdb..de863d7 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -480,9 +480,9 @@ implementations: uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 name: SecObserve tags: [vulnerability management system] - url: https://github.com/MaibornWolff/SecObserve + url: https://github.com/SecObserve/SecObserve description: | - The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. + SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates easily into CI/CD pipelines. sast: uuid: aaad322e-806e-4c51-b78d-6551f7dc376a name: SAST From e89f5d61fdec09c847a345b59fb1e1a024fccf16 Mon Sep 17 00:00:00 2001 From: Stefan Fleckenstein Date: Sun, 9 Nov 2025 15:37:17 +0000 Subject: [PATCH 121/370] Update src/assets/YAML/default/implementations.yaml Co-authored-by: Timo Pagel --- src/assets/YAML/default/implementations.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index de863d7..9e4fb4c 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -482,7 +482,7 @@ implementations: tags: [vulnerability management system] url: https://github.com/SecObserve/SecObserve description: | - SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates easily into CI/CD pipelines. + SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates into CI/CD pipelines. sast: uuid: aaad322e-806e-4c51-b78d-6551f7dc376a name: SAST From a659ac5bc3de324fb364f62b4922c76dc463ff3d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 9 Nov 2025 16:59:06 +0100 Subject: [PATCH 122/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 6810bc1..873ed20 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -6531,9 +6531,9 @@ Test and Verification: name: SecObserve tags: - vulnerability management system - url: https://github.com/MaibornWolff/SecObserve + url: https://github.com/SecObserve/SecObserve description: | - The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools. + SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates into CI/CD pipelines. references: samm2: - I-DM-A-3 From 99c2c7785550f9d14d7350f8fd151fff25879dfa Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 12 Nov 2025 13:55:01 +0100 Subject: [PATCH 123/370] feat: add activties.yaml with new breaking format, not breaking now because the old still exists --- .github/workflows/main.yml | 8 +- .gitignore | 8 +- README.md | 6 + src/assets/script.bash | 148 +++++++++++++++++++++++++ yaml-generation/generateDimensions.php | 23 +++- 5 files changed, 189 insertions(+), 4 deletions(-) create mode 100755 src/assets/script.bash diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 9092663..4f70d0e 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -57,8 +57,12 @@ jobs: run: | docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 docker cp yaml:/var/www/html/src/assets/YAML/generated/generated.yaml src/assets/YAML/generated/generated.yaml - # Commit all changed files back to the repository - - uses: planetscale/ghcommit-action@v0.1.6 + + - name: Replace version placeholder in generated.yaml + run: | + sed -i "s/__VERSION_PLACEHOLDER__/${{ steps.get-version.outputs.version }}/g" src/assets/YAML/generated/generated.yaml + - name: Commit all changed files back to the repository + uses: planetscale/ghcommit-action@v0.1.6 with: commit_message: "🤖 fmt" repo: ${{ github.repository }} diff --git a/.gitignore b/.gitignore index 70387d7..6c64515 100644 --- a/.gitignore +++ b/.gitignore @@ -43,5 +43,11 @@ testem.log .DS_Store Thumbs.db /yaml-generation/vendor/ -# Generated YAML + +/src/assets/YAML/teams.yaml +/src/assets/YAML/meta.yaml + +# Generated /src/assets/YAML/generated/generated.yaml +/src/assets/YAML/activities.yaml +src/assets/YAML/generated/dependency-tree.md \ No newline at end of file diff --git a/README.md b/README.md index 5a3d944..c46d81b 100644 --- a/README.md +++ b/README.md @@ -10,6 +10,12 @@ docker run -ti -v $(pwd)/src/assets/YAML/default:/var/www/html/src/assets/YAML/d docker run -v $(pwd)/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm ``` +## Development +cd yaml-generation +docker run --rm -v $(pwd):/app composer install +cd .. +docker run -ti -v $(pwd)/yaml-generation:/var/www/html/yaml-generation -v $(pwd)/src/assets/YAML/:/var/www/html/src/assets/YAML/ wurstbrot/dsomm-yaml-generation + ## Credits * The dimension _Test and Verification_ is based on Christian Schneiders [Security DevOps Maturity Model (SDOMM)](https://www.christian-schneider.net/SecurityDevOpsMaturityModel.html). _Application tests_ and _Infrastructure tests_ are added by Timo Pagel. Also, the sub-dimension _Static depth_ has been evaluated by security experts at [OWASP Stammtisch Hamburg](https://www.owasp.org/index.php/OWASP_German_Chapter_Stammtisch_Initiative/Hamburg). diff --git a/src/assets/script.bash b/src/assets/script.bash new file mode 100755 index 0000000..4138f6e --- /dev/null +++ b/src/assets/script.bash @@ -0,0 +1,148 @@ +#!/bin/bash + +# Funktion zur Konvertierung von DSOMM zu SAMM Format +convert_dsomm_to_samm() { + local input_file="$1" + local output_file="$2" + + if [[ -z "$input_file" ]]; then + echo "Verwendung: convert_dsomm_to_samm [output_file]" + echo "Beispiel: convert_dsomm_to_samm document.txt converted_document.txt" + return 1 + fi + + if [[ ! -f "$input_file" ]]; then + echo "Fehler: Datei '$input_file' nicht gefunden!" + return 1 + fi + + # Wenn keine Output-Datei angegeben, verwende Input-Datei mit _converted Suffix + if [[ -z "$output_file" ]]; then + output_file="${input_file%.*}_converted.${input_file##*.}" + fi + + echo "Konvertiere DSOMM Referenzen zu SAMM Format..." + echo "Input: $input_file" + echo "Output: $output_file" + + # Sed-Befehl zur Umwandlung: + # Sucht nach Pattern: BUCHSTABE-BUCHSTABEN-ZAHL-BUCHSTABE + # Wandelt um zu: BUCHSTABE-BUCHSTABEN-BUCHSTABE-ZAHL + sed -E 's/([A-Z]+-[A-Z]+)-([0-9]+)-([A-Z]+)/\1-\3-\2/g' "$input_file" > "$output_file" + + echo "Konvertierung abgeschlossen!" + echo "Überprüfe die ersten konvertierten Zeilen:" + head -10 "$output_file" | grep -E '[A-Z]+-[A-Z]+-[A-Z]+-[0-9]+' || echo "Keine konvertierten Referenzen in den ersten 10 Zeilen gefunden." +} + +# Direkte Verwendung für eine einzelne Zeile (für Tests): +convert_single_reference() { + local ref="$1" + echo "$ref" | sed -E 's/([A-Z]+-[A-Z]+)-([0-9]+)-([A-Z]+)/\1-\3-\2/g' +} + +# Beispiel-Test mit den von Ihnen bereitgestellten Referenzen: +echo "=== Test der Konvertierung ===" +echo "Original → Konvertiert:" +echo "G-SM-1-A → $(convert_single_reference 'G-SM-1-A')" +echo "D-TA-2-B → $(convert_single_reference 'D-TA-2-B')" +echo "V-RT-3-A → $(convert_single_reference 'V-RT-3-A')" +echo "O-OM-1-B → $(convert_single_reference 'O-OM-1-B')" + +# Funktion zum Suchen und Konvertieren aller YAML-Dateien +process_all_yaml_files() { + echo "Suche nach YAML-Dateien im aktuellen Verzeichnis und Unterverzeichnissen..." + + # Finde alle .yaml Dateien + mapfile -t yaml_files < <(find . -name "*.yaml" -type f) + + if [[ ${#yaml_files[@]} -eq 0 ]]; then + echo "Keine YAML-Dateien gefunden." + return 1 + fi + + echo "Gefundene YAML-Dateien: ${#yaml_files[@]}" + + # Bestätigung vom Benutzer einholen + echo "" + echo "Folgende YAML-Dateien wurden gefunden:" + printf '%s\n' "${yaml_files[@]}" + echo "" + read -p "Möchten Sie alle diese Dateien konvertieren? (y/N): " -n 1 -r + echo "" + + if [[ ! $REPLY =~ ^[Yy]$ ]]; then + echo "Abgebrochen." + return 0 + fi + + # Backup-Verzeichnis erstellen + backup_dir="./backup_$(date +%Y%m%d_%H%M%S)" + mkdir -p "$backup_dir" + echo "Backups werden in '$backup_dir' erstellt..." + + # Konvertierung durchführen + local converted_count=0 + local total_count=${#yaml_files[@]} + + for yaml_file in "${yaml_files[@]}"; do + echo "Verarbeite: $yaml_file" + + # Backup erstellen + backup_file="$backup_dir/${yaml_file#./}" + mkdir -p "$(dirname "$backup_file")" + cp "$yaml_file" "$backup_file" + + # Prüfen ob DSOMM Referenzen vorhanden sind + if grep -qE '[A-Z]+-[A-Z]+-[0-9]+-[A-Z]+' "$yaml_file"; then + # Konvertierung durchführen (in-place) + sed -i.tmp -E 's/([A-Z]+-[A-Z]+)-([0-9]+)-([A-Z]+)/\1-\3-\2/g' "$yaml_file" + rm "$yaml_file.tmp" 2>/dev/null + ((converted_count++)) + echo " ✓ Konvertiert" + else + echo " - Keine DSOMM Referenzen gefunden" + fi + done + + echo "" + echo "=== Konvertierung abgeschlossen ===" + echo "Verarbeitete Dateien: $total_count" + echo "Konvertierte Dateien: $converted_count" + echo "Backups gespeichert in: $backup_dir" + + if [[ $converted_count -gt 0 ]]; then + echo "" + echo "Beispiele konvertierter Referenzen:" + find . -name "*.yaml" -type f -exec grep -H -E '[A-Z]+-[A-Z]+-[A-Z]+-[0-9]+' {} \; | head -5 + fi +} + +# Hauptfunktion aufrufen wenn Argumente übergeben wurden +if [[ $# -gt 0 ]]; then + if [[ "$1" == "--all-yaml" || "$1" == "-a" ]]; then + process_all_yaml_files + else + convert_dsomm_to_samm "$@" + fi +else + echo "DSOMM zu SAMM Referenz Konverter" + echo "================================" + echo "" + echo "Verwendung:" + echo " $0 [output_file] # Einzelne Datei konvertieren" + echo " $0 --all-yaml | -a # Alle YAML-Dateien konvertieren" + echo "" + echo "Beispiele:" + echo " $0 document.txt" + echo " $0 document.txt converted_document.txt" + echo " $0 --all-yaml # Alle .yaml Dateien im Verzeichnis" + echo "" + echo "Das Script konvertiert DSOMM Referenzen im Format:" + echo "

---" + echo "zu SAMM Format:" + echo "

---" + echo "" + echo "Bei --all-yaml wird automatisch nach .yaml Dateien gesucht und" + echo "Backups vor der Konvertierung erstellt." +fi diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 71d5c20..cc47a3c 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -193,12 +193,33 @@ } -// Store generated data +// Store generated data with meta document first +$metaDocument = array( + 'meta' => array( + 'version' => '__VERSION_PLACEHOLDER__', + 'released' => date('Y-m-d'), + 'publisher' => 'https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/' + ) +); + +$metaString = yaml_emit($metaDocument); $dimensionsString = yaml_emit($dimensionsAggregated); + +// Combine both documents with proper YAML document separators +// Remove trailing ... from meta document and add proper separator +$metaString = rtrim($metaString); +if (substr($metaString, -3) === '...') { + $metaString = substr($metaString, 0, -3); +} + $targetGeneratedFile = getcwd() . "/src/assets/YAML/generated/generated.yaml"; echo "\nStoring to $targetGeneratedFile\n"; file_put_contents($targetGeneratedFile, $dimensionsString); +$combinedYaml = $metaString . $dimensionsString; +$targetGeneratedFile = getcwd() . "/src/assets/YAML/activities.yaml"; +echo "\nStoring to $targetGeneratedFile\n"; +file_put_contents($targetGeneratedFile, $combinedYaml); // Store dependency graph $graphFilename = getcwd() . "/src/assets/YAML/generated/dependency-tree.md"; From 10f08d5f98f1a8eb011b3b310cddf7760105f21a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 12 Nov 2025 13:56:47 +0100 Subject: [PATCH 124/370] fix: fix path --- .github/workflows/main.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 4f70d0e..5533545 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -58,9 +58,9 @@ jobs: docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 docker cp yaml:/var/www/html/src/assets/YAML/generated/generated.yaml src/assets/YAML/generated/generated.yaml - - name: Replace version placeholder in generated.yaml + - name: Replace version placeholder in activities.yaml run: | - sed -i "s/__VERSION_PLACEHOLDER__/${{ steps.get-version.outputs.version }}/g" src/assets/YAML/generated/generated.yaml + sed -i "s/__VERSION_PLACEHOLDER__/${{ steps.get-version.outputs.version }}/g" src/assets/YAML/activities.yaml - name: Commit all changed files back to the repository uses: planetscale/ghcommit-action@v0.1.6 with: From 9ed68a4231236bb524ac4f451b37052fbb9d280f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 12 Nov 2025 13:58:21 +0100 Subject: [PATCH 125/370] fix: add activities.yaml to git after generation --- .github/workflows/main.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 5533545..db0d101 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -53,10 +53,11 @@ jobs: file: Dockerfile platforms: linux/amd64,linux/arm64 tags: wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }},wurstbrot/dsomm-yaml-generation:latest - - name: Extract generated.yaml + - name: Extract generated.yaml and activities.yaml run: | docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 - docker cp yaml:/var/www/html/src/assets/YAML/generated/generated.yaml src/assets/YAML/generated/generated.yaml + docker cp yaml:/var/www/html/src/assets/YAML/generated/generated.yaml src/assets/YAML/generated/generated.yaml # TODO: Remove + docker cp yaml:/var/www/html/src/assets/YAML/activities.yaml src/assets/YAML/activities.yaml - name: Replace version placeholder in activities.yaml run: | From dd0ea1a9ad5794f1bea2c2d9fa06133a47e0a077 Mon Sep 17 00:00:00 2001 From: vbakke Date: Fri, 14 Nov 2025 16:24:39 +0100 Subject: [PATCH 126/370] Remove team and evidence from activities.yaml Removed unused team and evidence references. Not part of the the new v4 `activities.yaml` --- yaml-generation/generateDimensions.php | 33 -------------------------- 1 file changed, 33 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index cc47a3c..263d466 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -4,16 +4,6 @@ $errorMsg = array(); $implementationReferenceFile = "src/assets/YAML/default/implementations.yaml"; -$metadata = readYaml("src/assets/YAML/meta.yaml"); - -$teams = $metadata["teams"]; -if (sizeof($teams) == 0) { - echo "Warning: No teams defined"; -} -$teamsImplemented = array(); -foreach ($teams as $team) { - $teamsImplemented[$team] = false; -} $files = glob("src/assets/YAML/default/*/*.yaml"); $dimensions = array(); @@ -89,29 +79,6 @@ if (!array_key_exists("tags", $activity)) { $dimensionsAggregated[$dimension][$subdimension][$activityName]["tags"] = ["none"]; } - if (!array_key_exists("teamsImplemented", $activity)) { - $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = array(); - } - $evidenceImplemented = array(); - if (array_key_exists("teamsEvidence", $activity) && is_array($activity["teamsEvidence"]) && IS_IMPLEMENTED_WHEN_EVIDENCE) { - foreach ($activity["teamsEvidence"] as $team => $evidenceForTeam) { - if(!is_string($activity["teamsEvidence"][$team])) { - echo "teamsEvidence for team $team in $activityName is not a string, ignoring"; - continue; - } - if (strlen($activity["teamsEvidence"][$team]) > 0) { - $evidenceImplemented[$team] = true; - } else { - echo "Warning: '$activityName -> evidence -> $team' has no evidence set but should have"; - } - } - } - $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = - array_merge( - $teamsImplemented, - $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"], - $evidenceImplemented - ); if (!array_key_exists("openCRE", $activity["references"])) { $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"] = array(); $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = "https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/" . $subdimension . "/" . $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; From c9c72ebbc09a3ff2eb564e3e5d0e9be9ea84cc41 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Fri, 14 Nov 2025 17:52:41 +0100 Subject: [PATCH 127/370] Removed 'uuid:' in `dependsOn:` --- .../BuildAndDeployment/Deployment.yaml | 4 +- .../CultureAndOrganization/Process.yaml | 2 +- .../DevelopmentAndSourceControl.yaml | 6 +- .../default/InformationGathering/TestKPI.yaml | 6 +- .../TestAndVerification/Consolidation.yaml | 12 ++-- .../DynamicDepthForInfrastructure.yaml | 2 +- .../StaticDepthForApplications.yaml | 18 +++--- yaml-generation/generateDimensions.php | 61 +++++-------------- 8 files changed, 41 insertions(+), 70 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index efa825a..59a6bff 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -182,7 +182,7 @@ Build and Deployment: A documented inventory of dependencies used in artifacts like container images and containers exists. dependsOn: - - uuid:83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts + - 83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts - SBOM of components difficultyOfImplementation: knowledge: 2 @@ -249,7 +249,7 @@ Build and Deployment: measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically). dependsOn: - Defined deployment process - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components difficultyOfImplementation: knowledge: 2 time: 2 diff --git a/src/assets/YAML/default/CultureAndOrganization/Process.yaml b/src/assets/YAML/default/CultureAndOrganization/Process.yaml index 2769b16..dace513 100755 --- a/src/assets/YAML/default/CultureAndOrganization/Process.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/Process.yaml @@ -103,7 +103,7 @@ Culture and Organization: usefulness: 3 level: 2 dependsOn: - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-defectdojo - $ref: src/assets/YAML/default/implementations.yaml#/implementations/purify diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index 6c497cd..3d02cb1 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -68,7 +68,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies @@ -150,7 +150,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies @@ -182,7 +182,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - uuid:e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/azuredevops - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-policies diff --git a/src/assets/YAML/default/InformationGathering/TestKPI.yaml b/src/assets/YAML/default/InformationGathering/TestKPI.yaml index 80cc016..3a18fa5 100644 --- a/src/assets/YAML/default/InformationGathering/TestKPI.yaml +++ b/src/assets/YAML/default/InformationGathering/TestKPI.yaml @@ -90,7 +90,7 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 #Automated PRs for patches implementation: [] references: samm2: @@ -151,8 +151,8 @@ Information Gathering: usefulness: 3 level: 4 dependsOn: - - uuid:86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR - - uuid:8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches implementation: [] references: samm2: diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index fd67896..1b87b98 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -21,9 +21,9 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - uuid:44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher: - #- uuid:3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher: + #- 3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: references: samm2: @@ -372,9 +372,9 @@ Test and Verification: resources: 2 usefulness: 2 dependsOn: - - uuid:f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV - - uuid:6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion - - uuid:185d5a74-19dc-4422-be07-44ea35226783 # Office Hours + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV + - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion + - 185d5a74-19dc-4422-be07-44ea35226783 # Office Hours level: 3 description: |- For known vulnerabilities a processes to estimate the exploit ability of a vulnerability is recommended. diff --git a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml index d8b921c..20db40e 100755 --- a/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/DynamicDepthForInfrastructure.yaml @@ -142,7 +142,7 @@ Test and Verification: implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/netassert dependsOn: - - uuid:4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments + - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments references: samm2: - V-ST-A-2 diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 2009526..0388402 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -159,7 +159,7 @@ Test and Verification: - 8.28 # Secure coding isImplemented: false dependsOn: - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 risk: Used components like libraries and legacy applications might have vulnerabilities @@ -173,7 +173,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: [] references: samm2: @@ -209,7 +209,7 @@ Test and Verification: dependsOn: - Static analysis for important client side components - Static analysis for important server side components - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-A-2 @@ -244,7 +244,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-A-2 @@ -277,7 +277,7 @@ Test and Verification: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/appscan-vscode-extension dependsOn: - Defined build process - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-A-2 @@ -333,7 +333,7 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - uuid:d918cd44-a972-43e9-a974-eff3f4a5dcfe # SCA for server + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # SCA for server implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cisa-kev - $ref: src/assets/YAML/default/implementations.yaml#/implementations/epss @@ -357,8 +357,8 @@ Test and Verification: level: 3 dependsOn: - Defined build process - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - - uuid:f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # EPSS/CISA KEV implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/retire-js - $ref: src/assets/YAML/default/implementations.yaml#/implementations/npm-audit @@ -390,7 +390,7 @@ Test and Verification: level: 2 dependsOn: - Defined build process - - uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-dependency-che - $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 71d5c20..0a66372 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -4,16 +4,6 @@ $errorMsg = array(); $implementationReferenceFile = "src/assets/YAML/default/implementations.yaml"; -$metadata = readYaml("src/assets/YAML/meta.yaml"); - -$teams = $metadata["teams"]; -if (sizeof($teams) == 0) { - echo "Warning: No teams defined"; -} -$teamsImplemented = array(); -foreach ($teams as $team) { - $teamsImplemented[$team] = false; -} $files = glob("src/assets/YAML/default/*/*.yaml"); $dimensions = array(); @@ -67,12 +57,12 @@ foreach ($elements as $activityName => $activity) { if (!array_key_exists("level", $activity)) { - array_push($errorMsg,"Missing 'level' attribute in activity: $activityName"); + array_push($errorMsg,"Missing 'level' attribute in activity: '$activityName'"); } // echo "$subdimension | $activityName\n"; if (!array_key_exists("uuid", $activity)) { - array_push($errorMsg, "$activityName is missing an uuid in $dimension"); + array_push($errorMsg, "'$activityName' is missing an uuid in '$dimension'"); } else { $uuid = $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; $tmp_activityName = getActivityNameByUuid($uuid, $dimensionsAggregated); @@ -89,34 +79,6 @@ if (!array_key_exists("tags", $activity)) { $dimensionsAggregated[$dimension][$subdimension][$activityName]["tags"] = ["none"]; } - if (!array_key_exists("teamsImplemented", $activity)) { - $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = array(); - } - $evidenceImplemented = array(); - if (array_key_exists("teamsEvidence", $activity) && is_array($activity["teamsEvidence"]) && IS_IMPLEMENTED_WHEN_EVIDENCE) { - foreach ($activity["teamsEvidence"] as $team => $evidenceForTeam) { - if(!is_string($activity["teamsEvidence"][$team])) { - echo "teamsEvidence for team $team in $activityName is not a string, ignoring"; - continue; - } - if (strlen($activity["teamsEvidence"][$team]) > 0) { - $evidenceImplemented[$team] = true; - } else { - echo "Warning: '$activityName -> evidence -> $team' has no evidence set but should have"; - } - } - } - $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"] = - array_merge( - $teamsImplemented, - $dimensionsAggregated[$dimension][$subdimension][$activityName]["teamsImplemented"], - $evidenceImplemented - ); - if (!array_key_exists("openCRE", $activity["references"])) { - $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"] = array(); - $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = "https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/" . $subdimension . "/" . $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; - } - // can be removed in 2025 if (array_key_exists("isImplemented", $activity)) { unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["isImplemented"]); } @@ -136,13 +98,13 @@ $dependsOnUuid = $matches[2]; $dependsOn = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); if (is_null($dependsOn)) { - array_push($errorMsg,"DependsOn non-existing activity uuid: $dependsOnUuid (in activity: $activityName)"); - } else if ($matches[1] == "") { - echo "WARNING: DependsOn is not prefixed by 'uuid:' for $dependsOnUuid (in activity: $activityName)\n"; + array_push($errorMsg,"DependsOn non-existing activity uuid: $dependsOnUuid (in activity: '$activityName')"); + } else if ($matches[1] != "") { + echo "WARNING: DependsOn is prefixed by deprecated 'uuid:' for $dependsOnUuid (in activity: '$activityName'). Use activity name, or the uuid only\n"; } - // echo "exchanged $dependsOnUuid with name $dependsOnActivityName\n"; - $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = $dependsOn; + // Trick emit_yaml() to have uuid plus a comment in a string. Removed in post-processing below. + $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = "{ $dependsOnUuid # $dependsOn }"; } else { if (is_null(getUuidByActivityName($dependsOn, $dimensionsAggregated))) { @@ -195,6 +157,15 @@ // Store generated data $dimensionsString = yaml_emit($dimensionsAggregated); + +// Post-process to convert quoted UUID comments to inline comments +// Pattern: `- '{ uuid #comment }'` becomes: `- uuid #comment` +$dimensionsString = preg_replace( + "/^(\s+- )'{\s*([0-9a-f-]+)\s+(#[^'}]*)\s*}'$/m", + "$1$2 $3", + $dimensionsString +); + $targetGeneratedFile = getcwd() . "/src/assets/YAML/generated/generated.yaml"; echo "\nStoring to $targetGeneratedFile\n"; file_put_contents($targetGeneratedFile, $dimensionsString); From fd1ad5de238b93e9b9ff96dacdfce7345a3c0c89 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Fri, 14 Nov 2025 17:56:27 +0100 Subject: [PATCH 128/370] Removed last remaining 'uuid:' prefix --- src/assets/YAML/default/BuildAndDeployment/Deployment.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 59a6bff..e6f76a0 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -83,7 +83,7 @@ Build and Deployment: usefulness: 4 level: 1 dependsOn: - - uuid:f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools - $ref: src/assets/YAML/default/implementations.yaml#/implementations/docker From 77f1319b9496b137e3f958a79bfd4d06e6ddef78 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Fri, 14 Nov 2025 18:06:14 +0100 Subject: [PATCH 129/370] Independant on uuid or name in dependsOn --- yaml-generation/generateDimensions.php | 34 +++++++++++++------------- 1 file changed, 17 insertions(+), 17 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 0a66372..284e974 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -86,40 +86,40 @@ unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["evidence"]); } if (array_key_exists("dependsOn", $activity)) { - foreach($activity['dependsOn'] as $index => $dependsOn) { - if(!is_string($dependsOn)) { - array_push($errorMsg, "The 'dependsOn' is not a string '" . json_encode($dependsOn) . "' (in $activityName)"); + foreach($activity['dependsOn'] as $index => $dependsOnName) { + if(!is_string($dependsOnName)) { + array_push($errorMsg, "The 'dependsOn' is not a string '" . json_encode($dependsOnName) . "' (in $activityName)"); continue; } - // Swap uuids with activity name + // Load dependsOnName and dependsOnUuid, depending on actual content $uuidRegExp = "/(uuid:)?\s*([0-9a-f]{6,}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{6,})/"; - if (preg_match($uuidRegExp, $dependsOn, $matches)) { + if (preg_match($uuidRegExp, $dependsOnName, $matches)) { $dependsOnUuid = $matches[2]; - $dependsOn = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); - if (is_null($dependsOn)) { + $dependsOnName = getActivityNameByUuid($dependsOnUuid, $dimensionsAggregated); + if (is_null($dependsOnName)) { array_push($errorMsg,"DependsOn non-existing activity uuid: $dependsOnUuid (in activity: '$activityName')"); } else if ($matches[1] != "") { echo "WARNING: DependsOn is prefixed by deprecated 'uuid:' for $dependsOnUuid (in activity: '$activityName'). Use activity name, or the uuid only\n"; - } - - // Trick emit_yaml() to have uuid plus a comment in a string. Removed in post-processing below. - $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = "{ $dependsOnUuid # $dependsOn }"; - + } } else { - if (is_null(getUuidByActivityName($dependsOn, $dimensionsAggregated))) { - array_push($errorMsg,"DependsOn non-existing activity: '$dependsOn' (in activity: $activityName)"); + $dependsOnUuid = getUuidByActivityName($dependsOnName, $dimensionsAggregated); + if (is_null(getUuidByActivityName($dependsOnName, $dimensionsAggregated))) { + array_push($errorMsg,"DependsOn non-existing activity: '$dependsOnName' (in activity: $activityName)"); } } + // Trick emit_yaml() to have uuid plus a comment in a string. Removed in post-processing below. + $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = "{ $dependsOnUuid # $dependsOnName }"; + // Build dependency graph if (!array_key_exists($activityName, $activityIndex)) { $activityIndex[$activityName] = count($activityIndex); } - if (!array_key_exists($dependsOn, $activityIndex)) { - $activityIndex[$dependsOn] = count($activityIndex); + if (!array_key_exists($dependsOnName, $activityIndex)) { + $activityIndex[$dependsOnName] = count($activityIndex); } - array_push_item_to($dependencies, $activityIndex[$dependsOn], $activityIndex[$activityName]); + array_push_item_to($dependencies, $activityIndex[$dependsOnName], $activityIndex[$activityName]); } } From 91b97ac735e07c4392913731e10d3af1870fcff8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 14 Nov 2025 19:44:47 +0100 Subject: [PATCH 130/370] Delete src/assets/script.bash --- src/assets/script.bash | 148 ----------------------------------------- 1 file changed, 148 deletions(-) delete mode 100755 src/assets/script.bash diff --git a/src/assets/script.bash b/src/assets/script.bash deleted file mode 100755 index 4138f6e..0000000 --- a/src/assets/script.bash +++ /dev/null @@ -1,148 +0,0 @@ -#!/bin/bash - -# Funktion zur Konvertierung von DSOMM zu SAMM Format -convert_dsomm_to_samm() { - local input_file="$1" - local output_file="$2" - - if [[ -z "$input_file" ]]; then - echo "Verwendung: convert_dsomm_to_samm [output_file]" - echo "Beispiel: convert_dsomm_to_samm document.txt converted_document.txt" - return 1 - fi - - if [[ ! -f "$input_file" ]]; then - echo "Fehler: Datei '$input_file' nicht gefunden!" - return 1 - fi - - # Wenn keine Output-Datei angegeben, verwende Input-Datei mit _converted Suffix - if [[ -z "$output_file" ]]; then - output_file="${input_file%.*}_converted.${input_file##*.}" - fi - - echo "Konvertiere DSOMM Referenzen zu SAMM Format..." - echo "Input: $input_file" - echo "Output: $output_file" - - # Sed-Befehl zur Umwandlung: - # Sucht nach Pattern: BUCHSTABE-BUCHSTABEN-ZAHL-BUCHSTABE - # Wandelt um zu: BUCHSTABE-BUCHSTABEN-BUCHSTABE-ZAHL - sed -E 's/([A-Z]+-[A-Z]+)-([0-9]+)-([A-Z]+)/\1-\3-\2/g' "$input_file" > "$output_file" - - echo "Konvertierung abgeschlossen!" - echo "Überprüfe die ersten konvertierten Zeilen:" - head -10 "$output_file" | grep -E '[A-Z]+-[A-Z]+-[A-Z]+-[0-9]+' || echo "Keine konvertierten Referenzen in den ersten 10 Zeilen gefunden." -} - -# Direkte Verwendung für eine einzelne Zeile (für Tests): -convert_single_reference() { - local ref="$1" - echo "$ref" | sed -E 's/([A-Z]+-[A-Z]+)-([0-9]+)-([A-Z]+)/\1-\3-\2/g' -} - -# Beispiel-Test mit den von Ihnen bereitgestellten Referenzen: -echo "=== Test der Konvertierung ===" -echo "Original → Konvertiert:" -echo "G-SM-1-A → $(convert_single_reference 'G-SM-1-A')" -echo "D-TA-2-B → $(convert_single_reference 'D-TA-2-B')" -echo "V-RT-3-A → $(convert_single_reference 'V-RT-3-A')" -echo "O-OM-1-B → $(convert_single_reference 'O-OM-1-B')" - -# Funktion zum Suchen und Konvertieren aller YAML-Dateien -process_all_yaml_files() { - echo "Suche nach YAML-Dateien im aktuellen Verzeichnis und Unterverzeichnissen..." - - # Finde alle .yaml Dateien - mapfile -t yaml_files < <(find . -name "*.yaml" -type f) - - if [[ ${#yaml_files[@]} -eq 0 ]]; then - echo "Keine YAML-Dateien gefunden." - return 1 - fi - - echo "Gefundene YAML-Dateien: ${#yaml_files[@]}" - - # Bestätigung vom Benutzer einholen - echo "" - echo "Folgende YAML-Dateien wurden gefunden:" - printf '%s\n' "${yaml_files[@]}" - echo "" - read -p "Möchten Sie alle diese Dateien konvertieren? (y/N): " -n 1 -r - echo "" - - if [[ ! $REPLY =~ ^[Yy]$ ]]; then - echo "Abgebrochen." - return 0 - fi - - # Backup-Verzeichnis erstellen - backup_dir="./backup_$(date +%Y%m%d_%H%M%S)" - mkdir -p "$backup_dir" - echo "Backups werden in '$backup_dir' erstellt..." - - # Konvertierung durchführen - local converted_count=0 - local total_count=${#yaml_files[@]} - - for yaml_file in "${yaml_files[@]}"; do - echo "Verarbeite: $yaml_file" - - # Backup erstellen - backup_file="$backup_dir/${yaml_file#./}" - mkdir -p "$(dirname "$backup_file")" - cp "$yaml_file" "$backup_file" - - # Prüfen ob DSOMM Referenzen vorhanden sind - if grep -qE '[A-Z]+-[A-Z]+-[0-9]+-[A-Z]+' "$yaml_file"; then - # Konvertierung durchführen (in-place) - sed -i.tmp -E 's/([A-Z]+-[A-Z]+)-([0-9]+)-([A-Z]+)/\1-\3-\2/g' "$yaml_file" - rm "$yaml_file.tmp" 2>/dev/null - ((converted_count++)) - echo " ✓ Konvertiert" - else - echo " - Keine DSOMM Referenzen gefunden" - fi - done - - echo "" - echo "=== Konvertierung abgeschlossen ===" - echo "Verarbeitete Dateien: $total_count" - echo "Konvertierte Dateien: $converted_count" - echo "Backups gespeichert in: $backup_dir" - - if [[ $converted_count -gt 0 ]]; then - echo "" - echo "Beispiele konvertierter Referenzen:" - find . -name "*.yaml" -type f -exec grep -H -E '[A-Z]+-[A-Z]+-[A-Z]+-[0-9]+' {} \; | head -5 - fi -} - -# Hauptfunktion aufrufen wenn Argumente übergeben wurden -if [[ $# -gt 0 ]]; then - if [[ "$1" == "--all-yaml" || "$1" == "-a" ]]; then - process_all_yaml_files - else - convert_dsomm_to_samm "$@" - fi -else - echo "DSOMM zu SAMM Referenz Konverter" - echo "================================" - echo "" - echo "Verwendung:" - echo " $0 [output_file] # Einzelne Datei konvertieren" - echo " $0 --all-yaml | -a # Alle YAML-Dateien konvertieren" - echo "" - echo "Beispiele:" - echo " $0 document.txt" - echo " $0 document.txt converted_document.txt" - echo " $0 --all-yaml # Alle .yaml Dateien im Verzeichnis" - echo "" - echo "Das Script konvertiert DSOMM Referenzen im Format:" - echo "

---" - echo "zu SAMM Format:" - echo "

---" - echo "" - echo "Bei --all-yaml wird automatisch nach .yaml Dateien gesucht und" - echo "Backups vor der Konvertierung erstellt." -fi From 18d6205beb02b5c809b95dc15a76c9bcb803eb3d Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 16 Nov 2025 18:44:41 +0100 Subject: [PATCH 131/370] feat: Improved start script --- README.md | 81 ++++++++++++++++++++----- yaml-generation/generateDimensions.bash | 40 ++++++++---- yaml-generation/generateDimensions.bat | 33 +++++++--- 3 files changed, 120 insertions(+), 34 deletions(-) diff --git a/README.md b/README.md index 5a3d944..89ccac4 100644 --- a/README.md +++ b/README.md @@ -1,21 +1,74 @@ # OWASP DevSecOps Maturity Model Data -Data for the OWASP DevSecOps Maturity Model. + +This GitHub project ([DevSecOps-MaturityModel-data](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data)) contains the source for the model itself, used by the DSOMM applciation [DevSecOps-MaturityModel](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel). + +The source files include dimensions, activities, descriptions, measures, and other model data used by the application. + + +## Contribution + +Contributions that improve the DSOMM model are welcome. Please edit the source files under `src/assets/YAML/default/*` and open a pull request. + + +### Testing + +After making changes, generate a new `activities.yaml` and use it in a local DSOMM application to verify there are no technical issues. + ## Usage -To test changes to the yaml-files, please run: -```bash -docker run -ti -v $(pwd)/src/assets/YAML/default:/var/www/html/src/assets/YAML/default -v $(pwd)/src/assets/YAML/generated:/var/www/html/src/assets/YAML/generated -v $(pwd)/src/assets/YAML/schema:/var/www/html/src/assets/YAML/schema wurstbrot/dsomm-yaml-generation -# Afterwards, you can use the generated.yaml in a container -docker run -v $(pwd)/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm -``` +The script is executed using `docker` (or alternatively `podman`). +Depending on your platform use either `generateDimensions.bash` (Linux) or `generateDimensions.bat` (Windows). + +1. Clone the repo: + + `git clone https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data.git` + +2. Change directory: + + `cd yaml-generation` + +3. Install dependencies: + + `./generateDimensions.bash --install` + +4. Generate `activities.yaml`: + + `./generateDimensions.bash` + + + +### Starting a local DSOMM application + +To start a local DSOMM instance on http://localhost:8080, run: + + `./generateDimensions.bash --start-dsomm` + + +### Test referenced URLs + +To test all URLs referenced by `implementations.yaml` and save results to `url-test-results.txt`, run: + + `./generateDimensions.bash --test-urls` + + +### Using Podman instead of Docker + +If you prefer Podman over Docker, edit the script and set the `DOCKER` variable to `podman`. For example: + - Linux: `DOCKER=podman` + - Windows: `set DOCKER=podman` + ## Credits -* The dimension _Test and Verification_ is based on Christian Schneiders [Security DevOps Maturity Model (SDOMM)](https://www.christian-schneider.net/SecurityDevOpsMaturityModel.html). _Application tests_ and _Infrastructure tests_ are added by Timo Pagel. Also, the sub-dimension _Static depth_ has been evaluated by security experts at [OWASP Stammtisch Hamburg](https://www.owasp.org/index.php/OWASP_German_Chapter_Stammtisch_Initiative/Hamburg). -* The sub-dimension Process has been added after a discussion with [Francois Raynaud](https://www.linkedin.com/in/francoisraynaud/) that reactive activities are missing. -* Enhancement of my basic translation is performed by [Claud Camerino](https://github.com/clazba). -* Adding ISO 27001:2017 mapping, [Andre Baumeier](https://github.com/AndreBaumeier). -* [OWASP Project Integration Project Writeup](https://github.com/OWASP/www-project-integration-standards/blob/master/writeups/owasp_in_sdlc/index.md) for providing documentation on different DevSecOps practices which are copied&pasted/ (and adopted) (https://github.com/northdpole, https://github.com/ThunderSon) -* The requirements from [level 0](https://github.com/AppSecure-nrw/security-belts/blob/master/white/) are based on/copied from [AppSecure NRW](https://appsecure.nrw/) -* The sub dimension _Test KPI_, _Triage_, _Dynamic depth for app/infra_, _Static depth for app/infra_ and some other vulnerability management activities are based/inspired by [Vulnerability Managment Maturity Model - Cheat Sheet V1.6](TODO FRANCESCO LINK) +- The "Test and Verification" dimension is based on Christian Schneider's Security DevOps Maturity Model (SDOMM). +- Application and infrastructure tests were added by Timo Pagel. +- The "Process" sub-dimension was added after discussion with Francois Raynaud. +- Translations and edits were contributed by Claud Camerino. +- ISO 27001:2017 mapping by Andre Baumeier. +- Other inspirations and contributions are acknowledged in the original README. + + +## License + +See the `LICENSE` file in this repository for license details. diff --git a/yaml-generation/generateDimensions.bash b/yaml-generation/generateDimensions.bash index f1f302b..ea62de5 100755 --- a/yaml-generation/generateDimensions.bash +++ b/yaml-generation/generateDimensions.bash @@ -1,14 +1,30 @@ #!/bin/bash -curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/master/src/assets/YAML/meta.yaml -o ../src/assets/YAML/meta.yaml -docker run -e IS_IMPLEMENTED_WHEN_EVIDENCE=true -ti --rm --volume ${PWD}/../:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' - -#docker run --rm --interactive --tty --volume $PWD/:/app --user $(id -u):$(id -g) composer install \ -# --ignore-platform-reqs \ -# --no-interaction \ -# --no-plugins \ -# --no-scripts \ -# --prefer-dist -# -#cd .. -#docker run --rm --volume $PWD/:/app php:apache-buster bash -c 'apt-get update && apt-get -y dist-upgrade && apt-get -y install apt-utils libyaml-dev wget && pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml && cd /app/ && php yaml-generation/generateDimensions.php' \ No newline at end of file +# Usage: +# ./generateDimensions.bash --install First time, install composer dependencies +# ./generateDimensions.bash Generate activities.yaml +# ./generateDimensions.bash --test-urls Test URLs in implementations.yaml + +cd "$(dirname "$0")"/.. +pwd + +# Use: docker | podman +DOCKER=docker + +if [ "$1" = "--install" ]; then + echo Installing composer dependencies... + MSYS_NO_PATHCONV=1 $DOCKER run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist' + +elif [ "$1" = "--start-dsomm" ]; then + echo "Starting local DSOMM application..." + MSYS_NO_PATHCONV=1 $DOCKER run -ti --rm --volume $(pwd)/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm + +elif [ "$1" = "--test-urls" ]; then + echo "Test URLs in implementations.yaml..." + MSYS_NO_PATHCONV=1 $DOCKER run -e TEST_REFERENCED_URLS=true -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' | tee url-test-results.txt + +else + echo "Generating activities.yaml..." + MSYS_NO_PATHCONV=1 $DOCKER run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' + +fi diff --git a/yaml-generation/generateDimensions.bat b/yaml-generation/generateDimensions.bat index 38f8e26..3715612 100644 --- a/yaml-generation/generateDimensions.bat +++ b/yaml-generation/generateDimensions.bat @@ -1,15 +1,32 @@ @echo off -REM Usage: generateDimensions.bat [--test-urls] -REM If --test-urls is provided, the script will check if referenced URLs are live. - -setlocal -SET var=DUMMY= -if "%~1"=="--test-urls" SET var=TEST_REFERENCED_URLS=true +REM Usage: +REM ./generateDimensions.bash --install First time, install composer dependencies +REM ./generateDimensions.bash Generate activities.yaml +REM ./generateDimensions.bash --test-urls Test URLs in implementations.yaml +setlocal REM Change working directory to the project root cd %~dp0\.. -REM Run the php script in the Docker container -docker run -e %var% -e IS_IMPLEMENTED_WHEN_EVIDENCE=true -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" +REM Use: docker | podman +set DOCKER=docker + +if "%~1"=="--install" ( + echo Installing composer dependencies... + %DOCKER% run -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist" + +) else if "%~1"=="--start-dsomm" ( + echo Start local DSOMM application... + %DOCKER% run -ti --rm --volume "%CD%/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml" -p 8080:8080 wurstbrot/dsomm + +) else if "%~1"=="--test-urls" ( + echo Test URLs in implementations.yaml... + %DOCKER% run -e TEST_REFERENCED_URLS=true -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" | tee url-test-results.txt + +) else ( + echo Generate activities.yaml... + %DOCKER% run -e %argument% -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" + +) From dbe217b28ae54b078bf3427de5cd57023fce37a2 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 16 Nov 2025 20:18:05 +0100 Subject: [PATCH 132/370] Let podman|docker be controlled by env varriable --- README.md | 4 +--- yaml-generation/generateDimensions.bash | 12 +++++++----- yaml-generation/generateDimensions.bat | 12 +++++++----- 3 files changed, 15 insertions(+), 13 deletions(-) diff --git a/README.md b/README.md index 89ccac4..4224236 100644 --- a/README.md +++ b/README.md @@ -54,9 +54,7 @@ To test all URLs referenced by `implementations.yaml` and save results to `url-t ### Using Podman instead of Docker -If you prefer Podman over Docker, edit the script and set the `DOCKER` variable to `podman`. For example: - - Linux: `DOCKER=podman` - - Windows: `set DOCKER=podman` +If you prefer Podman over Docker, set the environement variable `DOCKER_CMD` to `podman`, or edit the script for you operating system. ## Credits diff --git a/yaml-generation/generateDimensions.bash b/yaml-generation/generateDimensions.bash index ea62de5..0ac8bb6 100755 --- a/yaml-generation/generateDimensions.bash +++ b/yaml-generation/generateDimensions.bash @@ -9,22 +9,24 @@ cd "$(dirname "$0")"/.. pwd # Use: docker | podman -DOCKER=docker +if [ -z "${DOCKER_CMD}" ]; then + DOCKER_CMD=docker +fi if [ "$1" = "--install" ]; then echo Installing composer dependencies... - MSYS_NO_PATHCONV=1 $DOCKER run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist' + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist' elif [ "$1" = "--start-dsomm" ]; then echo "Starting local DSOMM application..." - MSYS_NO_PATHCONV=1 $DOCKER run -ti --rm --volume $(pwd)/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume $(pwd)/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm elif [ "$1" = "--test-urls" ]; then echo "Test URLs in implementations.yaml..." - MSYS_NO_PATHCONV=1 $DOCKER run -e TEST_REFERENCED_URLS=true -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' | tee url-test-results.txt + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -e TEST_REFERENCED_URLS=true -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' | tee url-test-results.txt else echo "Generating activities.yaml..." - MSYS_NO_PATHCONV=1 $DOCKER run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' fi diff --git a/yaml-generation/generateDimensions.bat b/yaml-generation/generateDimensions.bat index 3715612..2cfa058 100644 --- a/yaml-generation/generateDimensions.bat +++ b/yaml-generation/generateDimensions.bat @@ -10,23 +10,25 @@ REM Change working directory to the project root cd %~dp0\.. REM Use: docker | podman -set DOCKER=docker +if "%DOCKER_CMD%"=="" ( + set DOCKER_CMD=docker +) if "%~1"=="--install" ( echo Installing composer dependencies... - %DOCKER% run -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist" + %DOCKER_CMD% run -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist" ) else if "%~1"=="--start-dsomm" ( echo Start local DSOMM application... - %DOCKER% run -ti --rm --volume "%CD%/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml" -p 8080:8080 wurstbrot/dsomm + %DOCKER_CMD% run -ti --rm --volume "%CD%/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml" -p 8080:8080 wurstbrot/dsomm ) else if "%~1"=="--test-urls" ( echo Test URLs in implementations.yaml... - %DOCKER% run -e TEST_REFERENCED_URLS=true -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" | tee url-test-results.txt + %DOCKER_CMD% run -e TEST_REFERENCED_URLS=true -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" | tee url-test-results.txt ) else ( echo Generate activities.yaml... - %DOCKER% run -e %argument% -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" + %DOCKER_CMD% run -e %argument% -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" ) From d60b22c432f9351e17ed8bec894b52ab232fbf33 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 17 Nov 2025 13:11:40 +0100 Subject: [PATCH 133/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 1559 +++------------------- 1 file changed, 166 insertions(+), 1393 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 873ed20..a29b0c3 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -41,15 +41,9 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/a340f46b-6360-4cb8-847b-a0d3483d09d3 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b description: "A *build process* include more than just compiling your source @@ -93,15 +87,9 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f6f7737f-25a9-4317-8de2-09bf59f29b5b comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Pinning of artifacts: uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 risk: Unauthorized manipulation of artifacts might be difficult to spot. For @@ -145,7 +133,7 @@ Build and Deployment: description: Immutable images are an other way, e.g. by using a registry, which doesn't allow overriding of images. dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - I-SB-B-1 @@ -153,13 +141,7 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 comments: "" - teamsImplemented: - Default: false - B: false - C: false SBOM of components: uuid: 2858ac12-0179-40d9-9acf-1b839c030473 description: |- @@ -173,7 +155,7 @@ Build and Deployment: measure: Creation of an SBOM of components (e.g. application and container image content) during build. dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process difficultyOfImplementation: knowledge: 2 time: 2 @@ -191,15 +173,9 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/2858ac12-0179-40d9-9acf-1b839c030473 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Signing of artifacts: uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -235,8 +211,8 @@ Build and Deployment: tags: [] url: https://in-toto.github.io/ dependsOn: - - Defined build process - - Pinning of artifacts + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 # Pinning of artifacts references: samm2: - I-SB-A-1 @@ -244,15 +220,9 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/5786959d-0c6f-46a6-8e1c-a32ff1a50222 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Signing of code: uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -279,7 +249,7 @@ Build and Deployment: url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule description: Usage of branch protection rules dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - I-SB-A-2 @@ -287,15 +257,9 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Build/9f107927-61e9-4574-85ad-3f2b4bca8665 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Deployment: Blue/Green Deployment: uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 @@ -315,7 +279,7 @@ Build and Deployment: tags: [] url: https://martinfowler.com/bliki/BlueGreenDeployment.html dependsOn: - - Smoke Test + - 73aaae0b-5d68-4953-9fa4-fd25bf665f2a # Smoke Test references: samm2: - I-SD-A-3 @@ -333,15 +297,9 @@ Build and Deployment: - 8.32 - 8.19 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0cb2626b-fb0d-4a0f-9688-57f787310d97 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Defined decommissioning process: uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 description: |- @@ -368,15 +326,9 @@ Build and Deployment: - 11.2.7 iso27001-2022: - 7.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/da4ff665-dcb9-4e93-9d20-48cdedc50fc2 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a risk: Deployment of insecure or malfunctioning artifacts. @@ -390,7 +342,7 @@ Build and Deployment: usefulness: 4 level: 1 dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process implementation: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 name: CI/CD tools @@ -411,15 +363,9 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/74938a3f-1269-49b9-9d0f-c43a79a1985a comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Environment depending configuration parameters (secrets): uuid: df428c9d-efa0-4226-9f47-a15bb53f822b risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. @@ -455,14 +401,8 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/df428c9d-efa0-4226-9f47-a15bb53f822b tags: - secret - teamsImplemented: - Default: false - B: false - C: false Evaluation of the trust of used components: uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba risk: Application and system components like Open Source libraries or images @@ -506,15 +446,9 @@ Build and Deployment: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/0de465a6-55a7-4343-af79-948bb5ff10ba comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Handover of confidential parameters: uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a risk: Parameters are often used to set credentials, for example by starting @@ -531,7 +465,8 @@ Build and Deployment: level: 3 implementation: "" dependsOn: - - Environment depending configuration parameters (secrets) + - df428c9d-efa0-4226-9f47-a15bb53f822b # Environment depending configuration + parameters (secrets) references: samm2: - I-SD-B-2 @@ -549,14 +484,8 @@ Build and Deployment: - 8.24 d3f: - ApplicationConfigurationHardening - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/94a96f79-8bd6-4904-97c0-994ff88f176a tags: - secret - teamsImplemented: - Default: false - B: false - C: false Inventory of production artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs @@ -565,8 +494,9 @@ Build and Deployment: measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically). dependsOn: - - Defined deployment process - - Inventory of production components + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + difficultyOfImplementation: knowledge: 2 time: 2 @@ -614,14 +544,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/83057028-0b77-4d2e-8135-40969768ae88 tags: - inventory - teamsImplemented: - Default: false - B: false - C: false Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f risk: An organization is unaware of components like applications in production. @@ -630,7 +554,7 @@ Build and Deployment: A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process difficultyOfImplementation: knowledge: 1 time: 1 @@ -678,14 +602,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/2a44b708-734f-4463-b0cb-86dc46344b2f tags: - inventory - teamsImplemented: - Default: false - B: false - C: false Inventory of production dependencies: uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 risk: Delayed identification of components and their vulnerabilities in production. @@ -694,8 +612,9 @@ Build and Deployment: measure: A documented inventory of dependencies used in artifacts like container images and containers exists. dependsOn: - - Inventory of production artifacts - - SBOM of components + - 83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts + + - 2858ac12-0179-40d9-9acf-1b839c030473 # SBOM of components difficultyOfImplementation: knowledge: 2 time: 2 @@ -744,16 +663,10 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/13e9757e-58e2-4277-bc0f-eadc674891e6 comments: "" tags: - inventory - sbom - teamsImplemented: - Default: false - B: false - C: false Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. @@ -777,7 +690,7 @@ Build and Deployment: name: rolling update tags: [] dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process references: samm2: - I-SD-A-2 @@ -790,15 +703,9 @@ Build and Deployment: - 8.19 - 8.32 - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/85d52588-f542-4225-a338-20dc22a5508d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Same artifact for environments: uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f risk: Building of an artifact for different environments means that an untested @@ -817,7 +724,7 @@ Build and Deployment: url: https://github.com/moby/moby tags: [] dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - I-SD-A-2 @@ -830,15 +737,9 @@ Build and Deployment: - 8.33 - 8.29 - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a854b48d-83bd-4f8d-8621-a0bdd470837f comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of feature toggles: uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad risk: Using environment variables to enable or disable features can lead to @@ -866,7 +767,8 @@ Build and Deployment: description: | Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) dependsOn: - - Same artifact for environments + - a854b48d-83bd-4f8d-8621-a0bdd470837f # Same artifact for environments + references: samm2: - I-SD-A-2 @@ -881,15 +783,9 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Deployment/a511799b-045e-4b96-9843-7d63d8c1e2ad comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d @@ -914,16 +810,9 @@ Build and Deployment: - 8.8 - 8.19 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/99415139-6b50-441b-89e1-0aa59accd43d comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 risk: Components with known (or unknown) vulnerabilities might stay for long @@ -970,16 +859,9 @@ Build and Deployment: iso27001-2022: - "8.8" - "8.27" - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/8ae0b92c-10e0-4602-ba22-7524d6aed488 comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Automated deployment of automated PRs: uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d description: Automated merges of automated created PRs for outdated dependencies. @@ -995,7 +877,8 @@ Build and Deployment: usefulness: 3 level: 3 dependsOn: - - Automated merge of automated PRs + - f2594f8f-1cd6-45f9-af29-eaf3315698eb # Automated merge of automated PRs + implementation: - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 name: terraform @@ -1016,16 +899,9 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/08f27c26-2c6a-47fe-9458-5e88f188085d comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Automated merge of automated PRs: uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: Automated merges of automated created PRs for outdated dependencies. @@ -1041,7 +917,7 @@ Build and Deployment: usefulness: 3 level: 2 dependsOn: - - Automated PRs for patches + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches implementation: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 name: dependabot @@ -1062,16 +938,9 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/f2594f8f-1cd6-45f9-af29-eaf3315698eb comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Nightly build of images (base images): uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 description: |- @@ -1100,16 +969,9 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/34869eaf-f2e1-4926-b0bd-28c43402f057 comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Reduction of the attack surface: uuid: 16e39c8f-5336-4001-88ed-a552d2447531 description: |- @@ -1149,16 +1011,9 @@ Build and Deployment: - 14.2.1 iso27001-2022: - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/16e39c8f-5336-4001-88ed-a552d2447531 comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Usage of a maximum lifetime for images: uuid: 485a3383-7f2e-4dba-bb84-479377070904 description: |- @@ -1192,16 +1047,9 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/485a3383-7f2e-4dba-bb84-479377070904 comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Usage of a short maximum lifetime for images: uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e description: |- @@ -1245,16 +1093,9 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Patch - Management/6b96e5a0-ce34-4ea4-a88f-469d3b84546e comments: "" tags: - patching - teamsImplemented: - Default: false - B: false - C: false Culture and Organization: Design: Conduction of advanced threat modeling: @@ -1269,8 +1110,10 @@ Culture and Organization: usefulness: 3 level: 4 dependsOn: - - Conduction of simple threat modeling on technical level - - Creation of threat modeling processes and standards + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling + on technical level + - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes + and standards description: | **Example High Maturity Scenario:** @@ -1349,15 +1192,9 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of simple threat modeling on business level: uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 risk: Business related threats are discovered too late in the development and @@ -1385,15 +1222,9 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/48f97f31-931c-46eb-9b3e-e2fec0cd0426 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e risk: Technical related threats are discovered too late in the development and @@ -1509,15 +1340,9 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/47419324-e263-415b-815d-e7161b6b905e comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Creation of advanced abuse stories: uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e risk: Simple user stories are not going deep enough. Relevant security considerations @@ -1531,7 +1356,8 @@ Culture and Organization: usefulness: 4 level: 5 dependsOn: - - Creation of simple abuse stories + - bacf85b6-5bc0-405d-b5ba-a5d971467cc1 # Creation of simple abuse stories + implementation: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 name: Don't Forget EVIL User stories @@ -1556,15 +1382,9 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/0a929c3e-ab9a-4206-8761-adf84b74622e comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Creation of simple abuse stories: uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 risk: User stories mostly don't consider security implications. Security flaws @@ -1585,8 +1405,10 @@ Culture and Organization: and [Practical Security Stories and Security Tasks for Agile Development Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' dependsOn: - - Conduction of simple threat modeling on technical level - - Creation of threat modeling processes and standards + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling + on technical level + - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes + and standards references: samm2: - D-TA-B-2 @@ -1602,15 +1424,9 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/bacf85b6-5bc0-405d-b5ba-a5d971467cc1 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Creation of threat modeling processes and standards: uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e risk: Inadequate identification of business and technical risks. @@ -1641,7 +1457,8 @@ Culture and Organization: - defender url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ dependsOn: - - Conduction of simple threat modeling on technical level + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling + on technical level references: samm2: - D-TA-B-3 @@ -1656,15 +1473,9 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Information security targets are communicated: uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 risk: Employees don't know their organizations security targets. Therefore security @@ -1688,15 +1499,9 @@ Culture and Organization: iso27001-2022: - 5.1 - 5.4 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Design/1b9281b9-48e2-4c01-9ac6-9db9931c4885 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 @@ -1732,15 +1537,8 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298 tags: - none - teamsImplemented: - Default: false - B: false - C: false Aligning security in teams: uuid: f994a55d-71bb-45a4-a887-0a213d72c504 risk: The concept of Security Champions might suggest that only he/she is responsible @@ -1767,16 +1565,9 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/f994a55d-71bb-45a4-a887-0a213d72c504 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of build-it, break-it, fix-it contests: uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 risk: Understanding security is hard, even for security champions and the conduction @@ -1803,16 +1594,9 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/bfdb576e-a416-4ec6-96fe-a078d58b2ff8 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of collaborative security checks with developers and system administrators: uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 risk: Security checks by external companies do not increase the understanding @@ -1843,16 +1627,9 @@ Culture and Organization: - 6.3 - 8.8 - 8.34 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/95caef96-36ed-458c-a087-5c35d4f9dec2 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of collaborative team security checks: uuid: 35446784-7610-40d9-af9e-d43f3173bf8c risk: Development teams limited insight over security practices. @@ -1875,16 +1652,9 @@ Culture and Organization: iso27001-2022: - Mutual security testing is not explicitly required in ISO 27001 may be - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/35446784-7610-40d9-af9e-d43f3173bf8c comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Conduction of war games: uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 risk: Understanding incident response plans during an incident is hard and ineffective. @@ -1912,16 +1682,9 @@ Culture and Organization: - 6.3 - 5.24 - 5.26 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/534f60bf-0995-4314-bb9c-f0f2bf204694 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Each team has a security champion: uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 risk: No one feels directly responsible for security and the security champion @@ -1958,16 +1721,9 @@ Culture and Organization: - Security champions are missing in ISO 27001 most likely - 5.4 - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Office Hours: uuid: 185d5a74-19dc-4422-be07-44ea35226783 risk: Developers and Operations are not in contact with the security team and @@ -1988,15 +1744,8 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/185d5a74-19dc-4422-be07-44ea35226783 tags: - none - teamsImplemented: - Default: false - B: false - C: false Regular security training for all: uuid: 9768f154-357a-4c06-af6f-d66570677c9b risk: Understanding security is hard. @@ -2037,16 +1786,9 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/9768f154-357a-4c06-af6f-d66570677c9b comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Regular security training for externals: uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 risk: Understanding security is hard. @@ -2079,16 +1821,9 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/31833d56-35af-4ef3-9300-f23d27646ce7 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Regular security training of security champions: uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 risk: Understanding security is hard, even for security champions. @@ -2110,7 +1845,8 @@ Culture and Organization: - secure coding url: https://cheatsheetseries.owasp.org/ dependsOn: - - Each team has a security champion + - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion + references: samm2: - D-TA-B-2 @@ -2121,16 +1857,9 @@ Culture and Organization: iso27001-2022: - Security champions are missing in ISO 27001 - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Reward of good communication: uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c risk: Employees are not getting excited about security. @@ -2168,16 +1897,9 @@ Culture and Organization: but nothing to promote good behavior. iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/91b6f75b-9f4a-4d77-95a2-af7ad3222c7c comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security Coaching: uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 risk: Training does not change behaviour. Therefore, even if security practices @@ -2208,16 +1930,9 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security code review: uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 risk: Understanding security is hard. @@ -2258,16 +1973,9 @@ Culture and Organization: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/7121b0c7-6ace-4d6b-95d0-94535dbccb57 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 risk: Not asking a security expert when questions regarding security appear @@ -2301,16 +2009,9 @@ Culture and Organization: - 5.2 - 5.6 - 5.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/0b28367b-75a0-4bae-a926-3725c1bf9bb0 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security-Lessoned-Learned: uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 risk: After an incident, a similar incident might reoccur. @@ -2332,16 +2033,9 @@ Culture and Organization: - 16.1.6 iso27001-2022: - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/58c46807-fee9-448b-b6dd-8050c464ab52 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple mob hacking: uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de risk: Understanding security is hard. @@ -2389,16 +2083,9 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education - and Guidance/535f301a-e8e8-4eda-ad77-a08b035c92de comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Process: Approval by reviewing any new version: uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 @@ -2424,15 +2111,9 @@ Culture and Organization: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/3f63bdbc-c75f-4780-a941-e6ad42e894e1 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Definition of a change management process: uuid: b4193d32-3948-47e2-a326-3748c48019a1 risk: The impact of a change is not controlled because these are not recorded @@ -2454,15 +2135,9 @@ Culture and Organization: iso27001-2022: - 8.32 - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/b4193d32-3948-47e2-a326-3748c48019a1 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 description: A _Business Continuity and Disaster Recovery_ (BCDR) is a plan @@ -2490,14 +2165,8 @@ Culture and Organization: - 17.1.1 iso27001-2022: - 5.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/c72da779-86cc-45b1-a339-190ce5093171 tags: - none - teamsImplemented: - Default: false - B: false - C: false Determining the protection requirement: uuid: 72737130-472c-4984-80f8-9ab2f1c2ed5d risk: "Not defining the protection requirement of applications can lead to wrong @@ -2514,7 +2183,8 @@ Culture and Organization: usefulness: 3 level: 2 dependsOn: - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -2555,16 +2225,10 @@ Culture and Organization: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Process/72737130-472c-4984-80f8-9ab2f1c2ed5d tags: - vulnerability-mgmt - metrics - vmm-measurements - teamsImplemented: - Default: false - B: false - C: false Implementation: Application Hardening: App. Hardening Level 1: @@ -2584,7 +2248,7 @@ Implementation: usefulness: 4 level: 2 dependsOn: - - App. Hardening Level 1 (50%) + - b597928e-54d6-48a5-a806-8003dcd56aab # App. Hardening Level 1 (50%) description: | To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely. @@ -2625,16 +2289,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/cf819225-30cb-4702-8e32-60225eedc33d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false App. Hardening Level 1 (50%): uuid: b597928e-54d6-48a5-a806-8003dcd56aab risk: Using an insecure application might lead to a compromised application. @@ -2691,16 +2348,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/b597928e-54d6-48a5-a806-8003dcd56aab comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false App. Hardening Level 2: uuid: ffe86caf-2fec-4630-b514-2db83983984d risk: Using an insecure application might lead to a compromised application. @@ -2735,18 +2385,11 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/ffe86caf-2fec-4630-b514-2db83983984d comments: "" dependsOn: - - App. Hardening Level 2 (75%) + - 03643ca2-03c2-472b-8e19-956bf02fe9b7 # App. Hardening Level 2 (75%) tags: - none - teamsImplemented: - Default: false - B: false - C: false App. Hardening Level 2 (75%): uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 risk: Using an insecure application might lead to a compromised application. @@ -2781,18 +2424,11 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/03643ca2-03c2-472b-8e19-956bf02fe9b7 comments: "" dependsOn: - - App. Hardening Level 1 + - cf819225-30cb-4702-8e32-60225eedc33d # App. Hardening Level 1 tags: - none - teamsImplemented: - Default: false - B: false - C: false App. Hardening Level 3: uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a risk: Using an insecure application might lead to a compromised application. @@ -2827,17 +2463,10 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/4cae98c2-4163-44ed-bb88-3c67c569533a dependsOn: - - App. Hardening Level 2 + - ffe86caf-2fec-4630-b514-2db83983984d # App. Hardening Level 2 tags: - none - teamsImplemented: - Default: false - B: false - C: false Containers are running as non-root: uuid: a86c1fbc-28fd-4610-89a3-a7f73acfe45f risk: |- @@ -2892,15 +2521,8 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/a86c1fbc-28fd-4610-89a3-a7f73acfe45f tags: - none - teamsImplemented: - Default: false - B: false - C: false Context-aware output encoding: uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 description: "**Input validation** stops malicious data from entering your system. @@ -2944,16 +2566,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/e1f37abb-d848-4a3a-b3df-65e91a89dcb7 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Parametrization: uuid: 00e91a8a-3972-4692-8679-674ab8547486 description: | @@ -2995,16 +2610,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - Hardening/00e91a8a-3972-4692-8679-674ab8547486 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Secure headers: uuid: 29318d60-18ce-4526-80ea-f5928e49f639 risk: | @@ -3067,10 +2675,6 @@ Implementation: - https://www.opencre.org/cre/620-421 tags: - none - teamsImplemented: - Default: false - B: false - C: false Development and Source Control: .gitignore: uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d @@ -3097,15 +2701,8 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/363a3eea-baf9-4010-88ca-bb8186a2989d tags: - none - teamsImplemented: - Default: false - B: false - C: false Block force pushes: uuid: c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 risk: "Misuse of force push can lead to loss of work. It may overwrite remote @@ -3123,7 +2720,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -3146,15 +2743,8 @@ Implementation: iso27001-2022: - 5.3 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 tags: - none - teamsImplemented: - Default: false - B: false - C: false Dismiss stale PR approvals: uuid: ea6f69f7-54a5-4922-ac15-a77ff0c16162 risk: Intentional or accidental alterations in critical branches like main (or @@ -3169,7 +2759,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -3200,15 +2790,8 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/ea6f69f7-54a5-4922-ac15-a77ff0c16162 tags: - none - teamsImplemented: - Default: false - B: false - C: false Local development linting & style checks performed: uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 risk: Insecure or unmaintainable code base. @@ -3240,16 +2823,9 @@ Implementation: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/517b0957-4981-4ac0-b4c7-0d8d1934c474 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Require a PR before merging: uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 risk: Intentional or accidental alterations in critical branches like main (or @@ -3289,15 +2865,8 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/e7598ac4-b082-4e56-b7df-e2c6b426a5e2 tags: - none - teamsImplemented: - Default: false - B: false - C: false Require status checks to pass: uuid: ac8730a2-ccc0-465c-9550-d91edae9d5ee risk: Organizations risk introducing broken builds, quality issues, and security @@ -3311,7 +2880,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -3340,15 +2909,8 @@ Implementation: iso27001-2022: - 5.3 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/ac8730a2-ccc0-465c-9550-d91edae9d5ee tags: - none - teamsImplemented: - Default: false - B: false - C: false Versioning: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f risk: Deployment of untracked artifacts. @@ -3364,7 +2926,7 @@ Implementation: usefulness: 5 level: 1 dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: [] references: samm2: @@ -3379,15 +2941,8 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Development - and Source Control/066084c6-1135-4635-9cc5-9e75c7c5459f tags: - none - teamsImplemented: - Default: false - B: false - C: false Infrastructure Hardening: Applications are running in virtualized environments: uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 @@ -3410,16 +2965,9 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/3a94d55e-fd82-4996-9eb3-20d23ff2a873 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Backup: uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc risk: If errors are experienced during the deployment process you want to deploy @@ -3440,7 +2988,7 @@ Implementation: name: A Point in Time Recovery for databases should be implemented. tags: [] dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process references: samm2: - TODO @@ -3450,16 +2998,9 @@ Implementation: iso27001-2022: - 8.13 - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/5c61fd6b-8106-4c68-ac28-a8a42f1c67dc comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Baseline Hardening of the environment: uuid: 5992c38c-8597-4035-89db-d15820d81c3a risk: Using default configurations for a cluster environment leads to potential @@ -3521,16 +3062,9 @@ Implementation: - 13.1.3 iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/5992c38c-8597-4035-89db-d15820d81c3a comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Filter outgoing traffic: uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d risk: A compromised infrastructure component might try to send out stolen data. @@ -3561,16 +3095,9 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/6df508ef-86fc-4c22-bd9f-646c3127ce7d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Hardening of the Environment: uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 risk: Using default configurations for a cluster environment leads to potential @@ -3633,16 +3160,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/dcf9601b-b4f2-4e25-9143-e39af75f7c33 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Immutable infrastructure: uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 risk: The availability of IT systems might be disturbed due to components failures @@ -3654,7 +3174,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - Infrastructure as Code + - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code implementation: - uuid: b206481f-9c66-45e2-843c-37c5730580cd name: Remove direct access to infrastructure @@ -3668,16 +3188,9 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/48e92bb1-fdba-40e8-b6c2-35de0d431833 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Infrastructure as Code: uuid: 8b994601-575e-4ea5-b228-accb18c8e514 risk: No tracking of changes in systems might lead to errors in the configuration. @@ -3723,16 +3236,9 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/8b994601-575e-4ea5-b228-accb18c8e514 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Isolated networks for virtual environments: uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 risk: Virtual environments in default settings are able to access other virtual @@ -3769,16 +3275,9 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/4ce24abd-8ba6-494c-828d-4d193e28e4a1 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Limitation of system events: uuid: e5386abf-9154-4752-a1a8-c3a8900f732d risk: System events (system calls) can lead to privilege escalation. @@ -3790,7 +3289,7 @@ Implementation: usefulness: 5 level: 3 dependsOn: - - Audit of system events + - 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 # Audit of system events implementation: - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd name: seccomp @@ -3816,16 +3315,9 @@ Implementation: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/e5386abf-9154-4752-a1a8-c3a8900f732d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false MFA: uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de risk: One factor authentication is more vulnerable to brute force attacks and @@ -3839,7 +3331,7 @@ Implementation: usefulness: 4 level: 2 dependsOn: - - MFA for admins + - 8098e416-e1ed-4ae4-a561-83efbe76bf57 # MFA for admins implementation: - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 name: YubiKey - Smartcard @@ -3865,16 +3357,9 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/598e9f13-1ac8-4a01-b85e-8fab93ee81de comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false MFA for admins: uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 risk: One factor authentication is more vulnerable to brute force attacks and @@ -3912,16 +3397,9 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/8098e416-e1ed-4ae4-a561-83efbe76bf57 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Production near environments are used by developers: uuid: e14de741-94b3-447c-8b07-eea947d82e61 risk: In case an errors occurs in production, the developer need to be able @@ -3938,8 +3416,8 @@ Implementation: usefulness: 4 level: 4 dependsOn: - - Defined deployment process - - Infrastructure as Code + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code implementation: [] references: samm2: @@ -3950,16 +3428,9 @@ Implementation: iso27001-2022: - 8.31 - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/e14de741-94b3-447c-8b07-eea947d82e61 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Role based authentication and authorization: uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 risk: Everyone is able to get unauthorized access to information on systems @@ -3982,8 +3453,8 @@ Implementation: name: Plugins tags: [] dependsOn: - - Defined deployment process - - Defined build process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - O-EM-A-2 @@ -3991,16 +3462,9 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/070bb14b-e04a-4f3d-896a-a08eba7a35f9 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple access control for systems: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 risk: Attackers a gaining access to internal systems and application interfaces @@ -4012,7 +3476,7 @@ Implementation: usefulness: 5 level: 1 dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 name: HTTP-Basic Authentication @@ -4029,16 +3493,9 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/82e499d1-f463-4a4b-be90-68812a874af6 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of a chaos technology: uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe risk: Due to manual changes on a system, they are not replaceable anymore. In @@ -4073,16 +3530,9 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f8e80f18-2503-4e3e-b3bc-7f67bb28defe comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of an security account: uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 risk: Having security auditing in the same account as infrastructure and applications @@ -4103,16 +3553,9 @@ Implementation: - 10.1 iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/746025a6-dbfb-4087-a000-e46acab64ee1 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of edge encryption at transit: uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 risk: Evil actors might be able to perform a man in the middle attack and sniff @@ -4136,16 +3579,9 @@ Implementation: - 10.1 iso27001-2022: - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/ad23be9c-5661-4f1f-81a3-5a5dc7061629 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of encryption at rest: uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 risk: Evil actors might be able to access data and read information, e.g. from @@ -4166,16 +3602,9 @@ Implementation: - 10.1 iso27001-2022: - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/0ff45fb8-7eef-46ed-9b3a-84c955cd7060 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of internal encryption at transit: uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 risk: Evil actors within the organization of traffic in transit might be able @@ -4197,16 +3626,9 @@ Implementation: - 10.1 iso27001-2022: - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/ecb0184c-6bc9-45da-bbbb-a983797ffc93 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of security by default for components: uuid: 11b3848e-e931-4146-a35d-35409ada24ee risk: Components (images, libraries, applications) are not hardened. @@ -4235,7 +3657,7 @@ Implementation: tags: [] url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - O-EM-A-2 @@ -4243,16 +3665,9 @@ Implementation: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/11b3848e-e931-4146-a35d-35409ada24ee comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of test and production environments: uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 risk: Security tests are not running regularly because test environments are @@ -4265,7 +3680,7 @@ Implementation: usefulness: 4 level: 2 dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: [] references: samm2: @@ -4278,16 +3693,9 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 8.31 - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/bfdacb52-1e3f-431d-ae72-d844a5e86415 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Virtual environments are limited: uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca risk: Denial of service (internally by an attacker or unintentionally by a bug) @@ -4301,7 +3709,8 @@ Implementation: usefulness: 3 level: 2 dependsOn: - - Applications are running in virtualized environments + - 3a94d55e-fd82-4996-9eb3-20d23ff2a873 # Applications are running in virtualized + environments implementation: [] references: samm2: @@ -4316,16 +3725,9 @@ Implementation: - 8.6 - 8.22 - 8.14 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/760f1056-b0ee-4f22-a35b-f65446f944ca comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false WAF Advanced: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced risk: The presence of sophisticated threats necessitates a robust defense strategy @@ -4356,7 +3758,7 @@ Implementation: usefulness: 4 level: 5 dependsOn: - - WAF medium + - '{ f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium # WAF medium }' implementation: [] references: samm2: @@ -4367,16 +3769,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced comments: ~ tags: - none - teamsImplemented: - Default: false - B: false - C: false WAF baseline: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b risk: Vulnerable input, such as exploits, can infiltrate the application via @@ -4401,7 +3796,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - Context-aware output encoding + - e1f37abb-d848-4a3a-b3df-65e91a89dcb7 # Context-aware output encoding implementation: [] references: samm2: @@ -4412,16 +3807,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b comments: ~ tags: - none - teamsImplemented: - Default: false - B: false - C: false WAF medium: uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium risk: The threat from malicious inputs remains high, with exploits seeking to @@ -4445,7 +3833,7 @@ Implementation: usefulness: 3 level: 4 dependsOn: - - WAF baseline + - f0e01814-3b88-4bd0-a3a9-f91db001d20b # WAF baseline implementation: [] references: samm2: @@ -4456,16 +3844,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Infrastructure - Hardening/f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium comments: ~ tags: - none - teamsImplemented: - Default: false - B: false - C: false Information Gathering: Logging: Analyze logs: @@ -4490,14 +3871,8 @@ Information Gathering: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/b217c8bb-5d61-4b41-a675-1083993f83b1 tags: - none - teamsImplemented: - Default: false - B: false - C: false Centralized application logging: uuid: fe875e17-ae4a-45f8-a359-244aa4fcbc04 risk: Local stored logs can be unauthorized manipulated by attackers with system @@ -4512,7 +3887,7 @@ Information Gathering: usefulness: 5 level: 2 dependsOn: - - Alerting + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting implementation: [] references: samm2: @@ -4523,14 +3898,8 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/fe875e17-ae4a-45f8-a359-244aa4fcbc04 tags: - none - teamsImplemented: - Default: false - B: false - C: false Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: Local stored system logs can be unauthorized manipulated by attackers @@ -4566,15 +3935,9 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/4eced38a-7904-4c45-adb0-50b663065540 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Correlation of security events: uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 risk: Detection of security related events with hints on different systems/tools/metrics @@ -4588,8 +3951,8 @@ Information Gathering: usefulness: 3 level: 5 dependsOn: - - Visualized logging - - Alerting + - 7c735089-6a83-419f-8b27-c1e676cedea1 # Visualized logging + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting implementation: [] references: samm2: @@ -4600,15 +3963,9 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccf4561d-253f-4762-adcb-bc4622fd6fc5 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Logging of security events: uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb description: | @@ -4662,18 +4019,12 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/ccfdd0a8-991e-4269-ad77-c0a54ca655cb risk: |- * No track of security-relevant events makes it harder to analyze an incident. * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false PII logging concept: uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 risk: Personal identifiable information (PII) is logged and the privacy law @@ -4719,15 +4070,9 @@ Information Gathering: - Not explicitly covered by ISO 27001 - too specific - 8.15 - 5.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/613a73dc-4f60-49db-a6ce-4fb7bf8519f9 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Visualized logging: uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 risk: System and application protocols are not visualized properly which leads @@ -4743,8 +4088,9 @@ Information Gathering: usefulness: 4 level: 3 dependsOn: - - Centralized system logging - - Centralized application logging + - 4eced38a-7904-4c45-adb0-50b663065540 # Centralized system logging + - fe875e17-ae4a-45f8-a359-244aa4fcbc04 # Centralized application logging + implementation: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 name: ELK-Stack @@ -4759,15 +4105,9 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Logging/7c735089-6a83-419f-8b27-c1e676cedea1 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Monitoring: Advanced app. metrics: uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf @@ -4781,8 +4121,8 @@ Information Gathering: usefulness: 4 level: 4 dependsOn: - - Simple application metrics - - Visualized metrics + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: @@ -4791,15 +4131,9 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d03bc410-74a7-4e92-82cb-d01a020cb6bf comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Advanced availability and stability metrics: uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 risk: Trends and advanced attacks are not detected. @@ -4812,8 +4146,8 @@ Information Gathering: usefulness: 4 level: 3 dependsOn: - - Simple application metrics - - Visualized metrics + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: @@ -4822,15 +4156,9 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ed715b38-c34b-40cd-83fd-ce807f306fc1 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Alerting: uuid: 8a442d8e-0eb1-4793-a513-571aef982edd risk: Incidents are discovered after they happened. @@ -4843,7 +4171,7 @@ Information Gathering: usefulness: 5 level: 2 dependsOn: - - Visualized metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: @@ -4857,15 +4185,9 @@ Information Gathering: - 6.8 - 5.25 - 8.31 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8a442d8e-0eb1-4793-a513-571aef982edd comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Audit of system events: uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 risk: System events (system calls) trends and attacks are not detected. @@ -4877,7 +4199,7 @@ Information Gathering: usefulness: 4 level: 3 dependsOn: - - Visualized metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 name: Falco @@ -4895,15 +4217,9 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/1cd5e4b8-be36-4726-adc7-d8f843f47ac8 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage and control metrics: uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d risk: The effectiveness of configuration, patch and vulnerability management @@ -4921,7 +4237,7 @@ Information Gathering: usefulness: 4 level: 4 dependsOn: - - Visualized metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d name: https://ht.transpare @@ -4935,15 +4251,9 @@ Information Gathering: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d0d681e7-d6de-4829-ac64-a9eb2546aa0d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Deactivation of unused metrics: uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 risk: High resources are used while gathering unused metrics. @@ -4955,7 +4265,7 @@ Information Gathering: usefulness: 5 level: 3 dependsOn: - - Visualized metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: @@ -4966,15 +4276,9 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/7f36b9ba-bc05-4fd6-9a2a-73344c249722 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Defense metrics: uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 risk: IDS/IPS systems like packet- or application-firewalls detect and prevent @@ -4989,8 +4293,8 @@ Information Gathering: usefulness: 4 level: 4 dependsOn: - - Visualized metrics - - Filter outgoing traffic + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - 6df508ef-86fc-4c22-bd9f-646c3127ce7d # Filter outgoing traffic implementation: [] references: samm2: @@ -5001,15 +4305,9 @@ Information Gathering: iso27001-2022: - 8.15 - 8.2 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e808028c-351c-42f1-bcd9-fba738d1fc55 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Grouping of metrics: uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b risk: The analysis of metrics takes long. @@ -5030,15 +4328,9 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/42170a71-d4c8-47af-bd71-bf36875fd05b comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Metrics are combined with tests: uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 risk: Changes might cause high load due to programming errors. @@ -5050,7 +4342,7 @@ Information Gathering: usefulness: 5 level: 5 dependsOn: - - Grouping of metrics + - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics implementation: [] references: samm2: @@ -5059,15 +4351,9 @@ Information Gathering: - not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/71699daf-b2a4-466b-a0b2-89f7dbb18506 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Monitoring of costs: uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e risk: Not monitoring costs might lead to unexpected high resource consumption @@ -5082,8 +4368,8 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - Simple application metrics - - Simple system metrics + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics implementation: [] references: samm2: @@ -5092,15 +4378,9 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/10e23a8c-22ff-4487-a706-87ccc9d0798e comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Screens with metric visualization: uuid: 8746647c-638c-473f-8e17-82c068e4c311 risk: Security related information is discovered too late during an incident. @@ -5113,7 +4393,7 @@ Information Gathering: usefulness: 5 level: 4 dependsOn: - - Grouping of metrics + - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics implementation: [] references: samm2: @@ -5124,15 +4404,9 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/8746647c-638c-473f-8e17-82c068e4c311 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 risk: Attacks on an application are not recognized. @@ -5167,15 +4441,9 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/e9a6d403-a467-445e-b98a-74f0c29da0b1 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 risk: Not getting notified about reaching the end of the budget (e.g. due to @@ -5199,15 +4467,9 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/f08a3219-6941-43ec-8762-4aff739f4664 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 risk: Without simple metrics analysis of incidents are hard. In case an application @@ -5234,15 +4496,9 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/3d1f4c3b-f713-46d9-933a-54a014a26c03 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Targeted alerting: uuid: d6f06ae8-401a-4f44-85df-1079247fa030 risk: People are bored (ignorant) of incident alarm messages, as they are not @@ -5256,7 +4512,7 @@ Information Gathering: usefulness: 5 level: 3 dependsOn: - - Alerting + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting implementation: [] references: samm2: @@ -5268,15 +4524,9 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/d6f06ae8-401a-4f44-85df-1079247fa030 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Visualized metrics: uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 risk: Not visualized metrics lead to restricted usage of metrics. @@ -5288,8 +4538,8 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - Simple application metrics - - Simple system metrics + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics implementation: [] references: samm2: @@ -5298,15 +4548,9 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Monitoring/ded39bcf-4eaa-4c5f-9c94-09acde0a4734 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test KPI: Fix rate per repo/product: uuid: cf0d600e-114d-4887-9059-d81c53805f0d @@ -5363,17 +4607,10 @@ Information Gathering: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/cf0d600e-114d-4887-9059-d81c53805f0d tags: - vulnerability-mgmt - metrics - vmm-measurements - teamsImplemented: - Default: false - B: false - C: false Generation of response statistics: uuid: c922981b-65ed-40f3-a947-96fee9a0125f risk: No or delayed reaction to findings leads to potential exploitation of @@ -5386,7 +4623,8 @@ Information Gathering: resources: 1 usefulness: 3 dependsOn: - - Usage of a vulnerability management system + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management + system level: 3 implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb @@ -5429,9 +4667,6 @@ Information Gathering: iso27001-2022: - 5.25 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/c922981b-65ed-40f3-a947-96fee9a0125f tags: - vulnerability-mgmt - metrics @@ -5439,10 +4674,6 @@ Information Gathering: comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) generates statistics from OWASP DefectDojo and places the results in a [Github repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). - teamsImplemented: - Default: false - B: false - C: false Number of vulnerabilities/severity: uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 risk: Failing to convey the number of vulnerabilities by severity might undermine @@ -5468,17 +4699,10 @@ Information Gathering: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/bc548cba-cb82-4f76-bd4b-325d9d256279 tags: - vulnerability-mgmt - metrics - vmm-measurement - teamsImplemented: - Default: false - B: false - C: false Number of vulnerabilities/severity/layer: uuid: 0ec92899-a5cb-4649-984b-2fb1d6c784ad risk: Failing to convey the number of vulnerabilities by severity and layer @@ -5517,17 +4741,10 @@ Information Gathering: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/0ec92899-a5cb-4649-984b-2fb1d6c784ad tags: - vulnerability-mgmt - metrics - vmm-measurement - teamsImplemented: - Default: false - B: false - C: false Patching mean time to resolution via PR: uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 risk: Without measuring Mean Time to Resolution (MTTR) related to patching, @@ -5548,7 +4765,7 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - Automated PRs for patches + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches implementation: [] references: samm2: @@ -5558,17 +4775,10 @@ Information Gathering: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/86d490b9-d798-4a5b-a011-ab9688014c46 tags: - patching - metrics - vmm-measurements - teamsImplemented: - Default: false - B: false - C: false Patching mean time to resolution via production: uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f risk: Without measuring Mean Time to Resolution (MTTR) related to patching, @@ -5585,8 +4795,9 @@ Information Gathering: usefulness: 3 level: 4 dependsOn: - - Patching mean time to resolution via PR - - Automated PRs for patches + - 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution + via PR + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches implementation: [] references: samm2: @@ -5595,17 +4806,10 @@ Information Gathering: - 16.1.4 iso27001-2022: - 5.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f tags: - patching - metrics - vmm-measurements - teamsImplemented: - Default: false - B: false - C: false SLA per criticality: uuid: 51f3fce5-b5c8-4683-8c41-e785fe4f3b5f risk: "Not communicating how many applications are adhering to SLAs based on @@ -5662,17 +4866,10 @@ Information Gathering: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test - KPI/51f3fce5-b5c8-4683-8c41-e785fe4f3b5f tags: - vulnerability-mgmt - metrics - vmm-measurements - teamsImplemented: - Default: false - B: false - C: false Test and Verification: Application tests: High coverage of security related module and integration tests: @@ -5697,16 +4894,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - tests/67667c97-c33e-4306-a4e5-e7b1d8e10c5a comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security integration tests for important components: uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 risk: Vulnerabilities are rising due to code changes in a complex microservice @@ -5728,16 +4918,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - tests/f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Security unit tests for important components: uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 risk: Vulnerabilities are rising due to code changes. @@ -5771,15 +4954,8 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - tests/eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 tags: - none - teamsImplemented: - Default: false - B: false - C: false Smoke Test: uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a risk: During a deployment an error might happen which leads to non-availability @@ -5794,7 +4970,7 @@ Test and Verification: level: 4 implementation: [] dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process references: samm2: - V-RT-A-3 @@ -5804,16 +4980,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Application - tests/73aaae0b-5d68-4953-9fa4-fd25bf665f2a comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Consolidation: Advanced visualization of defects: uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 @@ -5862,15 +5031,9 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/7a82020c-94d1-471c-bbd3-5f7fe7df4876 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Artifact-based false positive treatment: uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f risk: Without artifact-specific false positive handling, teams must repeatedly @@ -5892,7 +5055,8 @@ Test and Verification: usefulness: 3 level: 2 dependsOn: - - Simple false positive treatment + - c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment + implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -5933,15 +5097,9 @@ Test and Verification: iso27001-2022: - 5.25 - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f tags: - false-positive - defect-management - teamsImplemented: - Default: false - B: false - C: false Fix based on accessibility: uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed risk: Overwhelming volume of security findings from automated testing tools. @@ -5961,8 +5119,10 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - Treatment of defects with severity high or higher - - Inventory of production components + - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity + high or higher + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: ~ references: samm2: @@ -5977,15 +5137,9 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/0c10a7f7-f78f-49f2-943d-19fdef248fed tags: - vuln-action - defect-management - teamsImplemented: - Default: false - B: false - C: false Global false positive treatment: uuid: 9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c risk: Without centralized false positive management across environments, organizations @@ -6007,8 +5161,10 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - Artifact-based false positive treatment - - Usage of a vulnerability management system + - 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment + + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management + system implementation: ~ references: samm2: @@ -6023,15 +5179,9 @@ Test and Verification: - 6.8 - 5.25 - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c tags: - false-positive - defect-management - teamsImplemented: - Default: false - B: false - C: false Integration in development process: uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d risk: "Not integrating vulnerability handling into the development process may @@ -6106,15 +5256,9 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/aaffa73f-59f6-4267-b0ab-732f3d13e90d tags: - vulnerability-mgmt - vmm-measurements - teamsImplemented: - Default: false - B: false - C: false Integration of vulnerability issues into the development process: uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e risk: To read console output of the build server to search for vulnerabilities @@ -6154,15 +5298,9 @@ Test and Verification: - 5.25 - 5.26 - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/ce970c9b-da94-41cf-bd78-8c15357b7e8e comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Reproducible defect tickets: uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 risk: Vulnerability descriptions are hard to understand by staff from operations @@ -6190,15 +5328,9 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/27337442-e4b1-4e87-8dc9-ce86fbb79a39 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 risk: As false positive occur during each test, all vulnerabilities might be @@ -6246,15 +5378,9 @@ Test and Verification: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/c1acc8af-312e-4503-a817-a26220c993a0 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: The security level of a component is not visible. Therefore, the motivation @@ -6318,15 +5444,9 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/55f4c916-3a34-474d-ad96-9a9f7a4f6a83 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Treatment of all defects: uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d risk: Vulnerabilities with severity low are not visible. @@ -6347,16 +5467,10 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/b2f77606-3e6c-41e9-b72d-7c0b1d3d581d tags: - vuln-action - defect-management comments: "" - teamsImplemented: - Default: false - B: false - C: false Treatment of defects per protection requirement: uuid: 2b7cc923-bdaf-43e3-8fb4-a995b7783969 risk: "Not defining the protection requirement of applications can lead to wrong @@ -6418,16 +5532,10 @@ Test and Verification: - 5.12 - 5.13 - 5.1 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/2b7cc923-bdaf-43e3-8fb4-a995b7783969 tags: - vulnerability-mgmt - metrics - vmm-measurements - teamsImplemented: - Default: false - B: false - C: false Treatment of defects with severity high or higher: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 risk: Vulnerabilities with severity high or higher are not visible. @@ -6449,16 +5557,10 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/44f2c8a9-4aaa-4c72-942d-63f78b89f385 implementation: [] tags: - vuln-action - defect-management - teamsImplemented: - Default: false - B: false - C: false Treatment of defects with severity middle: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. @@ -6479,16 +5581,10 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/9cac3341-fe83-4079-bef2-bfc4279eb594 implementation: [] tags: - vuln-action - defect-management - teamsImplemented: - Default: false - B: false - C: false Usage of a vulnerability management system: uuid: 85ba5623-84be-4219-8892-808837be582d risk: Maintenance of false positives in each tool enforces a high workload. @@ -6502,9 +5598,10 @@ Test and Verification: resources: 2 usefulness: 2 dependsOn: - - Exploit likelihood estimation - - Each team has a security champion - - Office Hours + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation + - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion + + - 185d5a74-19dc-4422-be07-44ea35226783 # Office Hours level: 3 description: "For known vulnerabilities a processes to estimate the exploit ability of a vulnerability is recommended.\n\nTo implement a security culture @@ -6549,14 +5646,8 @@ Test and Verification: - 5.25 - 5.26 - 5.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Consolidation/85ba5623-84be-4219-8892-808837be582d tags: - none - teamsImplemented: - Default: false - B: false - C: false Dynamic depth for applications: Coverage analysis: uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 @@ -6589,16 +5680,9 @@ Test and Verification: - part of periodic review, PDCA iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/d0ba0be5-c573-405f-b905-b7a8f87a9cc7 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of client side dynamic components: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript @@ -6613,7 +5697,7 @@ Test and Verification: usefulness: 4 level: 2 dependsOn: - - Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-ST-A-2 @@ -6623,9 +5707,6 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/9711f871-f79d-4573-8d4f-d2c98fd0d18e implementation: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb name: Ajax Spider @@ -6634,10 +5715,6 @@ Test and Verification: comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of hidden endpoints: uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 risk: Hidden endpoints of the service are not getting tracked. @@ -6676,7 +5753,7 @@ Test and Verification: description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. dependsOn: - - Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-ST-A-2 @@ -6684,16 +5761,9 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/6a9cb303-0f98-48a8-bdcd-56d41c0012b8 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of more input vectors: uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc risk: Parts of the service are not covered. For example specially formatted @@ -6708,7 +5778,7 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-RT-B-1 @@ -6716,9 +5786,6 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/5e0ff85b-ec89-4ef0-96b1-5695fa0025dc implementation: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b name: Schemathesis @@ -6732,10 +5799,6 @@ Test and Verification: comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of sequential operations: uuid: 845f06ec-148c-4c67-9755-7041911dcca5 risk: Sequential operations like workflows (e.g. login -> put products in the @@ -6754,7 +5817,7 @@ Test and Verification: tags: [] url: https://curl.se/ dependsOn: - - Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-ST-A-2 @@ -6764,16 +5827,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/845f06ec-148c-4c67-9755-7041911dcca5 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Coverage of service to service communication: uuid: 22aab0ef-76ce-4b8c-979c-3699784330db risk: Service to service communication is not covered. @@ -6785,7 +5841,7 @@ Test and Verification: usefulness: 3 level: 5 dependsOn: - - Simple Scan + - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan references: samm2: - V-ST-A-2 @@ -6795,9 +5851,6 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/22aab0ef-76ce-4b8c-979c-3699784330db implementation: - uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 name: Citrus Fresh Integration Testing @@ -6810,10 +5863,6 @@ Test and Verification: comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Simple Scan: uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 risk: Deficient security tests are performed. Simple vulnerabilities are not @@ -6829,7 +5878,7 @@ Test and Verification: usefulness: 1 level: 2 dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process implementation: - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 name: OWASP Zap @@ -6851,16 +5900,9 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/07796811-37f9-467c-9ff2-48f346e77ff3 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of different roles: uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 risk: Parts of the service are not covered during the scan, because a login @@ -6873,7 +5915,7 @@ Test and Verification: usefulness: 2 level: 2 dependsOn: - - Simple Scan + - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan references: samm2: - V-ST-A-2 @@ -6884,9 +5926,6 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/65a2d7d9-5441-46bf-a4e3-f76919857750 implementation: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 name: Zest @@ -6899,10 +5938,6 @@ Test and Verification: comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Usage of multiple scanners: uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea risk: Each vulnerability scanner has different opportunities. By using just @@ -6916,7 +5951,7 @@ Test and Verification: usefulness: 1 level: 4 dependsOn: - - Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles implementation: - uuid: f220b299-0917-4750-96c5-d81cd402b4df name: OWASP secureCodeBox @@ -6935,16 +5970,9 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for applications/5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Dynamic depth for infrastructure: Load tests: uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd @@ -6970,16 +5998,9 @@ Test and Verification: - 8.6 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/ab5725aa-4d53-47b9-96df-c14b3fa93bcd comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for exposed services: uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 risk: Standard network segmentation and firewalling has not been performed, @@ -6993,7 +6014,8 @@ Test and Verification: time: 1 resources: 2 dependsOn: - - Isolated networks for virtual environments + - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments + usefulness: 2 level: 2 implementation: @@ -7016,16 +6038,9 @@ Test and Verification: - 8.22 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for unauthorized installation: uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a risk: Unapproved components are used. @@ -7053,17 +6068,11 @@ Test and Verification: iso27001-2022: - 8.19 - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/dccf1949-b9a8-4ce8-b992-6a4a7f3a623a dependsOn: - - Evaluation of the trust of used components + - 0de465a6-55a7-4343-af79-948bb5ff10ba # Evaluation of the trust of used + components tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for unused Resources: uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 risk: Unused resources, specially secrets, might be still valid, but are exposing @@ -7098,16 +6107,9 @@ Test and Verification: - 8.22 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/6532c1fe-9d23-4228-8722-558ddabca7d4 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test network segmentation: uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 risk: Wrong or no network segmentation of pods makes it easier for an attacker @@ -7126,7 +6128,8 @@ Test and Verification: tags: [] url: https://github.com/controlplaneio/netassert dependsOn: - - Isolated networks for virtual environments + - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments + references: samm2: - V-ST-A-2 @@ -7138,16 +6141,9 @@ Test and Verification: - 8.22 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/6d2c3ac6-8afc-4af6-a5e9-6188341aca01 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test of the configuration of cloud environments: uuid: 7bb70764-9392-4462-935d-e55b2e148199 risk: Standard hardening practices for cloud environments are not performed @@ -7190,16 +6186,9 @@ Test and Verification: - 8.8 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/7bb70764-9392-4462-935d-e55b2e148199 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Weak password test: uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f risk: Weak passwords in components like applications or systems, specially for @@ -7225,16 +6214,9 @@ Test and Verification: - 9.4.3 iso27001-2022: - 5.17 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Dynamic - depth for infrastructure/61e10f9c-e126-4ffa-af12-fdbe0d0a831f comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Static depth for applications: API design validation: uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 @@ -7280,17 +6262,11 @@ Test and Verification: - 8.25 - 8.27 - 8.28 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/017d9e26-42b5-49a4-b945-9f59b308fb99 dependsOn: - - Inventory of production components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + tags: - none - teamsImplemented: - Default: false - B: false - C: false Dead code elimination: uuid: a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d risk: Dead code increases the attack surface (use of hard coded credentials @@ -7307,7 +6283,7 @@ Test and Verification: name: PMD tags: [] dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -7319,16 +6295,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Exclusion of source code duplicates: uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 risk: Duplicates in source code might influence the stability of the application. @@ -7344,7 +6313,7 @@ Test and Verification: name: PMD tags: [] dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -7356,16 +6325,9 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d17dbff0-1f10-492a-b4c7-17bb59a0a711 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Exploit likelihood estimation: uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad risk: Without proper prioritization, organizations may waste time and effort @@ -7381,7 +6343,8 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - Software Composition Analysis (server side) + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server + side) implementation: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 name: Known Exploited Vulnerabilities @@ -7404,15 +6367,8 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/f2f0f274-c1a0-4501-92fe-7fc4452bc8ad tags: - none - teamsImplemented: - Default: false - B: false - C: false Local development security checks performed: uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b risk: Creating and developing code contains code smells and quality issues. @@ -7463,16 +6419,9 @@ Test and Verification: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/6e180abc-7c98-4265-b4e9-852cb91b067b comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Software Composition Analysis (client side): uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 risk: Client side components might have vulnerabilities. @@ -7485,9 +6434,10 @@ Test and Verification: usefulness: 2 level: 3 dependsOn: - - Defined build process - - Inventory of production components - - Exploit likelihood estimation + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation implementation: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js @@ -7527,16 +6477,9 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/07fe8c4f-ae33-4409-b1b2-cf64cfccea86 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe description: Use a tool like trivy and concentrate on application related vulnerabilities. @@ -7552,8 +6495,9 @@ Test and Verification: usefulness: 5 level: 2 dependsOn: - - Defined build process - - Inventory of production components + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 name: OWASP Dependency Check @@ -7604,15 +6548,8 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/d918cd44-a972-43e9-a974-eff3f4a5dcfe tags: - vmm-testing - teamsImplemented: - Default: false - B: false - C: false Static analysis for all components/libraries: uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 risk: Used components like libraries and legacy applications might have vulnerabilities @@ -7624,9 +6561,12 @@ Test and Verification: usefulness: 3 level: 5 dependsOn: - - Static analysis for important client side components - - Static analysis for important server side components - - Inventory of production components + - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client + side components + - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server + side components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: [] references: samm2: @@ -7636,16 +6576,9 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Static analysis for all self written components: uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 risk: Parts in the source code of the frontend or middleware have vulnerabilities. @@ -7689,9 +6622,12 @@ Test and Verification: - ide - sast dependsOn: - - Static analysis for important client side components - - Static analysis for important server side components - - Inventory of production components + - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client + side components + - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server + side components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + references: samm2: - V-ST-A-2 @@ -7700,16 +6636,9 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/ee68331f-9b1d-4f61-844b-b2ea04753a84 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Static analysis for important client side components: uuid: e237176b-bec5-447d-a926-e37d6dd60e4b risk: Important parts in the source code of the frontend have vulnerabilities. @@ -7758,8 +6687,9 @@ Test and Verification: - ide - sast dependsOn: - - Defined build process - - Inventory of production components + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + references: samm2: - V-ST-A-2 @@ -7767,16 +6697,9 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/e237176b-bec5-447d-a926-e37d6dd60e4b comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Static analysis for important server side components: uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 risk: Important parts in the source code of the middleware have vulnerabilities. @@ -7820,8 +6743,9 @@ Test and Verification: - ide - sast dependsOn: - - Defined build process - - Inventory of production components + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + references: samm2: - V-ST-A-2 @@ -7830,16 +6754,9 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/6c05c837-8c99-46e2-828b-7c903e27dba4 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Stylistic analysis: uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 risk: Unclear or obfuscated code might have unexpected behavior. @@ -7886,16 +6803,9 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for Patch Deployment Time: uuid: 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -7914,8 +6824,8 @@ Test and Verification: name: PMD tags: [] dependsOn: - - Automated PRs for patches - - Defined build process + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -7927,9 +6837,6 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 comments: "" meta: implementationGuide: Self implementation. This activity is not repeated in @@ -7937,10 +6844,6 @@ Test and Verification: as well. tags: - patching - teamsImplemented: - Default: false - B: false - C: false Test for Time to Patch: uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -7968,7 +6871,7 @@ Test and Verification: - patching url: https://github.com/renovatebot/renovate dependsOn: - - Automated PRs for patches + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches references: samm2: - V-ST-A-2 @@ -7980,9 +6883,6 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/13af1227-3dd1-4d4f-a9e9-53deb793c18f comments: "" meta: implementationGuide: Usage of a version control platform API (e.g. github @@ -7990,10 +6890,6 @@ Test and Verification: might be an alternative to this activity. tags: - patching - teamsImplemented: - Default: false - B: false - C: false Test libyear: uuid: 87b54313-fafd-4860-930f-5ef132b3e4ad risk: Vulnerabilities in running artifacts stay for long and might get exploited. @@ -8015,7 +6911,7 @@ Test and Verification: description: A simple measure of software dependency freshness. It is a single number telling you how up-to-date your dependencies are. dependsOn: - - Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -8027,9 +6923,6 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/87b54313-fafd-4860-930f-5ef132b3e4ad comments: "" meta: implementationGuide: | @@ -8037,10 +6930,6 @@ Test and Verification: An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). tags: - patching - teamsImplemented: - Default: false - B: false - C: false Usage of multiple analyzers: uuid: 297be001-8d94-41ee-ab29-207020d423c0 risk: Each vulnerability analyzer has different opportunities. By using just @@ -8053,9 +6942,12 @@ Test and Verification: usefulness: 1 level: 4 dependsOn: - - Software Composition Analysis (server side) - - Software Composition Analysis (client side) - - Static analysis for all self written components + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server + side) + - 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 # Software Composition Analysis (client + side) + - ee68331f-9b1d-4f61-844b-b2ea04753a84 # Static analysis for all self written + components implementation: [] references: samm2: @@ -8068,16 +6960,9 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for applications/297be001-8d94-41ee-ab29-207020d423c0 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Static depth for infrastructure: Correlate known vulnerabilities in infrastructure with new image versions: uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 @@ -8090,7 +6975,8 @@ Test and Verification: usefulness: 1 level: 4 dependsOn: - - Usage of a maximum lifetime for images + - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for + images implementation: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc name: Anchore.io @@ -8117,16 +7003,9 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/7de0ae33-6538-45cd-8222-a1475647ba58 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Software Composition Analysis: uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad risk: Known vulnerabilities in infrastructure components like container images @@ -8171,16 +7050,9 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/26e1c6d5-5632-4ec7-80d2-e564b98732ad comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test cluster deployment resources: uuid: 621fb6a5-5c0a-4408-826a-068868bb031b risk: The deployment configuration (e.g. kubernetes deployment resources) might @@ -8211,16 +7083,9 @@ Test and Verification: - 8.8 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/621fb6a5-5c0a-4408-826a-068868bb031b comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for image lifetime: uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b risk: Old container images in production indicate that patch management is not @@ -8255,16 +7120,9 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for malware: uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d risk: Third party might include malware. Ether due to the maintainer (e.g. @@ -8299,16 +7157,9 @@ Test and Verification: - 12.2.1 iso27001-2022: - 8.7 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/837f8f90-adc2-4e6b-9ebb-60c2ee29494d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for new image version: uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e risk: When a new version of an image is available, it might fix security vulnerabilities. @@ -8331,16 +7182,9 @@ Test and Verification: - 8.8 - 8.7 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/cb6321aa-0fbf-4996-9e08-05ab26ef4c1e comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for stored secrets in build artifacts: uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f risk: Stored secrets in container images or other build artifacts shouldn't @@ -8372,16 +7216,9 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/d5e6303c-d5c6-4d59-b258-a3b9de38a07f comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test for stored secrets in code: uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c risk: Stored secrets in git history or directly in code shouldn't exists because @@ -8413,16 +7250,9 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/c6e3c812-56e2-41b0-ae01-b7afc41a004c comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test of infrastructure components for known vulnerabilities: uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 risk: Infrastructure components might have vulnerabilities. @@ -8438,7 +7268,8 @@ Test and Verification: usefulness: 1 level: 4 dependsOn: - - Usage of a maximum lifetime for images + - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for + images implementation: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc name: Anchore.io @@ -8465,16 +7296,9 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/13367d8f-e37f-4197-a610-9ffca4fde261 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test of virtualized environments: uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 risk: Virtualized environments (e.g. via Container Images) might contains @@ -8511,16 +7335,9 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/58825d22-1ce6-4748-af81-0ec9956e4129 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test the cloud configuration: uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc risk: Standard hardening practices for cloud environments are not performed @@ -8551,16 +7368,9 @@ Test and Verification: - 8.8 - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Test the definition of virtualized environments: uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e risk: The definition of virtualized environments (e.g. via Dockerfile) @@ -8610,15 +7420,8 @@ Test and Verification: - 8.32 - 8.29 - 8.25 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static - depth for infrastructure/8fc3de67-7b8d-420b-8d24-f35928cfed6e tags: - none - teamsImplemented: - Default: false - B: false - C: false Test-Intensity: Creation and application of a testing concept: uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe @@ -8648,15 +7451,9 @@ Test and Verification: - 8.32 - 8.27 - 8.8 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/79ef8103-e1ed-4055-8df8-fd2b2015bebe comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Deactivating of unneeded tests: uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 risk: As tools cover a wide range of different vulnerability tests, they might @@ -8683,15 +7480,9 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Default settings for intensity: uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d risk: Time pressure and ignorance might lead to false predictions for the test @@ -8715,15 +7506,9 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/ab0a4b51-3b18-43f1-a6fc-a98e4b28453d comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false High test intensity: uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 risk: A too small intensity or a too high confidence might lead to not visible @@ -8748,15 +7533,9 @@ Test and Verification: - 8.8 - 8.25 - 8.27 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/2ebfc421-8c76-415c-a3b0-fa518915bd10 comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false Regular automated tests: uuid: 598897a2-358e-441f-984c-e12ec4f6110a risk: After pushing source code to the version control system, any delay in @@ -8781,13 +7560,7 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 - openCRE: - - https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Test-Intensity/598897a2-358e-441f-984c-e12ec4f6110a comments: "" tags: - none - teamsImplemented: - Default: false - B: false - C: false ... From dc2a5059cb3fcabf8755fbbc738b7fefee941bc7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 17 Nov 2025 13:19:12 +0100 Subject: [PATCH 134/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index e8f5beb..3f655c0 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [1.19.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.18.0...v1.19.0) (2025-11-17) + + +### Features + +* Improved start script ([18d6205](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/18d6205beb02b5c809b95dc15a76c9bcb803eb3d)) + # [1.18.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.17.0...v1.18.0) (2025-11-06) From 0761ee35da67f843c68cbf413a04d365482ab879 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 17 Nov 2025 13:21:21 +0100 Subject: [PATCH 135/370] feat: install dep always --- yaml-generation/generateDimensions.bash | 9 ++++----- 1 file changed, 4 insertions(+), 5 deletions(-) diff --git a/yaml-generation/generateDimensions.bash b/yaml-generation/generateDimensions.bash index 0ac8bb6..1cb18a9 100755 --- a/yaml-generation/generateDimensions.bash +++ b/yaml-generation/generateDimensions.bash @@ -6,18 +6,17 @@ # ./generateDimensions.bash --test-urls Test URLs in implementations.yaml cd "$(dirname "$0")"/.. -pwd +pwd # Use: docker | podman if [ -z "${DOCKER_CMD}" ]; then DOCKER_CMD=docker fi -if [ "$1" = "--install" ]; then - echo Installing composer dependencies... - MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist' +echo Installing composer dependencies... +MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist' -elif [ "$1" = "--start-dsomm" ]; then +if [ "$1" = "--start-dsomm" ]; then echo "Starting local DSOMM application..." MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume $(pwd)/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm From 796e1d27f682eb27b6de5c4b6c5969119caa5a2e Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 17 Nov 2025 21:20:17 +0100 Subject: [PATCH 136/370] feat: adopt changes to bat file --- yaml-generation/generateDimensions.bash | 11 ++++------- yaml-generation/generateDimensions.bat | 7 +++---- 2 files changed, 7 insertions(+), 11 deletions(-) diff --git a/yaml-generation/generateDimensions.bash b/yaml-generation/generateDimensions.bash index 1cb18a9..8f6499a 100755 --- a/yaml-generation/generateDimensions.bash +++ b/yaml-generation/generateDimensions.bash @@ -6,7 +6,6 @@ # ./generateDimensions.bash --test-urls Test URLs in implementations.yaml cd "$(dirname "$0")"/.. -pwd # Use: docker | podman if [ -z "${DOCKER_CMD}" ]; then @@ -14,18 +13,16 @@ if [ -z "${DOCKER_CMD}" ]; then fi echo Installing composer dependencies... -MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist' +MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}:/app" wurstbrot/dsomm-yaml-generation bash -c 'cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist' if [ "$1" = "--start-dsomm" ]; then echo "Starting local DSOMM application..." - MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume $(pwd)/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml -p 8080:8080 wurstbrot/dsomm - + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml" -p 8080:8080 wurstbrot/dsomm elif [ "$1" = "--test-urls" ]; then echo "Test URLs in implementations.yaml..." - MSYS_NO_PATHCONV=1 $DOCKER_CMD run -e TEST_REFERENCED_URLS=true -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' | tee url-test-results.txt + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -e TEST_REFERENCED_URLS=true -ti --rm --volume "${PWD}:/app" wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' | tee url-test-results.txt else echo "Generating activities.yaml..." - MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume ${PWD}:/app wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' - + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}:/app" wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' fi diff --git a/yaml-generation/generateDimensions.bat b/yaml-generation/generateDimensions.bat index 2cfa058..646daab 100644 --- a/yaml-generation/generateDimensions.bat +++ b/yaml-generation/generateDimensions.bat @@ -14,11 +14,10 @@ if "%DOCKER_CMD%"=="" ( set DOCKER_CMD=docker ) -if "%~1"=="--install" ( - echo Installing composer dependencies... - %DOCKER_CMD% run -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist" +echo Installing composer dependencies... +%DOCKER_CMD% run -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/yaml-generation && composer install --no-interaction --no-plugins --no-scripts --prefer-dist" -) else if "%~1"=="--start-dsomm" ( +if "%~1"=="--start-dsomm" ( echo Start local DSOMM application... %DOCKER_CMD% run -ti --rm --volume "%CD%/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml" -p 8080:8080 wurstbrot/dsomm From 0bd3516b87858f46990f9d1f62ae1e4a679bdaaf Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 18 Nov 2025 08:58:41 +0100 Subject: [PATCH 137/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 3f655c0..905857b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,11 @@ +# [1.20.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.19.0...v1.20.0) (2025-11-18) + + +### Features + +* adopt changes to bat file ([796e1d2](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/796e1d27f682eb27b6de5c4b6c5969119caa5a2e)) +* install dep always ([0761ee3](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/0761ee35da67f843c68cbf413a04d365482ab879)) + # [1.19.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.18.0...v1.19.0) (2025-11-17) From e2aeba77089d21f0e7c5ce5bf6612903efc1938f Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 23 Nov 2025 21:29:47 +0100 Subject: [PATCH 138/370] fix: Sort activities by level, within each sub-dimension --- yaml-generation/functions.php | 15 +++++++++++++++ yaml-generation/generateDimensions.php | 1 + 2 files changed, 16 insertions(+) diff --git a/yaml-generation/functions.php b/yaml-generation/functions.php index 4bd5030..422047a 100644 --- a/yaml-generation/functions.php +++ b/yaml-generation/functions.php @@ -136,6 +136,21 @@ function getDimensions($filename = "data/generated/dimensions.yaml") { return $dimensions; } +/** + * Sort activities by their 'level' attribute within each subdimension. + * The uasort() is stable, i.e. it will retain the original order, within each level. + */ +function sortActivitiesByLevel($dimensions) { + foreach ($dimensions as $dimension => $subdimensions) { + foreach ($subdimensions as $subdimension => $elements) { + uasort($elements, function($a, $b) { + return ($a['level'] ?? 0) <=> ($b['level'] ?? 0); + }); + $dimensions[$dimension][$subdimension] = $elements; + } + } + return $dimensions; +} /** diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 284e974..c50d95a 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -16,6 +16,7 @@ } $dimensions = array_merge_recursive($dimensions, $dimension); } +$dimensions = sortActivitiesByLevel($dimensions); $files = glob("src/assets/YAML/custom/*/*.yaml"); $dimensionsCustom = array(); From ea7ffc0f5fe600dbf0c5d9d90385b01fadc91749 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 24 Nov 2025 08:52:08 +0100 Subject: [PATCH 139/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 + src/assets/YAML/generated/generated.yaml | 6518 +++++++++++----------- 2 files changed, 3266 insertions(+), 3259 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 905857b..22dc533 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [1.20.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.20.0...v1.20.1) (2025-11-24) + + +### Bug Fixes + +* Sort activities by level, within each sub-dimension ([e2aeba7](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/e2aeba77089d21f0e7c5ce5bf6612903efc1938f)) + # [1.20.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.19.0...v1.20.0) (2025-11-18) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index a29b0c3..53dd981 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -1,49 +1,6 @@ --- Build and Deployment: Build: - Building and testing of artifacts in virtual environments: - uuid: a340f46b-6360-4cb8-847b-a0d3483d09d3 - description: |- - While building and testing artifacts, third party systems, application frameworks - and 3rd party libraries are used. These might be malicious as a result of - vulnerable libraries or because they are altered during the delivery phase. - risk: |- - While building and testing artifacts, third party systems, application frameworks - and 3rd party libraries are used. These might be malicious as a result of - vulnerable libraries or because they are altered during the delivery phase. - measure: Each step during within the build and testing phase is performed in - a separate virtual environments, which is destroyed afterward. - meta: - implementationGuide: Depending on your environment, usage of virtual machines - or container technology is a good way. After the build, the filesystem should - not be used again in other builds. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 2 - level: 2 - implementation: - - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - references: - samm2: - - I-SB-A-2 - iso27001-2017: - - 14.2.6 - iso27001-2022: - - 8.31 - comments: "" - tags: - - none Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b description: "A *build process* include more than just compiling your source @@ -90,6 +47,49 @@ Build and Deployment: comments: "" tags: - none + Building and testing of artifacts in virtual environments: + uuid: a340f46b-6360-4cb8-847b-a0d3483d09d3 + description: |- + While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of + vulnerable libraries or because they are altered during the delivery phase. + risk: |- + While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of + vulnerable libraries or because they are altered during the delivery phase. + measure: Each step during within the build and testing phase is performed in + a separate virtual environments, which is destroyed afterward. + meta: + implementationGuide: Depending on your environment, usage of virtual machines + or container technology is a good way. After the build, the filesystem should + not be used again in other builds. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 2 + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + references: + samm2: + - I-SB-A-2 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + comments: "" + tags: + - none Pinning of artifacts: uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 risk: Unauthorized manipulation of artifacts might be difficult to spot. For @@ -176,6 +176,43 @@ Build and Deployment: comments: "" tags: - none + Signing of code: + uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 + risk: Execution or usage of malicious code or data e.g. via executables, libraries + or container images. + measure: Digitally signing commits helps to prevent unauthorized manipulation + of source code. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - I-SB-A-2 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + comments: "" + tags: + - none Signing of artifacts: uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -223,83 +260,102 @@ Build and Deployment: comments: "" tags: - none - Signing of code: - uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 - risk: Execution or usage of malicious code or data e.g. via executables, libraries - or container images. - measure: Digitally signing commits helps to prevent unauthorized manipulation - of source code. + Deployment: + Defined deployment process: + uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a + risk: Deployment of insecure or malfunctioning artifacts. + measure: Defining a deployment process ensures that there are established criteria + in terms of functionalities, security, compliance, and performance, and that + the artifacts meet them. difficultyOfImplementation: knowledge: 2 time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: d6d755d3-b9f1-4942-a084-e62b266541df - name: Signing of commits - tags: - - signing - url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work - description: Signing of commits in git - - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules + resources: 1 + usefulness: 4 + level: 1 dependsOn: - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] references: samm2: - - I-SB-A-2 + - I-SD-A-1 iso27001-2017: - - 14.2.6 + - 12.1.1 + - 14.2.2 iso27001-2022: - - 8.31 + - 5.37 + - 8.32 comments: "" tags: - none - Deployment: - Blue/Green Deployment: - uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 - risk: A new artifact's version can have unknown defects. + Inventory of production components: + uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + risk: An organization is unaware of components like applications in production. + Not knowing existing applications in production leads to not assessing it. measure: |- - Using a blue/green deployment strategy increases application availability - and reduces deployment risk by simplifying the rollback process if a deployment fails. + A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. + In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process difficultyOfImplementation: knowledge: 1 - time: 2 + time: 1 resources: 1 - usefulness: 2 - level: 5 + usefulness: 4 + level: 1 implementation: - - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 - name: Blue/Green Deployments - tags: [] - url: https://martinfowler.com/bliki/BlueGreenDeployment.html - dependsOn: - - 73aaae0b-5d68-4953-9fa4-fd25bf665f2a # Smoke Test + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. references: samm2: - - I-SD-A-3 + - I-SB-B-1 + - D-TA-B-1 iso27001-2017: - - 17.2.1 - - 12.1.1 - - 12.1.2 - - 12.1.4 - - 12.5.1 - - 14.2.9 + - 8.1 + - 8.2 iso27001-2022: - - 8.14 - - 5.37 - - 8.31 - - 8.32 - - 8.19 - - 8.29 - comments: "" + - 5.9 + - 5.12 tags: - - none + - inventory Defined decommissioning process: uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 description: |- @@ -329,43 +385,6 @@ Build and Deployment: comments: "" tags: - none - Defined deployment process: - uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a - risk: Deployment of insecure or malfunctioning artifacts. - measure: Defining a deployment process ensures that there are established criteria - in terms of functionalities, security, compliance, and performance, and that - the artifacts meet them. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 1 - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - implementation: - - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - references: - samm2: - - I-SD-A-1 - iso27001-2017: - - 12.1.1 - - 14.2.2 - iso27001-2022: - - 5.37 - - 8.32 - comments: "" - tags: - - none Environment depending configuration parameters (secrets): uuid: df428c9d-efa0-4226-9f47-a15bb53f822b risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. @@ -449,43 +468,6 @@ Build and Deployment: comments: "" tags: - none - Handover of confidential parameters: - uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a - risk: Parameters are often used to set credentials, for example by starting - containers or applications; these parameters can often be seen by any one - listing running processes on the target system. - measure: Encryption ensures confidentiality of credentials e.g. from unauthorized - access on the file system. Also, the usage of a credential management system - can help protect credentials. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 3 - implementation: "" - dependsOn: - - df428c9d-efa0-4226-9f47-a15bb53f822b # Environment depending configuration - parameters (secrets) - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 14.1.3 - - 13.1.3 - - 9.4.3 - - 9.4.1 - - 10.1.2 - iso27001-2022: - - 8.33 - - 8.22 - - 5.17 - - 8.3 - - 8.24 - d3f: - - ApplicationConfigurationHardening - tags: - - secret Inventory of production artifacts: uuid: 83057028-0b77-4d2e-8135-40969768ae88 risk: In case a vulnerability of severity high or critical exists, it needs @@ -546,64 +528,43 @@ Build and Deployment: - 5.12 tags: - inventory - Inventory of production components: - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f - risk: An organization is unaware of components like applications in production. - Not knowing existing applications in production leads to not assessing it. - measure: |- - A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. - In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + Handover of confidential parameters: + uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a + risk: Parameters are often used to set credentials, for example by starting + containers or applications; these parameters can often be seen by any one + listing running processes on the target system. + measure: Encryption ensures confidentiality of credentials e.g. from unauthorized + access on the file system. Also, the usage of a credential management system + can help protect credentials. difficultyOfImplementation: - knowledge: 1 - time: 1 + knowledge: 2 + time: 2 resources: 1 usefulness: 4 - level: 1 - implementation: - - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + level: 3 + implementation: "" + dependsOn: + - df428c9d-efa0-4226-9f47-a15bb53f822b # Environment depending configuration + parameters (secrets) references: samm2: - - I-SB-B-1 - - D-TA-B-1 + - I-SD-B-2 iso27001-2017: - - 8.1 - - 8.2 + - 14.1.3 + - 13.1.3 + - 9.4.3 + - 9.4.1 + - 10.1.2 iso27001-2022: - - 5.9 - - 5.12 + - 8.33 + - 8.22 + - 5.17 + - 8.3 + - 8.24 + d3f: + - ApplicationConfigurationHardening tags: - - inventory + - secret Inventory of production dependencies: uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 risk: Delayed identification of components and their vulnerabilities in production. @@ -786,6 +747,45 @@ Build and Deployment: comments: "" tags: - none + Blue/Green Deployment: + uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 + risk: A new artifact's version can have unknown defects. + measure: |- + Using a blue/green deployment strategy increases application availability + and reduces deployment risk by simplifying the rollback process if a deployment fails. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 5 + implementation: + - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + dependsOn: + - 73aaae0b-5d68-4953-9fa4-fd25bf665f2a # Smoke Test + references: + samm2: + - I-SD-A-3 + iso27001-2017: + - 17.2.1 + - 12.1.1 + - 12.1.2 + - 12.1.4 + - 12.5.1 + - 14.2.9 + iso27001-2022: + - 8.14 + - 5.37 + - 8.31 + - 8.32 + - 8.19 + - 8.29 + comments: "" + tags: + - none Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d @@ -862,46 +862,6 @@ Build and Deployment: comments: "" tags: - patching - Automated deployment of automated PRs: - uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d - description: Automated merges of automated created PRs for outdated dependencies. - risk: Even if automated dependencies PRs are merged, they might not be deployed. - This results in vulnerabilities in running artifacts stay for too long and - might get exploited. - measure: | - After merging of an automated dependency PR, automated deployment is needed, - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - dependsOn: - - f2594f8f-1cd6-45f9-af29-eaf3315698eb # Automated merge of automated PRs - - implementation: - - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - references: - samm2: - - O-EM-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - patching Automated merge of automated PRs: uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: Automated merges of automated created PRs for outdated dependencies. @@ -1050,29 +1010,69 @@ Build and Deployment: comments: "" tags: - patching - Usage of a short maximum lifetime for images: - uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e - description: |- - The maximum lifetime for a Docker container refers to the duration a container - should be allowed to run before it is considered outdated, stale, or insecure. - There is not a fixed, universally applicable maximum lifetime for a Docker - container, as it varies depending on the specific use case, application - requirements, and security needs. As a best practice, it is essential to define - a reasonable maximum lifetime for containers to ensure that you consistently - deploy the most recent, patched, and secure versions of both your custom base - images and third-party images. - risk: Vulnerabilities in running containers stay for too long and might get - exploited. + Automated deployment of automated PRs: + uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d + description: Automated merges of automated created PRs for outdated dependencies. + risk: Even if automated dependencies PRs are merged, they might not be deployed. + This results in vulnerabilities in running artifacts stay for too long and + might get exploited. measure: | - A good practice is to perform the build and deployment daily or even just-in-time, when a new component (e.g. package) for the image is available. + After merging of an automated dependency PR, automated deployment is needed, difficultyOfImplementation: knowledge: 3 - time: 4 - resources: 2 + time: 3 + resources: 1 usefulness: 3 - level: 4 - implementation: - - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + level: 3 + dependsOn: + - f2594f8f-1cd6-45f9-af29-eaf3315698eb # Automated merge of automated PRs + + implementation: + - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + comments: "" + tags: + - patching + Usage of a short maximum lifetime for images: + uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e + description: |- + The maximum lifetime for a Docker container refers to the duration a container + should be allowed to run before it is considered outdated, stale, or insecure. + There is not a fixed, universally applicable maximum lifetime for a Docker + container, as it varies depending on the specific use case, application + requirements, and security needs. As a best practice, it is essential to define + a reasonable maximum lifetime for containers to ensure that you consistently + deploy the most recent, patched, and secure versions of both your custom base + images and third-party images. + risk: Vulnerabilities in running containers stay for too long and might get + exploited. + measure: | + A good practice is to perform the build and deployment daily or even just-in-time, when a new component (e.g. package) for the image is available. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d name: "Sample concept: \n(1" tags: [] description: "Sample concept: \n(1) each container has a set lifetime and @@ -1098,133 +1098,6 @@ Build and Deployment: - patching Culture and Organization: Design: - Conduction of advanced threat modeling: - uuid: ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 - risk: Inadequate identification of business and technical risks. - measure: Threat modeling is performed by using reviewing user stories and producing - security driven data flow diagrams. - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 2 - usefulness: 3 - level: 4 - dependsOn: - - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling - on technical level - - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes - and standards - description: | - **Example High Maturity Scenario:** - - Based on a detailed threat model defined and updated through code, the team decides the following: - - * Local encrypted caches need to expire and auto-purged. - * Communication channels encrypted and authenticated. - * All secrets persisted in shared secrets store. - * Frontend designed with permissions model integration. - * Permissions matrix defined. - * Input is escaped output is encoded appropriately using well established libraries. - - Source: OWASP Project Integration Project - implementation: - - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c - name: Threagile - tags: - - threat-modeling - url: https://github.com/Threagile/threagile - - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - references: - samm2: - - D-TA-B-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 8.2.1 - - 14.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 5.12 - - 8.25 - comments: "" - tags: - - none - Conduction of simple threat modeling on business level: - uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 - risk: Business related threats are discovered too late in the development and - deployment process. - measure: Threat modeling of business functionality is performed during the product - backlog creation to facilitate early detection of security defects. - difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: [] - references: - samm2: - - D-TA-B-1 - - D-TA-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 8.2.1 - - 14.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 5.12 - - 8.25 - comments: "" - tags: - - none Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e risk: Technical related threats are discovered too late in the development and @@ -1343,45 +1216,59 @@ Culture and Organization: comments: "" tags: - none - Creation of advanced abuse stories: - uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e - risk: Simple user stories are not going deep enough. Relevant security considerations - are performed. Security flaws are discovered too late in the development and - deployment process - measure: Advanced abuse stories are created as part of threat modeling activities. + Information security targets are communicated: + uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 + risk: Employees don't know their organizations security targets. Therefore security + is not considered during development and administration as much as it should + be. + measure: Transparent and timely communication of the security targets by senior + management is essential to ensure teams' buy-in and support. difficultyOfImplementation: - knowledge: 4 - time: 2 + knowledge: 1 + time: 1 resources: 1 - usefulness: 4 - level: 5 - dependsOn: - - bacf85b6-5bc0-405d-b5ba-a5d971467cc1 # Creation of simple abuse stories - - implementation: - - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: Don't Forget EVIL User stories - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + usefulness: 3 + level: 2 + implementation: [] references: samm2: - - D-TA-B-2 - - V-RT-B-2 + - G-SM-A-2 + iso27001-2017: + - 5.1.1 + - 7.2.1 + iso27001-2022: + - 5.1 + - 5.4 + comments: "" + tags: + - none + Conduction of simple threat modeling on business level: + uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 + risk: Business related threats are discovered too late in the development and + deployment process. + measure: Threat modeling of business functionality is performed during the product + backlog creation to facilitate early detection of security defects. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - D-TA-B-1 + - D-TA-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - - May be part of project management - - 6.1.5 - May be part of risk assessment - - 8.1.2 + - 8.2.1 + - 14.2.1 iso27001-2022: - Not explicitly covered by ISO 27001 - - May be part of project management - - 5.8 - May be part of risk assessment - - 5.9 + - 5.12 + - 8.25 comments: "" tags: - none @@ -1476,29 +1363,142 @@ Culture and Organization: comments: "" tags: - none - Information security targets are communicated: - uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 - risk: Employees don't know their organizations security targets. Therefore security - is not considered during development and administration as much as it should - be. - measure: Transparent and timely communication of the security targets by senior - management is essential to ensure teams' buy-in and support. + Conduction of advanced threat modeling: + uuid: ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 + risk: Inadequate identification of business and technical risks. + measure: Threat modeling is performed by using reviewing user stories and producing + security driven data flow diagrams. difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 + knowledge: 4 + time: 3 + resources: 2 usefulness: 3 - level: 2 - implementation: [] + level: 4 + dependsOn: + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling + on technical level + - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes + and standards + description: | + **Example High Maturity Scenario:** + + Based on a detailed threat model defined and updated through code, the team decides the following: + + * Local encrypted caches need to expire and auto-purged. + * Communication channels encrypted and authenticated. + * All secrets persisted in shared secrets store. + * Frontend designed with permissions model integration. + * Permissions matrix defined. + * Input is escaped output is encoded appropriately using well established libraries. + + Source: OWASP Project Integration Project + implementation: + - uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + - uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes references: samm2: - - G-SM-A-2 + - D-TA-B-2 iso27001-2017: - - 5.1.1 - - 7.2.1 + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 iso27001-2022: - - 5.1 - - 5.4 + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + comments: "" + tags: + - none + Creation of advanced abuse stories: + uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e + risk: Simple user stories are not going deep enough. Relevant security considerations + are performed. Security flaws are discovered too late in the development and + deployment process + measure: Advanced abuse stories are created as part of threat modeling activities. + difficultyOfImplementation: + knowledge: 4 + time: 2 + resources: 1 + usefulness: 4 + level: 5 + dependsOn: + - bacf85b6-5bc0-405d-b5ba-a5d971467cc1 # Creation of simple abuse stories + + implementation: + - uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: Don't Forget EVIL User stories + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + references: + samm2: + - D-TA-B-2 + - V-RT-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 6.1.5 + - May be part of risk assessment + - 8.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 5.8 + - May be part of risk assessment + - 5.9 comments: "" tags: - none @@ -1539,213 +1539,81 @@ Culture and Organization: - 6.3 tags: - none - Aligning security in teams: - uuid: f994a55d-71bb-45a4-a887-0a213d72c504 - risk: The concept of Security Champions might suggest that only he/she is responsible - for security. However, everyone in the project team should be responsible - for security. - measure: By aligning security Subject Matter Experts with project teams, a higher - security standard can be achieved. - difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 1 - usefulness: 5 - implementation: - - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 - name: Involve Security SME - tags: [] - description: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. - level: 4 - references: - samm2: - - G-EG-B-3 - iso27001-2017: - - 7.1.1 - iso27001-2022: - - 6.1 - comments: "" - tags: - - none - Conduction of build-it, break-it, fix-it contests: - uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 - risk: Understanding security is hard, even for security champions and the conduction - of security training often focuses on breaking a component instead of building - a component secure. - measure: The build-it, break-it, fix-it contest allows to train people with - security related roles like security champions the build, break and fix part - of a secure application. This increases the learning of building secure components. + Security consulting on request: + uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 + risk: Not asking a security expert when questions regarding security appear + might lead to flaws. + measure: Security consulting to teams is given on request. The security consultants + can be internal or external. difficultyOfImplementation: - knowledge: 5 - time: 3 + knowledge: 3 + time: 1 resources: 1 usefulness: 3 - level: 3 + level: 1 implementation: - - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f - name: Build it Break it Fix it Contest - tags: [] - url: https://builditbreakit.org/ + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ references: samm2: - - G-EG-A-2 + - G-EG-A-1 + - G-EG-B-1 iso27001-2017: - - 7.2.2 + - security consulting is missing in ISO 27001 may be + - 6.1.1 + - 6.1.4 + - 6.1.5 iso27001-2022: - - 6.3 + - Security consulting is missing in ISO 27001 may be + - 5.2 + - 5.6 + - 5.8 comments: "" tags: - none - Conduction of collaborative security checks with developers and system administrators: - uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 - risk: Security checks by external companies do not increase the understanding - of an application/system for internal employees. - measure: Periodically security reviews of source code (SCA), in which security - SME, developers and operations are involved, are effective at increasing the - robustness of software and the security knowledge of the teams involved. + Each team has a security champion: + uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 + risk: No one feels directly responsible for security and the security champion + does not have enough time to allocate to each team. + measure: Each team defines an individual to be responsible for security. These + individuals are often referred to as 'security champions' difficultyOfImplementation: knowledge: 3 time: 2 resources: 1 - usefulness: 3 - level: 5 - implementation: [] + usefulness: 4 + level: 2 + description: | + Implement a program where each software development team has a member considered a "Security Champion" who is the liaison between Information Security and developers. Depending on the size and structure of the team the "Security Champion" may be a software developer, tester, or a product manager. The "Security Champion" has a set number of hours per week for Information Security related activities. They participate in periodic briefings to increase awareness and expertise in different security disciplines. "Security Champions" have additional training to help develop these roles as Software Security subject-matter experts. You may need to customize the way you create and support "Security Champions" for cultural reasons. + + The goals of the position are to increase effectiveness and efficiency of application security and compliance and to strengthen the relationship between various teams and Information Security. To achieve these objectives, "Security Champions" assist with researching, verifying, and prioritizing security and compliance related software defects. They are involved in all Risk Assessments, Threat Assessments, and Architectural Reviews to help identify opportunities to remediate security defects by making the architecture of the application more resilient and reducing the attack threat surface. + + [Source: OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/) + implementation: + - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook references: samm2: - - G-EG-A-2 + - G-EG-B-1 - G-EG-B-2 iso27001-2017: - - Mutual review of source code is not explicitly required in ISO 27001 may - be + - Security champions are missing in ISO 27001 most likely + - 7.2.1 - 7.2.2 - - 12.6.1 - - 12.7.1 iso27001-2022: - - Mutual review of source code is not explicitly required in ISO 27001 may - be + - Security champions are missing in ISO 27001 most likely + - 5.4 - 6.3 - - 8.8 - - 8.34 comments: "" tags: - none - Conduction of collaborative team security checks: - uuid: 35446784-7610-40d9-af9e-d43f3173bf8c - risk: Development teams limited insight over security practices. - measure: Mutual security testing the security of other teams project enhances - security awareness and knowledge. - difficultyOfImplementation: - resources: 2 - knowledge: 4 - time: 4 - usefulness: 2 - level: 4 - implementation: [] - references: - samm2: - - G-EG-A-1 - - G-EG-A-2 - iso27001-2017: - - Mutual security testing is not explicitly required in ISO 27001 may be - - 7.2.2 - iso27001-2022: - - Mutual security testing is not explicitly required in ISO 27001 may be - - 6.3 - comments: "" - tags: - - none - Conduction of war games: - uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 - risk: Understanding incident response plans during an incident is hard and ineffective. - measure: War Games like activities help train for incidents. Security SMEs create - attack scenarios in a testing environment enabling the trainees to learn how - to react in case of an incident. - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 4 - usefulness: 3 - level: 4 - implementation: [] - references: - samm2: - - G-EG-A-2 - - O-IM-B-2 - iso27001-2017: - - War games are not explicitly required in ISO 27001 may be - - 7.2.2 - - 16.1 - - 16.1.5 - iso27001-2022: - - War games are not explicitly required in ISO 27001 may be - - 6.3 - - 5.24 - - 5.26 - comments: "" - tags: - - none - Each team has a security champion: - uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 - risk: No one feels directly responsible for security and the security champion - does not have enough time to allocate to each team. - measure: Each team defines an individual to be responsible for security. These - individuals are often referred to as 'security champions' - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - description: | - Implement a program where each software development team has a member considered a "Security Champion" who is the liaison between Information Security and developers. Depending on the size and structure of the team the "Security Champion" may be a software developer, tester, or a product manager. The "Security Champion" has a set number of hours per week for Information Security related activities. They participate in periodic briefings to increase awareness and expertise in different security disciplines. "Security Champions" have additional training to help develop these roles as Software Security subject-matter experts. You may need to customize the way you create and support "Security Champions" for cultural reasons. - - The goals of the position are to increase effectiveness and efficiency of application security and compliance and to strengthen the relationship between various teams and Information Security. To achieve these objectives, "Security Champions" assist with researching, verifying, and prioritizing security and compliance related software defects. They are involved in all Risk Assessments, Threat Assessments, and Architectural Reviews to help identify opportunities to remediate security defects by making the architecture of the application more resilient and reducing the attack threat surface. - - [Source: OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/) - implementation: - - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 - name: OWASP Security Champions Playbook - tags: - - security champions - url: https://github.com/c0rdis/security-champions-playbook - references: - samm2: - - G-EG-B-1 - - G-EG-B-2 - iso27001-2017: - - Security champions are missing in ISO 27001 most likely - - 7.2.1 - - 7.2.2 - iso27001-2022: - - Security champions are missing in ISO 27001 most likely - - 5.4 - - 6.3 - comments: "" - tags: - - none - Office Hours: - uuid: 185d5a74-19dc-4422-be07-44ea35226783 - risk: Developers and Operations are not in contact with the security team and - therefore do not ask prior implementation of (known or unknown) threats- - measure: As a security team, be open for questions and hints during defined - office hours. x x d - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 3 - level: 3 - implementation: ~ - references: - samm2: - - G-EG-A-1 - iso27001-2017: - - 7.2.2 - iso27001-2022: - - 6.3 - tags: - - none Regular security training for all: uuid: 9768f154-357a-4c06-af6f-d66570677c9b risk: Understanding security is hard. @@ -1789,41 +1657,6 @@ Culture and Organization: comments: "" tags: - none - Regular security training for externals: - uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 - risk: Understanding security is hard. - measure: Provide security awareness training for all personnel including externals - involved in software development on a regular basis. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 3 - usefulness: 4 - level: 4 - implementation: - - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - references: - samm2: - - G-EG-A-2 - iso27001-2017: - - 7.2.2 - iso27001-2022: - - 6.3 - comments: "" - tags: - - none Regular security training of security champions: uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 risk: Understanding security is hard, even for security champions. @@ -1900,39 +1733,6 @@ Culture and Organization: comments: "" tags: - none - Security Coaching: - uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 - risk: Training does not change behaviour. Therefore, even if security practices - are understood, it's likely that they are not performed. - measure: By coaching teams on security topics using for example the samman coaching - method, teams internalize security practices as new habits in their development - process. - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 1 - usefulness: 3 - implementation: - - uuid: 9223be73-00da-400e-a910-3871734cff2f - name: sammancoaching - tags: - - documentation - - coaching - - education - url: https://sammancoaching.org/ - description: | - Security coaches work with software development teams to help them adopt better security practices. - level: 3 - references: - samm2: - - G-EG-B-3 - iso27001-2017: - - 7.1.1 - iso27001-2022: - - 6.1 - comments: "" - tags: - - none Security code review: uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 risk: Understanding security is hard. @@ -1976,69 +1776,117 @@ Culture and Organization: comments: "" tags: - none - Security consulting on request: - uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 - risk: Not asking a security expert when questions regarding security appear - might lead to flaws. - measure: Security consulting to teams is given on request. The security consultants - can be internal or external. + Conduction of build-it, break-it, fix-it contests: + uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 + risk: Understanding security is hard, even for security champions and the conduction + of security training often focuses on breaking a component instead of building + a component secure. + measure: The build-it, break-it, fix-it contest allows to train people with + security related roles like security champions the build, break and fix part + of a secure application. This increases the learning of building secure components. difficultyOfImplementation: - knowledge: 3 - time: 1 + knowledge: 5 + time: 3 resources: 1 usefulness: 3 - level: 1 + level: 3 implementation: - - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ + - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ references: samm2: - - G-EG-A-1 - - G-EG-B-1 + - G-EG-A-2 iso27001-2017: - - security consulting is missing in ISO 27001 may be - - 6.1.1 - - 6.1.4 - - 6.1.5 + - 7.2.2 iso27001-2022: - - Security consulting is missing in ISO 27001 may be - - 5.2 - - 5.6 - - 5.8 + - 6.3 comments: "" tags: - none - Security-Lessoned-Learned: - uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 - risk: After an incident, a similar incident might reoccur. - measure: Running a 'lessons learned' session after an incident helps drive continuous - improvement. Regular meetings with security champions are a good place to - share and discuss lessons learned. + Office Hours: + uuid: 185d5a74-19dc-4422-be07-44ea35226783 + risk: Developers and Operations are not in contact with the security team and + therefore do not ask prior implementation of (known or unknown) threats- + measure: As a security team, be open for questions and hints during defined + office hours. x x d difficultyOfImplementation: - knowledge: 3 - time: 3 + knowledge: 1 + time: 1 resources: 1 usefulness: 3 level: 3 - implementation: [] + implementation: ~ references: samm2: - - G-EG-B-3 - - O-IM-B-3 + - G-EG-A-1 iso27001-2017: - - 16.1.6 + - 7.2.2 iso27001-2022: - - 5.27 - comments: "" + - 6.3 tags: - none - Simple mob hacking: - uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de - risk: Understanding security is hard. + Security Coaching: + uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 + risk: Training does not change behaviour. Therefore, even if security practices + are understood, it's likely that they are not performed. + measure: By coaching teams on security topics using for example the samman coaching + method, teams internalize security practices as new habits in their development + process. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + implementation: + - uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + level: 3 + references: + samm2: + - G-EG-B-3 + iso27001-2017: + - 7.1.1 + iso27001-2022: + - 6.1 + comments: "" + tags: + - none + Security-Lessoned-Learned: + uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 + risk: After an incident, a similar incident might reoccur. + measure: Running a 'lessons learned' session after an incident helps drive continuous + improvement. Regular meetings with security champions are a good place to + share and discuss lessons learned. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - G-EG-B-3 + - O-IM-B-3 + iso27001-2017: + - 16.1.6 + iso27001-2022: + - 5.27 + comments: "" + tags: + - none + Simple mob hacking: + uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de + risk: Understanding security is hard. measure: | Participate with your whole team in a simple mob hacking session organized by the Security Champion Guild. In the session the guild presents a vulnerable application and together you look at possible exploits. @@ -2086,58 +1934,159 @@ Culture and Organization: comments: "" tags: - none - Process: - Approval by reviewing any new version: - uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 - risk: An individual might forget to implement security measures to protect source - code or infrastructure components. - measure: On each new version (e.g. Pull Request) of source code or infrastructure - components a security peer review of the changes is performed (two eyes principle) - and approval given by the reviewer. + Aligning security in teams: + uuid: f994a55d-71bb-45a4-a887-0a213d72c504 + risk: The concept of Security Champions might suggest that only he/she is responsible + for security. However, everyone in the project team should be responsible + for security. + measure: By aligning security Subject Matter Experts with project teams, a higher + security standard can be achieved. difficultyOfImplementation: - knowledge: 2 - time: 2 + knowledge: 4 + time: 4 resources: 1 - usefulness: 3 - level: 3 + usefulness: 5 + implementation: + - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + level: 4 + references: + samm2: + - G-EG-B-3 + iso27001-2017: + - 7.1.1 + iso27001-2022: + - 6.1 + comments: "" + tags: + - none + Conduction of collaborative team security checks: + uuid: 35446784-7610-40d9-af9e-d43f3173bf8c + risk: Development teams limited insight over security practices. + measure: Mutual security testing the security of other teams project enhances + security awareness and knowledge. + difficultyOfImplementation: + resources: 2 + knowledge: 4 + time: 4 + usefulness: 2 + level: 4 implementation: [] references: - samm2: [] + samm2: + - G-EG-A-1 + - G-EG-A-2 iso27001-2017: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - - 6.1.2 - - 14.2.1 + - Mutual security testing is not explicitly required in ISO 27001 may be + - 7.2.2 iso27001-2022: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - - 5.3 - - 8.25 + - Mutual security testing is not explicitly required in ISO 27001 may be + - 6.3 comments: "" tags: - none - Definition of a change management process: - uuid: b4193d32-3948-47e2-a326-3748c48019a1 - risk: The impact of a change is not controlled because these are not recorded - or documented. - measure: Each change of a system is automatically recorded and adequately logged. + Conduction of war games: + uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 + risk: Understanding incident response plans during an incident is hard and ineffective. + measure: War Games like activities help train for incidents. Security SMEs create + attack scenarios in a testing environment enabling the trainees to learn how + to react in case of an incident. difficultyOfImplementation: knowledge: 4 - time: 3 + time: 5 + resources: 4 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - G-EG-A-2 + - O-IM-B-2 + iso27001-2017: + - War games are not explicitly required in ISO 27001 may be + - 7.2.2 + - 16.1 + - 16.1.5 + iso27001-2022: + - War games are not explicitly required in ISO 27001 may be + - 6.3 + - 5.24 + - 5.26 + comments: "" + tags: + - none + Regular security training for externals: + uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 + risk: Understanding security is hard. + measure: Provide security awareness training for all personnel including externals + involved in software development on a regular basis. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 + usefulness: 4 + level: 4 + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-2 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + comments: "" + tags: + - none + Conduction of collaborative security checks with developers and system administrators: + uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 + risk: Security checks by external companies do not increase the understanding + of an application/system for internal employees. + measure: Periodically security reviews of source code (SCA), in which security + SME, developers and operations are involved, are effective at increasing the + robustness of software and the security knowledge of the teams involved. + difficultyOfImplementation: + knowledge: 3 + time: 2 resources: 1 usefulness: 3 - level: 3 + level: 5 implementation: [] references: - samm2: [] + samm2: + - G-EG-A-2 + - G-EG-B-2 iso27001-2017: - - 14.2.2 - - 12.1.2 - - 12.4.1 + - Mutual review of source code is not explicitly required in ISO 27001 may + be + - 7.2.2 + - 12.6.1 + - 12.7.1 iso27001-2022: - - 8.32 - - 8.15 + - Mutual review of source code is not explicitly required in ISO 27001 may + be + - 6.3 + - 8.8 + - 8.34 comments: "" tags: - none + Process: Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 description: A _Business Continuity and Disaster Recovery_ (BCDR) is a plan @@ -2229,69 +2178,59 @@ Culture and Organization: - vulnerability-mgmt - metrics - vmm-measurements -Implementation: - Application Hardening: - App. Hardening Level 1: - uuid: cf819225-30cb-4702-8e32-60225eedc33d - risk: Using an insecure application might lead to a compromised application. - This might lead to total data theft or data modification. - measure: | - Following frameworks like the - * OWASP Application Security Verification Standard Level 1 - * OWASP Mobile Application Security Verification Standard - - in all applications provides a good baseline. Implement 95%-100% of the recommendations. + Approval by reviewing any new version: + uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 + risk: An individual might forget to implement security measures to protect source + code or infrastructure components. + measure: On each new version (e.g. Pull Request) of source code or infrastructure + components a security peer review of the changes is performed (two eyes principle) + and approval given by the reviewer. difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 - usefulness: 4 - level: 2 - dependsOn: - - b597928e-54d6-48a5-a806-8003dcd56aab # App. Hardening Level 1 (50%) - description: | - To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely. - - [...] - - ### Planning aka Requirements Gathering & Analysis - The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. - - ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) - - Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. - - These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. - - In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. - - Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) - implementation: - - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ + usefulness: 3 + level: 3 + implementation: [] references: - samm2: - - D-SR-A-3 + samm2: [] iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + comments: "" + tags: + - none + Definition of a change management process: + uuid: b4193d32-3948-47e2-a326-3748c48019a1 + risk: The impact of a change is not controlled because these are not recorded + or documented. + measure: Each change of a system is automatically recorded and adequately logged. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: [] + iso27001-2017: + - 14.2.2 + - 12.1.2 + - 12.4.1 + iso27001-2022: + - 8.32 + - 8.15 comments: "" tags: - none +Implementation: + Application Hardening: App. Hardening Level 1 (50%): uuid: b597928e-54d6-48a5-a806-8003dcd56aab risk: Using an insecure application might lead to a compromised application. @@ -2351,34 +2290,43 @@ Implementation: comments: "" tags: - none - App. Hardening Level 2: - uuid: ffe86caf-2fec-4630-b514-2db83983984d - risk: Using an insecure application might lead to a compromised application. - This might lead to total data theft or data modification. - measure: | - Following frameworks like the - * OWASP Application Security Verification Standard Level 2 - * OWASP Mobile Application Security Verification Standard Level 2 - - Implement 95%-100% of the recommendations. + Context-aware output encoding: + uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 + description: "**Input validation** stops malicious data from entering your system. + \\\n**Output encoding** neutralizes malicious data before rendering to user, + or the next system.\n\nInput validation and output encoding work together. + Apply both. \n\n**Context-aware output encoding** encodes data differently, + depending on its context. In the sample below the `{{bad_data}}` must be encoded + differently, depending on its context, to render safe HTML.\n\n```html\n

{{bad_data}}
\nClick me\n\n\n```\n" + risk: If an attacker manages to slip though your input validation, the attacker + may gain control over the user session or execute arbitrary actions. + measure: "* Use modern secure frameworks such as React/Angular/Vue/Svelte. The + default method here renders data in a safe way.\n* Use established and well-maintained + encoding libraries such as OWASP\u2019s Java Encoder and Microsoft\u2019s + AntiXSS.\n* Implement content security policies (CSP) to restrict the types + of content that can be loaded and executed.\n" difficultyOfImplementation: - knowledge: 3 - time: 3 + knowledge: 1 + time: 2 resources: 1 usefulness: 3 - level: 4 + level: 1 implementation: - - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS + - uuid: 2d61e48f-bade-4332-a383-adc50c29673a + name: OWASP DOM based XSS Prevention CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html tags: [] - url: https://github.com/OWASP/owasp-masvs + - uuid: ae97c9b0-308c-4dab-bff9-bf3330a897dc + name: CWE-838 Inappropriate Encoding for Output Context + tags: + - documentation + - cwe + url: https://cwe.mitre.org/data/definitions/838.html references: samm2: - - D-SR-A-2 + - D-SR-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2386,38 +2334,43 @@ Implementation: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 comments: "" - dependsOn: - - 03643ca2-03c2-472b-8e19-956bf02fe9b7 # App. Hardening Level 2 (75%) tags: - none - App. Hardening Level 2 (75%): - uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 - risk: Using an insecure application might lead to a compromised application. - This might lead to total data theft or data modification. - measure: | - Following frameworks like the - * OWASP Application Security Verification Standard Level 2 - * OWASP Mobile Application Security Verification Standard Level 2 + Parametrization: + uuid: 00e91a8a-3972-4692-8679-674ab8547486 + description: | + By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well. - Implement 75% of the recommendations. + This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed. + + Pay attention to these two lines of code. They seem similar, but behave very differently. + + * `sql.execute("SELECT * FROM table WHERE ID = " + id);` + * `sql.execute("SELECT * FROM table WHERE ID = ?", id);` + The second line is parameterized. The same principle applies to other types, such as command line execution, etc. + risk: "Systems vulnerable to injections may lead to data breaches, loss of data, + \nunauthorized alteration of data, or complete database compromise or downtime.\n\nThis + applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc.\n" + measure: | + * Identify which of the types your application is using. Check that you use: + * Use _parametrized queries_ (or _prepared statements_) + * For database queries, you may also use: + * Use _stored procedures_ () + * Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization difficultyOfImplementation: - knowledge: 3 - time: 3 + knowledge: 1 + time: 2 resources: 1 usefulness: 3 - level: 3 + level: 1 implementation: - - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS + - uuid: d880fa0f-9dbb-454e-a003-d844fad31ab4 + name: OWASP Parameterization CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html tags: [] - url: https://github.com/OWASP/owasp-masvs references: samm2: - - D-SR-A-3 + - D-SR-A-1 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2425,26 +2378,43 @@ Implementation: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 comments: "" - dependsOn: - - cf819225-30cb-4702-8e32-60225eedc33d # App. Hardening Level 1 tags: - none - App. Hardening Level 3: - uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a + App. Hardening Level 1: + uuid: cf819225-30cb-4702-8e32-60225eedc33d risk: Using an insecure application might lead to a compromised application. This might lead to total data theft or data modification. measure: | Following frameworks like the - * OWASP Application Security Verification Standard Level 3 + * OWASP Application Security Verification Standard Level 1 * OWASP Mobile Application Security Verification Standard - Implement 95%-100% of the recommendations. + in all applications provides a good baseline. Implement 95%-100% of the recommendations. difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 2 + knowledge: 2 + time: 2 + resources: 1 usefulness: 4 - level: 5 + level: 2 + dependsOn: + - b597928e-54d6-48a5-a806-8003dcd56aab # App. Hardening Level 1 (50%) + description: | + To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely. + + [...] + + ### Planning aka Requirements Gathering & Analysis + The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. + + ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) + + Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. + + These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. + + In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. + + Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) implementation: - uuid: 88767cde-1610-402e-98ec-bc3575377183 name: OWASP ASVS @@ -2454,6 +2424,11 @@ Implementation: name: OWASP MASVS tags: [] url: https://github.com/OWASP/owasp-masvs + - uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ references: samm2: - D-SR-A-3 @@ -2463,8 +2438,7 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - dependsOn: - - ffe86caf-2fec-4630-b514-2db83983984d # App. Hardening Level 2 + comments: "" tags: - none Containers are running as non-root: @@ -2523,87 +2497,34 @@ Implementation: - 8.22 tags: - none - Context-aware output encoding: - uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 - description: "**Input validation** stops malicious data from entering your system. - \\\n**Output encoding** neutralizes malicious data before rendering to user, - or the next system.\n\nInput validation and output encoding work together. - Apply both. \n\n**Context-aware output encoding** encodes data differently, - depending on its context. In the sample below the `{{bad_data}}` must be encoded - differently, depending on its context, to render safe HTML.\n\n```html\n
{{bad_data}}
\nClick me\n\n\n```\n" - risk: If an attacker manages to slip though your input validation, the attacker - may gain control over the user session or execute arbitrary actions. - measure: "* Use modern secure frameworks such as React/Angular/Vue/Svelte. The - default method here renders data in a safe way.\n* Use established and well-maintained - encoding libraries such as OWASP\u2019s Java Encoder and Microsoft\u2019s - AntiXSS.\n* Implement content security policies (CSP) to restrict the types - of content that can be loaded and executed.\n" + App. Hardening Level 2 (75%): + uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 2 + * OWASP Mobile Application Security Verification Standard Level 2 + + Implement 75% of the recommendations. difficultyOfImplementation: - knowledge: 1 - time: 2 + knowledge: 3 + time: 3 resources: 1 usefulness: 3 - level: 1 + level: 3 implementation: - - uuid: 2d61e48f-bade-4332-a383-adc50c29673a - name: OWASP DOM based XSS Prevention CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS tags: [] - - uuid: ae97c9b0-308c-4dab-bff9-bf3330a897dc - name: CWE-838 Inappropriate Encoding for Output Context - tags: - - documentation - - cwe - url: https://cwe.mitre.org/data/definitions/838.html - references: - samm2: - - D-SR-A-1 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - Parametrization: - uuid: 00e91a8a-3972-4692-8679-674ab8547486 - description: | - By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well. - - This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed. - - Pay attention to these two lines of code. They seem similar, but behave very differently. - - * `sql.execute("SELECT * FROM table WHERE ID = " + id);` - * `sql.execute("SELECT * FROM table WHERE ID = ?", id);` - The second line is parameterized. The same principle applies to other types, such as command line execution, etc. - risk: "Systems vulnerable to injections may lead to data breaches, loss of data, - \nunauthorized alteration of data, or complete database compromise or downtime.\n\nThis - applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc.\n" - measure: | - * Identify which of the types your application is using. Check that you use: - * Use _parametrized queries_ (or _prepared statements_) - * For database queries, you may also use: - * Use _stored procedures_ () - * Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 - usefulness: 3 - level: 1 - implementation: - - uuid: d880fa0f-9dbb-454e-a003-d844fad31ab4 - name: OWASP Parameterization CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS tags: [] + url: https://github.com/OWASP/owasp-masvs references: samm2: - - D-SR-A-1 + - D-SR-A-3 iso27001-2017: - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -2611,6 +2532,8 @@ Implementation: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 comments: "" + dependsOn: + - cf819225-30cb-4702-8e32-60225eedc33d # App. Hardening Level 1 tags: - none Secure headers: @@ -2675,23 +2598,105 @@ Implementation: - https://www.opencre.org/cre/620-421 tags: - none - Development and Source Control: - .gitignore: - uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d - risk: Unintended leakage of secrets, debug, or workstation specific data - measure: .gitignore files help prevent accidental commits of secrets, debug, - or workstation specific data + App. Hardening Level 2: + uuid: ffe86caf-2fec-4630-b514-2db83983984d + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 2 + * OWASP Mobile Application Security Verification Standard Level 2 + + Implement 95%-100% of the recommendations. difficultyOfImplementation: - knowledge: 2 - time: 1 + knowledge: 3 + time: 3 resources: 1 - usefulness: 5 + usefulness: 3 level: 4 - dependsOn: [] + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + comments: "" + dependsOn: + - 03643ca2-03c2-472b-8e19-956bf02fe9b7 # App. Hardening Level 2 (75%) + tags: + - none + App. Hardening Level 3: + uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 3 + * OWASP Mobile Application Security Verification Standard + + Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 + usefulness: 4 + level: 5 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-A-3 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + dependsOn: + - ffe86caf-2fec-4630-b514-2db83983984d # App. Hardening Level 2 + tags: + - none + Development and Source Control: + Versioning: + uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f + risk: Deployment of untracked artifacts. + description: Use a version control system platform like Github, Gitlab, Bitbucket, + gittea,... to version your code. + measure: Version artifacts in order to identify deployed features and issues. + This includes application and infrastructure code, jenkins configuration, + container and virtual machine images definitions. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 1 + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: [] references: samm2: - O-EM-A-1 + - I-SB-A-2 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.1.1 @@ -2703,6 +2708,47 @@ Implementation: - 8.32 tags: - none + Require a PR before merging: + uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + risk: Intentional or accidental alterations in critical branches like main (or + master). + measure: Define source code management system policies (e.g. branch protection + rules, mandatory code reviews from at least one person, ...) to ensure that + changes to critical branches are only possible under defined conditions. These + policies can be implemented at repository level or organization level, depending + on the source code management system. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 2 + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + tags: + - none Block force pushes: uuid: c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 risk: "Misuse of force push can lead to loss of work. It may overwrite remote @@ -2792,55 +2838,20 @@ Implementation: - 8.25 tags: - none - Local development linting & style checks performed: - uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 - risk: Insecure or unmaintainable code base. - measure: Integrate static code analysis tools in IDEs. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 2 - level: 5 - description: "" - implementation: - - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Require a PR before merging: - uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 - risk: Intentional or accidental alterations in critical branches like main (or - master). - measure: Define source code management system policies (e.g. branch protection - rules, mandatory code reviews from at least one person, ...) to ensure that - changes to critical branches are only possible under defined conditions. These - policies can be implemented at repository level or organization level, depending - on the source code management system. + Require status checks to pass: + uuid: ac8730a2-ccc0-465c-9550-d91edae9d5ee + risk: Organizations risk introducing broken builds, quality issues, and security + vulnerabilities into their codebase. + measure: Mandate passing of security related specified status checks, like successful + builds or static application security tests, before proceeding. difficultyOfImplementation: knowledge: 2 time: 1 resources: 2 usefulness: 4 - level: 2 + level: 3 + dependsOn: + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -2854,71 +2865,129 @@ Implementation: tags: - source-code-protection - scm + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules references: samm2: - O-EM-A-1 iso27001-2017: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - 6.1.2 - 14.2.1 iso27001-2022: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 tags: - none - Require status checks to pass: - uuid: ac8730a2-ccc0-465c-9550-d91edae9d5ee - risk: Organizations risk introducing broken builds, quality issues, and security - vulnerabilities into their codebase. - measure: Mandate passing of security related specified status checks, like successful - builds or static application security tests, before proceeding. + .gitignore: + uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d + risk: Unintended leakage of secrets, debug, or workstation specific data + measure: .gitignore files help prevent accidental commits of secrets, debug, + or workstation specific data difficultyOfImplementation: knowledge: 2 time: 1 - resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging + resources: 1 + usefulness: 5 + level: 4 + dependsOn: [] + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + - 14.2.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + tags: + - none + Local development linting & style checks performed: + uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 + risk: Insecure or unmaintainable code base. + measure: Integrate static code analysis tools in IDEs. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 5 + description: "" implementation: - - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm tags: - - source-code-protection - - scm - - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing + - ide + - linting + - uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules + - ide + - linting + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + comments: "" + tags: + - none + Infrastructure Hardening: + MFA for admins: + uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 + risk: One factor authentication is more vulnerable to brute force attacks and + is considered less secure. + measure: Two ore more factor authentication for all privileged accounts on systems + and applications + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 1 + implementation: + - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey - Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ references: samm2: - O-EM-A-1 iso27001-2017: + - 9.2.4 - 6.1.2 - 14.2.1 iso27001-2022: + - 5.17 - 5.3 - 8.25 + d3f: + - Multi-factorAuthentication + comments: "" tags: - none - Versioning: - uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f - risk: Deployment of untracked artifacts. - description: Use a version control system platform like Github, Gitlab, Bitbucket, - gittea,... to version your code. - measure: Version artifacts in order to identify deployed features and issues. - This includes application and infrastructure code, jenkins configuration, - container and virtual machine images definitions. + Simple access control for systems: + uuid: 82e499d1-f463-4a4b-be90-68812a874af6 + risk: Attackers a gaining access to internal systems and application interfaces + measure: All internal systems are using simple authentication difficultyOfImplementation: knowledge: 3 time: 3 @@ -2927,23 +2996,51 @@ Implementation: level: 1 dependsOn: - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - implementation: [] + implementation: + - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ references: samm2: - O-EM-A-1 - - I-SB-A-2 iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.1.1 - - 12.1.2 - - 14.2.2 + - 9.4.1 iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.37 - - 8.32 + - 8.3 + comments: "" + tags: + - none + Usage of edge encryption at transit: + uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 + risk: Evil actors might be able to perform a man in the middle attack and sniff + confidential information (e.g. authentication factors like passwords). + measure: |- + By using encryption at the edge of traffic in transit, it is impossible + or at least harder to sniff credentials or information being outside of the organization. + + Using standard secure protocols like HTTPS is recommended. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + comments: "" tags: - none - Infrastructure Hardening: Applications are running in virtualized environments: uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 risk: Through a vulnerability in one service on a server, the attacker gains @@ -3065,30 +3162,36 @@ Implementation: comments: "" tags: - none - Filter outgoing traffic: - uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d - risk: A compromised infrastructure component might try to send out stolen data. - measure: Having a whitelist and explicitly allowing egress traffic provides - the ability to stop unauthorized data leakage. + Isolated networks for virtual environments: + uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 + risk: Virtual environments in default settings are able to access other virtual + environments on the network stack. By using virtual machines, it is often + possible to connect to other virtual machines. By using docker, one bridge + is used by default so that all containers on one host can communicate with + each other. + measure: The communication between virtual environments is controlled and regulated. difficultyOfImplementation: knowledge: 3 time: 3 resources: 3 - usefulness: 2 - level: 3 + usefulness: 5 + level: 2 dependsOn: [] implementation: - - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 - name: Open Policy Agent + - uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges tags: [] - url: https://www.openpolicyagent.org/ - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 name: firewalls tags: [] url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ references: samm2: - - O-EM-A-2 + - O-EM-A-1 iso27001-2017: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 @@ -3098,67 +3201,183 @@ Implementation: comments: "" tags: - none - Hardening of the Environment: - uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 - risk: Using default configurations for a cluster environment leads to potential - risks. - measure: Harden environments according to best practices. Level 2 and partially - level 3 from hardening practices like 'CIS Kubernetes Bench for Security' - should be considered. + MFA: + uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de + risk: One factor authentication is more vulnerable to brute force attacks and + is considered less secure. + measure: Two ore more factor authentication for all accounts on all (important) + systems and applications difficultyOfImplementation: - knowledge: 4 - time: 4 + knowledge: 2 + time: 2 resources: 2 - usefulness: 3 - level: 4 + usefulness: 4 + level: 2 + dependsOn: + - 8098e416-e1ed-4ae4-a561-83efbe76bf57 # MFA for admins implementation: - - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Benchmark for Security + - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey - Smartcard tags: [] - url: https://www.cisecurity.org/benchmark/kubernetes - - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Benchmark for Security + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS tags: [] - url: https://www.cisecurity.org/benchmark/docker - - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont + - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/containers/ - description: Attack matrix for containers - - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 9.2.4 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.17 + - 5.3 + - 8.25 + d3f: + - Multi-factorAuthentication + comments: "" + tags: + - none + Usage of an security account: + uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 + risk: Having security auditing in the same account as infrastructure and applications + at the cloud provide might cause evil administrators (or threat actors taking + over an account of an administrator) to alter evidence like audit logs. + measure: Usage of a separate account dedicated for security activities. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 + usefulness: 4 + level: 2 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - ISO 27001:2022 mapping is missing + comments: "" + tags: + - none + Usage of encryption at rest: + uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 + risk: Evil actors might be able to access data and read information, e.g. from + physical hard disks. + measure: By using encryption at rest, it is impossible or at least harder to + to read information. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + comments: "" + tags: + - none + Usage of test and production environments: + uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 + risk: Security tests are not running regularly because test environments are + missing + measure: A test and a production like environment is used + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 4 + level: 2 + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.4 + - 17.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.31 + - 8.14 + comments: "" + tags: + - none + Virtual environments are limited: + uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca + risk: Denial of service (internally by an attacker or unintentionally by a bug) + on one service effects other services + measure: All virtual environments are using resource limits on hard disks, memory + and CPU + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + dependsOn: + - 3a94d55e-fd82-4996-9eb3-20d23ff2a873 # Applications are running in virtualized + environments + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 12.1.3 + - 13.1.3 + - 17.2.1 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.6 + - 8.22 + - 8.14 + comments: "" + tags: + - none + Filter outgoing traffic: + uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d + risk: A compromised infrastructure component might try to send out stolen data. + measure: Having a whitelist and explicitly allowing egress traffic provides + the ability to stop unauthorized data leakage. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 2 + level: 3 + dependsOn: [] + implementation: + - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ references: samm2: - O-EM-A-2 iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific + - Virtual environments are not explicitly covered by ISO 27001 - too specific - 13.1.3 iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific + - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 comments: "" tags: @@ -3239,45 +3458,6 @@ Implementation: comments: "" tags: - none - Isolated networks for virtual environments: - uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 - risk: Virtual environments in default settings are able to access other virtual - environments on the network stack. By using virtual machines, it is often - possible to connect to other virtual machines. By using docker, one bridge - is used by default so that all containers on one host can communicate with - each other. - measure: The communication between virtual environments is controlled and regulated. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 - usefulness: 5 - level: 2 - dependsOn: [] - implementation: - - uuid: 9429d52c-203d-49ae-814f-1401210887cd - name: istio - tags: [] - url: https://istio.io/ - - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 - name: bridges - tags: [] - - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none Limitation of system events: uuid: e5386abf-9154-4752-a1a8-c3a8900f732d risk: System events (system calls) can lead to privilege escalation. @@ -3318,181 +3498,234 @@ Implementation: comments: "" tags: - none - MFA: - uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de - risk: One factor authentication is more vulnerable to brute force attacks and - is considered less secure. - measure: Two ore more factor authentication for all accounts on all (important) - systems and applications + Role based authentication and authorization: + uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 + risk: Everyone is able to get unauthorized access to information on systems + or to modify information unauthorized on systems. + measure: The usage of a (role based) access control helps to restrict system + access to authorized users. And enhancement is to use attribute based access + control. difficultyOfImplementation: knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 2 - dependsOn: - - 8098e416-e1ed-4ae4-a561-83efbe76bf57 # MFA for admins + time: 3 + resources: 1 + usefulness: 3 + level: 3 implementation: - - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS + - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service tags: [] - - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - - O-EM-A-1 + - O-EM-A-2 iso27001-2017: - - 9.2.4 - - 6.1.2 - - 14.2.1 + - 9.4.1 iso27001-2022: - - 5.17 - - 5.3 - - 8.25 - d3f: - - Multi-factorAuthentication + - 8.3 comments: "" tags: - none - MFA for admins: - uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 - risk: One factor authentication is more vulnerable to brute force attacks and - is considered less secure. - measure: Two ore more factor authentication for all privileged accounts on systems - and applications - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 + Usage of internal encryption at transit: + uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 + risk: Evil actors within the organization of traffic in transit might be able + to perform a man in the middle attack and sniff confidential information (e.g. + authentication factors like passwords) + measure: By using encryption internally, e.g. inside of a cluster, it is impossible + or at least harder to sniff credentials. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 3 usefulness: 4 - level: 1 + level: 3 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + comments: "" + tags: + - none + Usage of security by default for components: + uuid: 11b3848e-e931-4146-a35d-35409ada24ee + risk: Components (images, libraries, applications) are not hardened. + measure: Hardening of components is important, specially for image on which + other teams base on. Hardening should be performed on the operation system + and on the services inside (e.g. Nginx or a Java-Application). + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + level: 3 implementation: - - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - Smartcard + - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS + - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets tags: [] - - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - - O-EM-A-1 + - O-EM-A-2 iso27001-2017: - - 9.2.4 - - 6.1.2 - - 14.2.1 + - not explicitly covered by ISO 27001 - too specific iso27001-2022: - - 5.17 - - 5.3 - - 8.25 - d3f: - - Multi-factorAuthentication + - ISO 27001:2022 mapping is missing comments: "" tags: - none - Production near environments are used by developers: - uuid: e14de741-94b3-447c-8b07-eea947d82e61 - risk: In case an errors occurs in production, the developer need to be able - to create a production near environment on a local development environment. - measure: Usage of infrastructure as code helps to create a production near environment. - The developer needs to be trained in order to setup a local development environment. - In addition, it should be possible to create production like test data. Often - personal identifiable information is anonymized in order to comply with data - protection laws. + WAF baseline: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b + risk: Vulnerable input, such as exploits, can infiltrate the application via + numerous entry points, posing a significant security threat. + measure: |- + Implementing a web application firewall (WAF) is a critical security control. At a baseline level, the objective is to finely balance the reduction of false positives, maintaining user experience, against a potential increase in the less noticeable false negatives. + Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. + description: | + A baseline WAF configuration provides essential defense against common vulnerabilities, acting as a first line of automated threat detection and response. + Steps: + - Configure WAF in alert mode to establish traffic patterns + - Analyze alerts and adjust sensitivity to optimize for fewer false positives + - Gradually switch to a proactive blocking stance as confidence in the accuracy of the rules increases + + It's crucial to monitor and update the WAF configuration to adapt to evolving threats and minimize the potential for both false positives and false negatives. + + There are debates on how useful a WAF is for APIs. difficultyOfImplementation: knowledge: 3 - time: 3 + time: 4 resources: 3 - usefulness: 4 - level: 4 + usefulness: 3 + level: 3 dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code + - e1f37abb-d848-4a3a-b3df-65e91a89dcb7 # Context-aware output encoding implementation: [] references: samm2: - - O-EM-A-2 + - O-EM-A-1 iso27001-2017: - - 12.1.4 - - 17.2.1 + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 iso27001-2022: - - 8.31 - - 8.14 - comments: "" + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + comments: ~ tags: - none - Role based authentication and authorization: - uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 - risk: Everyone is able to get unauthorized access to information on systems - or to modify information unauthorized on systems. - measure: The usage of a (role based) access control helps to restrict system - access to authorized users. And enhancement is to use attribute based access - control. + Hardening of the Environment: + uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 + risk: Using default configurations for a cluster environment leads to potential + risks. + measure: Harden environments according to best practices. Level 2 and partially + level 3 from hardening practices like 'CIS Kubernetes Bench for Security' + should be considered. difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 + knowledge: 4 + time: 4 + resources: 2 usefulness: 3 - level: 3 + level: 4 implementation: - - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 - name: Directory Service + - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Benchmark for Security tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ - - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e - name: Plugins + url: https://www.cisecurity.org/benchmark/kubernetes + - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Benchmark for Security tags: [] - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + url: https://www.cisecurity.org/benchmark/docker + - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + - uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/containers/ + description: Attack matrix for containers + - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes references: samm2: - O-EM-A-2 iso27001-2017: - - 9.4.1 + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 iso27001-2022: - - 8.3 + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 comments: "" tags: - none - Simple access control for systems: - uuid: 82e499d1-f463-4a4b-be90-68812a874af6 - risk: Attackers a gaining access to internal systems and application interfaces - measure: All internal systems are using simple authentication + Production near environments are used by developers: + uuid: e14de741-94b3-447c-8b07-eea947d82e61 + risk: In case an errors occurs in production, the developer need to be able + to create a production near environment on a local development environment. + measure: Usage of infrastructure as code helps to create a production near environment. + The developer needs to be trained in order to setup a local development environment. + In addition, it should be possible to create production like test data. Often + personal identifiable information is anonymized in order to comply with data + protection laws. difficultyOfImplementation: knowledge: 3 time: 3 resources: 3 - usefulness: 5 - level: 1 + usefulness: 4 + level: 4 dependsOn: - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - implementation: - - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 - name: HTTP-Basic Authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ - - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e - name: VPN - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code + implementation: [] references: samm2: - - O-EM-A-1 + - O-EM-A-2 iso27001-2017: - - 9.4.1 + - 12.1.4 + - 17.2.1 iso27001-2022: - - 8.3 + - 8.31 + - 8.14 comments: "" tags: - none @@ -3533,199 +3766,41 @@ Implementation: comments: "" tags: - none - Usage of an security account: - uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 - risk: Having security auditing in the same account as infrastructure and applications - at the cloud provide might cause evil administrators (or threat actors taking - over an account of an administrator) to alter evidence like audit logs. - measure: Usage of a separate account dedicated for security activities. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 3 - usefulness: 4 - level: 2 - implementation: "" - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 10.1 - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Usage of edge encryption at transit: - uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 - risk: Evil actors might be able to perform a man in the middle attack and sniff - confidential information (e.g. authentication factors like passwords). - measure: |- - By using encryption at the edge of traffic in transit, it is impossible - or at least harder to sniff credentials or information being outside of the organization. - - Using standard secure protocols like HTTPS is recommended. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 1 - implementation: "" - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 10.1 - iso27001-2022: - - 8.24 - comments: "" - tags: - - none - Usage of encryption at rest: - uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 - risk: Evil actors might be able to access data and read information, e.g. from - physical hard disks. - measure: By using encryption at rest, it is impossible or at least harder to - to read information. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - implementation: "" - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 10.1 - iso27001-2022: - - 8.24 - comments: "" - tags: - - none - Usage of internal encryption at transit: - uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 - risk: Evil actors within the organization of traffic in transit might be able - to perform a man in the middle attack and sniff confidential information (e.g. - authentication factors like passwords) - measure: By using encryption internally, e.g. inside of a cluster, it is impossible - or at least harder to sniff credentials. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 3 - usefulness: 4 - level: 3 - implementation: "" - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 10.1 - iso27001-2022: - - 8.24 - comments: "" - tags: - - none - Usage of security by default for components: - uuid: 11b3848e-e931-4146-a35d-35409ada24ee - risk: Components (images, libraries, applications) are not hardened. - measure: Hardening of components is important, specially for image on which - other teams base on. Hardening should be performed on the operation system - and on the services inside (e.g. Nginx or a Java-Application). + WAF medium: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium + risk: The threat from malicious inputs remains high, with exploits seeking to + exploit any vulnerabilities present at the various points of entry to the + application. + measure: |- + A WAF deployed with a medium level of protection strengthens the security posture by striking a more advanced balance between the detection of genuine threats and the minimization of false alarms. + Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. + description: "A medium-level WAF configuration builds upon the baseline to offer + a more nuanced and responsive defense mechanism against a wider array of threats.\n\nSample + steps:\n - Implement an enhanced set of WAF rules based on baseline data\n + \ - Continuous monitoring and fine-tuning of the WAF configuration\n - Develop + a strategic incident response plan utilizing WAF insights \n \nThe + medium configuration requires diligent management and continuous improvement + to address new vulnerabilities while maintaining the integrity of application + access.\n\nThere are debates on how useful a WAF is for APIs.\n" difficultyOfImplementation: knowledge: 4 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c - name: 'For applications: Check default encoding' - tags: [] - - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf - name: managing secrets - tags: [] - url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ - - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 - name: crypto - tags: [] - - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 - name: authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Usage of test and production environments: - uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 - risk: Security tests are not running regularly because test environments are - missing - measure: A test and a production like environment is used - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 - usefulness: 4 - level: 2 - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - implementation: [] - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.1.4 - - 17.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.31 - - 8.14 - comments: "" - tags: - - none - Virtual environments are limited: - uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca - risk: Denial of service (internally by an attacker or unintentionally by a bug) - on one service effects other services - measure: All virtual environments are using resource limits on hard disks, memory - and CPU - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 + time: 5 + resources: 4 usefulness: 3 - level: 2 + level: 4 dependsOn: - - 3a94d55e-fd82-4996-9eb3-20d23ff2a873 # Applications are running in virtualized - environments + - f0e01814-3b88-4bd0-a3a9-f91db001d20b # WAF baseline implementation: [] references: samm2: - - O-EM-A-1 + - O-EM-A-2 iso27001-2017: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 12.1.3 + - Hardening is not explicitly covered by ISO 27001 - too specific - 13.1.3 - - 17.2.1 iso27001-2022: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 8.6 + - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 - - 8.14 - comments: "" + comments: ~ tags: - none WAF Advanced: @@ -3772,134 +3847,8 @@ Implementation: comments: ~ tags: - none - WAF baseline: - uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b - risk: Vulnerable input, such as exploits, can infiltrate the application via - numerous entry points, posing a significant security threat. - measure: |- - Implementing a web application firewall (WAF) is a critical security control. At a baseline level, the objective is to finely balance the reduction of false positives, maintaining user experience, against a potential increase in the less noticeable false negatives. - Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. - description: | - A baseline WAF configuration provides essential defense against common vulnerabilities, acting as a first line of automated threat detection and response. - Steps: - - Configure WAF in alert mode to establish traffic patterns - - Analyze alerts and adjust sensitivity to optimize for fewer false positives - - Gradually switch to a proactive blocking stance as confidence in the accuracy of the rules increases - - It's crucial to monitor and update the WAF configuration to adapt to evolving threats and minimize the potential for both false positives and false negatives. - - There are debates on how useful a WAF is for APIs. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 3 - usefulness: 3 - level: 3 - dependsOn: - - e1f37abb-d848-4a3a-b3df-65e91a89dcb7 # Context-aware output encoding - implementation: [] - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: ~ - tags: - - none - WAF medium: - uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium - risk: The threat from malicious inputs remains high, with exploits seeking to - exploit any vulnerabilities present at the various points of entry to the - application. - measure: |- - A WAF deployed with a medium level of protection strengthens the security posture by striking a more advanced balance between the detection of genuine threats and the minimization of false alarms. - Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. - description: "A medium-level WAF configuration builds upon the baseline to offer - a more nuanced and responsive defense mechanism against a wider array of threats.\n\nSample - steps:\n - Implement an enhanced set of WAF rules based on baseline data\n - \ - Continuous monitoring and fine-tuning of the WAF configuration\n - Develop - a strategic incident response plan utilizing WAF insights \n \nThe - medium configuration requires diligent management and continuous improvement - to address new vulnerabilities while maintaining the integrity of application - access.\n\nThere are debates on how useful a WAF is for APIs.\n" - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 4 - usefulness: 3 - level: 4 - dependsOn: - - f0e01814-3b88-4bd0-a3a9-f91db001d20b # WAF baseline - implementation: [] - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: ~ - tags: - - none Information Gathering: Logging: - Analyze logs: - uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 - risk: Not aware of attacks happening. - measure: Check logs for keywords. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - tags: - - none - Centralized application logging: - uuid: fe875e17-ae4a-45f8-a359-244aa4fcbc04 - risk: Local stored logs can be unauthorized manipulated by attackers with system - access or might be corrupt after an incident. In addition, it is hard to perform - an correlation of logs. This leads attacks, which can be performed silently. - measure: A centralized logging system is used and applications logs (including - application exceptions) are shipped to it. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 5 - level: 2 - dependsOn: - - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting - implementation: [] - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.4.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.15 - tags: - - none Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 risk: Local stored system logs can be unauthorized manipulated by attackers @@ -3938,32 +3887,31 @@ Information Gathering: comments: "" tags: - none - Correlation of security events: - uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 - risk: Detection of security related events with hints on different systems/tools/metrics - is not possible. - measure: Events are correlated on one system. For example the correlation and - visualization of failed login attempts combined with successful login attempts. + Centralized application logging: + uuid: fe875e17-ae4a-45f8-a359-244aa4fcbc04 + risk: Local stored logs can be unauthorized manipulated by attackers with system + access or might be corrupt after an incident. In addition, it is hard to perform + an correlation of logs. This leads attacks, which can be performed silently. + measure: A centralized logging system is used and applications logs (including + application exceptions) are shipped to it. difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 4 - usefulness: 3 - level: 5 + knowledge: 1 + time: 1 + resources: 1 + usefulness: 5 + level: 2 dependsOn: - - 7c735089-6a83-419f-8b27-c1e676cedea1 # Visualized logging - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting implementation: [] references: samm2: - - O-IM-A-2 + - O-IM-A-1 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 12.4.1 iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 - comments: "" tags: - none Logging of security events: @@ -4019,9 +3967,96 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 - risk: |- - * No track of security-relevant events makes it harder to analyze an incident. - * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. + risk: |- + * No track of security-relevant events makes it harder to analyze an incident. + * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. + comments: "" + tags: + - none + Analyze logs: + uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 + risk: Not aware of attacks happening. + measure: Check logs for keywords. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + tags: + - none + Visualized logging: + uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 + risk: System and application protocols are not visualized properly which leads + to no or very limited logging assessment. Specially developers might have + difficulty to read applications logs with unusually tools like the Linux tool + 'cat' + measure: Protocols are visualized in a simple to use real time monitoring system. + The GUI gives the ability to search for special attributes in the protocol. + difficultyOfImplementation: + knowledge: 1 + time: 3 + resources: 3 + usefulness: 4 + level: 3 + dependsOn: + - 4eced38a-7904-4c45-adb0-50b663065540 # Centralized system logging + - fe875e17-ae4a-45f8-a359-244aa4fcbc04 # Centralized application logging + + implementation: + - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + comments: "" + tags: + - none + Correlation of security events: + uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 + risk: Detection of security related events with hints on different systems/tools/metrics + is not possible. + measure: Events are correlated on one system. For example the correlation and + visualization of failed login attempts combined with successful login attempts. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 4 + usefulness: 3 + level: 5 + dependsOn: + - 7c735089-6a83-419f-8b27-c1e676cedea1 # Visualized logging + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 comments: "" tags: - none @@ -4073,85 +4108,92 @@ Information Gathering: comments: "" tags: - none - Visualized logging: - uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 - risk: System and application protocols are not visualized properly which leads - to no or very limited logging assessment. Specially developers might have - difficulty to read applications logs with unusually tools like the Linux tool - 'cat' - measure: Protocols are visualized in a simple to use real time monitoring system. - The GUI gives the ability to search for special attributes in the protocol. + Monitoring: + Simple application metrics: + uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 + risk: Attacks on an application are not recognized. + measure: |- + Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: + - Authentication attempts (successful/failed logins) + - Transaction volumes and patterns (e.g. orders, payments) + - API call rates and response times + - User session metrics + - Resource utilization + + Example: An e-commerce application normally processes 100 orders per hour. A sudden spike to 1000 orders per hour could indicate either: + - A legitimate event (unannounced marketing campaign, viral social media post) + - A security incident (automated bulk purchase bots, credential stuffing attack) + + By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. difficultyOfImplementation: - knowledge: 1 - time: 3 - resources: 3 - usefulness: 4 - level: 3 - dependsOn: - - 4eced38a-7904-4c45-adb0-50b663065540 # Centralized system logging - - fe875e17-ae4a-45f8-a359-244aa4fcbc04 # Centralized application logging - + knowledge: 2 + time: 2 + resources: 2 + usefulness: 5 + level: 1 implementation: - - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 - name: ELK-Stack + - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus tags: [] - url: https://www.elastic.co/elk-stack + url: https://prometheus.io/ references: samm2: - O-IM-A-1 iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - 12.4.1 iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - 8.15 comments: "" tags: - none - Monitoring: - Advanced app. metrics: - uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf - risk: People are not looking into tests results. Vulnerabilities not recolonized, - even they are detected by tools. - measure: All defects from the dimension Test- and Verification are instrumented. + Simple budget metrics: + uuid: f08a3219-6941-43ec-8762-4aff739f4664 + risk: Not getting notified about reaching the end of the budget (e.g. due to + a denial of service) creates unexpected costs. + measure: Cloud providers often provide insight into budgets. A threshold and + alarming for the budget is set. difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 - usefulness: 4 - level: 4 - dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: [] + knowledge: 1 + time: 1 + resources: 1 + usefulness: 5 + level: 1 + implementation: + - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] references: samm2: - - O-IM-A-2 + - O-IM-A-1 iso27001-2017: - - 12.6.1 + - 12.1.3 iso27001-2022: - - 8.8 + - 8.6 comments: "" tags: - none - Advanced availability and stability metrics: - uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 - risk: Trends and advanced attacks are not detected. - measure: Advanced metrics are gathered in relation to availability and stability. - For example unplanned downtime's per year. + Simple system metrics: + uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 + risk: Without simple metrics analysis of incidents are hard. In case an application + uses a lot of CPU from time to time, it is hard for a developer to find out + the source with Linux commands. + measure: Gathering of system metrics helps to identify incidents and specially + bottlenecks like in CPU usage, memory usage and hard disk usage. difficultyOfImplementation: - knowledge: 3 - time: 3 + knowledge: 2 + time: 2 resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: [] + usefulness: 5 + assessment: | + Are system metrics gathered? + level: 1 + implementation: + - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] references: samm2: - - O-IM-A-2 + - O-IM-A-1 iso27001-2017: - 12.1.3 iso27001-2022: @@ -4188,69 +4230,111 @@ Information Gathering: comments: "" tags: - none - Audit of system events: - uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 - risk: System events (system calls) trends and attacks are not detected. - measure: Gathering of system calls. + Monitoring of costs: + uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e + risk: Not monitoring costs might lead to unexpected high resource consumption + and a high invoice. + measure: Implement cost budgets. Setting of an alert threshold and sending out + errors when it is reached. In the best case, a second threshold with a limit + is set so that the cost can not go higher. difficultyOfImplementation: - knowledge: 2 + knowledge: 1 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + comments: "" + tags: + - none + Visualized metrics: + uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 + risk: Not visualized metrics lead to restricted usage of metrics. + measure: Metrics are visualized in real time in a user friendly way. + difficultyOfImplementation: + knowledge: 1 time: 2 resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + comments: "" + tags: + - none + Advanced availability and stability metrics: + uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 + risk: Trends and advanced attacks are not detected. + measure: Advanced metrics are gathered in relation to availability and stability. + For example unplanned downtime's per year. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 usefulness: 4 level: 3 dependsOn: + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: - - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + implementation: [] references: samm2: - O-IM-A-2 iso27001-2017: - - 12.6.1 + - 12.1.3 iso27001-2022: - - 8.8 + - 8.6 comments: "" tags: - none - Coverage and control metrics: - uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d - risk: The effectiveness of configuration, patch and vulnerability management - is unknown. - measure: "Usage of Coverage- and control-metrics to show the effectiveness of - the security program. Coverage is the degree in \n which a specific - security control for a specific target group is applied with all resources.\n - \ The control degree shows the actual application of security standards - and security-guidelines. Examples are gathering information on anti-virus, - anti-rootkits, patch management, server configuration and vulnerability management." + Audit of system events: + uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 + risk: System events (system calls) trends and attacks are not detected. + measure: Gathering of system calls. difficultyOfImplementation: - knowledge: 3 - time: 5 + knowledge: 2 + time: 2 resources: 2 usefulness: 4 - level: 4 + level: 3 dependsOn: - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: - - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. references: samm2: - O-IM-A-2 iso27001-2017: - - not explicitly covered by ISO 27001 - too specific + - 12.6.1 iso27001-2022: - - ISO 27001:2022 mapping is missing + - 8.8 comments: "" tags: - none @@ -4279,35 +4363,6 @@ Information Gathering: comments: "" tags: - none - Defense metrics: - uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 - risk: IDS/IPS systems like packet- or application-firewalls detect and prevent - attacks. It is not known how many attacks has been detected and blocked. - measure: | - Gathering of defense metrics like TCP/UDP sources enables to assume the geographic location of the request. - Assuming a Kubernetes cluster with an egress-traffic filter (e.g. IP/domain based), an alert might be send out in case of every violation. For ingress-traffic, alerting might not even be considered. - difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 2 - usefulness: 4 - level: 4 - dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - - 6df508ef-86fc-4c22-bd9f-646c3127ce7d # Filter outgoing traffic - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - 12.4.1 - - 13.1.1 - iso27001-2022: - - 8.15 - - 8.2 - comments: "" - tags: - - none Grouping of metrics: uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b risk: The analysis of metrics takes long. @@ -4331,193 +4386,139 @@ Information Gathering: comments: "" tags: - none - Metrics are combined with tests: - uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 - risk: Changes might cause high load due to programming errors. - measure: Metrics during tests helps to identify programming errors. + Targeted alerting: + uuid: d6f06ae8-401a-4f44-85df-1079247fa030 + risk: People are bored (ignorant) of incident alarm messages, as they are not + responsible to react. + measure: By the definition of target groups for incidents people are only getting + alarms for incidents they are in charge for. difficultyOfImplementation: knowledge: 2 - time: 3 - resources: 2 + time: 5 + resources: 5 usefulness: 5 - level: 5 + level: 3 dependsOn: - - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting implementation: [] references: samm2: - O-IM-A-2 + - I-DM-A-3 iso27001-2017: - - not explicitly covered by ISO 27001 + - Not explicitly covered by ISO 27001 - too specific + - 16.1.5 iso27001-2022: - - ISO 27001:2022 mapping is missing + - Not explicitly covered by ISO 27001 - too specific + - 5.26 comments: "" tags: - none - Monitoring of costs: - uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e - risk: Not monitoring costs might lead to unexpected high resource consumption - and a high invoice. - measure: Implement cost budgets. Setting of an alert threshold and sending out - errors when it is reached. In the best case, a second threshold with a limit - is set so that the cost can not go higher. + Advanced app. metrics: + uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf + risk: People are not looking into tests results. Vulnerabilities not recolonized, + even they are detected by tools. + measure: All defects from the dimension Test- and Verification are instrumented. difficultyOfImplementation: - knowledge: 1 - time: 2 + knowledge: 3 + time: 3 resources: 2 - usefulness: 3 - level: 2 + usefulness: 4 + level: 4 dependsOn: - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: - O-IM-A-2 iso27001-2017: - - 12.1.3 + - 12.6.1 iso27001-2022: - - 8.6 + - 8.8 comments: "" tags: - none - Screens with metric visualization: - uuid: 8746647c-638c-473f-8e17-82c068e4c311 - risk: Security related information is discovered too late during an incident. - measure: By having an internal accessible screen with a security related dashboards - helps to visualize incidents. + Coverage and control metrics: + uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d + risk: The effectiveness of configuration, patch and vulnerability management + is unknown. + measure: "Usage of Coverage- and control-metrics to show the effectiveness of + the security program. Coverage is the degree in \n which a specific + security control for a specific target group is applied with all resources.\n + \ The control degree shows the actual application of security standards + and security-guidelines. Examples are gathering information on anti-virus, + anti-rootkits, patch management, server configuration and vulnerability management." difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 5 + knowledge: 3 + time: 5 + resources: 2 + usefulness: 4 level: 4 dependsOn: - - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics - implementation: [] + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + implementation: + - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf references: samm2: - O-IM-A-2 iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 16.1.5 + - not explicitly covered by ISO 27001 - too specific iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.26 + - ISO 27001:2022 mapping is missing comments: "" tags: - none - Simple application metrics: - uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 - risk: Attacks on an application are not recognized. - measure: |- - Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: - - Authentication attempts (successful/failed logins) - - Transaction volumes and patterns (e.g. orders, payments) - - API call rates and response times - - User session metrics - - Resource utilization - - Example: An e-commerce application normally processes 100 orders per hour. A sudden spike to 1000 orders per hour could indicate either: - - A legitimate event (unannounced marketing campaign, viral social media post) - - A security incident (automated bulk purchase bots, credential stuffing attack) - - By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. + Defense metrics: + uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 + risk: IDS/IPS systems like packet- or application-firewalls detect and prevent + attacks. It is not known how many attacks has been detected and blocked. + measure: | + Gathering of defense metrics like TCP/UDP sources enables to assume the geographic location of the request. + Assuming a Kubernetes cluster with an egress-traffic filter (e.g. IP/domain based), an alert might be send out in case of every violation. For ingress-traffic, alerting might not even be considered. difficultyOfImplementation: - knowledge: 2 - time: 2 + knowledge: 3 + time: 5 resources: 2 - usefulness: 5 - level: 1 - implementation: - - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c - name: Prometheus - tags: [] - url: https://prometheus.io/ + usefulness: 4 + level: 4 + dependsOn: + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - 6df508ef-86fc-4c22-bd9f-646c3127ce7d # Filter outgoing traffic + implementation: [] references: samm2: - - O-IM-A-1 + - O-IM-A-2 iso27001-2017: - 12.4.1 + - 13.1.1 iso27001-2022: - 8.15 + - 8.2 comments: "" tags: - none - Simple budget metrics: - uuid: f08a3219-6941-43ec-8762-4aff739f4664 - risk: Not getting notified about reaching the end of the budget (e.g. due to - a denial of service) creates unexpected costs. - measure: Cloud providers often provide insight into budgets. A threshold and - alarming for the budget is set. + Screens with metric visualization: + uuid: 8746647c-638c-473f-8e17-82c068e4c311 + risk: Security related information is discovered too late during an incident. + measure: By having an internal accessible screen with a security related dashboards + helps to visualize incidents. difficultyOfImplementation: - knowledge: 1 + knowledge: 2 time: 1 resources: 1 usefulness: 5 - level: 1 - implementation: - - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - 12.1.3 - iso27001-2022: - - 8.6 - comments: "" - tags: - - none - Simple system metrics: - uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 - risk: Without simple metrics analysis of incidents are hard. In case an application - uses a lot of CPU from time to time, it is hard for a developer to find out - the source with Linux commands. - measure: Gathering of system metrics helps to identify incidents and specially - bottlenecks like in CPU usage, memory usage and hard disk usage. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 5 - assessment: | - Are system metrics gathered? - level: 1 - implementation: - - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - 12.1.3 - iso27001-2022: - - 8.6 - comments: "" - tags: - - none - Targeted alerting: - uuid: d6f06ae8-401a-4f44-85df-1079247fa030 - risk: People are bored (ignorant) of incident alarm messages, as they are not - responsible to react. - measure: By the definition of target groups for incidents people are only getting - alarms for incidents they are in charge for. - difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 5 - usefulness: 5 - level: 3 + level: 4 dependsOn: - - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting + - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics implementation: [] references: samm2: - O-IM-A-2 - - I-DM-A-3 iso27001-2017: - Not explicitly covered by ISO 27001 - too specific - 16.1.5 @@ -4527,153 +4528,30 @@ Information Gathering: comments: "" tags: - none - Visualized metrics: - uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 - risk: Not visualized metrics lead to restricted usage of metrics. - measure: Metrics are visualized in real time in a user friendly way. + Metrics are combined with tests: + uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 + risk: Changes might cause high load due to programming errors. + measure: Metrics during tests helps to identify programming errors. difficultyOfImplementation: - knowledge: 1 - time: 2 + knowledge: 2 + time: 3 resources: 2 - usefulness: 3 - level: 2 + usefulness: 5 + level: 5 dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics + - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics implementation: [] references: samm2: - O-IM-A-2 iso27001-2017: - - 12.1.3 + - not explicitly covered by ISO 27001 iso27001-2022: - - 8.6 + - ISO 27001:2022 mapping is missing comments: "" tags: - none Test KPI: - Fix rate per repo/product: - uuid: cf0d600e-114d-4887-9059-d81c53805f0d - risk: "Not communicating how many applications are adhering to SLAs based on - the criticality of vulnerabilities can lead to delayed remediation of \ncritical - security issues, increasing the risk of exploitation and potential damage - to the organization." - measure: "Measurement and communication of the number of vulnerabilities handled - per severity level for components such as applications, ensuring alignment - with SLAs. \nThe rate should be broken down by team, product, application, - repository, and/or service. This analysis should be conducted at least quarterly." - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - I-DM-B-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurements - Generation of response statistics: - uuid: c922981b-65ed-40f3-a947-96fee9a0125f - risk: No or delayed reaction to findings leads to potential exploitation of - findings. - measure: Creation and response statistics (e.g. Mean Time to Resolution) of - findings. This is also referred to as _Mean Time to Resolve_. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - dependsOn: - - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management - system - level: 3 - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - I-DM-B-2 - - I-SB-B-3 - iso27001-2017: - - 16.1.4 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurements - comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) - generates statistics from OWASP DefectDojo and places the results in a [Github - repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). Number of vulnerabilities/severity: uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 risk: Failing to convey the number of vulnerabilities by severity might undermine @@ -4779,37 +4657,128 @@ Information Gathering: - patching - metrics - vmm-measurements - Patching mean time to resolution via production: - uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f - risk: Without measuring Mean Time to Resolution (MTTR) related to patching, - it is challenging to identify delays in the patching process. Unaddressed - vulnerabilities can be exploited by attackers, leading to potential security - breaches and data loss. - measure: |- - Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. - Average time to patch is visualized per component/project/team. + Fix rate per repo/product: + uuid: cf0d600e-114d-4887-9059-d81c53805f0d + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of the number of vulnerabilities handled + per severity level for components such as applications, ensuring alignment + with SLAs. \nThe rate should be broken down by team, product, application, + repository, and/or service. This analysis should be conducted at least quarterly." difficultyOfImplementation: - knowledge: 1 - time: 1 + knowledge: 2 + time: 2 resources: 2 usefulness: 3 - level: 4 + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + Generation of response statistics: + uuid: c922981b-65ed-40f3-a947-96fee9a0125f + risk: No or delayed reaction to findings leads to potential exploitation of + findings. + measure: Creation and response statistics (e.g. Mean Time to Resolution) of + findings. This is also referred to as _Mean Time to Resolve_. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 dependsOn: - - 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution - via PR - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches - implementation: [] + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management + system + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - I-DM-B-2 + - I-SB-B-3 iso27001-2017: - 16.1.4 + - 8.2.3 iso27001-2022: - 5.25 + - 5.1 tags: - - patching + - vulnerability-mgmt - metrics - vmm-measurements + comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) + generates statistics from OWASP DefectDojo and places the results in a [Github + repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). SLA per criticality: uuid: 51f3fce5-b5c8-4683-8c41-e785fe4f3b5f risk: "Not communicating how many applications are adhering to SLAs based on @@ -4870,57 +4839,39 @@ Information Gathering: - vulnerability-mgmt - metrics - vmm-measurements -Test and Verification: - Application tests: - High coverage of security related module and integration tests: - uuid: 67667c97-c33e-4306-a4e5-e7b1d8e10c5a - risk: Vulnerabilities are rising due to code changes in a complex microservice - environment in not important components. - measure: Implementation of security related tests via unit tests and integration - tests. Including the test of libraries, in case the are not tested already. + Patching mean time to resolution via production: + uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f + risk: Without measuring Mean Time to Resolution (MTTR) related to patching, + it is challenging to identify delays in the patching process. Unaddressed + vulnerabilities can be exploited by attackers, leading to potential security + breaches and data loss. + measure: |- + Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + Average time to patch is visualized per component/project/team. difficultyOfImplementation: - knowledge: 5 - time: 5 - resources: 3 + knowledge: 1 + time: 1 + resources: 2 usefulness: 3 - level: 5 + level: 4 + dependsOn: + - 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution + via PR + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches implementation: [] references: samm2: - - V-RT-B-3 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - Security integration tests for important components: - uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 - risk: Vulnerabilities are rising due to code changes in a complex microservice - environment. - measure: Implementation of essential security related integration tests. For - example for authentication and authorization. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 - usefulness: 2 - level: 3 - references: - samm2: - - V-RT-A-3 + - I-DM-B-2 iso27001-2017: - - 14.2.3 - - 14.2.8 + - 16.1.4 iso27001-2022: - - 8.32 - - 8.29 - comments: "" + - 5.25 tags: - - none + - patching + - metrics + - vmm-measurements +Test and Verification: + Application tests: Security unit tests for important components: uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 risk: Vulnerabilities are rising due to code changes. @@ -4956,6 +4907,30 @@ Test and Verification: - 8.29 tags: - none + Security integration tests for important components: + uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment. + measure: Implementation of essential security related integration tests. For + example for authentication and authorization. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 2 + level: 3 + references: + samm2: + - V-RT-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + comments: "" + tags: + - none Smoke Test: uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a risk: During a deployment an error might happen which leads to non-availability @@ -4983,18 +4958,54 @@ Test and Verification: comments: "" tags: - none + High coverage of security related module and integration tests: + uuid: 67667c97-c33e-4306-a4e5-e7b1d8e10c5a + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment in not important components. + measure: Implementation of security related tests via unit tests and integration + tests. Including the test of libraries, in case the are not tested already. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 3 + usefulness: 3 + level: 5 + implementation: [] + references: + samm2: + - V-RT-B-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + comments: "" + tags: + - none Consolidation: - Advanced visualization of defects: - uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 - risk: Correlation of the vulnerabilities of different tools to have an overview - of the the overall security level per component/project/team is not given. - measure: Findings are visualized per component/project/team. + Simple false positive treatment: + uuid: c1acc8af-312e-4503-a817-a26220c993a0 + risk: As false positive occur during each test, all vulnerabilities might be + ignored. Specially, if tests are automated an run daily. + measure: |- + Findings from security tests must be triaged and outcomes persisted/documented to: + - Prevent re-analysis of known issues in subsequent test runs + - Track accepted risks vs false positives + - Enable consistent decision-making across teams + + At this maturity level, a simple tracking system suffices - tools need only distinguish between "triaged" and "untriaged" findings, without complex categorization. Some tools refer to this as "suppression" of findings. + + Samples for false positive handling: + - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) + - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) + - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) difficultyOfImplementation: - knowledge: 2 - time: 4 + knowledge: 1 + time: 1 resources: 1 - usefulness: 2 - level: 4 + usefulness: 4 + level: 1 implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -5011,29 +5022,43 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system references: samm2: - - I-DM-A-3 + - I-DM-A-1 iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 + - Not explicitly covered by ISO 27001 - too specific + - 16.1.6 iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 + - Not explicitly covered by ISO 27001 - too specific + - 5.27 comments: "" tags: - none + Treatment of defects with severity high or higher: + uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 + risk: Vulnerabilities with severity high or higher are not visible. + measure: Vulnerabilities with severity high or higher are added to the quality + gate. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + comments: False positive analysis, specially for static analysis, is time consuming. + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + implementation: [] + tags: + - vuln-action + - defect-management Artifact-based false positive treatment: uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f risk: Without artifact-specific false positive handling, teams must repeatedly @@ -5051,13 +5076,90 @@ Test and Verification: difficultyOfImplementation: knowledge: 2 time: 2 - resources: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment + + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + references: + samm2: + - I-DM-A-2 + - I-DM-B-2 + - I-SB-B-3 + iso27001-2017: + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 5.25 + - 5.27 + tags: + - false-positive + - defect-management + Simple visualization of defects: + uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 + risk: The security level of a component is not visible. Therefore, the motivation + to enhance the security is not give. + measure: Vulnerabilities are simple visualized. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 usefulness: 3 level: 2 - dependsOn: - - c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment - implementation: + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo tags: @@ -5073,33 +5175,22 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory references: samm2: - I-DM-A-2 - - I-DM-B-2 - - I-SB-B-3 iso27001-2017: - 16.1.4 - - 16.1.6 + - 8.2.1 + - 8.2.2 + - 8.2.3 iso27001-2022: - 5.25 - - 5.27 + - 5.12 + - 5.13 + - 5.1 + comments: "" tags: - - false-positive - - defect-management + - none Fix based on accessibility: uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed risk: Overwhelming volume of security findings from automated testing tools. @@ -5159,263 +5250,72 @@ Test and Verification: time: 3 resources: 2 usefulness: 4 - level: 3 - dependsOn: - - 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment - - - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management - system - implementation: ~ - references: - samm2: - - I-DM-B-2 - - I-DM-A-3 - - I-SB-B-3 - iso27001-2017: - - 16.1.3 - - 16.1.4 - - 16.1.6 - iso27001-2022: - - 6.8 - - 5.25 - - 5.27 - tags: - - false-positive - - defect-management - Integration in development process: - uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d - risk: "Not integrating vulnerability handling into the development process may - result in product teams ignoring findings. \n\nSecurity joke: We will gain - 100% false negatives." - measure: Integration of findings into the development process. E.g. adding findings - to the backlog of products teams. - description: |- - Validating Findings by Security Engineers Pros: - - Ensures accuracy and relevance of findings before they reach product teams - - Reduces false positives, saving development teams time and effort - - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities - - Validating Findings by Security Engineers Cons: - - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations - - May slow down the process if security engineers are overloaded with validation tasks - - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application - - Pushing Findings Directly to Product Teams Pros: - - Accelerates the process by immediately notifying product teams of potential vulnerabilities - - Empowers product teams to take swift action in addressing security issues - Pushing Findings Directly to Product Teams Cons: - - Increases the workload on product teams, potentially leading to frustration - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - dependsOn: [] - implementation: - - uuid: 889444eb-de68-4367-bada-a66f8cb9733a - name: Jira - tags: - - documentation - - issue - - proprietary - url: https://jira.atlassian.com/ - description: Jira is a bug tracking and project management tool developed - by Atlassian, used by development teams for tracking issues, planning sprints, - and managing software releases. It offers features for creating and managing - tasks, assigning them to team members, and monitoring progress through customizable - workflows and dashboards. - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - I-DM-A-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - vmm-measurements - Integration of vulnerability issues into the development process: - uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e - risk: To read console output of the build server to search for vulnerabilities - might be difficult. Also, to check a vulnerability management system might - not be a daily task for a developer. - measure: Vulnerabilities are tracked in the teams issue system (e.g. jira). - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 2 - level: 3 - implementation: - - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a - name: SAST - tags: [] - description: 'At SAST (Static Application Security Testing): Server-side / - client-side teams can easily be recorded. With microservice architecture - individual microservices can be used usually Teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ - - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 - name: DAST - tags: [] - description: 'At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 16.1.4 - - 16.1.5 - - 16.1.6 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.25 - - 5.26 - - 5.27 - comments: "" - tags: - - none - Reproducible defect tickets: - uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 - risk: Vulnerability descriptions are hard to understand by staff from operations - and development. - measure: Vulnerabilities include the test procedure to give the staff from operations - and development the ability to reproduce vulnerabilities. This enhances the - understanding of vulnerabilities and therefore the fix have a higher quality. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 2 - usefulness: 2 - level: 4 - implementation: [] - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - comments: "" - tags: - - none - Simple false positive treatment: - uuid: c1acc8af-312e-4503-a817-a26220c993a0 - risk: As false positive occur during each test, all vulnerabilities might be - ignored. Specially, if tests are automated an run daily. - measure: |- - Findings from security tests must be triaged and outcomes persisted/documented to: - - Prevent re-analysis of known issues in subsequent test runs - - Track accepted risks vs false positives - - Enable consistent decision-making across teams - - At this maturity level, a simple tracking system suffices - tools need only distinguish between "triaged" and "untriaged" findings, without complex categorization. Some tools refer to this as "suppression" of findings. - - Samples for false positive handling: - - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) - - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) - - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 4 - level: 1 - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + level: 3 + dependsOn: + - 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment + + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management + system + implementation: ~ references: samm2: - - I-DM-A-1 + - I-DM-B-2 + - I-DM-A-3 + - I-SB-B-3 iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific + - 16.1.3 + - 16.1.4 - 16.1.6 iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific + - 6.8 + - 5.25 - 5.27 - comments: "" tags: - - none - Simple visualization of defects: - uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 - risk: The security level of a component is not visible. Therefore, the motivation - to enhance the security is not give. - measure: Vulnerabilities are simple visualized. + - false-positive + - defect-management + Integration in development process: + uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d + risk: "Not integrating vulnerability handling into the development process may + result in product teams ignoring findings. \n\nSecurity joke: We will gain + 100% false negatives." + measure: Integration of findings into the development process. E.g. adding findings + to the backlog of products teams. + description: |- + Validating Findings by Security Engineers Pros: + - Ensures accuracy and relevance of findings before they reach product teams + - Reduces false positives, saving development teams time and effort + - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities + + Validating Findings by Security Engineers Cons: + - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations + - May slow down the process if security engineers are overloaded with validation tasks + - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application + + Pushing Findings Directly to Product Teams Pros: + - Accelerates the process by immediately notifying product teams of potential vulnerabilities + - Empowers product teams to take swift action in addressing security issues + Pushing Findings Directly to Product Teams Cons: + - Increases the workload on product teams, potentially leading to frustration difficultyOfImplementation: knowledge: 2 time: 2 - resources: 1 + resources: 2 usefulness: 3 - level: 2 + level: 3 + dependsOn: [] implementation: - - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track + - uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 - name: LogParser Jenkins Plugins - tags: [] + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning sprints, + and managing software releases. It offers features for creating and managing + tasks, assigning them to team members, and monitoring progress through customizable + workflows and dashboards. - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo tags: @@ -5431,46 +5331,67 @@ Test and Verification: url: https://github.com/faloker/purify/ description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. references: samm2: - I-DM-A-2 - iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 iso27001-2022: - 5.25 - 5.12 - 5.13 - 5.1 - comments: "" tags: - - none - Treatment of all defects: - uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d - risk: Vulnerabilities with severity low are not visible. - measure: All vulnerabilities are added to the quality gate. + - vulnerability-mgmt + - vmm-measurements + Integration of vulnerability issues into the development process: + uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e + risk: To read console output of the build server to search for vulnerabilities + might be difficult. Also, to check a vulnerability management system might + not be a daily task for a developer. + measure: Vulnerabilities are tracked in the teams issue system (e.g. jira). difficultyOfImplementation: - knowledge: 3 - time: 4 + knowledge: 2 + time: 2 resources: 1 usefulness: 2 - level: 5 - implementation: [] + level: 3 + implementation: + - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side / + client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ references: samm2: - I-DM-A-2 iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific - 16.1.4 - - 12.6.1 + - 16.1.5 + - 16.1.6 iso27001-2022: - - 8.8 + - Not explicitly covered by ISO 27001 - too specific - 5.25 - tags: - - vuln-action - - defect-management + - 5.26 + - 5.27 comments: "" + tags: + - none Treatment of defects per protection requirement: uuid: 2b7cc923-bdaf-43e3-8fb4-a995b7783969 risk: "Not defining the protection requirement of applications can lead to wrong @@ -5536,31 +5457,6 @@ Test and Verification: - vulnerability-mgmt - metrics - vmm-measurements - Treatment of defects with severity high or higher: - uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 - risk: Vulnerabilities with severity high or higher are not visible. - measure: Vulnerabilities with severity high or higher are added to the quality - gate. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 1 - comments: False positive analysis, specially for static analysis, is time consuming. - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - 16.1.4 - - 12.6.1 - iso27001-2022: - - 8.8 - - 5.25 - implementation: [] - tags: - - vuln-action - - defect-management Treatment of defects with severity middle: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. @@ -5633,56 +5529,126 @@ Test and Verification: SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates into CI/CD pipelines. references: samm2: - - I-DM-A-3 + - I-DM-A-3 + iso27001-2017: + - 12.6.1 + - 16.1.3 + - 16.1.4 + - 16.1.5 + - 16.1.6 + iso27001-2022: + - 8.8 + - 6.8 + - 5.25 + - 5.26 + - 5.27 + tags: + - none + Advanced visualization of defects: + uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 + risk: Correlation of the vulnerabilities of different tools to have an overview + of the the overall security level per component/project/team is not given. + measure: Findings are visualized per component/project/team. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 1 + usefulness: 2 + level: 4 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + references: + samm2: + - I-DM-A-3 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + comments: "" + tags: + - none + Reproducible defect tickets: + uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 + risk: Vulnerability descriptions are hard to understand by staff from operations + and development. + measure: Vulnerabilities include the test procedure to give the staff from operations + and development the ability to reproduce vulnerabilities. This enhances the + understanding of vulnerabilities and therefore the fix have a higher quality. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - I-DM-A-2 iso27001-2017: - - 12.6.1 - - 16.1.3 - 16.1.4 - - 16.1.5 - - 16.1.6 + - 8.2.1 + - 8.2.2 + - 8.2.3 iso27001-2022: - - 8.8 - - 6.8 - 5.25 - - 5.26 - - 5.27 + - 5.12 + - 5.13 + - 5.1 + comments: "" tags: - none - Dynamic depth for applications: - Coverage analysis: - uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 - risk: Parts of the service are not still covered by tests. - measure: Check that there are no missing paths in the application with coverage-tools. + Treatment of all defects: + uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d + risk: Vulnerabilities with severity low are not visible. + measure: All vulnerabilities are added to the quality gate. difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 3 - usefulness: 4 + knowledge: 3 + time: 4 + resources: 1 + usefulness: 2 level: 5 - implementation: - - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 - name: OWASP Code Pulse - tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse - - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 - name: Coverage.py - tags: - - testing - - coverage - url: https://github.com/nedbat/coveragepy - description: | - Code coverage measurement for Python + implementation: [] references: samm2: - - V-ST-A-2 + - I-DM-A-2 iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - - part of periodic review, PDCA + - 16.1.4 + - 12.6.1 iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" + - 8.8 + - 5.25 tags: - - none + - vuln-action + - defect-management + comments: "" + Dynamic depth for applications: Coverage of client side dynamic components: uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e risk: Parts of the service are not covered during the scan, because JavaScript @@ -5715,6 +5681,81 @@ Test and Verification: comments: "" tags: - none + Simple Scan: + uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 + risk: Deficient security tests are performed. Simple vulnerabilities are not + detected and missing security configurations (e.g. headers) are not set. Fast + feedback is not given. + measure: A simple scan is performed to get a security baseline. In case the + test is done in under 10 minutes, it should be part of the build and deployment + process. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 1 + level: 2 + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + implementation: + - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + comments: "" + tags: + - none + Usage of different roles: + uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 + risk: Parts of the service are not covered during the scan, because a login + is not performed. + measure: Integration of authentication with all roles used in the service. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 2 + level: 2 + dependsOn: + - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + implementation: + - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + assessment: For REST APIs, multiple OAuth2 scopes are used. + comments: "" + tags: + - none Coverage of hidden endpoints: uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 risk: Hidden endpoints of the service are not getting tracked. @@ -5811,130 +5852,22 @@ Test and Verification: resources: 1 usefulness: 5 level: 3 - implementation: - - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 14.2.8 - - 14.2.3 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - Coverage of service to service communication: - uuid: 22aab0ef-76ce-4b8c-979c-3699784330db - risk: Service to service communication is not covered. - measure: Service to service communication is dumped and checked. - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 2 - usefulness: 3 - level: 5 - dependsOn: - - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - implementation: - - uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 - name: Citrus Fresh Integration Testing - tags: - - framework - - testing - url: https://citrusframework.org/ - description: Integration Test framework with focus on messaging applications - and Microservices. - comments: "" - tags: - - none - Simple Scan: - uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 - risk: Deficient security tests are performed. Simple vulnerabilities are not - detected and missing security configurations (e.g. headers) are not set. Fast - feedback is not given. - measure: A simple scan is performed to get a security baseline. In case the - test is done in under 10 minutes, it should be part of the build and deployment - process. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 1 - level: 2 - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - implementation: - - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 - name: Arachni - url: https://github.com/Arachni/arachni - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - Usage of different roles: - uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 - risk: Parts of the service are not covered during the scan, because a login - is not performed. - measure: Integration of authentication with all roles used in the service. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 2 - level: 2 + implementation: + - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ dependsOn: - - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-ST-A-2 iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - - 14.2.3 - 14.2.8 + - 14.2.3 iso27001-2022: - 8.32 - 8.29 - implementation: - - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 - name: Zest - url: https://www.zaproxy.org/docs/desktop/addons/zest/ - tags: - - zap - description: | - Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - assessment: For REST APIs, multiple OAuth2 scopes are used. comments: "" tags: - none @@ -5973,34 +5906,74 @@ Test and Verification: comments: "" tags: - none - Dynamic depth for infrastructure: - Load tests: - uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd - risk: As it is unknown how many requests the systems and applications can serve, - due to an unexpected load the availability is disturbed. - measure: Load test against the production system or a production near system - is performed. + Coverage analysis: + uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 + risk: Parts of the service are not still covered by tests. + measure: Check that there are no missing paths in the application with coverage-tools. difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 5 + knowledge: 4 + time: 5 + resources: 3 + usefulness: 4 + level: 5 + implementation: + - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + - part of periodic review, PDCA + iso27001-2022: + - ISO 27001:2022 mapping is missing + comments: "" + tags: + - none + Coverage of service to service communication: + uuid: 22aab0ef-76ce-4b8c-979c-3699784330db + risk: Service to service communication is not covered. + measure: Service to service communication is dumped and checked. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 2 usefulness: 3 - level: 4 - implementation: [] + level: 5 + dependsOn: + - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan references: samm2: - - V-RT-AB-1 + - V-ST-A-2 iso27001-2017: - - 12.1.3 - 14.2.3 - 14.2.8 iso27001-2022: - - 8.6 - 8.32 - 8.29 + implementation: + - uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 + name: Citrus Fresh Integration Testing + tags: + - framework + - testing + url: https://citrusframework.org/ + description: Integration Test framework with focus on messaging applications + and Microservices. comments: "" tags: - none + Dynamic depth for infrastructure: Test for exposed services: uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 risk: Standard network segmentation and firewalling has not been performed, @@ -6041,6 +6014,85 @@ Test and Verification: comments: "" tags: - none + Test network segmentation: + uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 + risk: Wrong or no network segmentation of pods makes it easier for an attacker + to access a database and extract or modify data. + measure: Cluster internal test needs to be performed. Integration of fine granulated + network segmentation (also between pods in the same namespace). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + dependsOn: + - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments + + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + comments: "" + tags: + - none + Test of the configuration of cloud environments: + uuid: 7bb70764-9392-4462-935d-e55b2e148199 + risk: Standard hardening practices for cloud environments are not performed + leading to vulnerabilities. + measure: With the help of tools the configuration of virtual environments are + tested. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + - uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + references: + samm2: [] + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + comments: "" + tags: + - none Test for unauthorized installation: uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a risk: Unapproved components are used. @@ -6073,66 +6125,87 @@ Test and Verification: components tags: - none - Test for unused Resources: - uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 - risk: Unused resources, specially secrets, might be still valid, but are exposing - information. As an attacker, I compromise a system, gather credentials and - try to use them. - measure: Test for unused resources helps to identify unused resources. + Weak password test: + uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f + risk: Weak passwords in components like applications or systems, specially for + privileged accounts, lead to take over of that account. + measure: Automatic brute force attacks are performed. Specially the usage of + standard accounts like 'admin' and employee user-ids is recommended. difficultyOfImplementation: - knowledge: 1 + knowledge: 2 time: 1 resources: 1 - usefulness: 2 - level: 5 + usefulness: 1 + level: 3 implementation: - - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 - name: K8sPurger + - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ references: samm2: - - V-ST-A-1 + - V-ST-A-2 iso27001-2017: - - 13.1.3 + - 9.4.3 + iso27001-2022: + - 5.17 + comments: "" + tags: + - none + Load tests: + uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd + risk: As it is unknown how many requests the systems and applications can serve, + due to an unexpected load the availability is disturbed. + measure: Load test against the production system or a production near system + is performed. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 5 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - V-RT-AB-1 + iso27001-2017: + - 12.1.3 - 14.2.3 - 14.2.8 iso27001-2022: - - 8.22 + - 8.6 - 8.32 - 8.29 comments: "" tags: - none - Test network segmentation: - uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 - risk: Wrong or no network segmentation of pods makes it easier for an attacker - to access a database and extract or modify data. - measure: Cluster internal test needs to be performed. Integration of fine granulated - network segmentation (also between pods in the same namespace). + Test for unused Resources: + uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 + risk: Unused resources, specially secrets, might be still valid, but are exposing + information. As an attacker, I compromise a system, gather credentials and + try to use them. + measure: Test for unused resources helps to identify unused resources. difficultyOfImplementation: - knowledge: 2 - time: 2 + knowledge: 1 + time: 1 resources: 1 - usefulness: 3 - level: 2 + usefulness: 2 + level: 5 implementation: - - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c - name: netassert - tags: [] - url: https://github.com/controlplaneio/netassert - dependsOn: - - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments - + - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. references: samm2: - - V-ST-A-2 + - V-ST-A-1 iso27001-2017: - 13.1.3 - 14.2.3 @@ -6144,80 +6217,163 @@ Test and Verification: comments: "" tags: - none - Test of the configuration of cloud environments: - uuid: 7bb70764-9392-4462-935d-e55b2e148199 - risk: Standard hardening practices for cloud environments are not performed - leading to vulnerabilities. - measure: With the help of tools the configuration of virtual environments are - tested. + Static depth for applications: + Software Composition Analysis (server side): + uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + description: Use a tool like trivy and concentrate on application related vulnerabilities. + At this stage, ignore vulnerabilities in container base images used in the + service. + risk: Server side components might have vulnerabilities. + measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) + are performed. difficultyOfImplementation: - knowledge: 2 - time: 2 + knowledge: 1 + time: 3 resources: 1 - usefulness: 4 + usefulness: 5 level: 2 + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: - - uuid: 893d9f37-2142-4490-996c-e43b55064d3d - name: kubescape - url: https://github.com/armosec/kubescape + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check tags: - - kubernetes + - OpenSource + - Supply Chain - vulnerability - - misconfiguration - description: _Testing if Kubernetes is deployed securely as defined in Kubernetes - Hardening Guidance by to NSA and CISA_ - - uuid: 2af7204c-a25c-4625-9775-889978386407 - name: kube-hunter + url: https://owasp.org/www-project-dependency-check/ + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js tags: [] - url: https://github.com/aquasecurity/kube-hunter - - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f - name: openVAS + url: https://github.com/RetireJS/retire.js/ + - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit tags: [] - url: https://www.openvas.org/ + url: https://docs.npmjs.com/cli/audit + - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy references: - samm2: [] + samm2: + - V-ST-A-2 + - I-SB-B-2 iso27001-2017: - - System hardening is not explicitly covered by ISO 27001 - too specific - 12.6.1 - - 14.2.3 - - 14.2.8 iso27001-2022: - - System hardening is not explicitly covered by ISO 27001 - too specific - 8.8 - - 8.32 - - 8.29 + tags: + - vmm-testing + Test for Time to Patch: + uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f + risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities + in production artifacts. + measure: |- + Test of the Time to Patch (e.g. based on Mean Time to Close automatic PRs) + This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + dependsOn: + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 comments: "" + meta: + implementationGuide: Usage of a version control platform API (e.g. github + API) can be used to fetch the information. Consider that `Measure libyears` + might be an alternative to this activity. tags: - - none - Weak password test: - uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f - risk: Weak passwords in components like applications or systems, specially for - privileged accounts, lead to take over of that account. - measure: Automatic brute force attacks are performed. Specially the usage of - standard accounts like 'admin' and employee user-ids is recommended. + - patching + Test libyear: + uuid: 87b54313-fafd-4860-930f-5ef132b3e4ad + risk: Vulnerabilities in running artifacts stay for long and might get exploited. + measure: Test `libyear`, which provides a good insight how good patch management + is. difficultyOfImplementation: - knowledge: 2 + knowledge: 1 time: 1 resources: 1 - usefulness: 1 - level: 3 + usefulness: 3 + level: 2 implementation: - - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce - name: HTC Hydra + - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 + name: libyear tags: - - password - url: https://www.htc-cs.com/en/products/htc-hydra/ + - patching + - build + url: https://libyear.com/ + description: A simple measure of software dependency freshness. It is a single + number telling you how up-to-date your dependencies are. + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 iso27001-2017: - - 9.4.3 + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 iso27001-2022: - - 5.17 + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 comments: "" + meta: + implementationGuide: | + `libyear` can be integrated into the build process and flag or even better break the build in case the defined threshold (e.g. 30 years) is reached. + An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). tags: - - none - Static depth for applications: + - patching API design validation: uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 risk: Creation of insecure or non-compliant API. @@ -6246,86 +6402,25 @@ Test and Verification: name: API OAS Checker tags: - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.25 - - 8.27 - - 8.28 - dependsOn: - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - - tags: - - none - Dead code elimination: - uuid: a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d - risk: Dead code increases the attack surface (use of hard coded credentials - and variables, sensitive information) - measure: Collection of unused code and then manual removal of unused code. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 5 - implementation: - - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 - comments: "" - tags: - - none - Exclusion of source code duplicates: - uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 - risk: Duplicates in source code might influence the stability of the application. - measure: Automatic Detection and manual removal of duplicates in source code. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 5 - implementation: - - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. references: samm2: - - V-ST-A-2 + - V-ST-A-1 iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - 14.2.1 - 14.2.5 iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 - comments: "" + - 8.28 + dependsOn: + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + tags: - none Exploit likelihood estimation: @@ -6480,117 +6575,18 @@ Test and Verification: comments: "" tags: - none - Software Composition Analysis (server side): - uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe - description: Use a tool like trivy and concentrate on application related vulnerabilities. - At this stage, ignore vulnerabilities in container base images used in the - service. - risk: Server side components might have vulnerabilities. - measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) - are performed. - difficultyOfImplementation: - knowledge: 1 - time: 3 - resources: 1 - usefulness: 5 - level: 2 - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - - implementation: - - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - references: - samm2: - - V-ST-A-2 - - I-SB-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - tags: - - vmm-testing - Static analysis for all components/libraries: - uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 - risk: Used components like libraries and legacy applications might have vulnerabilities - measure: Usage of a static analysis for all used components. - difficultyOfImplementation: - knowledge: 2 - time: 4 - resources: 2 - usefulness: 3 - level: 5 - dependsOn: - - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client - side components - - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server - side components - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - - implementation: [] - references: - samm2: - - V-ST-A-2 - - I-SB-B-3 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Static analysis for all self written components: - uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 - risk: Parts in the source code of the frontend or middleware have vulnerabilities. - measure: Usage of static analysis tools for all parts of the middleware and - frontend. Static analysis uses for example string matching algorithms and/or + Static analysis for important client side components: + uuid: e237176b-bec5-447d-a926-e37d6dd60e4b + risk: Important parts in the source code of the frontend have vulnerabilities. + measure: Usage of static analysis tools for important parts of the frontend + are used. Static analysis uses for example string matching algorithms and/or dataflow analysis. difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 - usefulness: 4 - level: 4 + usefulness: 3 + level: 3 implementation: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b name: eslint @@ -6603,6 +6599,11 @@ Test and Verification: name: jsprime tags: [] url: https://github.com/dpnishant/jsprime + - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 name: Fortify Extension for Visual Studio Code url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code @@ -6622,16 +6623,12 @@ Test and Verification: - ide - sast dependsOn: - - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client - side components - - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server - side components + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components references: samm2: - V-ST-A-2 - - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -6639,17 +6636,17 @@ Test and Verification: comments: "" tags: - none - Static analysis for important client side components: - uuid: e237176b-bec5-447d-a926-e37d6dd60e4b - risk: Important parts in the source code of the frontend have vulnerabilities. - measure: Usage of static analysis tools for important parts of the frontend + Static analysis for important server side components: + uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 + risk: Important parts in the source code of the middleware have vulnerabilities. + measure: Usage of static analysis tools for important parts of the middleware are used. Static analysis uses for example string matching algorithms and/or dataflow analysis. difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 - usefulness: 3 + usefulness: 4 level: 3 implementation: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b @@ -6663,11 +6660,6 @@ Test and Verification: name: jsprime tags: [] url: https://github.com/dpnishant/jsprime - - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 name: Fortify Extension for Visual Studio Code url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code @@ -6693,6 +6685,7 @@ Test and Verification: references: samm2: - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - 12.6.1 iso27001-2022: @@ -6700,18 +6693,56 @@ Test and Verification: comments: "" tags: - none - Static analysis for important server side components: - uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 - risk: Important parts in the source code of the middleware have vulnerabilities. - measure: Usage of static analysis tools for important parts of the middleware - are used. Static analysis uses for example string matching algorithms and/or + Test for Patch Deployment Time: + uuid: 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 + risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities + in production artifacts. + measure: | + Test of the Patch Deployment Time. + This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + comments: "" + meta: + implementationGuide: Self implementation. This activity is not repeated in + the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure + as well. + tags: + - patching + Static analysis for all self written components: + uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 + risk: Parts in the source code of the frontend or middleware have vulnerabilities. + measure: Usage of static analysis tools for all parts of the middleware and + frontend. Static analysis uses for example string matching algorithms and/or dataflow analysis. difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 usefulness: 4 - level: 3 + level: 4 implementation: - uuid: 6a0948a7-4781-4858-9766-f4303971b28b name: eslint @@ -6743,58 +6774,45 @@ Test and Verification: - ide - sast dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - - references: - samm2: - - V-ST-A-2 - - I-SB-B-3 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Stylistic analysis: - uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 - risk: Unclear or obfuscated code might have unexpected behavior. - measure: Analysis of compliance to style guides of the source code ensures that - source code formatting rules are met (e.g. indentation, loops, ...). - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 5 - implementation: - - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f - name: Super-Linter - tags: - - linting - - scm - url: https://github.com/github/super-linter - description: | - Lint code bases to catch common errors and enforce code style + - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client + side components + - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server + side components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + references: samm2: - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + comments: "" + tags: + - none + Usage of multiple analyzers: + uuid: 297be001-8d94-41ee-ab29-207020d423c0 + risk: Each vulnerability analyzer has different opportunities. By using just + one analyzer, some vulnerabilities might not be found. + measure: Usage of multiple static tools to find more vulnerabilities. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 1 + level: 4 + dependsOn: + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server + side) + - 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 # Software Composition Analysis (client + side) + - ee68331f-9b1d-4f61-844b-b2ea04753a84 # Static analysis for all self written + components + implementation: [] + references: + samm2: + - V-ST-A-3 iso27001-2017: - 12.6.1 - 14.2.1 @@ -6806,25 +6824,22 @@ Test and Verification: comments: "" tags: - none - Test for Patch Deployment Time: - uuid: 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 - risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities - in production artifacts. - measure: | - Test of the Patch Deployment Time. - This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. + Dead code elimination: + uuid: a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d + risk: Dead code increases the attack surface (use of hard coded credentials + and variables, sensitive information) + measure: Collection of unused code and then manual removal of unused code. difficultyOfImplementation: - knowledge: 2 - time: 2 + knowledge: 1 + time: 1 resources: 1 - usefulness: 3 - level: 3 + usefulness: 1 + level: 5 implementation: - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb name: PMD tags: [] dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: @@ -6838,40 +6853,24 @@ Test and Verification: - 8.25 - 8.27 comments: "" - meta: - implementationGuide: Self implementation. This activity is not repeated in - the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure - as well. tags: - - patching - Test for Time to Patch: - uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f - risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities - in production artifacts. - measure: |- - Test of the Time to Patch (e.g. based on Mean Time to Close automatic PRs) - This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. + - none + Exclusion of source code duplicates: + uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + risk: Duplicates in source code might influence the stability of the application. + measure: Automatic Detection and manual removal of duplicates in source code. difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 - usefulness: 3 - level: 2 + usefulness: 1 + level: 5 implementation: - - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -6884,74 +6883,75 @@ Test and Verification: - 8.25 - 8.27 comments: "" - meta: - implementationGuide: Usage of a version control platform API (e.g. github - API) can be used to fetch the information. Consider that `Measure libyears` - might be an alternative to this activity. tags: - - patching - Test libyear: - uuid: 87b54313-fafd-4860-930f-5ef132b3e4ad - risk: Vulnerabilities in running artifacts stay for long and might get exploited. - measure: Test `libyear`, which provides a good insight how good patch management - is. + - none + Static analysis for all components/libraries: + uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 + risk: Used components like libraries and legacy applications might have vulnerabilities + measure: Usage of a static analysis for all used components. difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 + knowledge: 2 + time: 4 + resources: 2 usefulness: 3 - level: 2 - implementation: - - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a single - number telling you how up-to-date your dependencies are. + level: 5 dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client + side components + - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server + side components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + + implementation: [] references: samm2: - V-ST-A-2 + - I-SB-B-3 iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 + - 12.6.1 iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 + - 8.8 comments: "" - meta: - implementationGuide: | - `libyear` can be integrated into the build process and flag or even better break the build in case the defined threshold (e.g. 30 years) is reached. - An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). tags: - - patching - Usage of multiple analyzers: - uuid: 297be001-8d94-41ee-ab29-207020d423c0 - risk: Each vulnerability analyzer has different opportunities. By using just - one analyzer, some vulnerabilities might not be found. - measure: Usage of multiple static tools to find more vulnerabilities. + - none + Stylistic analysis: + uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 + risk: Unclear or obfuscated code might have unexpected behavior. + measure: Analysis of compliance to style guides of the source code ensures that + source code formatting rules are met (e.g. indentation, loops, ...). difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 + knowledge: 1 + time: 1 + resources: 1 usefulness: 1 - level: 4 - dependsOn: - - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server - side) - - 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 # Software Composition Analysis (client - side) - - ee68331f-9b1d-4f61-844b-b2ea04753a84 # Static analysis for all self written - components - implementation: [] + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + - uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style references: samm2: - - V-ST-A-3 + - V-ST-A-2 iso27001-2017: - 12.6.1 - 14.2.1 @@ -6964,92 +6964,71 @@ Test and Verification: tags: - none Static depth for infrastructure: - Correlate known vulnerabilities in infrastructure with new image versions: - uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 - risk: TODO. - measure: TODO + Test for stored secrets in build artifacts: + uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f + risk: Stored secrets in container images or other build artifacts shouldn't + exists because they might be exposed to unauthorized parties. + measure: Test for secrets in container images and other artifacts difficultyOfImplementation: knowledge: 2 - time: 5 - resources: 4 - usefulness: 1 - level: 4 - dependsOn: - - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for - images + time: 1 + resources: 2 + usefulness: 2 + level: 1 implementation: - - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog tags: [] - url: https://www.open-scap.org/ - - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries tags: [] - url: https://github.com/future-architect/vuls + url: https://github.com/nccgroup/go-pillage-registries references: samm2: - V-ST-A-1 iso27001-2017: - - 12.6.1 - - 14.2.1 + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 iso27001-2022: - - 8.8 - - 8.25 + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 comments: "" tags: - - none - Software Composition Analysis: - uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad - risk: Known vulnerabilities in infrastructure components like container images - might get exploited. - measure: Check for known vulnerabilities + - none + Test for stored secrets in code: + uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c + risk: Stored secrets in git history or directly in code shouldn't exists because + they might be exposed to unauthorized parties. + measure: Test for secrets in code and git history difficultyOfImplementation: knowledge: 2 time: 1 - resources: 1 - usefulness: 4 - level: 4 - description: Subscribing to Github projects and reading release notes might - help. Software Composition Analysis for infrastructure might help, but is - often too fine-granular. + resources: 2 + usefulness: 2 + level: 1 implementation: - - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog tags: [] - url: https://github.com/aquasecurity/trivy - - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory + url: https://github.com/nccgroup/go-pillage-registries references: samm2: - - V-ST-A-2 + - V-ST-A-1 iso27001-2017: - - 12.6.1 + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 iso27001-2022: - - 8.8 + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 comments: "" tags: - none @@ -7123,6 +7102,129 @@ Test and Verification: comments: "" tags: - none + Test of virtualized environments: + uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 + risk: Virtualized environments (e.g. via Container Images) might contains + unsecure configurations. + measure: Test virtualized environments for unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + comments: "" + tags: + - none + Test the cloud configuration: + uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc + risk: Standard hardening practices for cloud environments are not performed + leading to vulnerabilities. + measure: With the help of tools, the configuration of virtual environments are + tested. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + comments: "" + tags: + - none + Test the definition of virtualized environments: + uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e + risk: The definition of virtualized environments (e.g. via Dockerfile) + might contain unsecure configurations. + measure: Test the definition of virtualized environments for unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + meta: + implementationGuide: For containier (images), test that the images are following + best practices like distroless or non-root. + implementation: + - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile and + looks for common traps, mistakes and helps enforce best practices. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - System hardening, virtual environments are not explicitly covered by ISO + 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + - 14.2.1 + iso27001-2022: + - System hardening, virtual environments are not explicitly covered by ISO + 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + - 8.25 + tags: + - none Test for malware: uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d risk: Third party might include malware. Ether due to the maintainer (e.g. @@ -7185,86 +7287,14 @@ Test and Verification: comments: "" tags: - none - Test for stored secrets in build artifacts: - uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f - risk: Stored secrets in container images or other build artifacts shouldn't - exists because they might be exposed to unauthorized parties. - measure: Test for secrets in container images and other artifacts - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 2 - level: 1 - implementation: - - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - vcs usage is not explicitly covered by ISO 27001 - too specific - - 9.4.3 - - 10.1.2 - iso27001-2022: - - vcs usage is not explicitly covered by ISO 27001 - too specific - - 5.17 - - 8.24 - comments: "" - tags: - - none - Test for stored secrets in code: - uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c - risk: Stored secrets in git history or directly in code shouldn't exists because - they might be exposed to unauthorized parties. - measure: Test for secrets in code and git history - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 2 - level: 1 - implementation: - - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - vcs usage is not explicitly covered by ISO 27001 - too specific - - 9.4.3 - - 10.1.2 - iso27001-2022: - - vcs usage is not explicitly covered by ISO 27001 - too specific - - 5.17 - - 8.24 - comments: "" - tags: - - none - Test of infrastructure components for known vulnerabilities: - uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 - risk: Infrastructure components might have vulnerabilities. - measure: Test for known vulnerabilities in infrastructure components. Often, - the only way to respond to known vulnerabilities in operating system packages - is to accept the risk and wait for a patch. As the patch needs to be applied - fast when it is available, this activity depends on 'Usage of a maximum life - for images'. + Correlate known vulnerabilities in infrastructure with new image versions: + uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 + risk: TODO. + measure: TODO difficultyOfImplementation: knowledge: 2 time: 5 - resources: 2 + resources: 4 usefulness: 1 level: 4 dependsOn: @@ -7299,158 +7329,150 @@ Test and Verification: comments: "" tags: - none - Test of virtualized environments: - uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 - risk: Virtualized environments (e.g. via Container Images) might contains - unsecure configurations. - measure: Test virtualized environments for unsecured configurations. + Software Composition Analysis: + uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad + risk: Known vulnerabilities in infrastructure components like container images + might get exploited. + measure: Check for known vulnerabilities difficultyOfImplementation: knowledge: 2 time: 1 - resources: 2 - usefulness: 3 - level: 2 + resources: 1 + usefulness: 4 + level: 4 + description: Subscribing to Github projects and reading release notes might + help. Software Composition Analysis for infrastructure might help, but is + often too fine-granular. implementation: - - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 - name: Dive to inspect a container images + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy tags: [] - url: https://github.com/wagoodman/dive - - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner + url: https://github.com/aquasecurity/trivy + - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track tags: - - docker - - image - - container + - sca + - inventory + - OpenSource + - Supply Chain - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. + - inventory references: samm2: - - V-ST-A-1 + - V-ST-A-2 iso27001-2017: - - ISO 27001:2017 mapping is missing + - 12.6.1 iso27001-2022: - - ISO 27001:2022 mapping is missing + - 8.8 comments: "" tags: - none - Test the cloud configuration: - uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc - risk: Standard hardening practices for cloud environments are not performed - leading to vulnerabilities. - measure: With the help of tools, the configuration of virtual environments are - tested. + Test of infrastructure components for known vulnerabilities: + uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 + risk: Infrastructure components might have vulnerabilities. + measure: Test for known vulnerabilities in infrastructure components. Often, + the only way to respond to known vulnerabilities in operating system packages + is to accept the risk and wait for a patch. As the patch needs to be applied + fast when it is available, this activity depends on 'Usage of a maximum life + for images'. difficultyOfImplementation: knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 2 + time: 5 + resources: 2 + usefulness: 1 + level: 4 + dependsOn: + - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for + images implementation: - - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 - name: kube-bench + - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io tags: [] - url: https://github.com/aquasecurity/kube-bench + url: https://anchore.com/ + - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls references: samm2: - V-ST-A-1 iso27001-2017: - - System hardening is not explicitly covered by ISO 27001 - too specific - 12.6.1 - - 14.2.3 - - 14.2.8 + - 14.2.1 iso27001-2022: - - System hardening is not explicitly covered by ISO 27001 - too specific - 8.8 - - 8.32 - - 8.29 + - 8.25 comments: "" tags: - none - Test the definition of virtualized environments: - uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e - risk: The definition of virtualized environments (e.g. via Dockerfile) - might contain unsecure configurations. - measure: Test the definition of virtualized environments for unsecured configurations. + Test-Intensity: + Default settings for intensity: + uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d + risk: Time pressure and ignorance might lead to false predictions for the test + intensity. + measure: The intensity of the used tools are not modified to save time. difficultyOfImplementation: - knowledge: 2 + knowledge: 1 time: 1 - resources: 2 - usefulness: 3 - level: 2 - meta: - implementationGuide: For containier (images), test that the images are following - best practices like distroless or non-root. - implementation: - - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 - name: Dockerfile with hadolint - tags: [] - url: https://github.com/hadolint/hadolint - - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b - name: Deployment with kube-score - tags: [] - url: https://github.com/zegl/kube-score - - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 - name: dockerfilelint - tags: - - sast - - docker - - dockerfile - url: https://github.com/replicatedhq/dockerfilelint - description: dockerfilelint is an node module that analyzes a Dockerfile and - looks for common traps, mistakes and helps enforce best practices. + resources: 1 + usefulness: 1 + level: 1 + implementation: [] references: samm2: - V-ST-A-1 iso27001-2017: - - System hardening, virtual environments are not explicitly covered by ISO - 27001 - too specific - 12.6.1 - - 14.2.3 - - 14.2.8 - 14.2.1 + - 14.2.5 iso27001-2022: - - System hardening, virtual environments are not explicitly covered by ISO - 27001 - too specific - 8.8 - - 8.32 - - 8.29 - 8.25 + - 8.27 + comments: "" tags: - none - Test-Intensity: - Creation and application of a testing concept: - uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe - risk: Scans might use a too small or too high test intensity. - measure: A testing concept considering the amount of time per scan/intensity - is created and applied. A dynamic analysis needs more time than a static analysis. - The dynamic scan, depending on the test intensity might be performed on every - commit, every night, every week or once in a month. + Regular automated tests: + uuid: 598897a2-358e-441f-984c-e12ec4f6110a + risk: After pushing source code to the version control system, any delay in + receiving feedback on defects makes them harder for the developer to remediate. + measure: On each push and/or at given intervals automatic security tests are + performed. difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 + knowledge: 1 + time: 1 + resources: 1 usefulness: 2 - level: 4 + level: 2 implementation: [] references: samm2: - - V-ST-A-2 + - I-SB-A-3 + - V-ST-A-3 iso27001-2017: - - 14.2.2 - 14.2.3 - - 14.2.1 - - 14.2.5 - - 12.6.1 + - 14.2.8 + - 14.2.9 iso27001-2022: - - 8.25 - 8.32 - - 8.27 - - 8.8 + - 8.29 comments: "" tags: - none @@ -7483,32 +7505,6 @@ Test and Verification: comments: "" tags: - none - Default settings for intensity: - uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d - risk: Time pressure and ignorance might lead to false predictions for the test - intensity. - measure: The intensity of the used tools are not modified to save time. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 1 - implementation: [] - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 12.6.1 - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.25 - - 8.27 - comments: "" - tags: - - none High test intensity: uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 risk: A too small intensity or a too high confidence might lead to not visible @@ -7536,30 +7532,34 @@ Test and Verification: comments: "" tags: - none - Regular automated tests: - uuid: 598897a2-358e-441f-984c-e12ec4f6110a - risk: After pushing source code to the version control system, any delay in - receiving feedback on defects makes them harder for the developer to remediate. - measure: On each push and/or at given intervals automatic security tests are - performed. + Creation and application of a testing concept: + uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe + risk: Scans might use a too small or too high test intensity. + measure: A testing concept considering the amount of time per scan/intensity + is created and applied. A dynamic analysis needs more time than a static analysis. + The dynamic scan, depending on the test intensity might be performed on every + commit, every night, every week or once in a month. difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 + knowledge: 3 + time: 3 + resources: 3 usefulness: 2 - level: 2 + level: 4 implementation: [] references: samm2: - - I-SB-A-3 - - V-ST-A-3 + - V-ST-A-2 iso27001-2017: + - 14.2.2 - 14.2.3 - - 14.2.8 - - 14.2.9 + - 14.2.1 + - 14.2.5 + - 12.6.1 iso27001-2022: + - 8.25 - 8.32 - - 8.29 + - 8.27 + - 8.8 comments: "" tags: - none From a7b2e6056a2cf4e615e142ab7c3c797d60429630 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Tue, 25 Nov 2025 21:11:11 +0100 Subject: [PATCH 140/370] Fix: dependsOn comment --- yaml-generation/generateDimensions.php | 20 ++++++++++---------- 1 file changed, 10 insertions(+), 10 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index c50d95a..a45d121 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -110,7 +110,7 @@ } } // Trick emit_yaml() to have uuid plus a comment in a string. Removed in post-processing below. - $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = "{ $dependsOnUuid # $dependsOnName }"; + $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = "{!$dependsOnUuid!}"; // Build dependency graph @@ -156,17 +156,17 @@ } -// Store generated data +// Post-process to add activity name as comment for `dependsOn` $dimensionsString = yaml_emit($dimensionsAggregated); +preg_match_all('/\{!([0-9a-z-]{30,})!\}/', $dimensionsString, $matches); +$uuids = array_unique($matches[1]); +foreach ($uuids as $uuid) { + $name = getActivityNameByUuid($uuid, $dimensionsAggregated); + // echo "Adding dependsOn-comment for $uuid: $name\n"; + $dimensionsString = str_replace("'{!$uuid!}'", "$uuid # $name", $dimensionsString); +} -// Post-process to convert quoted UUID comments to inline comments -// Pattern: `- '{ uuid #comment }'` becomes: `- uuid #comment` -$dimensionsString = preg_replace( - "/^(\s+- )'{\s*([0-9a-f-]+)\s+(#[^'}]*)\s*}'$/m", - "$1$2 $3", - $dimensionsString -); - +// Store generated data $targetGeneratedFile = getcwd() . "/src/assets/YAML/generated/generated.yaml"; echo "\nStoring to $targetGeneratedFile\n"; file_put_contents($targetGeneratedFile, $dimensionsString); From fad557a63cba9ea85a0039c20565198c6f162201 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 30 Nov 2025 15:17:51 +0100 Subject: [PATCH 141/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 247 ++++++++++------------- 1 file changed, 102 insertions(+), 145 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 53dd981..2cda5da 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -133,7 +133,7 @@ Build and Deployment: description: Immutable images are an other way, e.g. by using a registry, which doesn't allow overriding of images. dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - I-SB-B-1 @@ -155,7 +155,7 @@ Build and Deployment: measure: Creation of an SBOM of components (e.g. application and container image content) during build. dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process difficultyOfImplementation: knowledge: 2 time: 2 @@ -202,7 +202,7 @@ Build and Deployment: url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule description: Usage of branch protection rules dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - I-SB-A-2 @@ -248,8 +248,8 @@ Build and Deployment: tags: [] url: https://in-toto.github.io/ dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - - f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 # Pinning of artifacts + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 # Pinning of artifacts references: samm2: - I-SB-A-1 @@ -274,7 +274,7 @@ Build and Deployment: usefulness: 4 level: 1 dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process implementation: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 name: CI/CD tools @@ -306,7 +306,7 @@ Build and Deployment: A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process difficultyOfImplementation: knowledge: 1 time: 1 @@ -476,9 +476,8 @@ Build and Deployment: measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically). dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - difficultyOfImplementation: knowledge: 2 time: 2 @@ -544,8 +543,7 @@ Build and Deployment: level: 3 implementation: "" dependsOn: - - df428c9d-efa0-4226-9f47-a15bb53f822b # Environment depending configuration - parameters (secrets) + - df428c9d-efa0-4226-9f47-a15bb53f822b # Environment depending configuration parameters (secrets) references: samm2: - I-SD-B-2 @@ -574,8 +572,7 @@ Build and Deployment: images and containers exists. dependsOn: - 83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts - - - 2858ac12-0179-40d9-9acf-1b839c030473 # SBOM of components + - 2858ac12-0179-40d9-9acf-1b839c030473 # SBOM of components difficultyOfImplementation: knowledge: 2 time: 2 @@ -651,7 +648,7 @@ Build and Deployment: name: rolling update tags: [] dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process references: samm2: - I-SD-A-2 @@ -685,7 +682,7 @@ Build and Deployment: url: https://github.com/moby/moby tags: [] dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - I-SD-A-2 @@ -729,7 +726,6 @@ Build and Deployment: Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) dependsOn: - a854b48d-83bd-4f8d-8621-a0bdd470837f # Same artifact for environments - references: samm2: - I-SD-A-2 @@ -765,7 +761,7 @@ Build and Deployment: tags: [] url: https://martinfowler.com/bliki/BlueGreenDeployment.html dependsOn: - - 73aaae0b-5d68-4953-9fa4-fd25bf665f2a # Smoke Test + - 73aaae0b-5d68-4953-9fa4-fd25bf665f2a # Smoke Test references: samm2: - I-SD-A-3 @@ -877,7 +873,7 @@ Build and Deployment: usefulness: 3 level: 2 dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches implementation: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 name: dependabot @@ -1026,7 +1022,6 @@ Build and Deployment: level: 3 dependsOn: - f2594f8f-1cd6-45f9-af29-eaf3315698eb # Automated merge of automated PRs - implementation: - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 name: terraform @@ -1292,10 +1287,8 @@ Culture and Organization: and [Practical Security Stories and Security Tasks for Agile Development Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' dependsOn: - - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling - on technical level - - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes - and standards + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level + - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes and standards references: samm2: - D-TA-B-2 @@ -1344,8 +1337,7 @@ Culture and Organization: - defender url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ dependsOn: - - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling - on technical level + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level references: samm2: - D-TA-B-3 @@ -1375,10 +1367,8 @@ Culture and Organization: usefulness: 3 level: 4 dependsOn: - - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling - on technical level - - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes - and standards + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level + - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes and standards description: | **Example High Maturity Scenario:** @@ -1474,7 +1464,6 @@ Culture and Organization: level: 5 dependsOn: - bacf85b6-5bc0-405d-b5ba-a5d971467cc1 # Creation of simple abuse stories - implementation: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 name: Don't Forget EVIL User stories @@ -1679,7 +1668,6 @@ Culture and Organization: url: https://cheatsheetseries.owasp.org/ dependsOn: - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion - references: samm2: - D-TA-B-2 @@ -2133,7 +2121,6 @@ Culture and Organization: level: 2 dependsOn: - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -2397,7 +2384,7 @@ Implementation: usefulness: 4 level: 2 dependsOn: - - b597928e-54d6-48a5-a806-8003dcd56aab # App. Hardening Level 1 (50%) + - b597928e-54d6-48a5-a806-8003dcd56aab # App. Hardening Level 1 (50%) description: | To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely. @@ -2533,7 +2520,7 @@ Implementation: - 8.22 comments: "" dependsOn: - - cf819225-30cb-4702-8e32-60225eedc33d # App. Hardening Level 1 + - cf819225-30cb-4702-8e32-60225eedc33d # App. Hardening Level 1 tags: - none Secure headers: @@ -2634,7 +2621,7 @@ Implementation: - 8.22 comments: "" dependsOn: - - 03643ca2-03c2-472b-8e19-956bf02fe9b7 # App. Hardening Level 2 (75%) + - 03643ca2-03c2-472b-8e19-956bf02fe9b7 # App. Hardening Level 2 (75%) tags: - none App. Hardening Level 3: @@ -2672,7 +2659,7 @@ Implementation: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 dependsOn: - - ffe86caf-2fec-4630-b514-2db83983984d # App. Hardening Level 2 + - ffe86caf-2fec-4630-b514-2db83983984d # App. Hardening Level 2 tags: - none Development and Source Control: @@ -2691,7 +2678,7 @@ Implementation: usefulness: 5 level: 1 dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: [] references: samm2: @@ -2766,7 +2753,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -2805,7 +2792,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -2851,7 +2838,7 @@ Implementation: usefulness: 4 level: 3 dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies @@ -2995,7 +2982,7 @@ Implementation: usefulness: 5 level: 1 dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 name: HTTP-Basic Authentication @@ -3085,7 +3072,7 @@ Implementation: name: A Point in Time Recovery for databases should be implemented. tags: [] dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process references: samm2: - TODO @@ -3214,7 +3201,7 @@ Implementation: usefulness: 4 level: 2 dependsOn: - - 8098e416-e1ed-4ae4-a561-83efbe76bf57 # MFA for admins + - 8098e416-e1ed-4ae4-a561-83efbe76bf57 # MFA for admins implementation: - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 name: YubiKey - Smartcard @@ -3301,7 +3288,7 @@ Implementation: usefulness: 4 level: 2 dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: [] references: samm2: @@ -3330,8 +3317,7 @@ Implementation: usefulness: 3 level: 2 dependsOn: - - 3a94d55e-fd82-4996-9eb3-20d23ff2a873 # Applications are running in virtualized - environments + - 3a94d55e-fd82-4996-9eb3-20d23ff2a873 # Applications are running in virtualized environments implementation: [] references: samm2: @@ -3393,7 +3379,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code + - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code implementation: - uuid: b206481f-9c66-45e2-843c-37c5730580cd name: Remove direct access to infrastructure @@ -3469,7 +3455,7 @@ Implementation: usefulness: 5 level: 3 dependsOn: - - 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 # Audit of system events + - 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 # Audit of system events implementation: - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd name: seccomp @@ -3520,8 +3506,8 @@ Implementation: name: Plugins tags: [] dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - O-EM-A-2 @@ -3584,7 +3570,7 @@ Implementation: tags: [] url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - O-EM-A-2 @@ -3619,7 +3605,7 @@ Implementation: usefulness: 3 level: 3 dependsOn: - - e1f37abb-d848-4a3a-b3df-65e91a89dcb7 # Context-aware output encoding + - e1f37abb-d848-4a3a-b3df-65e91a89dcb7 # Context-aware output encoding implementation: [] references: samm2: @@ -3714,8 +3700,8 @@ Implementation: usefulness: 4 level: 4 dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code implementation: [] references: samm2: @@ -3789,7 +3775,7 @@ Implementation: usefulness: 3 level: 4 dependsOn: - - f0e01814-3b88-4bd0-a3a9-f91db001d20b # WAF baseline + - f0e01814-3b88-4bd0-a3a9-f91db001d20b # WAF baseline implementation: [] references: samm2: @@ -3833,7 +3819,7 @@ Implementation: usefulness: 4 level: 5 dependsOn: - - '{ f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium # WAF medium }' + - f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium # WAF medium implementation: [] references: samm2: @@ -3901,7 +3887,7 @@ Information Gathering: usefulness: 5 level: 2 dependsOn: - - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting implementation: [] references: samm2: @@ -4012,9 +3998,8 @@ Information Gathering: usefulness: 4 level: 3 dependsOn: - - 4eced38a-7904-4c45-adb0-50b663065540 # Centralized system logging + - 4eced38a-7904-4c45-adb0-50b663065540 # Centralized system logging - fe875e17-ae4a-45f8-a359-244aa4fcbc04 # Centralized application logging - implementation: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 name: ELK-Stack @@ -4045,8 +4030,8 @@ Information Gathering: usefulness: 3 level: 5 dependsOn: - - 7c735089-6a83-419f-8b27-c1e676cedea1 # Visualized logging - - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting + - 7c735089-6a83-419f-8b27-c1e676cedea1 # Visualized logging + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting implementation: [] references: samm2: @@ -4213,7 +4198,7 @@ Information Gathering: usefulness: 5 level: 2 dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: @@ -4244,8 +4229,8 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics implementation: [] references: samm2: @@ -4268,8 +4253,8 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics implementation: [] references: samm2: @@ -4293,8 +4278,8 @@ Information Gathering: usefulness: 4 level: 3 dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: @@ -4317,7 +4302,7 @@ Information Gathering: usefulness: 4 level: 3 dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 name: Falco @@ -4349,7 +4334,7 @@ Information Gathering: usefulness: 5 level: 3 dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: @@ -4399,7 +4384,7 @@ Information Gathering: usefulness: 5 level: 3 dependsOn: - - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting implementation: [] references: samm2: @@ -4426,8 +4411,8 @@ Information Gathering: usefulness: 4 level: 4 dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: [] references: samm2: @@ -4456,7 +4441,7 @@ Information Gathering: usefulness: 4 level: 4 dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics implementation: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d name: https://ht.transpare @@ -4487,8 +4472,8 @@ Information Gathering: usefulness: 4 level: 4 dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - - 6df508ef-86fc-4c22-bd9f-646c3127ce7d # Filter outgoing traffic + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - 6df508ef-86fc-4c22-bd9f-646c3127ce7d # Filter outgoing traffic implementation: [] references: samm2: @@ -4514,7 +4499,7 @@ Information Gathering: usefulness: 5 level: 4 dependsOn: - - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics + - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics implementation: [] references: samm2: @@ -4539,7 +4524,7 @@ Information Gathering: usefulness: 5 level: 5 dependsOn: - - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics + - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics implementation: [] references: samm2: @@ -4643,7 +4628,7 @@ Information Gathering: usefulness: 3 level: 2 dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches implementation: [] references: samm2: @@ -4728,8 +4713,7 @@ Information Gathering: resources: 1 usefulness: 3 dependsOn: - - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management - system + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system level: 3 implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb @@ -4855,9 +4839,8 @@ Information Gathering: usefulness: 3 level: 4 dependsOn: - - 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution - via PR - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches implementation: [] references: samm2: @@ -4945,7 +4928,7 @@ Test and Verification: level: 4 implementation: [] dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process references: samm2: - V-RT-A-3 @@ -5081,7 +5064,6 @@ Test and Verification: level: 2 dependsOn: - c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment - implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -5210,10 +5192,8 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity - high or higher + - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - implementation: ~ references: samm2: @@ -5253,9 +5233,7 @@ Test and Verification: level: 3 dependsOn: - 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment - - - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management - system + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system implementation: ~ references: samm2: @@ -5494,10 +5472,9 @@ Test and Verification: resources: 2 usefulness: 2 dependsOn: - - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion - - - 185d5a74-19dc-4422-be07-44ea35226783 # Office Hours + - 185d5a74-19dc-4422-be07-44ea35226783 # Office Hours level: 3 description: "For known vulnerabilities a processes to estimate the exploit ability of a vulnerability is recommended.\n\nTo implement a security culture @@ -5663,7 +5640,7 @@ Test and Verification: usefulness: 4 level: 2 dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-ST-A-2 @@ -5696,7 +5673,7 @@ Test and Verification: usefulness: 1 level: 2 dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process implementation: - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 name: OWASP Zap @@ -5733,7 +5710,7 @@ Test and Verification: usefulness: 2 level: 2 dependsOn: - - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan + - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan references: samm2: - V-ST-A-2 @@ -5794,7 +5771,7 @@ Test and Verification: description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-ST-A-2 @@ -5819,7 +5796,7 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-RT-B-1 @@ -5858,7 +5835,7 @@ Test and Verification: tags: [] url: https://curl.se/ dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles references: samm2: - V-ST-A-2 @@ -5884,7 +5861,7 @@ Test and Verification: usefulness: 1 level: 4 dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles implementation: - uuid: f220b299-0917-4750-96c5-d81cd402b4df name: OWASP secureCodeBox @@ -5951,7 +5928,7 @@ Test and Verification: usefulness: 3 level: 5 dependsOn: - - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan + - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan references: samm2: - V-ST-A-2 @@ -5988,7 +5965,6 @@ Test and Verification: resources: 2 dependsOn: - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments - usefulness: 2 level: 2 implementation: @@ -6033,7 +6009,6 @@ Test and Verification: url: https://github.com/controlplaneio/netassert dependsOn: - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments - references: samm2: - V-ST-A-2 @@ -6121,8 +6096,7 @@ Test and Verification: - 8.19 - 8.8 dependsOn: - - 0de465a6-55a7-4343-af79-948bb5ff10ba # Evaluation of the trust of used - components + - 0de465a6-55a7-4343-af79-948bb5ff10ba # Evaluation of the trust of used components tags: - none Weak password test: @@ -6233,9 +6207,8 @@ Test and Verification: usefulness: 5 level: 2 dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - implementation: - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 name: OWASP Dependency Check @@ -6315,7 +6288,7 @@ Test and Verification: - patching url: https://github.com/renovatebot/renovate dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches references: samm2: - V-ST-A-2 @@ -6355,7 +6328,7 @@ Test and Verification: description: A simple measure of software dependency freshness. It is a single number telling you how up-to-date your dependencies are. dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -6420,7 +6393,6 @@ Test and Verification: - 8.28 dependsOn: - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - tags: - none Exploit likelihood estimation: @@ -6438,8 +6410,7 @@ Test and Verification: usefulness: 4 level: 3 dependsOn: - - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server - side) + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server side) implementation: - uuid: aa507341-9531-42cd-95cf-d7b51af47086 name: Known Exploited Vulnerabilities @@ -6529,10 +6500,9 @@ Test and Verification: usefulness: 2 level: 3 dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - - - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation implementation: - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 name: retire.js @@ -6623,9 +6593,8 @@ Test and Verification: - ide - sast dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - references: samm2: - V-ST-A-2 @@ -6679,9 +6648,8 @@ Test and Verification: - ide - sast dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - references: samm2: - V-ST-A-2 @@ -6711,8 +6679,8 @@ Test and Verification: name: PMD tags: [] dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -6774,12 +6742,9 @@ Test and Verification: - ide - sast dependsOn: - - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client - side components - - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server - side components + - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client side components + - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server side components - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - references: samm2: - V-ST-A-2 @@ -6803,12 +6768,9 @@ Test and Verification: usefulness: 1 level: 4 dependsOn: - - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server - side) - - 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 # Software Composition Analysis (client - side) - - ee68331f-9b1d-4f61-844b-b2ea04753a84 # Static analysis for all self written - components + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server side) + - 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 # Software Composition Analysis (client side) + - ee68331f-9b1d-4f61-844b-b2ea04753a84 # Static analysis for all self written components implementation: [] references: samm2: @@ -6840,7 +6802,7 @@ Test and Verification: name: PMD tags: [] dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -6870,7 +6832,7 @@ Test and Verification: name: PMD tags: [] dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - V-ST-A-2 @@ -6896,12 +6858,9 @@ Test and Verification: usefulness: 3 level: 5 dependsOn: - - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client - side components - - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server - side components + - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client side components + - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server side components - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - implementation: [] references: samm2: @@ -7298,8 +7257,7 @@ Test and Verification: usefulness: 1 level: 4 dependsOn: - - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for - images + - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for images implementation: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc name: Anchore.io @@ -7391,8 +7349,7 @@ Test and Verification: usefulness: 1 level: 4 dependsOn: - - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for - images + - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for images implementation: - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc name: Anchore.io From 23b94aad30b0b84b0393421f405095a9d2f44c07 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 30 Nov 2025 17:15:37 +0100 Subject: [PATCH 142/370] Removed unused meta.yaml fetch --- Dockerfile | 2 -- 1 file changed, 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index 471116f..a5be9e1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,8 +10,6 @@ RUN cd /var/www/html/yaml-generation && composer install \ --prefer-dist RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml -RUN curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/main/src/assets/YAML/meta.yaml -o /var/www/html/src/assets/YAML/meta.yaml -RUN echo "test" ; cat /var/www/html/src/assets/YAML/meta.yaml RUN cd /var/www/html && php yaml-generation/generateDimensions.php workdir /var/www/html CMD php yaml-generation/generateDimensions.php From 82deb7af5a8d2f0d589bd5cf0fc1640514a34ce6 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 30 Nov 2025 17:15:37 +0100 Subject: [PATCH 143/370] Removed unused IS_IMPLEMENTED_WHEN_EVIDENCE --- yaml-generation/bib.php | 1 - 1 file changed, 1 deletion(-) diff --git a/yaml-generation/bib.php b/yaml-generation/bib.php index c844ef2..106d375 100644 --- a/yaml-generation/bib.php +++ b/yaml-generation/bib.php @@ -14,7 +14,6 @@ ini_set('display_startup_errors', 1); error_reporting(E_ALL); define('NUMBER_LEVELS', 4); -defineConstFromEnv("IS_IMPLEMENTED_WHEN_EVIDENCE"); defineConstFromEnv("TEST_REFERENCED_URLS"); From f2a9f2eef0388feffca3670bc0c6c69cb0020485 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 30 Nov 2025 17:19:41 +0100 Subject: [PATCH 144/370] Prepare for new major version --- .github/workflows/main.yml | 7 +- .gitignore | 7 +- src/assets/YAML/generated/README.md | 1 - src/assets/YAML/generated/generated.yaml | 7523 ---------------------- yaml-generation/generateDimensions.php | 67 +- 5 files changed, 48 insertions(+), 7557 deletions(-) delete mode 100644 src/assets/YAML/generated/README.md delete mode 100644 src/assets/YAML/generated/generated.yaml diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index db0d101..e0634c7 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -53,12 +53,11 @@ jobs: file: Dockerfile platforms: linux/amd64,linux/arm64 tags: wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }},wurstbrot/dsomm-yaml-generation:latest - - name: Extract generated.yaml and activities.yaml + - name: Extract generated files from docker image run: | docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 - docker cp yaml:/var/www/html/src/assets/YAML/generated/generated.yaml src/assets/YAML/generated/generated.yaml # TODO: Remove - docker cp yaml:/var/www/html/src/assets/YAML/activities.yaml src/assets/YAML/activities.yaml - + docker cp yaml:/var/www/html/generated/model.yaml generated/model.yaml + docker cp yaml:/var/www/html/generated/dependency-tree.md generated/dependency-tree.md - name: Replace version placeholder in activities.yaml run: | sed -i "s/__VERSION_PLACEHOLDER__/${{ steps.get-version.outputs.version }}/g" src/assets/YAML/activities.yaml diff --git a/.gitignore b/.gitignore index 6c64515..6f22dad 100644 --- a/.gitignore +++ b/.gitignore @@ -44,10 +44,9 @@ testem.log Thumbs.db /yaml-generation/vendor/ -/src/assets/YAML/teams.yaml -/src/assets/YAML/meta.yaml # Generated /src/assets/YAML/generated/generated.yaml -/src/assets/YAML/activities.yaml -src/assets/YAML/generated/dependency-tree.md \ No newline at end of file +/generated/model.yaml +dependency-tree.md +url-test-results.txt \ No newline at end of file diff --git a/src/assets/YAML/generated/README.md b/src/assets/YAML/generated/README.md deleted file mode 100644 index d8e2c1d..0000000 --- a/src/assets/YAML/generated/README.md +++ /dev/null @@ -1 +0,0 @@ -In this folder, the generated.yaml will be placed diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml deleted file mode 100644 index 2cda5da..0000000 --- a/src/assets/YAML/generated/generated.yaml +++ /dev/null @@ -1,7523 +0,0 @@ ---- -Build and Deployment: - Build: - Defined build process: - uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b - description: "A *build process* include more than just compiling your source - code. \nIt also includes steps such as managing (third party) dependencies, - \nenvironment configuration, running the unit tests, etc. \n\nA *defined build - process* has automated these steps to ensure consistency.\n\nThis can be done - with a Jenkinsfile, Maven, or similar tools.\n" - risk: Performing builds without a defined process is error prone; for example, - as a result of incorrect security related configuration. - measure: A well defined build process lowers the possibility of errors during - the build process. - difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 2 - usefulness: 4 - level: 1 - assessment: | - - Show your build pipeline and an exemplary job (build + test). - - Show that every team member has access. - - Show that failed jobs are fixed. - - Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) - implementation: - - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - references: - samm2: - - I-SB-A-1 - iso27001-2017: - - 12.1.1 - - 14.2.2 - iso27001-2022: - - 5.37 - - 8.32 - comments: "" - tags: - - none - Building and testing of artifacts in virtual environments: - uuid: a340f46b-6360-4cb8-847b-a0d3483d09d3 - description: |- - While building and testing artifacts, third party systems, application frameworks - and 3rd party libraries are used. These might be malicious as a result of - vulnerable libraries or because they are altered during the delivery phase. - risk: |- - While building and testing artifacts, third party systems, application frameworks - and 3rd party libraries are used. These might be malicious as a result of - vulnerable libraries or because they are altered during the delivery phase. - measure: Each step during within the build and testing phase is performed in - a separate virtual environments, which is destroyed afterward. - meta: - implementationGuide: Depending on your environment, usage of virtual machines - or container technology is a good way. After the build, the filesystem should - not be used again in other builds. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 2 - level: 2 - implementation: - - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 - name: Container technologies and orchestration like Docker, Kubernetes - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ - references: - samm2: - - I-SB-A-2 - iso27001-2017: - - 14.2.6 - iso27001-2022: - - 8.31 - comments: "" - tags: - - none - Pinning of artifacts: - uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 - risk: Unauthorized manipulation of artifacts might be difficult to spot. For - example, this may result in using images with malicious code. Also, intended - major changes, which are automatically used in an image used might break the - functionality. - measure: Pinning of artifacts ensure that changes are performed only when intended. - comment: The usage of pinning requires a good processes for patching. Therefore, - choose this activity wisely. - meta: - implementationGuide: Pinning artifacts in Dockerfile refers to the practice - of using specific, immutable versions of base images and dependencies in - your build process. Instead of using the latest tag for your base image, - select a specific version or digest. For example, replace FROM node:latest, - to FROM node@sha256:abcdef12. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - tags: - - inventory - implementation: - - uuid: 9368abfb-cf37-477a-9091-a804d2de9148 - name: Signing of containers - tags: - - signing - - container - - build - url: https://www.aquasec.com/cloud-native-academy/supply-chain-security/container-image-signing/ - description: Container technology automatically creates a hash for images, - which can be used. - - uuid: 638b3691-c9a5-45fa-9ba8-e40aeea32766 - name: Immutable images - tags: - - deployment - - container - - build - url: https://kubernetes.io/blog/2022/09/29/enforce-immutability-using-cel/#immutablility-after-first-modification - description: Immutable images are an other way, e.g. by using a registry, - which doesn't allow overriding of images. - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - I-SB-B-1 - iso27001-2017: - - 14.2.6 - iso27001-2022: - - 8.31 - comments: "" - SBOM of components: - uuid: 2858ac12-0179-40d9-9acf-1b839c030473 - description: |- - SBOM (Software Bill of Materials) is a document that lists all components, libraries, - and dependencies used in a software application or container image. Creating an SBOM - during the build process can help ensure transparency, security, and license compliance - for your application. - risk: In case a vulnerability of severity high or critical exists, it needs - to be known where an artifacts with that vulnerability is deployed with which - dependencies. - measure: Creation of an SBOM of components (e.g. application and container image - content) during build. - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 - usefulness: 3 - level: 2 - implementation: [] - references: - samm2: - - I-SB-B-1 - - D-TA-A-1 - iso27001-2017: - - 8.1 - - 8.2 - iso27001-2022: - - 5.9 - - 5.12 - comments: "" - tags: - - none - Signing of code: - uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 - risk: Execution or usage of malicious code or data e.g. via executables, libraries - or container images. - measure: Digitally signing commits helps to prevent unauthorized manipulation - of source code. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: d6d755d3-b9f1-4942-a084-e62b266541df - name: Signing of commits - tags: - - signing - url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work - description: Signing of commits in git - - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - I-SB-A-2 - iso27001-2017: - - 14.2.6 - iso27001-2022: - - 8.31 - comments: "" - tags: - - none - Signing of artifacts: - uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 - risk: Execution or usage of malicious code or data e.g. via executables, libraries - or container images. - measure: Digitally signing artifacts for all steps during the build and especially - docker images, helps to ensure their integrity and authenticity. - description: "To perform a push to a GitHub repository, you must be authenticated. - It's important to note that GitHub does not verify if the authenticated user's - email address matches the one in the commit.\nTo clearly identify the author - of a commit for reviewers, commit signing is recommended.\n\nGitHub actions - such as [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) - do not automatically sign commits and may encounter issues as a result. \n\nTo - address this, you can refer to a working configuration example in the [workflow - folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) - of DSOMM, which demonstrates how to use semantic release action in conjunction - with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action).\nFor - added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) - provided by your organization for a specific repository. Store the Personal - Access Token (PAT) as a secret in your project." - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 5 - implementation: - - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 - name: Docker Content Trust - tags: [] - url: https://docs.docker.com/engine/security/trust/ - - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f - name: in-toto - tags: [] - url: https://in-toto.github.io/ - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - - f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 # Pinning of artifacts - references: - samm2: - - I-SB-A-1 - iso27001-2017: - - 14.2.6 - iso27001-2022: - - 8.31 - comments: "" - tags: - - none - Deployment: - Defined deployment process: - uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a - risk: Deployment of insecure or malfunctioning artifacts. - measure: Defining a deployment process ensures that there are established criteria - in terms of functionalities, security, compliance, and performance, and that - the artifacts meet them. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 1 - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - implementation: - - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 - name: CI/CD tools - tags: - - ci-cd - url: https://martinfowler.com/articles/continuousIntegration.html - description: CI/CD tools such as jenkins, gitlab-ci or github-actions - - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - references: - samm2: - - I-SD-A-1 - iso27001-2017: - - 12.1.1 - - 14.2.2 - iso27001-2022: - - 5.37 - - 8.32 - comments: "" - tags: - - none - Inventory of production components: - uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f - risk: An organization is unaware of components like applications in production. - Not knowing existing applications in production leads to not assessing it. - measure: |- - A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. - In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 4 - level: 1 - implementation: - - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - references: - samm2: - - I-SB-B-1 - - D-TA-B-1 - iso27001-2017: - - 8.1 - - 8.2 - iso27001-2022: - - 5.9 - - 5.12 - tags: - - inventory - Defined decommissioning process: - uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 - description: |- - The decommissioning process in the context of Docker and Kubernetes involves - retiring Docker containers, images, and Kubernetes resources that are no longer - needed or have been replaced. This process must be carefully executed to avoid - impacting other services and applications. - risk: Unused applications are not maintained and may contain vulnerabilities. - Once exploited they can be used to attack other applications or to perform - lateral movements within the organization. - measure: A clear decommissioning process ensures the removal of unused applications - from the `Inventory of production components` and if implemented from `Inventory - of production artifacts`. - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 - usefulness: 2 - level: 2 - references: - samm2: - - O-OM-B-2 - iso27001-2017: - - 11.2.7 - iso27001-2022: - - 7.14 - comments: "" - tags: - - none - Environment depending configuration parameters (secrets): - uuid: df428c9d-efa0-4226-9f47-a15bb53f822b - risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. - container images) through process listing (e.g. ps -ef). - measure: Set configuration parameters via environment variables stored using - specific platform functionalities or secrets management systems (e.g. Kubernetes - secrets or Hashicorp Vault). - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - implementation: - - uuid: e3a2ffc8-313f-437e-9663-b24591568209 - name: Hashicorp Vault - tags: - - authentication - - authorization - - secrets - - infrastructure - url: https://github.com/hashicorp/vault - description: | - A tool for secrets management, encryption as a service, and privileged access management. - references: - samm2: - - I-SD-B-1 - iso27001-2017: - - 9.4.5 - - 14.2.6 - iso27001-2022: - - 8.4 - - 8.31 - d3f: - - ApplicationConfigurationHardening - tags: - - secret - Evaluation of the trust of used components: - uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba - risk: Application and system components like Open Source libraries or images - can have implementation flaws or deployment flaws. Developers or operations - might start random images in the production cluster which have malicious code - or known vulnerabilities. - measure: Each components source is evaluated to be trusted. For example the - source, number of developers included, email configuration used by maintainers - to prevent maintainer account theft, typo-squatting, ... Create image assessment - criteria, perform an evaluation of images and create a whitelist of artifacts/container - images/virtual machine images. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 3 - level: 2 - implementation: - - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af - name: Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. - tags: [] - url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d - - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a - name: packj - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://github.com/ossillate-inc/packj - description: | - Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 - comments: "" - tags: - - none - Inventory of production artifacts: - uuid: 83057028-0b77-4d2e-8135-40969768ae88 - risk: In case a vulnerability of severity high or critical exists, it needs - to be known where an artifacts (e.g. container image) with that vulnerability - is deployed. - measure: A documented inventory of artifacts in production like container images - exists (gathered manually or automatically). - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 - usefulness: 3 - level: 2 - implementation: - - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - references: - samm2: - - I-SB-B-1 - - D-TA-B-1 - iso27001-2017: - - 8.1 - - 8.2 - iso27001-2022: - - 5.9 - - 5.12 - tags: - - inventory - Handover of confidential parameters: - uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a - risk: Parameters are often used to set credentials, for example by starting - containers or applications; these parameters can often be seen by any one - listing running processes on the target system. - measure: Encryption ensures confidentiality of credentials e.g. from unauthorized - access on the file system. Also, the usage of a credential management system - can help protect credentials. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 3 - implementation: "" - dependsOn: - - df428c9d-efa0-4226-9f47-a15bb53f822b # Environment depending configuration parameters (secrets) - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 14.1.3 - - 13.1.3 - - 9.4.3 - - 9.4.1 - - 10.1.2 - iso27001-2022: - - 8.33 - - 8.22 - - 5.17 - - 8.3 - - 8.24 - d3f: - - ApplicationConfigurationHardening - tags: - - secret - Inventory of production dependencies: - uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 - risk: Delayed identification of components and their vulnerabilities in production. - In case a vulnerability is known by the organization, it needs to be known - where an artifacts with that vulnerability is deployed with which dependencies. - measure: A documented inventory of dependencies used in artifacts like container - images and containers exists. - dependsOn: - - 83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts - - 2858ac12-0179-40d9-9acf-1b839c030473 # SBOM of components - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 - usefulness: 3 - level: 3 - implementation: - - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca - name: Backstage - tags: - - documentation - - inventory - url: https://github.com/backstage/backstage - description: | - Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c - name: Image Metadata Collector - tags: - - documentation - - inventory - - kubernetes - url: https://github.com/SDA-SE/image-metadata-collector/ - description: | - Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. - references: - samm2: - - I-SB-B-3 - - I-SB-B-2 - - I-SB-B-1 - iso27001-2017: - - 8.1 - - 8.2 - iso27001-2022: - - 5.9 - - 5.12 - comments: "" - tags: - - inventory - - sbom - Rolling update on deployment: - uuid: 85d52588-f542-4225-a338-20dc22a5508d - risk: While a deployment is performed, the application can not be reached. - measure: A deployment without downtime is performed*. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 2 - level: 3 - implementation: - - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb - name: Webserver - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ - - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e - name: rolling update - tags: [] - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - references: - samm2: - - I-SD-A-2 - - I-SD-A-3 - iso27001-2017: - - 12.5.1 - - 14.2.2 - - 17.2.1 - iso27001-2022: - - 8.19 - - 8.32 - - 8.14 - comments: "" - tags: - - none - Same artifact for environments: - uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f - risk: Building of an artifact for different environments means that an untested - artifact might reach the production environment. - measure: Building an artifact once and deploying it to different environments - means that only tested artifacts are allowed to reach the production environment - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 4 - implementation: - - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - I-SD-A-2 - - I-SD-A-3 - iso27001-2017: - - 14.3.1 - - 14.2.8 - - 12.1.4 - iso27001-2022: - - 8.33 - - 8.29 - - 8.31 - comments: "" - tags: - - none - Usage of feature toggles: - uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad - risk: Using environment variables to enable or disable features can lead to - a situation where a feature is accidentally enabled in the production environment. - measure: Usage of environment independent configuration parameter, called static - feature toggles, mitigates the risk of accidentally enabling insecure features - in production. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 2 - level: 4 - implementation: - - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba - name: Docker - url: https://github.com/moby/moby - tags: [] - - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 - name: Feature Toggles - tags: - - development - - architecture - url: https://martinfowler.com/articles/feature-toggles.html - description: | - Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) - dependsOn: - - a854b48d-83bd-4f8d-8621-a0bdd470837f # Same artifact for environments - references: - samm2: - - I-SD-A-2 - iso27001-2017: - - 14.3.1 - - 14.2.8 - - 14.2.9 - - 12.1.4 - iso27001-2022: - - 8.33 - - 8.29 - - 8.31 - d3f: - - ApplicationConfigurationHardening - comments: "" - tags: - - none - Blue/Green Deployment: - uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 - risk: A new artifact's version can have unknown defects. - measure: |- - Using a blue/green deployment strategy increases application availability - and reduces deployment risk by simplifying the rollback process if a deployment fails. - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 - usefulness: 2 - level: 5 - implementation: - - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 - name: Blue/Green Deployments - tags: [] - url: https://martinfowler.com/bliki/BlueGreenDeployment.html - dependsOn: - - 73aaae0b-5d68-4953-9fa4-fd25bf665f2a # Smoke Test - references: - samm2: - - I-SD-A-3 - iso27001-2017: - - 17.2.1 - - 12.1.1 - - 12.1.2 - - 12.1.4 - - 12.5.1 - - 14.2.9 - iso27001-2022: - - 8.14 - - 5.37 - - 8.31 - - 8.32 - - 8.19 - - 8.29 - comments: "" - tags: - - none - Patch Management: - A patch policy is defined: - uuid: 99415139-6b50-441b-89e1-0aa59accd43d - risk: Vulnerabilities in running artifacts stay for long and might get exploited. - measure: A patch policy for all artifacts (e.g. in images) is defined. How often - is an image rebuilt? - difficultyOfImplementation: - knowledge: 3 - time: 1 - resources: 2 - usefulness: 4 - level: 1 - implementation: [] - references: - samm2: - - O-EM-B-1 - iso27001-2017: - - 12.6.1 - - 12.5.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.19 - - 8.27 - comments: "" - tags: - - patching - Automated PRs for patches: - uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 - risk: Components with known (or unknown) vulnerabilities might stay for long - and get exploited, even when a patch is available. - measure: |- - Fast patching of third party component is needed. The DevOps way is to have an automated pull request for new components. This includes - * Applications * Virtualized operating system components (e.g. container images) * Operating Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform) - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 1 - implementation: - - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 - name: Jenkins - tags: [] - url: https://www.jenkins.io/ - - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - references: - samm2: - - O-EM-B-1 - iso27001-2017: - - 12.6.1 - - 14.2.5 - iso27001-2022: - - "8.8" - - "8.27" - comments: "" - tags: - - patching - Automated merge of automated PRs: - uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb - description: Automated merges of automated created PRs for outdated dependencies. - risk: Vulnerabilities in running artifacts stay for too long and might get exploited. - measure: | - A good practice is to merge trusted dependencies (e.g. spring boot) after a grace period like one week. - Often, patches, fixes and minor updates are automatically merged. Be aware that automated merging requires a high - automated test coverage. Enforcement of merging of pull requests after a grace period. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 3 - level: 2 - dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches - implementation: - - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - references: - samm2: - - O-EM-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - patching - Nightly build of images (base images): - uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 - description: |- - A base image is a pre-built image that serves as a starting point for building - new images or containers. These base images usually include an operating system, - necessary dependencies, libraries, and other components that are required to run - a specific application or service. Nightly builds of custom base images refer to - an automated process that occurs daily or on a scheduled basis, usually during - nighttime or off-peak hours, to create updated versions of custom base images. - risk: Vulnerabilities in running containers stay for too long and might get - exploited. - measure: Custom base images are getting build at least nightly. In case the - packages in the base image e.g. centos has changed, the build server - triggers the build of depending images. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - implementation: [] - references: - samm2: - - O-EM-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - patching - Reduction of the attack surface: - uuid: 16e39c8f-5336-4001-88ed-a552d2447531 - description: |- - Distroless images are minimal, stripped-down base images that contain only the - essential components required to run your application. They do not include package - managers, shells, or any other tools that are commonly found in standard Linux - distributions. Using distroless images can help reduce the attack surface and - overall size of your container images. - risk: Components, dependencies, files or file access rights might have vulnerabilities, - but the they are not needed. - measure: Removal of unneeded components, dependencies, files or file access - rights. For container images the usage of distroless images is recommended. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 - usefulness: 3 - level: 2 - implementation: - - uuid: ef647044-b675-47d3-9720-3ebc144ef37b - name: Distroless - tags: [] - url: https://github.com/GoogleContainerTools/distroless - - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a - name: Fedora CoreOS - tags: [] - url: https://getfedora.org/coreos - - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd - name: Distroless or Alpine - tags: [] - url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 - references: - samm2: - - I-SB-B-2 - iso27001-2017: - - hardening is missing in ISO 27001 - - 14.2.1 - iso27001-2022: - - 8.25 - comments: "" - tags: - - patching - Usage of a maximum lifetime for images: - uuid: 485a3383-7f2e-4dba-bb84-479377070904 - description: |- - The maximum lifetime for a Docker container refers to the duration a container - should be allowed to run before it is considered outdated, stale, or insecure. - There is not a fixed, universally applicable maximum lifetime for a Docker - container, as it varies depending on the specific use case, application - requirements, and security needs. As a best practice, it is essential to define - a reasonable maximum lifetime for containers to ensure that you consistently - deploy the most recent, patched, and secure versions of both your custom base - images and third-party images. - risk: Vulnerabilities in images of running containers stay for too long and - might get exploited. Long running containers have potential memory leaks. - A compromised container might get killed by restarting the container (e.g. - in case the attacker has not reached the persistence layer). - measure: A short maximum lifetime for images is defined, e.g. 30 days. The project - images, based on the nightly builded images, are deployed at leased once within - the defined lifetime. Third Party images are deployed at leased once within - the defined lifetime. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 - usefulness: 3 - level: 2 - implementation: [] - references: - samm2: - - O-EM-B-1 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - patching - Automated deployment of automated PRs: - uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d - description: Automated merges of automated created PRs for outdated dependencies. - risk: Even if automated dependencies PRs are merged, they might not be deployed. - This results in vulnerabilities in running artifacts stay for too long and - might get exploited. - measure: | - After merging of an automated dependency PR, automated deployment is needed, - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - dependsOn: - - f2594f8f-1cd6-45f9-af29-eaf3315698eb # Automated merge of automated PRs - implementation: - - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 - name: terraform - tags: - - IaC - url: https://www.terraform.io/ - description: | - Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f - name: argoCD - tags: - - deployment - url: https://argo-cd.readthedocs.io/en/stable/ - references: - samm2: - - O-EM-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - patching - Usage of a short maximum lifetime for images: - uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e - description: |- - The maximum lifetime for a Docker container refers to the duration a container - should be allowed to run before it is considered outdated, stale, or insecure. - There is not a fixed, universally applicable maximum lifetime for a Docker - container, as it varies depending on the specific use case, application - requirements, and security needs. As a best practice, it is essential to define - a reasonable maximum lifetime for containers to ensure that you consistently - deploy the most recent, patched, and secure versions of both your custom base - images and third-party images. - risk: Vulnerabilities in running containers stay for too long and might get - exploited. - measure: | - A good practice is to perform the build and deployment daily or even just-in-time, when a new component (e.g. package) for the image is available. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 - usefulness: 3 - level: 4 - implementation: - - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" - tags: [] - description: "Sample concept: \n(1) each container has a set lifetime and - is killed / replaced with a new container multiple times a day where you - have some form of a graceful replacement to ensure no (short) service outage - will occur to the end users. \n(2) twice a day a rebuild of images is done. - The rebuilds are put into a automated testing pipeline. If the testing has - no blocking issues the new images will be released for deployment during - the next \"restart\" of a container. What has to be done, is to ensure the - new containers are deployed in some canary deployment manner, this will - ensure that if (and only if) something buggy has been introduced which breaks - functionality the canary deployment will make sure the \"older version\" - is being used and not the buggy newer one." - references: - samm2: - - O-EM-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - patching -Culture and Organization: - Design: - Conduction of simple threat modeling on technical level: - uuid: 47419324-e263-415b-815d-e7161b6b905e - risk: Technical related threats are discovered too late in the development and - deployment process. - measure: Threat modeling of technical features is performed during the product - sprint planning. - difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 - usefulness: 3 - level: 1 - implementation: - - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - description: | - # OWASP SAMM Description - Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. - - Threat modeling is a team exercise, including product owners, architects, security champions, and security testers. At this maturity level, expose teams and stakeholders to threat modeling to increase security awareness and to create a shared vision on the security of the system. - - At maturity level 1, you perform threat modeling ad-hoc for high-risk applications and use simple threat checklists, such as STRIDE. Avoid lengthy workshops and overly detailed lists of low-relevant threats. Perform threat modeling iteratively to align to more iterative development paradigms. If you add new functionality to an existing application, look only into the newly added functions instead of trying to cover the entire scope. A good starting point is the existing diagrams that you annotate during discussion workshops. Always make sure to persist the outcome of a threat modeling discussion for later use. - - Your most important tool to start threat modeling is a whiteboard, smartboard, or a piece of paper. Aim for security awareness, a simple process, and actionable outcomes that you agree upon with your team. Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. - - Source: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - # OWASP Project Integration Description - There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. - - A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). - - OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). - - There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. - - > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ - - ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") - - Last, if the organizations maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. - - ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") - - This practice has the side effect that it trains non-security specialists to think like attackers. - - The outcomes of this stage should help lay the foundation of secure design and considerations. - - **Example Low Maturity Scenario:** - - Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. - - Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. - - Frontend serves data over GraphQL as a thin layer between caching system and end user. - - GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. - - Source: OWASP Project Integration Project - references: - samm2: - - D-TA-B-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 8.2.1 - - 14.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 5.12 - - 8.25 - comments: "" - tags: - - none - Information security targets are communicated: - uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 - risk: Employees don't know their organizations security targets. Therefore security - is not considered during development and administration as much as it should - be. - measure: Transparent and timely communication of the security targets by senior - management is essential to ensure teams' buy-in and support. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 3 - level: 2 - implementation: [] - references: - samm2: - - G-SM-A-2 - iso27001-2017: - - 5.1.1 - - 7.2.1 - iso27001-2022: - - 5.1 - - 5.4 - comments: "" - tags: - - none - Conduction of simple threat modeling on business level: - uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 - risk: Business related threats are discovered too late in the development and - deployment process. - measure: Threat modeling of business functionality is performed during the product - backlog creation to facilitate early detection of security defects. - difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: [] - references: - samm2: - - D-TA-B-1 - - D-TA-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 8.2.1 - - 14.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 5.12 - - 8.25 - comments: "" - tags: - - none - Creation of simple abuse stories: - uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 - risk: User stories mostly don't consider security implications. Security flaws - are discovered too late in the development and deployment process. - measure: Abuse stories are created during the creation of user stories. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 3 - implementation: - - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: Don't Forget EVIL User stories - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' - dependsOn: - - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level - - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes and standards - references: - samm2: - - D-TA-B-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - - May be part of project management - - 6.1.5 - - May be part of risk assessment - - 8.1.2 - iso27001-2022: - - Not explicitly covered by ISO 27001 - - May be part of project management - - 5.8 - - May be part of risk assessment - - 5.9 - comments: "" - tags: - - none - Creation of threat modeling processes and standards: - uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e - risk: Inadequate identification of business and technical risks. - measure: Creation of threat modeling processes and standards through the organization - helps to enhance the security culture and provide more structure to the threat - model exercises. - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 2 - usefulness: 3 - level: 3 - description: "" - implementation: - - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - dependsOn: - - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level - references: - samm2: - - D-TA-B-3 - - D-TA-B-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 8.2.1 - - 14.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 5.12 - - 8.25 - comments: "" - tags: - - none - Conduction of advanced threat modeling: - uuid: ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 - risk: Inadequate identification of business and technical risks. - measure: Threat modeling is performed by using reviewing user stories and producing - security driven data flow diagrams. - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 2 - usefulness: 3 - level: 4 - dependsOn: - - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level - - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes and standards - description: | - **Example High Maturity Scenario:** - - Based on a detailed threat model defined and updated through code, the team decides the following: - - * Local encrypted caches need to expire and auto-purged. - * Communication channels encrypted and authenticated. - * All secrets persisted in shared secrets store. - * Frontend designed with permissions model integration. - * Permissions matrix defined. - * Input is escaped output is encoded appropriately using well established libraries. - - Source: OWASP Project Integration Project - implementation: - - uuid: c0533602-11b7-4838-93cc-a40556398163 - name: Whiteboard - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://en.wikipedia.org/wiki/Whiteboard - - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 - name: Miro (or any other collaborative board) - tags: - - defender - - threat-modeling - - collaboration - - whiteboard - url: https://miro.com/ - - uuid: 088794c4-3424-40d4-9084-4151587fc84d - name: Draw.io - tags: - - defender - - threat-modeling - - whiteboard - url: https://github.com/jgraph/drawio-desktop - - uuid: fd0f282b-a065-4464-beed-770c604a5f52 - name: Threat Modeling Playbook - tags: - - owasp - - defender - - threat-modeling - - whiteboard - url: https://github.com/Toreon/threat-model-playbook - - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 - name: OWASP SAMM - tags: - - threat-modeling - - owasp - - defender - url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c - name: Threagile - tags: - - threat-modeling - url: https://github.com/Threagile/threagile - - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 - name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ - tags: - - documentation - - storage - - cluster - - kubernetes - references: - samm2: - - D-TA-B-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 8.2.1 - - 14.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - - May be part of risk assessment - - 5.12 - - 8.25 - comments: "" - tags: - - none - Creation of advanced abuse stories: - uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e - risk: Simple user stories are not going deep enough. Relevant security considerations - are performed. Security flaws are discovered too late in the development and - deployment process - measure: Advanced abuse stories are created as part of threat modeling activities. - difficultyOfImplementation: - knowledge: 4 - time: 2 - resources: 1 - usefulness: 4 - level: 5 - dependsOn: - - bacf85b6-5bc0-405d-b5ba-a5d971467cc1 # Creation of simple abuse stories - implementation: - - uuid: bb5b8988-021b-452a-a914-bd36887b6860 - name: Don't Forget EVIL User stories - tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' - references: - samm2: - - D-TA-B-2 - - V-RT-B-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - - May be part of project management - - 6.1.5 - - May be part of risk assessment - - 8.1.2 - iso27001-2022: - - Not explicitly covered by ISO 27001 - - May be part of project management - - 5.8 - - May be part of risk assessment - - 5.9 - comments: "" - tags: - - none - Education and Guidance: - Ad-Hoc Security trainings for software developers: - uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 - risk: Understanding security is hard and personnel needs to be trained on it. - Otherwise, flaws like an SQL Injection might be introduced into the software - which might get exploited. - measure: Provide security awareness training for all personnel involved in software - development Ad-Hoc. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 3 - level: 1 - implementation: - - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - references: - samm2: - - G-EG-A-1 - iso27001-2017: - - 7.2.2 - iso27001-2022: - - 6.3 - tags: - - none - Security consulting on request: - uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 - risk: Not asking a security expert when questions regarding security appear - might lead to flaws. - measure: Security consulting to teams is given on request. The security consultants - can be internal or external. - difficultyOfImplementation: - knowledge: 3 - time: 1 - resources: 1 - usefulness: 3 - level: 1 - implementation: - - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - references: - samm2: - - G-EG-A-1 - - G-EG-B-1 - iso27001-2017: - - security consulting is missing in ISO 27001 may be - - 6.1.1 - - 6.1.4 - - 6.1.5 - iso27001-2022: - - Security consulting is missing in ISO 27001 may be - - 5.2 - - 5.6 - - 5.8 - comments: "" - tags: - - none - Each team has a security champion: - uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 - risk: No one feels directly responsible for security and the security champion - does not have enough time to allocate to each team. - measure: Each team defines an individual to be responsible for security. These - individuals are often referred to as 'security champions' - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - description: | - Implement a program where each software development team has a member considered a "Security Champion" who is the liaison between Information Security and developers. Depending on the size and structure of the team the "Security Champion" may be a software developer, tester, or a product manager. The "Security Champion" has a set number of hours per week for Information Security related activities. They participate in periodic briefings to increase awareness and expertise in different security disciplines. "Security Champions" have additional training to help develop these roles as Software Security subject-matter experts. You may need to customize the way you create and support "Security Champions" for cultural reasons. - - The goals of the position are to increase effectiveness and efficiency of application security and compliance and to strengthen the relationship between various teams and Information Security. To achieve these objectives, "Security Champions" assist with researching, verifying, and prioritizing security and compliance related software defects. They are involved in all Risk Assessments, Threat Assessments, and Architectural Reviews to help identify opportunities to remediate security defects by making the architecture of the application more resilient and reducing the attack threat surface. - - [Source: OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/) - implementation: - - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 - name: OWASP Security Champions Playbook - tags: - - security champions - url: https://github.com/c0rdis/security-champions-playbook - references: - samm2: - - G-EG-B-1 - - G-EG-B-2 - iso27001-2017: - - Security champions are missing in ISO 27001 most likely - - 7.2.1 - - 7.2.2 - iso27001-2022: - - Security champions are missing in ISO 27001 most likely - - 5.4 - - 6.3 - comments: "" - tags: - - none - Regular security training for all: - uuid: 9768f154-357a-4c06-af6f-d66570677c9b - risk: Understanding security is hard. - measure: Provide security awareness training for all internal personnel involved - in software development on a regular basis like twice in a year for 1-3 days. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 - usefulness: 4 - level: 2 - description: | - Conduct security awareness training for all roles currently involved in the management, development, testing, or auditing of the software. The goal is to increase the awareness of application security threats and risks, security best practices, and secure software design principles. Develop training internally or procure it externally. Ideally, deliver training in person so participants can have discussions as a team, but Computer-Based Training (CBT) is also an option. - - Course content should include a range of topics relevant to application security and privacy, while remaining accessible to a non-technical audience. Suitable concepts are secure design principles including Least Privilege, Defense-in-Depth, Fail Secure (Safe), Complete Mediation, Session Management, Open Design, and Psychological Acceptability. Additionally, the training should include references to any organization-wide standards, policies, and procedures defined to improve application security. The OWASP Top 10 vulnerabilities should be covered at a high level. - - Training is mandatory for all employees and contractors involved with software development and includes an auditable sign-off to demonstrate compliance. Consider incorporating innovative ways of delivery (such as gamification) to maximize its effectiveness and combat desensitization. - - [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) - implementation: - - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - references: - samm2: - - G-EG-A-1 - iso27001-2017: - - 7.2.2 - iso27001-2022: - - 6.3 - comments: "" - tags: - - none - Regular security training of security champions: - uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 - risk: Understanding security is hard, even for security champions. - measure: Regular security training of security champions. - assessment: | - - Process Documentation: TODO - - Training Content: TOODO - difficultyOfImplementation: - knowledge: 4 - time: 2 - resources: 2 - usefulness: 5 - level: 2 - implementation: - - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - dependsOn: - - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion - references: - samm2: - - D-TA-B-2 - - G-EG-A-1 - iso27001-2017: - - Security champions are missing in ISO 27001 - - 7.2.2 - iso27001-2022: - - Security champions are missing in ISO 27001 - - 6.3 - comments: "" - tags: - - none - Reward of good communication: - uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c - risk: Employees are not getting excited about security. - measure: Good communication and transparency encourages cross-organizational - support. Gamification of security is also known to help, examples include - T-Shirts, mugs, cups, gift cards and 'High-Fives'. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 - usefulness: 3 - level: 2 - implementation: - - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 - name: Motivate people - tags: - - security champions - - gamification - - nudging - url: https://github.com/wurstbrot/security-pins - description: |- - Enhance motivation can be performed with the distribution of pins - as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) - - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 - name: OWASP Top 10 Maturity Categories for Security Champions - tags: - - security champions - url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx - references: - samm2: - - G-EG-B-1 - iso27001-2017: - - not required by ISO 27001 - - interestingly enough A7.2.3 is requiring a process to handle misconduct - but nothing to promote good behavior. - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Security code review: - uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 - risk: Understanding security is hard. - measure: | - The following areas of code tend to have a high-risk of containing security vulnerabilities: - - Crypto implementations / usage - - Parser, unparser - - System configuration - - Authentication, authorization - - Session management - - Request throttling - - :unicorn: (self-developed code, only used in that one software) - description: | - ### Benefits - - New vulnerabilities may be found before reaching production. - - Old vulnerabilities are found and fixed. - assessment: | - - Present the performed reviews (including participants, findings, consequences) and assess whether it is reasonable. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 - usefulness: 3 - level: 2 - implementation: - - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 - name: CWE Top 25 Most Dangerous Software Weaknesses - tags: - - documentation - - threat - url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html - credits: | - AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) - references: - samm2: - - V-ST-B-1 - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Conduction of build-it, break-it, fix-it contests: - uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 - risk: Understanding security is hard, even for security champions and the conduction - of security training often focuses on breaking a component instead of building - a component secure. - measure: The build-it, break-it, fix-it contest allows to train people with - security related roles like security champions the build, break and fix part - of a secure application. This increases the learning of building secure components. - difficultyOfImplementation: - knowledge: 5 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f - name: Build it Break it Fix it Contest - tags: [] - url: https://builditbreakit.org/ - references: - samm2: - - G-EG-A-2 - iso27001-2017: - - 7.2.2 - iso27001-2022: - - 6.3 - comments: "" - tags: - - none - Office Hours: - uuid: 185d5a74-19dc-4422-be07-44ea35226783 - risk: Developers and Operations are not in contact with the security team and - therefore do not ask prior implementation of (known or unknown) threats- - measure: As a security team, be open for questions and hints during defined - office hours. x x d - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 3 - level: 3 - implementation: ~ - references: - samm2: - - G-EG-A-1 - iso27001-2017: - - 7.2.2 - iso27001-2022: - - 6.3 - tags: - - none - Security Coaching: - uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 - risk: Training does not change behaviour. Therefore, even if security practices - are understood, it's likely that they are not performed. - measure: By coaching teams on security topics using for example the samman coaching - method, teams internalize security practices as new habits in their development - process. - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 1 - usefulness: 3 - implementation: - - uuid: 9223be73-00da-400e-a910-3871734cff2f - name: sammancoaching - tags: - - documentation - - coaching - - education - url: https://sammancoaching.org/ - description: | - Security coaches work with software development teams to help them adopt better security practices. - level: 3 - references: - samm2: - - G-EG-B-3 - iso27001-2017: - - 7.1.1 - iso27001-2022: - - 6.1 - comments: "" - tags: - - none - Security-Lessoned-Learned: - uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 - risk: After an incident, a similar incident might reoccur. - measure: Running a 'lessons learned' session after an incident helps drive continuous - improvement. Regular meetings with security champions are a good place to - share and discuss lessons learned. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: [] - references: - samm2: - - G-EG-B-3 - - O-IM-B-3 - iso27001-2017: - - 16.1.6 - iso27001-2022: - - 5.27 - comments: "" - tags: - - none - Simple mob hacking: - uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de - risk: Understanding security is hard. - measure: | - Participate with your whole team in a simple mob hacking session organized by the Security Champion Guild. - In the session the guild presents a vulnerable application and together you look at possible exploits. - Just like in mob programming there is one driver and several navigators. - description: | - ### Guidelines for your simple mob hacking session - - All exploits happen via the user interface. - - No need for security/hacking tools. - - No need for deep technical or security knowledge. - - Use an insecure training app, e.g., [DVWA](https://dvwa.co.uk/) or [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/). - - Encourage active participation, e.g., use small groups. - - Allow enough time for everyone to run at least one exploit. - - ### Benefits - - The team gets an idea of how exploits can look like and how easy applications can be attacked. - - The team understands functional correct working software can be highly insecure and easy to exploit. - difficultyOfImplementation: - knowledge: 5 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - credits: | - AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) - implementation: - - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 - name: Damn Vulnerable Web Application - tags: - - training - description: Simple Application with intended vulnerabilities. HTML based. - references: - samm2: - - G-EG-A-2 - iso27001-2017: - - 7.2.2 - iso27001-2022: - - 6.3 - comments: "" - tags: - - none - Aligning security in teams: - uuid: f994a55d-71bb-45a4-a887-0a213d72c504 - risk: The concept of Security Champions might suggest that only he/she is responsible - for security. However, everyone in the project team should be responsible - for security. - measure: By aligning security Subject Matter Experts with project teams, a higher - security standard can be achieved. - difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 1 - usefulness: 5 - implementation: - - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 - name: Involve Security SME - tags: [] - description: Security SME are involved in discussion for requirements analysis, - software design and sprint planning to provide guidance and suggestions. - level: 4 - references: - samm2: - - G-EG-B-3 - iso27001-2017: - - 7.1.1 - iso27001-2022: - - 6.1 - comments: "" - tags: - - none - Conduction of collaborative team security checks: - uuid: 35446784-7610-40d9-af9e-d43f3173bf8c - risk: Development teams limited insight over security practices. - measure: Mutual security testing the security of other teams project enhances - security awareness and knowledge. - difficultyOfImplementation: - resources: 2 - knowledge: 4 - time: 4 - usefulness: 2 - level: 4 - implementation: [] - references: - samm2: - - G-EG-A-1 - - G-EG-A-2 - iso27001-2017: - - Mutual security testing is not explicitly required in ISO 27001 may be - - 7.2.2 - iso27001-2022: - - Mutual security testing is not explicitly required in ISO 27001 may be - - 6.3 - comments: "" - tags: - - none - Conduction of war games: - uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 - risk: Understanding incident response plans during an incident is hard and ineffective. - measure: War Games like activities help train for incidents. Security SMEs create - attack scenarios in a testing environment enabling the trainees to learn how - to react in case of an incident. - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 4 - usefulness: 3 - level: 4 - implementation: [] - references: - samm2: - - G-EG-A-2 - - O-IM-B-2 - iso27001-2017: - - War games are not explicitly required in ISO 27001 may be - - 7.2.2 - - 16.1 - - 16.1.5 - iso27001-2022: - - War games are not explicitly required in ISO 27001 may be - - 6.3 - - 5.24 - - 5.26 - comments: "" - tags: - - none - Regular security training for externals: - uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 - risk: Understanding security is hard. - measure: Provide security awareness training for all personnel including externals - involved in software development on a regular basis. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 3 - usefulness: 4 - level: 4 - implementation: - - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a - name: OWASP Juice Shop - tags: - - training - url: https://github.com/bkimminich/juice-shop - description: In case you do not have the budget to hire an external security - expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 - name: OWASP Cheatsheet Series - tags: - - training - - secure coding - url: https://cheatsheetseries.owasp.org/ - references: - samm2: - - G-EG-A-2 - iso27001-2017: - - 7.2.2 - iso27001-2022: - - 6.3 - comments: "" - tags: - - none - Conduction of collaborative security checks with developers and system administrators: - uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 - risk: Security checks by external companies do not increase the understanding - of an application/system for internal employees. - measure: Periodically security reviews of source code (SCA), in which security - SME, developers and operations are involved, are effective at increasing the - robustness of software and the security knowledge of the teams involved. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 - usefulness: 3 - level: 5 - implementation: [] - references: - samm2: - - G-EG-A-2 - - G-EG-B-2 - iso27001-2017: - - Mutual review of source code is not explicitly required in ISO 27001 may - be - - 7.2.2 - - 12.6.1 - - 12.7.1 - iso27001-2022: - - Mutual review of source code is not explicitly required in ISO 27001 may - be - - 6.3 - - 8.8 - - 8.34 - comments: "" - tags: - - none - Process: - Definition of simple BCDR practices for critical components: - uuid: c72da779-86cc-45b1-a339-190ce5093171 - description: A _Business Continuity and Disaster Recovery_ (BCDR) is a plan - and a process that helps a business to return to normal operations if a disaster - occurs. - risk: If the disaster recovery actions are not clear, you risk slow reaction - and remediation delays. This applies to cyber attacks as well as natural emergencies, - such as a power outage. - measure: By understanding and documenting a business continuity and disaster - recovery (BCDR) plan, the overall availability of systems and applications - is increased. Success factors like responsibilities, Service Level Agreements, - Recovery Point Objectives, Recovery Time Objectives or Failover must be fully - documented and understood by the people involved in the recovery. - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 2 - usefulness: 4 - level: 1 - implementation: [] - references: - samm2: - - O-IM-B-2 - iso27001-2017: - - 17.1.1 - iso27001-2022: - - 5.29 - tags: - - none - Determining the protection requirement: - uuid: 72737130-472c-4984-80f8-9ab2f1c2ed5d - risk: "Not defining the protection requirement of applications can lead to wrong - prioritization, delayed remediation of \ncritical security issues, increasing - the risk of exploitation and potential damage to the organization." - measure: "Defining the protection requirement. \nThe protection requirements - for an application should consider:\n- Processed data criticality\n- Application - accessibility (internal vs. external)\n- Regulatory compliance\n- Other relevant - factors" - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 2 - dependsOn: - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - O-OM-A-2 - - G-PC-B-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurements - Approval by reviewing any new version: - uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 - risk: An individual might forget to implement security measures to protect source - code or infrastructure components. - measure: On each new version (e.g. Pull Request) of source code or infrastructure - components a security peer review of the changes is performed (two eyes principle) - and approval given by the reviewer. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 3 - implementation: [] - references: - samm2: [] - iso27001-2017: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - - 6.1.2 - - 14.2.1 - iso27001-2022: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - - 5.3 - - 8.25 - comments: "" - tags: - - none - Definition of a change management process: - uuid: b4193d32-3948-47e2-a326-3748c48019a1 - risk: The impact of a change is not controlled because these are not recorded - or documented. - measure: Each change of a system is automatically recorded and adequately logged. - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: [] - references: - samm2: [] - iso27001-2017: - - 14.2.2 - - 12.1.2 - - 12.4.1 - iso27001-2022: - - 8.32 - - 8.15 - comments: "" - tags: - - none -Implementation: - Application Hardening: - App. Hardening Level 1 (50%): - uuid: b597928e-54d6-48a5-a806-8003dcd56aab - risk: Using an insecure application might lead to a compromised application. - This might lead to total data theft or data modification. - measure: | - Following frameworks like the - * OWASP Application Security Verification Standard Level 1 - * OWASP Mobile Application Security Verification Standard - - in all applications provides a good baseline. Implement 50% of the recommendations. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 1 - description: | - To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jumpstart the development process, but also do so securely. - - [...] - - ### Planning aka Requirements Gathering & Analysis - The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. - - ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) - - Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. - - These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. - - In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. - - Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) - implementation: - - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ - references: - samm2: - - D-SR-A-2 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - Context-aware output encoding: - uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 - description: "**Input validation** stops malicious data from entering your system. - \\\n**Output encoding** neutralizes malicious data before rendering to user, - or the next system.\n\nInput validation and output encoding work together. - Apply both. \n\n**Context-aware output encoding** encodes data differently, - depending on its context. In the sample below the `{{bad_data}}` must be encoded - differently, depending on its context, to render safe HTML.\n\n```html\n
{{bad_data}}
\nClick me\n\n\n```\n" - risk: If an attacker manages to slip though your input validation, the attacker - may gain control over the user session or execute arbitrary actions. - measure: "* Use modern secure frameworks such as React/Angular/Vue/Svelte. The - default method here renders data in a safe way.\n* Use established and well-maintained - encoding libraries such as OWASP\u2019s Java Encoder and Microsoft\u2019s - AntiXSS.\n* Implement content security policies (CSP) to restrict the types - of content that can be loaded and executed.\n" - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 - usefulness: 3 - level: 1 - implementation: - - uuid: 2d61e48f-bade-4332-a383-adc50c29673a - name: OWASP DOM based XSS Prevention CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html - tags: [] - - uuid: ae97c9b0-308c-4dab-bff9-bf3330a897dc - name: CWE-838 Inappropriate Encoding for Output Context - tags: - - documentation - - cwe - url: https://cwe.mitre.org/data/definitions/838.html - references: - samm2: - - D-SR-A-1 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - Parametrization: - uuid: 00e91a8a-3972-4692-8679-674ab8547486 - description: | - By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well. - - This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed. - - Pay attention to these two lines of code. They seem similar, but behave very differently. - - * `sql.execute("SELECT * FROM table WHERE ID = " + id);` - * `sql.execute("SELECT * FROM table WHERE ID = ?", id);` - The second line is parameterized. The same principle applies to other types, such as command line execution, etc. - risk: "Systems vulnerable to injections may lead to data breaches, loss of data, - \nunauthorized alteration of data, or complete database compromise or downtime.\n\nThis - applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc.\n" - measure: | - * Identify which of the types your application is using. Check that you use: - * Use _parametrized queries_ (or _prepared statements_) - * For database queries, you may also use: - * Use _stored procedures_ () - * Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 - usefulness: 3 - level: 1 - implementation: - - uuid: d880fa0f-9dbb-454e-a003-d844fad31ab4 - name: OWASP Parameterization CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html - tags: [] - references: - samm2: - - D-SR-A-1 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - App. Hardening Level 1: - uuid: cf819225-30cb-4702-8e32-60225eedc33d - risk: Using an insecure application might lead to a compromised application. - This might lead to total data theft or data modification. - measure: | - Following frameworks like the - * OWASP Application Security Verification Standard Level 1 - * OWASP Mobile Application Security Verification Standard - - in all applications provides a good baseline. Implement 95%-100% of the recommendations. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - dependsOn: - - b597928e-54d6-48a5-a806-8003dcd56aab # App. Hardening Level 1 (50%) - description: | - To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely. - - [...] - - ### Planning aka Requirements Gathering & Analysis - The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. - - ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) - - Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. - - These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. - - In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. - - Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) - implementation: - - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - - uuid: 596cb528-8981-4723-bcc3-22c261f26114 - name: API Security Maturity Model for Authorization - tags: - - api - url: https://curity.io/resources/learn/the-api-security-maturity-model/ - references: - samm2: - - D-SR-A-3 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - Containers are running as non-root: - uuid: a86c1fbc-28fd-4610-89a3-a7f73acfe45f - risk: |- - There are various reasons to run a container as non-root. Samples are listed: - ## Container Escape Vectors - - - Root privileges significantly increase the chance of breaking container isolation - - Root access can be leveraged to exploit kernel vulnerabilities - - Compromised root containers provide attackers with maximum privileges inside the container - - Greater potential for escaping container boundaries to the host system - - ## Host System Vulnerabilities - - Root containers can potentially: - - - Mount sensitive host filesystems - - Access critical device files - - Modify host network settings - - Interact with host system processes - - Override security controls - - ## Resource Management Issues - - Root privileges may allow containers to: - - - Bypass resource quotas and limits - - Modify control group (cgroup) settings - - Interfere with other containers' resources - - Circumvent memory and CPU restrictions - - Security Boundary Weakening - - - Violates the principle of least privilege - - Provides unnecessary elevated permissions - - Expands the potential attack surface - - Increases the impact of a successful compromise - measure: "Containers are running as non-root. This can be enforced in the image - itself or during runtime parameters \n(e.g. `podman run --user [...]`)." - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 2 - implementation: [] - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 8.22 - tags: - - none - App. Hardening Level 2 (75%): - uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 - risk: Using an insecure application might lead to a compromised application. - This might lead to total data theft or data modification. - measure: | - Following frameworks like the - * OWASP Application Security Verification Standard Level 2 - * OWASP Mobile Application Security Verification Standard Level 2 - - Implement 75% of the recommendations. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - references: - samm2: - - D-SR-A-3 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - dependsOn: - - cf819225-30cb-4702-8e32-60225eedc33d # App. Hardening Level 1 - tags: - - none - Secure headers: - uuid: 29318d60-18ce-4526-80ea-f5928e49f639 - risk: | - Missing or misconfigured security headers can lead to various security vulnerabilities, e.g.: - - Cross-Site Scripting (XSS) due to missing Content Security Policy - - Clickjacking attacks due to missing X-Frame-Options - - Information disclosure through Server header exposure - - SSL/TLS downgrade attacks due to missing HSTS - - Cross-site scripting and injection due to missing security headers - measure: | - Implement and enforce security headers across all applications and services - - Implementation Methods: - 1. Reverse Proxy/Load Balancer: Configure at nginx/Apache level - 2. Web Application: Implement in the application middleware - 3. Service Mesh: Configure at the ingress controller level - 4. Standard Docker Image: Use secure base images with preset headers - - Remove or Secure: - - Server header: Hide server version information - - X-Powered-By: Remove technology stack information - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 4 - level: 3 - implementation: - - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e - name: OWASP Secure Headers Project - tags: - - header - - documentation - url: https://owasp.org/www-project-secure-headers/ - description: "The OWASP Secure Headers Project (also called OSHP) describes - HTTP response headers that your application can use \nto increase the security - of your application. Once set, these HTTP response headers can restrict - modern browsers \nfrom running into easily preventable vulnerabilities. - The OWASP Secure Headers Project intends to raise awareness\nand use of - these headers." - meta: - implementationGuide: | - Essential headers: - - Content-Security-Policy: Define trusted sources for content - - Strict-Transport-Security: Enforce HTTPS connections - - X-Frame-Options: Prevent clickjacking attacks - - X-Content-Type-Options: Prevent MIME-type sniffing - - X-XSS-Protection: Enable browser's XSS filtering - - Referrer-Policy: Control information in the Referrer header - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - openCRE: - - https://www.opencre.org/cre/620-421 - tags: - - none - App. Hardening Level 2: - uuid: ffe86caf-2fec-4630-b514-2db83983984d - risk: Using an insecure application might lead to a compromised application. - This might lead to total data theft or data modification. - measure: | - Following frameworks like the - * OWASP Application Security Verification Standard Level 2 - * OWASP Mobile Application Security Verification Standard Level 2 - - Implement 95%-100% of the recommendations. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 3 - level: 4 - implementation: - - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - references: - samm2: - - D-SR-A-2 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - dependsOn: - - 03643ca2-03c2-472b-8e19-956bf02fe9b7 # App. Hardening Level 2 (75%) - tags: - - none - App. Hardening Level 3: - uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a - risk: Using an insecure application might lead to a compromised application. - This might lead to total data theft or data modification. - measure: | - Following frameworks like the - * OWASP Application Security Verification Standard Level 3 - * OWASP Mobile Application Security Verification Standard - - Implement 95%-100% of the recommendations. - difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 2 - usefulness: 4 - level: 5 - implementation: - - uuid: 88767cde-1610-402e-98ec-bc3575377183 - name: OWASP ASVS - tags: [] - url: https://owasp.org/www-project-application-security-verification-standard/ - - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 - name: OWASP MASVS - tags: [] - url: https://github.com/OWASP/owasp-masvs - references: - samm2: - - D-SR-A-3 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - dependsOn: - - ffe86caf-2fec-4630-b514-2db83983984d # App. Hardening Level 2 - tags: - - none - Development and Source Control: - Versioning: - uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f - risk: Deployment of untracked artifacts. - description: Use a version control system platform like Github, Gitlab, Bitbucket, - gittea,... to version your code. - measure: Version artifacts in order to identify deployed features and issues. - This includes application and infrastructure code, jenkins configuration, - container and virtual machine images definitions. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 - usefulness: 5 - level: 1 - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - implementation: [] - references: - samm2: - - O-EM-A-1 - - I-SB-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.1.1 - - 12.1.2 - - 14.2.2 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.37 - - 8.32 - tags: - - none - Require a PR before merging: - uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 - risk: Intentional or accidental alterations in critical branches like main (or - master). - measure: Define source code management system policies (e.g. branch protection - rules, mandatory code reviews from at least one person, ...) to ensure that - changes to critical branches are only possible under defined conditions. These - policies can be implemented at repository level or organization level, depending - on the source code management system. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 4 - level: 2 - implementation: - - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - - 6.1.2 - - 14.2.1 - iso27001-2022: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - - 5.3 - - 8.25 - tags: - - none - Block force pushes: - uuid: c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 - risk: "Misuse of force push can lead to loss of work. It may overwrite remote - \nbranches without warning, potentially erasing valuable contributions from - team members. This can disrupt collaboration, \ncause data loss, and create - confusion in the development process.\n\nBypassing the pull request process - might remove an important code review step. \nThis increases the risk of merging - low-quality or buggy code into the main branch, potentially introducing bugs - in the codebase." - measure: Mandate blocking of force pushes in the version control platform. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 3 - level: 3 - dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging - implementation: - - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - 6.1.2 - - 14.2.1 - iso27001-2022: - - 5.3 - - 8.25 - tags: - - none - Dismiss stale PR approvals: - uuid: ea6f69f7-54a5-4922-ac15-a77ff0c16162 - risk: Intentional or accidental alterations in critical branches like main (or - master) through post-approval code additions. - measure: Implement a policy where any commits made after a pull request has - been approved automatically revoke that approval, necessitating a fresh review - and re-approval process. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging - implementation: - - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - - 6.1.2 - - 14.2.1 - iso27001-2022: - - Peer review - four eyes principle is not explicitly required by ISO 27001 - - 5.3 - - 8.25 - tags: - - none - Require status checks to pass: - uuid: ac8730a2-ccc0-465c-9550-d91edae9d5ee - risk: Organizations risk introducing broken builds, quality issues, and security - vulnerabilities into their codebase. - measure: Mandate passing of security related specified status checks, like successful - builds or static application security tests, before proceeding. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging - implementation: - - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a - name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops - tags: - - source-code-protection - - scm - - uuid: 99211481-de9c-4358-880e-628366416a27 - name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches - tags: - - source-code-protection - - scm - - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 - name: Enforcement of commit signing - tags: - - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule - description: Usage of branch protection rules - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - 6.1.2 - - 14.2.1 - iso27001-2022: - - 5.3 - - 8.25 - tags: - - none - .gitignore: - uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d - risk: Unintended leakage of secrets, debug, or workstation specific data - measure: .gitignore files help prevent accidental commits of secrets, debug, - or workstation specific data - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 5 - level: 4 - dependsOn: [] - implementation: [] - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.1.1 - - 12.1.2 - - 14.2.2 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.37 - - 8.32 - tags: - - none - Local development linting & style checks performed: - uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 - risk: Insecure or unmaintainable code base. - measure: Integrate static code analysis tools in IDEs. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 2 - level: 5 - description: "" - implementation: - - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Infrastructure Hardening: - MFA for admins: - uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 - risk: One factor authentication is more vulnerable to brute force attacks and - is considered less secure. - measure: Two ore more factor authentication for all privileged accounts on systems - and applications - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 4 - level: 1 - implementation: - - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS - tags: [] - - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP - tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - 9.2.4 - - 6.1.2 - - 14.2.1 - iso27001-2022: - - 5.17 - - 5.3 - - 8.25 - d3f: - - Multi-factorAuthentication - comments: "" - tags: - - none - Simple access control for systems: - uuid: 82e499d1-f463-4a4b-be90-68812a874af6 - risk: Attackers a gaining access to internal systems and application interfaces - measure: All internal systems are using simple authentication - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 - usefulness: 5 - level: 1 - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - implementation: - - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 - name: HTTP-Basic Authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ - - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e - name: VPN - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - 9.4.1 - iso27001-2022: - - 8.3 - comments: "" - tags: - - none - Usage of edge encryption at transit: - uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 - risk: Evil actors might be able to perform a man in the middle attack and sniff - confidential information (e.g. authentication factors like passwords). - measure: |- - By using encryption at the edge of traffic in transit, it is impossible - or at least harder to sniff credentials or information being outside of the organization. - - Using standard secure protocols like HTTPS is recommended. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 1 - implementation: "" - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 10.1 - iso27001-2022: - - 8.24 - comments: "" - tags: - - none - Applications are running in virtualized environments: - uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 - risk: Through a vulnerability in one service on a server, the attacker gains - access to other services running on the same server. - measure: Applications are running in a dedicated and isolated virtualized environments. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 - usefulness: 3 - level: 2 - implementation: [] - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - Backup: - uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc - risk: If errors are experienced during the deployment process you want to deploy - an old release. However, due to changes in the database this is often unfeasible. - measure: Performing automated periodical backups are used. Backup before deployment - can help facilitate deployments whilst testing the backup restore processes. - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - implementation: - - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b - name: A complete backup of persisted data might be performed*. - tags: [] - - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 - name: A Point in Time Recovery for databases should be implemented. - tags: [] - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - references: - samm2: - - TODO - iso27001-2017: - - 12.3 - - 14.2.6 - iso27001-2022: - - 8.13 - - 8.31 - comments: "" - tags: - - none - Baseline Hardening of the environment: - uuid: 5992c38c-8597-4035-89db-d15820d81c3a - risk: Using default configurations for a cluster environment leads to potential - risks. - measure: Harden environments according to best practices. Level 1 and partially - level 2 from hardening practices like 'CIS Kubernetes Bench for Security' - should be considered. - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 2 - usefulness: 4 - level: 2 - implementation: - - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Benchmark for Security - tags: [] - url: https://www.cisecurity.org/benchmark/kubernetes - - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Benchmark for Security - tags: [] - url: https://www.cisecurity.org/benchmark/docker - - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont - tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/containers/ - description: Attack matrix for containers - - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - system hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Isolated networks for virtual environments: - uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 - risk: Virtual environments in default settings are able to access other virtual - environments on the network stack. By using virtual machines, it is often - possible to connect to other virtual machines. By using docker, one bridge - is used by default so that all containers on one host can communicate with - each other. - measure: The communication between virtual environments is controlled and regulated. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 - usefulness: 5 - level: 2 - dependsOn: [] - implementation: - - uuid: 9429d52c-203d-49ae-814f-1401210887cd - name: istio - tags: [] - url: https://istio.io/ - - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 - name: bridges - tags: [] - - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - MFA: - uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de - risk: One factor authentication is more vulnerable to brute force attacks and - is considered less secure. - measure: Two ore more factor authentication for all accounts on all (important) - systems and applications - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 2 - dependsOn: - - 8098e416-e1ed-4ae4-a561-83efbe76bf57 # MFA for admins - implementation: - - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 - name: YubiKey - Smartcard - tags: [] - url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ - - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 - name: SMS - tags: [] - - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d - name: TOTP - tags: [] - url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - 9.2.4 - - 6.1.2 - - 14.2.1 - iso27001-2022: - - 5.17 - - 5.3 - - 8.25 - d3f: - - Multi-factorAuthentication - comments: "" - tags: - - none - Usage of an security account: - uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 - risk: Having security auditing in the same account as infrastructure and applications - at the cloud provide might cause evil administrators (or threat actors taking - over an account of an administrator) to alter evidence like audit logs. - measure: Usage of a separate account dedicated for security activities. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 3 - usefulness: 4 - level: 2 - implementation: "" - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 10.1 - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Usage of encryption at rest: - uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 - risk: Evil actors might be able to access data and read information, e.g. from - physical hard disks. - measure: By using encryption at rest, it is impossible or at least harder to - to read information. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - implementation: "" - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 10.1 - iso27001-2022: - - 8.24 - comments: "" - tags: - - none - Usage of test and production environments: - uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 - risk: Security tests are not running regularly because test environments are - missing - measure: A test and a production like environment is used - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 - usefulness: 4 - level: 2 - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - implementation: [] - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.1.4 - - 17.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.31 - - 8.14 - comments: "" - tags: - - none - Virtual environments are limited: - uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca - risk: Denial of service (internally by an attacker or unintentionally by a bug) - on one service effects other services - measure: All virtual environments are using resource limits on hard disks, memory - and CPU - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 3 - usefulness: 3 - level: 2 - dependsOn: - - 3a94d55e-fd82-4996-9eb3-20d23ff2a873 # Applications are running in virtualized environments - implementation: [] - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 12.1.3 - - 13.1.3 - - 17.2.1 - iso27001-2022: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 8.6 - - 8.22 - - 8.14 - comments: "" - tags: - - none - Filter outgoing traffic: - uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d - risk: A compromised infrastructure component might try to send out stolen data. - measure: Having a whitelist and explicitly allowing egress traffic provides - the ability to stop unauthorized data leakage. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 - usefulness: 2 - level: 3 - dependsOn: [] - implementation: - - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 - name: Open Policy Agent - tags: [] - url: https://www.openpolicyagent.org/ - - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 - name: firewalls - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Virtual environments are not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - Immutable infrastructure: - uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 - risk: The availability of IT systems might be disturbed due to components failures - measure: Redundancies in the IT systems - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 3 - dependsOn: - - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code - implementation: - - uuid: b206481f-9c66-45e2-843c-37c5730580cd - name: Remove direct access to infrastructure - tags: [] - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 17.2.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.14 - comments: "" - tags: - - none - Infrastructure as Code: - uuid: 8b994601-575e-4ea5-b228-accb18c8e514 - risk: No tracking of changes in systems might lead to errors in the configuration. - In additions, it might lead to unauthorized changes. An examples is jenkins. - measure: Systems are setup by code. A full environment can be provisioned. In - addition, software like Jenkins 2 can be setup and configured in in code too. - The code should be stored in a version control system. - difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 4 - usefulness: 4 - level: 3 - implementation: - - uuid: b0931397-2402-44f1-814b-63292ab4a339 - name: GitOps - tags: [] - url: https://www.redhat.com/en/topics/devops/what-is-gitops - - uuid: 73747d35-2185-4f22-94a0-723288fa283c - name: Ansible - tags: [] - url: https://github.com/ansible/ansible - - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce - name: Chef - tags: [] - url: https://github.com/chef/chef - - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 - name: Puppet - tags: [] - url: https://github.com/puppetlabs/puppet - - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 - name: Jenkinsfile - tags: [] - url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.1.1 - - 12.1.2 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.37 - - 8.32 - comments: "" - tags: - - none - Limitation of system events: - uuid: e5386abf-9154-4752-a1a8-c3a8900f732d - risk: System events (system calls) can lead to privilege escalation. - measure: System calls are limited. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 5 - level: 3 - dependsOn: - - 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 # Audit of system events - implementation: - - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd - name: seccomp - tags: [] - url: https://man7.org/linux/man-pages/man2/seccomp.2.html - - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff - name: strace - tags: [] - url: https://man7.org/linux/man-pages/man1/strace.1.html - - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - System hardening is not explicitly covered by ISO 27001 - too specific - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Role based authentication and authorization: - uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 - risk: Everyone is able to get unauthorized access to information on systems - or to modify information unauthorized on systems. - measure: The usage of a (role based) access control helps to restrict system - access to authorized users. And enhancement is to use attribute based access - control. - difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 - name: Directory Service - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ - - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e - name: Plugins - tags: [] - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - 9.4.1 - iso27001-2022: - - 8.3 - comments: "" - tags: - - none - Usage of internal encryption at transit: - uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 - risk: Evil actors within the organization of traffic in transit might be able - to perform a man in the middle attack and sniff confidential information (e.g. - authentication factors like passwords) - measure: By using encryption internally, e.g. inside of a cluster, it is impossible - or at least harder to sniff credentials. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 3 - usefulness: 4 - level: 3 - implementation: "" - references: - samm2: - - I-SD-B-2 - iso27001-2017: - - 10.1 - iso27001-2022: - - 8.24 - comments: "" - tags: - - none - Usage of security by default for components: - uuid: 11b3848e-e931-4146-a35d-35409ada24ee - risk: Components (images, libraries, applications) are not hardened. - measure: Hardening of components is important, specially for image on which - other teams base on. Hardening should be performed on the operation system - and on the services inside (e.g. Nginx or a Java-Application). - difficultyOfImplementation: - knowledge: 4 - time: 3 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c - name: 'For applications: Check default encoding' - tags: [] - - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf - name: managing secrets - tags: [] - url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ - - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 - name: crypto - tags: [] - - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 - name: authentication - tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - WAF baseline: - uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b - risk: Vulnerable input, such as exploits, can infiltrate the application via - numerous entry points, posing a significant security threat. - measure: |- - Implementing a web application firewall (WAF) is a critical security control. At a baseline level, the objective is to finely balance the reduction of false positives, maintaining user experience, against a potential increase in the less noticeable false negatives. - Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. - description: | - A baseline WAF configuration provides essential defense against common vulnerabilities, acting as a first line of automated threat detection and response. - Steps: - - Configure WAF in alert mode to establish traffic patterns - - Analyze alerts and adjust sensitivity to optimize for fewer false positives - - Gradually switch to a proactive blocking stance as confidence in the accuracy of the rules increases - - It's crucial to monitor and update the WAF configuration to adapt to evolving threats and minimize the potential for both false positives and false negatives. - - There are debates on how useful a WAF is for APIs. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 3 - usefulness: 3 - level: 3 - dependsOn: - - e1f37abb-d848-4a3a-b3df-65e91a89dcb7 # Context-aware output encoding - implementation: [] - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: ~ - tags: - - none - Hardening of the Environment: - uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 - risk: Using default configurations for a cluster environment leads to potential - risks. - measure: Harden environments according to best practices. Level 2 and partially - level 3 from hardening practices like 'CIS Kubernetes Bench for Security' - should be considered. - difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 2 - usefulness: 3 - level: 4 - implementation: - - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff - name: CIS Kubernetes Benchmark for Security - tags: [] - url: https://www.cisecurity.org/benchmark/kubernetes - - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f - name: CIS Docker Benchmark for Security - tags: [] - url: https://www.cisecurity.org/benchmark/docker - - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef - name: For example for Cont - tags: [] - description: 'For example for Containers: Deny running containers as root, - deny using advanced privileges, deny mounting of the hole filesystem, ...' - url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ - - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b - name: Attack Matrix Cloud - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/cloud/ - description: Attack matrix for cloud - - uuid: 59881520-4c69-4922-a44e-99044a77de2b - name: Attack Matrix Containers - tags: - - mitre - url: https://attack.mitre.org/matrices/enterprise/containers/ - description: Attack matrix for containers - - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 - name: Attack Matrix Kubernetes - tags: - - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ - description: Attack matrix for kubernetes - - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af - name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ - tags: - - documentation - - cluster - - kubernetes - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - Production near environments are used by developers: - uuid: e14de741-94b3-447c-8b07-eea947d82e61 - risk: In case an errors occurs in production, the developer need to be able - to create a production near environment on a local development environment. - measure: Usage of infrastructure as code helps to create a production near environment. - The developer needs to be trained in order to setup a local development environment. - In addition, it should be possible to create production like test data. Often - personal identifiable information is anonymized in order to comply with data - protection laws. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 - usefulness: 4 - level: 4 - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code - implementation: [] - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - 12.1.4 - - 17.2.1 - iso27001-2022: - - 8.31 - - 8.14 - comments: "" - tags: - - none - Usage of a chaos technology: - uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe - risk: Due to manual changes on a system, they are not replaceable anymore. In - case of a crash it might happen that a planned redundant system is unavailable. - In addition, it is hard to replay manual changes. - measure: A randomized periodically shutdown of systems makes sure, that nobody - will perform manual changes to a system. - difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 5 - usefulness: 3 - level: 4 - implementation: - - uuid: c117e79b-8223-4e55-9da5-efbf5d741c15 - name: Chaos Monkey - tags: - - chaos - - testing - url: https://github.com/Netflix/chaosmonkey - description: Chaos Monkey is a resiliency tool that helps applications tolerate - random instance failures. Chaos Monkey randomly terminates virtual machine - instances and containers that run inside of your production environment. - Exposing engineers to failures more frequently incentivizes them to build - resilient services. - references: - samm2: - - O-EM-A-3 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 17.1.3 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.29 - comments: "" - tags: - - none - WAF medium: - uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium - risk: The threat from malicious inputs remains high, with exploits seeking to - exploit any vulnerabilities present at the various points of entry to the - application. - measure: |- - A WAF deployed with a medium level of protection strengthens the security posture by striking a more advanced balance between the detection of genuine threats and the minimization of false alarms. - Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. - description: "A medium-level WAF configuration builds upon the baseline to offer - a more nuanced and responsive defense mechanism against a wider array of threats.\n\nSample - steps:\n - Implement an enhanced set of WAF rules based on baseline data\n - \ - Continuous monitoring and fine-tuning of the WAF configuration\n - Develop - a strategic incident response plan utilizing WAF insights \n \nThe - medium configuration requires diligent management and continuous improvement - to address new vulnerabilities while maintaining the integrity of application - access.\n\nThere are debates on how useful a WAF is for APIs.\n" - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 4 - usefulness: 3 - level: 4 - dependsOn: - - f0e01814-3b88-4bd0-a3a9-f91db001d20b # WAF baseline - implementation: [] - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: ~ - tags: - - none - WAF Advanced: - uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced - risk: The presence of sophisticated threats necessitates a robust defense strategy - where application inputs are meticulously scrutinized for security breaches, - including advanced persistent threats and zero-day vulnerabilities. - measure: |- - An advanced WAF protection level includes rigorous input validation, rejecting any parameters not explicitly required, and custom rule sets that are dynamically updated in response to emerging threats. - The advanced WAF setup is designed to ensure all data is in the correct format and any superfluous input parameters are automatically rejected. It includes machine learning algorithms to detect anomalies, custom-developed rules for real-time traffic analysis, and seamless integration with existing security infrastructures to adapt to the ever-changing threat landscape. - description: | - This advanced configuration goes beyond typical WAF implementations by enforcing strict input format checks and parameter validation to prevent any unauthorized or malformed data from compromising the application. - - Sample Steps: - - Implement strict data type and format validation rules to ensure only correctly formatted data is processed. - - Establish a denylist for all parameters that are not explicitly required, blocking them by default. - - Develop and continuously refine custom rulesets based on the application's traffic patterns, user behavior, and known vulnerabilities. - - Integrate machine learning algorithms to enhance anomaly detection and automatic rule adjustment. - - Correlate and analyze WAF logs with other security systems like SIEM for comprehensive threat intelligence. - - Conduct regular red team exercises to test and validate the effectiveness of the WAF configurations against simulated advanced attack scenarios. - - Activate automated threat response mechanisms to immediately neutralize detected threats. - - Embracing an advanced WAF setup requires a proactive approach, with continuous improvement and updating of security measures to ensure all inputs are scrutinized and validated, thus maintaining a resilient security posture against sophisticated attacks. - - There are debates on how useful a WAF is for APIs. - difficultyOfImplementation: - knowledge: 5 - time: 5 - resources: 5 - usefulness: 4 - level: 5 - dependsOn: - - f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium # WAF medium - implementation: [] - references: - samm2: - - O-EM-A-2 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: ~ - tags: - - none -Information Gathering: - Logging: - Centralized system logging: - uuid: 4eced38a-7904-4c45-adb0-50b663065540 - risk: Local stored system logs can be unauthorized manipulated by attackers - or might be corrupt after an incident. In addition, it is hard to perform - a aggregation of logs. - measure: By using centralized logging logs are protected against unauthorized - modification. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 2 - level: 1 - implementation: - - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 - name: rsyslog - url: https://www.rsyslog.com/ - tags: - - tool - - logging - - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.4.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.15 - comments: "" - tags: - - none - Centralized application logging: - uuid: fe875e17-ae4a-45f8-a359-244aa4fcbc04 - risk: Local stored logs can be unauthorized manipulated by attackers with system - access or might be corrupt after an incident. In addition, it is hard to perform - an correlation of logs. This leads attacks, which can be performed silently. - measure: A centralized logging system is used and applications logs (including - application exceptions) are shipped to it. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 5 - level: 2 - dependsOn: - - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting - implementation: [] - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.4.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.15 - tags: - - none - Logging of security events: - uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb - description: | - Implement logging of security relevant events. The following events tend to be security relevant: - - successful/failed login/logout - - creation, change, and deletion of users - - errors during input validation and output creation - - exceptions and errors with security in their name - - transactions of value (e.g., financial transactions, costly operations) - - :unicorn: (special things of your application) - measure: Security-relevant events like login/logout or creation, change, deletion - of users should be logged. - assessment: | - - Show which events are logged. - - Show a test for one event logging. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 4 - level: 2 - credits: | - [AppSecure-nrw](https://github.com/AppSecure-nrw/security-belts/blob/master/orange/logging-of-security-events.md) - implementation: - - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 - name: fluentd - tags: - - tool - url: https://www.fluentd.org/ - - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 - name: bash - tags: - - tool - url: https://www.gnu.org/software/bash/ - - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c - name: OWASP Logging CheatSheet - url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html - tags: - - logging - - documentation - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - 12.4.1 - iso27001-2022: - - 8.15 - risk: |- - * No track of security-relevant events makes it harder to analyze an incident. - * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. - comments: "" - tags: - - none - Analyze logs: - uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 - risk: Not aware of attacks happening. - measure: Check logs for keywords. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 - name: SigmaHQ - tags: [] - url: https://github.com/SigmaHQ/sigma - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - tags: - - none - Visualized logging: - uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 - risk: System and application protocols are not visualized properly which leads - to no or very limited logging assessment. Specially developers might have - difficulty to read applications logs with unusually tools like the Linux tool - 'cat' - measure: Protocols are visualized in a simple to use real time monitoring system. - The GUI gives the ability to search for special attributes in the protocol. - difficultyOfImplementation: - knowledge: 1 - time: 3 - resources: 3 - usefulness: 4 - level: 3 - dependsOn: - - 4eced38a-7904-4c45-adb0-50b663065540 # Centralized system logging - - fe875e17-ae4a-45f8-a359-244aa4fcbc04 # Centralized application logging - implementation: - - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 - name: ELK-Stack - tags: [] - url: https://www.elastic.co/elk-stack - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.4.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.15 - comments: "" - tags: - - none - Correlation of security events: - uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 - risk: Detection of security related events with hints on different systems/tools/metrics - is not possible. - measure: Events are correlated on one system. For example the correlation and - visualization of failed login attempts combined with successful login attempts. - difficultyOfImplementation: - knowledge: 4 - time: 4 - resources: 4 - usefulness: 3 - level: 5 - dependsOn: - - 7c735089-6a83-419f-8b27-c1e676cedea1 # Visualized logging - - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.4.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.15 - comments: "" - tags: - - none - PII logging concept: - uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 - risk: Personal identifiable information (PII) is logged and the privacy law - (e.g. General Data Protection Regulation) is not followed. - measure: A concept how to log PII is documented and applied. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 5 - implementation: - - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 - name: rsyslog - url: https://www.rsyslog.com/ - tags: - - tool - - logging - - uuid: 7a8fad2e-d642-4972-8501-74591b23feab - name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html - tags: - - tool - - logging - - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 - name: fluentd - tags: - - tool - url: https://www.fluentd.org/ - - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 - name: bash - tags: - - tool - url: https://www.gnu.org/software/bash/ - references: - samm2: - - O-OM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.4.1 - - 18.1.1 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.15 - - 5.31 - comments: "" - tags: - - none - Monitoring: - Simple application metrics: - uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 - risk: Attacks on an application are not recognized. - measure: |- - Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: - - Authentication attempts (successful/failed logins) - - Transaction volumes and patterns (e.g. orders, payments) - - API call rates and response times - - User session metrics - - Resource utilization - - Example: An e-commerce application normally processes 100 orders per hour. A sudden spike to 1000 orders per hour could indicate either: - - A legitimate event (unannounced marketing campaign, viral social media post) - - A security incident (automated bulk purchase bots, credential stuffing attack) - - By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 5 - level: 1 - implementation: - - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c - name: Prometheus - tags: [] - url: https://prometheus.io/ - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - 12.4.1 - iso27001-2022: - - 8.15 - comments: "" - tags: - - none - Simple budget metrics: - uuid: f08a3219-6941-43ec-8762-4aff739f4664 - risk: Not getting notified about reaching the end of the budget (e.g. due to - a denial of service) creates unexpected costs. - measure: Cloud providers often provide insight into budgets. A threshold and - alarming for the budget is set. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 5 - level: 1 - implementation: - - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - 12.1.3 - iso27001-2022: - - 8.6 - comments: "" - tags: - - none - Simple system metrics: - uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 - risk: Without simple metrics analysis of incidents are hard. In case an application - uses a lot of CPU from time to time, it is hard for a developer to find out - the source with Linux commands. - measure: Gathering of system metrics helps to identify incidents and specially - bottlenecks like in CPU usage, memory usage and hard disk usage. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 5 - assessment: | - Are system metrics gathered? - level: 1 - implementation: - - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 - name: collected - tags: [] - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - 12.1.3 - iso27001-2022: - - 8.6 - comments: "" - tags: - - none - Alerting: - uuid: 8a442d8e-0eb1-4793-a513-571aef982edd - risk: Incidents are discovered after they happened. - measure: | - Thresholds for metrics are set. In case the thresholds are reached, alarms are send out. Which should get attention due to the critically. - difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 5 - usefulness: 5 - level: 2 - dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: [] - references: - samm2: - - O-IM-A-2 - - I-DM-A-3 - iso27001-2017: - - 16.1.2 - - 16.1.4 - - 12.1.4 - iso27001-2022: - - 6.8 - - 5.25 - - 8.31 - comments: "" - tags: - - none - Monitoring of costs: - uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e - risk: Not monitoring costs might lead to unexpected high resource consumption - and a high invoice. - measure: Implement cost budgets. Setting of an alert threshold and sending out - errors when it is reached. In the best case, a second threshold with a limit - is set so that the cost can not go higher. - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - 12.1.3 - iso27001-2022: - - 8.6 - comments: "" - tags: - - none - Visualized metrics: - uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 - risk: Not visualized metrics lead to restricted usage of metrics. - measure: Metrics are visualized in real time in a user friendly way. - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - 12.1.3 - iso27001-2022: - - 8.6 - comments: "" - tags: - - none - Advanced availability and stability metrics: - uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 - risk: Trends and advanced attacks are not detected. - measure: Advanced metrics are gathered in relation to availability and stability. - For example unplanned downtime's per year. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - 12.1.3 - iso27001-2022: - - 8.6 - comments: "" - tags: - - none - Audit of system events: - uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 - risk: System events (system calls) trends and attacks are not detected. - measure: Gathering of system calls. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: - - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 - name: Falco - tags: - - falco - - systemcall - - monitoring - url: https://github.com/falcosecurity/falco - description: | - Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Deactivation of unused metrics: - uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 - risk: High resources are used while gathering unused metrics. - measure: Deactivation of unused metrics helps to free resources. - difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 5 - usefulness: 5 - level: 3 - dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: [] - references: - samm2: - - O-IM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.1.3 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.6 - comments: "" - tags: - - none - Grouping of metrics: - uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b - risk: The analysis of metrics takes long. - measure: Meaningful grouping of metrics helps to speed up analysis. - difficultyOfImplementation: - knowledge: 2 - time: 4 - resources: 2 - usefulness: 2 - level: 3 - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 12.1.3 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.6 - comments: "" - tags: - - none - Targeted alerting: - uuid: d6f06ae8-401a-4f44-85df-1079247fa030 - risk: People are bored (ignorant) of incident alarm messages, as they are not - responsible to react. - measure: By the definition of target groups for incidents people are only getting - alarms for incidents they are in charge for. - difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 5 - usefulness: 5 - level: 3 - dependsOn: - - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting - implementation: [] - references: - samm2: - - O-IM-A-2 - - I-DM-A-3 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 16.1.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.26 - comments: "" - tags: - - none - Advanced app. metrics: - uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf - risk: People are not looking into tests results. Vulnerabilities not recolonized, - even they are detected by tools. - measure: All defects from the dimension Test- and Verification are instrumented. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 - usefulness: 4 - level: 4 - dependsOn: - - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Coverage and control metrics: - uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d - risk: The effectiveness of configuration, patch and vulnerability management - is unknown. - measure: "Usage of Coverage- and control-metrics to show the effectiveness of - the security program. Coverage is the degree in \n which a specific - security control for a specific target group is applied with all resources.\n - \ The control degree shows the actual application of security standards - and security-guidelines. Examples are gathering information on anti-virus, - anti-rootkits, patch management, server configuration and vulnerability management." - difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 2 - usefulness: 4 - level: 4 - dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: - - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Defense metrics: - uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 - risk: IDS/IPS systems like packet- or application-firewalls detect and prevent - attacks. It is not known how many attacks has been detected and blocked. - measure: | - Gathering of defense metrics like TCP/UDP sources enables to assume the geographic location of the request. - Assuming a Kubernetes cluster with an egress-traffic filter (e.g. IP/domain based), an alert might be send out in case of every violation. For ingress-traffic, alerting might not even be considered. - difficultyOfImplementation: - knowledge: 3 - time: 5 - resources: 2 - usefulness: 4 - level: 4 - dependsOn: - - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - - 6df508ef-86fc-4c22-bd9f-646c3127ce7d # Filter outgoing traffic - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - 12.4.1 - - 13.1.1 - iso27001-2022: - - 8.15 - - 8.2 - comments: "" - tags: - - none - Screens with metric visualization: - uuid: 8746647c-638c-473f-8e17-82c068e4c311 - risk: Security related information is discovered too late during an incident. - measure: By having an internal accessible screen with a security related dashboards - helps to visualize incidents. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 5 - level: 4 - dependsOn: - - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 16.1.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.26 - comments: "" - tags: - - none - Metrics are combined with tests: - uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 - risk: Changes might cause high load due to programming errors. - measure: Metrics during tests helps to identify programming errors. - difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 2 - usefulness: 5 - level: 5 - dependsOn: - - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics - implementation: [] - references: - samm2: - - O-IM-A-2 - iso27001-2017: - - not explicitly covered by ISO 27001 - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Test KPI: - Number of vulnerabilities/severity: - uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 - risk: Failing to convey the number of vulnerabilities by severity might undermine - the effectiveness of product teams. This might lead to ignorance of findings. - measure: Measurement and communication of vulnerabilities per severity for components - like applications. At least quarterly. - description: |- - Communication can be performed in a simple way, e.g. text based during the build process. - This activity depends on at least one security testing implementation. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: [] - implementation: [] - references: - samm2: - - I-DM-B-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurement - Number of vulnerabilities/severity/layer: - uuid: 0ec92899-a5cb-4649-984b-2fb1d6c784ad - risk: Failing to convey the number of vulnerabilities by severity and layer - (app/infra) might undermine the effectiveness of product teams. This might - lead to ignorance of findings. - measure: Measurement and communication of vulnerabilities per severity for components - like applications and split it depending on the layer (e.g. app/infra). At - least quarterly. - description: |- - Communication can be performed in a simple way, e.g. text based during the build process. - This activity depends on at least one security testing implementation. - Layers to consider (SCA): - - Cloud provider (if insights are possible) - - Runtimes, e.g. Kubernetes nodes - - Base images and container images - - Application - - Layers to consider SAST/DAST: - - Cloud provider - - Runtime, e.g. Kubernetes - - Base images and container images - - Application - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: [] - implementation: [] - references: - samm2: - - I-DM-B-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurement - Patching mean time to resolution via PR: - uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 - risk: Without measuring Mean Time to Resolution (MTTR) related to patching, - it is challenging to identify delays in the patching process. Unaddressed - vulnerabilities can be exploited by attackers, leading to potential security - breaches and data loss. - measure: "Measurement and communication of patching Mean Time to Resolution - (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least - on a quarterly basis.\nThis includes the measurement of the existence of a - properly configured automated pull request (PR) tool (e.g., Dependabot or - Renovate) in a repository. \nIn addition, the measurement of the time from - opening an automated PR to merging it.\n\nAverage time to patch is visualized - per component/project/team." - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches - implementation: [] - references: - samm2: - - I-DM-B-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - patching - - metrics - - vmm-measurements - Fix rate per repo/product: - uuid: cf0d600e-114d-4887-9059-d81c53805f0d - risk: "Not communicating how many applications are adhering to SLAs based on - the criticality of vulnerabilities can lead to delayed remediation of \ncritical - security issues, increasing the risk of exploitation and potential damage - to the organization." - measure: "Measurement and communication of the number of vulnerabilities handled - per severity level for components such as applications, ensuring alignment - with SLAs. \nThe rate should be broken down by team, product, application, - repository, and/or service. This analysis should be conducted at least quarterly." - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - I-DM-B-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurements - Generation of response statistics: - uuid: c922981b-65ed-40f3-a947-96fee9a0125f - risk: No or delayed reaction to findings leads to potential exploitation of - findings. - measure: Creation and response statistics (e.g. Mean Time to Resolution) of - findings. This is also referred to as _Mean Time to Resolve_. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - dependsOn: - - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system - level: 3 - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - I-DM-B-2 - - I-SB-B-3 - iso27001-2017: - - 16.1.4 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurements - comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) - generates statistics from OWASP DefectDojo and places the results in a [Github - repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). - SLA per criticality: - uuid: 51f3fce5-b5c8-4683-8c41-e785fe4f3b5f - risk: "Not communicating how many applications are adhering to SLAs based on - the criticality of vulnerabilities can lead to delayed remediation of \ncritical - security issues, increasing the risk of exploitation and potential damage - to the organization." - measure: "Measurement and communication of how many of the vulnerabilities handling - per severity for components like applications are aligned to SLAs. \nThis - is performed for the hole organization and doesn't need to be broken down - (yet) on team/product/application. \nAt least quarterly." - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - dependsOn: [] - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - I-DM-B-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurements - Patching mean time to resolution via production: - uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f - risk: Without measuring Mean Time to Resolution (MTTR) related to patching, - it is challenging to identify delays in the patching process. Unaddressed - vulnerabilities can be exploited by attackers, leading to potential security - breaches and data loss. - measure: |- - Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. - Average time to patch is visualized per component/project/team. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 2 - usefulness: 3 - level: 4 - dependsOn: - - 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches - implementation: [] - references: - samm2: - - I-DM-B-2 - iso27001-2017: - - 16.1.4 - iso27001-2022: - - 5.25 - tags: - - patching - - metrics - - vmm-measurements -Test and Verification: - Application tests: - Security unit tests for important components: - uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 - risk: Vulnerabilities are rising due to code changes. - measure: Usage of unit tests to test important security related features like - authentication and authorization. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 - usefulness: 3 - level: 2 - comments: | - The integration of module tests takes place during development instead, it highlights vulnerabilities in sub-routines, functions, modules, libraries etc. checked. - A sample implementation of unit tests are explained in the video [Shift-Left-Security with the Security Test Pyramid - Andreas Falk](https://www.youtube.com/watch?v=TzFZy3f7d8E) starting with minute 9. - implementation: - - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d - name: JUnit - tags: - - unittest - url: https://junit.org/junit5/ - - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 - name: Karma - tags: [] - url: https://karma-runner.github.io - references: - samm2: - - V-RT-A-3 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - tags: - - none - Security integration tests for important components: - uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 - risk: Vulnerabilities are rising due to code changes in a complex microservice - environment. - measure: Implementation of essential security related integration tests. For - example for authentication and authorization. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 2 - usefulness: 2 - level: 3 - references: - samm2: - - V-RT-A-3 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - Smoke Test: - uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a - risk: During a deployment an error might happen which leads to non-availability - of the system, a part of the system or a feature. - measure: Integration tests are performed against the production environment - after each deployment. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 2 - level: 4 - implementation: [] - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - references: - samm2: - - V-RT-A-3 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - High coverage of security related module and integration tests: - uuid: 67667c97-c33e-4306-a4e5-e7b1d8e10c5a - risk: Vulnerabilities are rising due to code changes in a complex microservice - environment in not important components. - measure: Implementation of security related tests via unit tests and integration - tests. Including the test of libraries, in case the are not tested already. - difficultyOfImplementation: - knowledge: 5 - time: 5 - resources: 3 - usefulness: 3 - level: 5 - implementation: [] - references: - samm2: - - V-RT-B-3 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - Consolidation: - Simple false positive treatment: - uuid: c1acc8af-312e-4503-a817-a26220c993a0 - risk: As false positive occur during each test, all vulnerabilities might be - ignored. Specially, if tests are automated an run daily. - measure: |- - Findings from security tests must be triaged and outcomes persisted/documented to: - - Prevent re-analysis of known issues in subsequent test runs - - Track accepted risks vs false positives - - Enable consistent decision-making across teams - - At this maturity level, a simple tracking system suffices - tools need only distinguish between "triaged" and "untriaged" findings, without complex categorization. Some tools refer to this as "suppression" of findings. - - Samples for false positive handling: - - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) - - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) - - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 4 - level: 1 - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - references: - samm2: - - I-DM-A-1 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 16.1.6 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.27 - comments: "" - tags: - - none - Treatment of defects with severity high or higher: - uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 - risk: Vulnerabilities with severity high or higher are not visible. - measure: Vulnerabilities with severity high or higher are added to the quality - gate. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 1 - comments: False positive analysis, specially for static analysis, is time consuming. - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - 16.1.4 - - 12.6.1 - iso27001-2022: - - 8.8 - - 5.25 - implementation: [] - tags: - - vuln-action - - defect-management - Artifact-based false positive treatment: - uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f - risk: Without artifact-specific false positive handling, teams must repeatedly - triage the same findings across different versions or deployments of the same - component, leading to inefficient use of security resources. - measure: "Implement false positive marking and temporary acceptance of findings - \nbased on specific artifacts (applications, components, or repositories).\nThis - allows teams to suppress findings for specific versions or builds\nwhile maintaining - visibility for future releases." - description: |- - Artifact-based false positive treatment enables more granular control - over finding suppression by linking decisions to specific code artifacts, - container images, or application versions. This approach helps maintain - security oversight while reducing repeated analysis overhead. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 2 - dependsOn: - - c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - references: - samm2: - - I-DM-A-2 - - I-DM-B-2 - - I-SB-B-3 - iso27001-2017: - - 16.1.4 - - 16.1.6 - iso27001-2022: - - 5.25 - - 5.27 - tags: - - false-positive - - defect-management - Simple visualization of defects: - uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 - risk: The security level of a component is not visible. Therefore, the motivation - to enhance the security is not give. - measure: Vulnerabilities are simple visualized. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 2 - implementation: - - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 - name: LogParser Jenkins Plugins - tags: [] - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - comments: "" - tags: - - none - Fix based on accessibility: - uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed - risk: Overwhelming volume of security findings from automated testing tools. - This might lead to ignorance of findings. - measure: Implement a simple risk-based prioritization framework for vulnerability - remediation based on accessibility of the applications. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 3 - meta: - implementationGuide: |- - Develop a scoring system for asset accessibility, considering factors like: - - Whether the asset is internet-facing (highly recommended) - - The number of network hops required to reach the asset (recommended) - - Authentication requirements for access (recommended) - dependsOn: - - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - implementation: ~ - references: - samm2: - - I-DM-A-3 - iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vuln-action - - defect-management - Global false positive treatment: - uuid: 9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c - risk: Without centralized false positive management across environments, organizations - face inconsistent security decisions, duplicated analysis efforts, and potential - security gaps when the same findings are handled differently across applications - and teams. - measure: "Implement global false positive and acceptance management that applies - \nconsistently across all applications. This enables organization-wide security - decisions and reduces redundant \nanalysis of common false positives." - description: "Global false positive treatment allows (security) teams to make - \norganization-wide decisions about specific vulnerabilities or finding \npatterns. - When a finding is marked as a false positive or temporarily \naccepted at - the global level, this decision automatically applies to \nall applications - in the specified environment, ensuring consistency \nand operational efficiency." - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment - - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system - implementation: ~ - references: - samm2: - - I-DM-B-2 - - I-DM-A-3 - - I-SB-B-3 - iso27001-2017: - - 16.1.3 - - 16.1.4 - - 16.1.6 - iso27001-2022: - - 6.8 - - 5.25 - - 5.27 - tags: - - false-positive - - defect-management - Integration in development process: - uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d - risk: "Not integrating vulnerability handling into the development process may - result in product teams ignoring findings. \n\nSecurity joke: We will gain - 100% false negatives." - measure: Integration of findings into the development process. E.g. adding findings - to the backlog of products teams. - description: |- - Validating Findings by Security Engineers Pros: - - Ensures accuracy and relevance of findings before they reach product teams - - Reduces false positives, saving development teams time and effort - - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities - - Validating Findings by Security Engineers Cons: - - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations - - May slow down the process if security engineers are overloaded with validation tasks - - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application - - Pushing Findings Directly to Product Teams Pros: - - Accelerates the process by immediately notifying product teams of potential vulnerabilities - - Empowers product teams to take swift action in addressing security issues - Pushing Findings Directly to Product Teams Cons: - - Increases the workload on product teams, potentially leading to frustration - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - dependsOn: [] - implementation: - - uuid: 889444eb-de68-4367-bada-a66f8cb9733a - name: Jira - tags: - - documentation - - issue - - proprietary - url: https://jira.atlassian.com/ - description: Jira is a bug tracking and project management tool developed - by Atlassian, used by development teams for tracking issues, planning sprints, - and managing software releases. It offers features for creating and managing - tasks, assigning them to team members, and monitoring progress through customizable - workflows and dashboards. - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - I-DM-A-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - vmm-measurements - Integration of vulnerability issues into the development process: - uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e - risk: To read console output of the build server to search for vulnerabilities - might be difficult. Also, to check a vulnerability management system might - not be a daily task for a developer. - measure: Vulnerabilities are tracked in the teams issue system (e.g. jira). - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 2 - level: 3 - implementation: - - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a - name: SAST - tags: [] - description: 'At SAST (Static Application Security Testing): Server-side / - client-side teams can easily be recorded. With microservice architecture - individual microservices can be used usually Teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ - - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 - name: DAST - tags: [] - description: 'At DAST (Dynamic Application Security Testing): vulnerabilities - are classified and can be assigned to server-side and client-side teams.' - url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 16.1.4 - - 16.1.5 - - 16.1.6 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 5.25 - - 5.26 - - 5.27 - comments: "" - tags: - - none - Treatment of defects per protection requirement: - uuid: 2b7cc923-bdaf-43e3-8fb4-a995b7783969 - risk: "Not defining the protection requirement of applications can lead to wrong - prioritization, delayed remediation of \ncritical security issues, increasing - the risk of exploitation and potential damage to the organization." - measure: "Defining the protection requirement and the corresponding handling - of vulnerabilities per severity for components like applications are aligned - to SLAs. \n This is performed for the hole organization and doesn't need to - be broken down (yet) on team/product/application. \n At least quarterly." - description: |- - The protection requirements for an application should consider: - - Data criticality - - Application accessibility (internal vs. external) - - Regulatory compliance - - Other relevant factors - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - dependsOn: [] - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f - name: DefectDojo Client - tags: - - Defectdojo - - statistics - url: https://github.com/SDA-SE/defectdojo-client - description: | - This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. - references: - samm2: - - I-DM-A-2 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - tags: - - vulnerability-mgmt - - metrics - - vmm-measurements - Treatment of defects with severity middle: - uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 - risk: Vulnerabilities with severity middle are not visible. - measure: Vulnerabilities with severity middle are added to the quality gate. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 3 - comments: False positive analysis, specially for static analysis, is time consuming. - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - 16.1.4 - - 12.6.1 - iso27001-2022: - - 8.8 - - 5.25 - implementation: [] - tags: - - vuln-action - - defect-management - Usage of a vulnerability management system: - uuid: 85ba5623-84be-4219-8892-808837be582d - risk: Maintenance of false positives in each tool enforces a high workload. - In addition a correlation of the same finding from different tools is not - possible. - measure: Aggregation of vulnerabilities in one tool reduce the workload to handle - them, e.g. mark as false positives. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 2 - usefulness: 2 - dependsOn: - - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation - - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion - - 185d5a74-19dc-4422-be07-44ea35226783 # Office Hours - level: 3 - description: "For known vulnerabilities a processes to estimate the exploit - ability of a vulnerability is recommended.\n\nTo implement a security culture - including training, office hours and security champions can help integrating - \nsecurity scanning at scale. Such activities help to understand why a vulnerability - is potentially critical and needs handling." - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 - name: SecObserve - tags: - - vulnerability management system - url: https://github.com/SecObserve/SecObserve - description: | - SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates into CI/CD pipelines. - references: - samm2: - - I-DM-A-3 - iso27001-2017: - - 12.6.1 - - 16.1.3 - - 16.1.4 - - 16.1.5 - - 16.1.6 - iso27001-2022: - - 8.8 - - 6.8 - - 5.25 - - 5.26 - - 5.27 - tags: - - none - Advanced visualization of defects: - uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 - risk: Correlation of the vulnerabilities of different tools to have an overview - of the the overall security level per component/project/team is not given. - measure: Findings are visualized per component/project/team. - difficultyOfImplementation: - knowledge: 2 - time: 4 - resources: 1 - usefulness: 2 - level: 4 - implementation: - - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb - name: OWASP DefectDojo - tags: - - vulnerability management system - - owasp - url: https://github.com/DefectDojo/django-DefectDojo - description: | - DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. - - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 - name: Purify - tags: - - vulnerability management system - url: https://github.com/faloker/purify/ - description: | - The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde - name: Business friendly vulnerability management metrics - url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 - tags: - - documentation - - vulnerability - - vulnerability management system - references: - samm2: - - I-DM-A-3 - iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - comments: "" - tags: - - none - Reproducible defect tickets: - uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 - risk: Vulnerability descriptions are hard to understand by staff from operations - and development. - measure: Vulnerabilities include the test procedure to give the staff from operations - and development the ability to reproduce vulnerabilities. This enhances the - understanding of vulnerabilities and therefore the fix have a higher quality. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 2 - usefulness: 2 - level: 4 - implementation: [] - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - 16.1.4 - - 8.2.1 - - 8.2.2 - - 8.2.3 - iso27001-2022: - - 5.25 - - 5.12 - - 5.13 - - 5.1 - comments: "" - tags: - - none - Treatment of all defects: - uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d - risk: Vulnerabilities with severity low are not visible. - measure: All vulnerabilities are added to the quality gate. - difficultyOfImplementation: - knowledge: 3 - time: 4 - resources: 1 - usefulness: 2 - level: 5 - implementation: [] - references: - samm2: - - I-DM-A-2 - iso27001-2017: - - 16.1.4 - - 12.6.1 - iso27001-2022: - - 8.8 - - 5.25 - tags: - - vuln-action - - defect-management - comments: "" - Dynamic depth for applications: - Coverage of client side dynamic components: - uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e - risk: Parts of the service are not covered during the scan, because JavaScript - is not getting executed. Therefore, the coverage of client-side dynamic components - is limited, leading to potential security risks and undetected vulnerabilities. - measure: Usage of a spider which executes dynamic content like JavaScript, e.g. - via Selenium. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 4 - level: 2 - dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - implementation: - - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb - name: Ajax Spider - tags: [] - url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ - comments: "" - tags: - - none - Simple Scan: - uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 - risk: Deficient security tests are performed. Simple vulnerabilities are not - detected and missing security configurations (e.g. headers) are not set. Fast - feedback is not given. - measure: A simple scan is performed to get a security baseline. In case the - test is done in under 10 minutes, it should be part of the build and deployment - process. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 1 - level: 2 - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - implementation: - - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 - name: Arachni - url: https://github.com/Arachni/arachni - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - Usage of different roles: - uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 - risk: Parts of the service are not covered during the scan, because a login - is not performed. - measure: Integration of authentication with all roles used in the service. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 2 - level: 2 - dependsOn: - - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - implementation: - - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 - name: Zest - url: https://www.zaproxy.org/docs/desktop/addons/zest/ - tags: - - zap - description: | - Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. - assessment: For REST APIs, multiple OAuth2 scopes are used. - comments: "" - tags: - - none - Coverage of hidden endpoints: - uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 - risk: Hidden endpoints of the service are not getting tracked. - measure: Hidden endpoints are getting detected and included in the vulnerability - scan. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 1 - usefulness: 5 - level: 3 - implementation: - - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 - name: OpenAPI Specifications - tags: [] - url: https://spec.openapis.org/ - - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 - name: OWASP Zap - tags: - - vulnerability - - scanner - url: https://github.com/zaproxy/zaproxy - description: | - The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... - - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b - name: Schemathesis - tags: - - testing - - api - - documentation - url: https://github.com/schemathesis/schemathesis - description: | - Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Coverage of more input vectors: - uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc - risk: Parts of the service are not covered. For example specially formatted - or coded parameters are not getting detected as parameter (e.g. parameters - in REST-like URLs, parameters in JSON-Format or base64-coded parameters). - measure: Special parameter and special encodings are defined, so that they get - fuzzed by the used vulnerability scanners. - difficultyOfImplementation: - knowledge: 5 - time: 5 - resources: 1 - usefulness: 4 - level: 3 - dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles - references: - samm2: - - V-RT-B-1 - iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - iso27001-2022: - - ISO 27001:2022 mapping is missing - implementation: - - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b - name: Schemathesis - tags: - - testing - - api - - documentation - url: https://github.com/schemathesis/schemathesis - description: | - Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. - comments: "" - tags: - - none - Coverage of sequential operations: - uuid: 845f06ec-148c-4c67-9755-7041911dcca5 - risk: Sequential operations like workflows (e.g. login -> put products in the - basket - measure: Sequential operations are defined and checked by the vulnerability - scanner in the defined order. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 5 - level: 3 - implementation: - - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b - name: cURL - tags: [] - url: https://curl.se/ - dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 14.2.8 - - 14.2.3 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - Usage of multiple scanners: - uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea - risk: Each vulnerability scanner has different opportunities. By using just - one scanner, some vulnerabilities might not be found. - measure: Usage of multiple spiders and scanner enhance the coverage and the - vulnerabilities. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 - usefulness: 1 - level: 4 - dependsOn: - - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles - implementation: - - uuid: f220b299-0917-4750-96c5-d81cd402b4df - name: OWASP secureCodeBox - tags: - - vulnerability - - scanner-orchestration - url: https://github.com/secureCodeBox/secureCodeBox - description: | - secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 12.6.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.27 - comments: "" - tags: - - none - Coverage analysis: - uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 - risk: Parts of the service are not still covered by tests. - measure: Check that there are no missing paths in the application with coverage-tools. - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 3 - usefulness: 4 - level: 5 - implementation: - - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 - name: OWASP Code Pulse - tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse - - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 - name: Coverage.py - tags: - - testing - - coverage - url: https://github.com/nedbat/coveragepy - description: | - Code coverage measurement for Python - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - not explicitly covered by ISO 27001 - too specific - - part of periodic review, PDCA - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Coverage of service to service communication: - uuid: 22aab0ef-76ce-4b8c-979c-3699784330db - risk: Service to service communication is not covered. - measure: Service to service communication is dumped and checked. - difficultyOfImplementation: - knowledge: 4 - time: 5 - resources: 2 - usefulness: 3 - level: 5 - dependsOn: - - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.32 - - 8.29 - implementation: - - uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 - name: Citrus Fresh Integration Testing - tags: - - framework - - testing - url: https://citrusframework.org/ - description: Integration Test framework with focus on messaging applications - and Microservices. - comments: "" - tags: - - none - Dynamic depth for infrastructure: - Test for exposed services: - uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 - risk: Standard network segmentation and firewalling has not been performed, - leading to world open cluster management ports. - measure: With the help of tools the network configuration of unintentional exposed - cluster(s) are tested. To identify clusters, all subdomains might need to - be identified with a tool like OWASP Amass to perform port scans based o the - result. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 2 - dependsOn: - - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments - usefulness: 2 - level: 2 - implementation: - - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 - name: nmap - tags: [] - url: https://nmap.org/ - - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a - name: OWASP Amass - tags: [] - url: https://github.com/OWASP/Amass - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 13.1.3 - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.22 - - 8.32 - - 8.29 - comments: "" - tags: - - none - Test network segmentation: - uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 - risk: Wrong or no network segmentation of pods makes it easier for an attacker - to access a database and extract or modify data. - measure: Cluster internal test needs to be performed. Integration of fine granulated - network segmentation (also between pods in the same namespace). - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 2 - implementation: - - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c - name: netassert - tags: [] - url: https://github.com/controlplaneio/netassert - dependsOn: - - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 13.1.3 - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.22 - - 8.32 - - 8.29 - comments: "" - tags: - - none - Test of the configuration of cloud environments: - uuid: 7bb70764-9392-4462-935d-e55b2e148199 - risk: Standard hardening practices for cloud environments are not performed - leading to vulnerabilities. - measure: With the help of tools the configuration of virtual environments are - tested. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - implementation: - - uuid: 893d9f37-2142-4490-996c-e43b55064d3d - name: kubescape - url: https://github.com/armosec/kubescape - tags: - - kubernetes - - vulnerability - - misconfiguration - description: _Testing if Kubernetes is deployed securely as defined in Kubernetes - Hardening Guidance by to NSA and CISA_ - - uuid: 2af7204c-a25c-4625-9775-889978386407 - name: kube-hunter - tags: [] - url: https://github.com/aquasecurity/kube-hunter - - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f - name: openVAS - tags: [] - url: https://www.openvas.org/ - references: - samm2: [] - iso27001-2017: - - System hardening is not explicitly covered by ISO 27001 - too specific - - 12.6.1 - - 14.2.3 - - 14.2.8 - iso27001-2022: - - System hardening is not explicitly covered by ISO 27001 - too specific - - 8.8 - - 8.32 - - 8.29 - comments: "" - tags: - - none - Test for unauthorized installation: - uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a - risk: Unapproved components are used. - measure: Components must be whitelisted. Regular scans on the docker infrastructure - (e.g. cluster) need to be performed, to verify that only standardized base - images are used. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 - name: 'Example: All docker images used by teams need to be based on standard - images.' - tags: [] - comments: By preventing teams from trying out new components, innovation might - be hampered - references: - samm2: [] - iso27001-2017: - - 12.5.1 - - 12.6.1 - iso27001-2022: - - 8.19 - - 8.8 - dependsOn: - - 0de465a6-55a7-4343-af79-948bb5ff10ba # Evaluation of the trust of used components - tags: - - none - Weak password test: - uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f - risk: Weak passwords in components like applications or systems, specially for - privileged accounts, lead to take over of that account. - measure: Automatic brute force attacks are performed. Specially the usage of - standard accounts like 'admin' and employee user-ids is recommended. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 1 - level: 3 - implementation: - - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce - name: HTC Hydra - tags: - - password - url: https://www.htc-cs.com/en/products/htc-hydra/ - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 9.4.3 - iso27001-2022: - - 5.17 - comments: "" - tags: - - none - Load tests: - uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd - risk: As it is unknown how many requests the systems and applications can serve, - due to an unexpected load the availability is disturbed. - measure: Load test against the production system or a production near system - is performed. - difficultyOfImplementation: - knowledge: 3 - time: 2 - resources: 5 - usefulness: 3 - level: 4 - implementation: [] - references: - samm2: - - V-RT-AB-1 - iso27001-2017: - - 12.1.3 - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.6 - - 8.32 - - 8.29 - comments: "" - tags: - - none - Test for unused Resources: - uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 - risk: Unused resources, specially secrets, might be still valid, but are exposing - information. As an attacker, I compromise a system, gather credentials and - try to use them. - measure: Test for unused resources helps to identify unused resources. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 2 - level: 5 - implementation: - - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 - name: K8sPurger - tags: - - vulnerability - - scanner - - dast - - infrastructure - url: https://github.com/yogeshkk/K8sPurger - description: | - Hunt Unused Resources In Kubernetes. - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 13.1.3 - - 14.2.3 - - 14.2.8 - iso27001-2022: - - 8.22 - - 8.32 - - 8.29 - comments: "" - tags: - - none - Static depth for applications: - Software Composition Analysis (server side): - uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe - description: Use a tool like trivy and concentrate on application related vulnerabilities. - At this stage, ignore vulnerabilities in container base images used in the - service. - risk: Server side components might have vulnerabilities. - measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) - are performed. - difficultyOfImplementation: - knowledge: 1 - time: 3 - resources: 1 - usefulness: 5 - level: 2 - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - implementation: - - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 - name: OWASP Dependency Check - tags: - - OpenSource - - Supply Chain - - vulnerability - url: https://owasp.org/www-project-dependency-check/ - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - references: - samm2: - - V-ST-A-2 - - I-SB-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - tags: - - vmm-testing - Test for Time to Patch: - uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f - risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities - in production artifacts. - measure: |- - Test of the Time to Patch (e.g. based on Mean Time to Close automatic PRs) - This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 3 - level: 2 - implementation: - - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 - name: dependabot - tags: - - auto-pr - - patching - url: https://dependabot.com/ - - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 - name: renovate - tags: - - auto-pr - - patching - url: https://github.com/renovatebot/renovate - dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 - comments: "" - meta: - implementationGuide: Usage of a version control platform API (e.g. github - API) can be used to fetch the information. Consider that `Measure libyears` - might be an alternative to this activity. - tags: - - patching - Test libyear: - uuid: 87b54313-fafd-4860-930f-5ef132b3e4ad - risk: Vulnerabilities in running artifacts stay for long and might get exploited. - measure: Test `libyear`, which provides a good insight how good patch management - is. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 3 - level: 2 - implementation: - - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 - name: libyear - tags: - - patching - - build - url: https://libyear.com/ - description: A simple measure of software dependency freshness. It is a single - number telling you how up-to-date your dependencies are. - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 - comments: "" - meta: - implementationGuide: | - `libyear` can be integrated into the build process and flag or even better break the build in case the defined threshold (e.g. 30 years) is reached. - An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). - tags: - - patching - API design validation: - uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 - risk: Creation of insecure or non-compliant API. - measure: | - Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP - and validate the specification using specific tools. - Checks should be integrated in IDEs and CI/CD pipelines. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - uuid: 261f243e-f89c-4169-b076-b22a03ec00be - name: Spectral - tags: - - linting - - api - - documentation - url: https://github.com/stoplightio/spectral - description: | - Spectral is a flexible JSON/YAML linter built with extensibility in mind. - It uses JSON/YAML path rules to describe the problems you want to find. - - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f - name: API OAS Checker - tags: - - linting - - api - - documentation - url: https://github.com/italia/api-oas-checker - description: | - A tool to check OpenAPI specifications using a comprehensive ruleset based - on API best practices. - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.25 - - 8.27 - - 8.28 - dependsOn: - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - tags: - - none - Exploit likelihood estimation: - uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad - risk: Without proper prioritization, organizations may waste time and effort - on low-risk vulnerabilities while neglecting critical ones. - measure: Estimate the likelihood of exploitation by using data (CISA KEV) from - the past or prediction models (e.g. Exploit Prediction Scoring System, EPSS). - description: Severity-based vulnerability triage alone generates a lot false - positives, requiring a more refined approach. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server side) - implementation: - - uuid: aa507341-9531-42cd-95cf-d7b51af47086 - name: Known Exploited Vulnerabilities - tags: - - vulnerability - url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - description: A catalog of vulnerabilities that have been exploited. - - uuid: e39afc58-8195-4600-92c6-11922e3a141b - name: Exploit Prediction Scoring System - tags: - - vulnerability - url: https://www.first.org/epss/ - description: Estimates the likelihood that a software vulnerability will be - exploited. - references: - samm2: - - V-ST-A-2 - - I-SB-B-3 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - tags: - - none - Local development security checks performed: - uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b - risk: Creating and developing code contains code smells and quality issues. - measure: | - Integration of quality and linting plugins with interactive development environment (IDEs). - Implement pre-commit checks to prevent secrets & other security issues being commit to source code. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 4 - level: 3 - implementation: - - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 - name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop - tags: - - pre-commit - - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb - name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ - tags: - - pre-commit - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 13.1.3 - iso27001-2022: - - Hardening is not explicitly covered by ISO 27001 - too specific - - 8.22 - comments: "" - tags: - - none - Software Composition Analysis (client side): - uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 - risk: Client side components might have vulnerabilities. - measure: Tests for known vulnerabilities in components via Software Composition - Analysis of the frontend are performed. - difficultyOfImplementation: - knowledge: 1 - time: 2 - resources: 1 - usefulness: 2 - level: 3 - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation - implementation: - - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 - name: retire.js - tags: [] - url: https://github.com/RetireJS/retire.js/ - - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 - name: npm audit - tags: [] - url: https://docs.npmjs.com/cli/audit - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 - name: Dependabot - tags: - - dependency - - dependency-management - - scm - url: https://github.com/dependabot/dependabot-core - description: | - Dependabot creates pull requests to keep your dependencies secure and up-to-date. - references: - samm2: - - V-ST-A-2 - - I-SB-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Static analysis for important client side components: - uuid: e237176b-bec5-447d-a926-e37d6dd60e4b - risk: Important parts in the source code of the frontend have vulnerabilities. - measure: Usage of static analysis tools for important parts of the frontend - are used. Static analysis uses for example string matching algorithms and/or - dataflow analysis. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 - name: '[bdd-mobile-security' - tags: [] - url: https://github.com/ing-bank/bdd-mobile-security-automation-framework - description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' - - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Static analysis for important server side components: - uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 - risk: Important parts in the source code of the middleware have vulnerabilities. - measure: Usage of static analysis tools for important parts of the middleware - are used. Static analysis uses for example string matching algorithms and/or - dataflow analysis. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 3 - implementation: - - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - references: - samm2: - - V-ST-A-2 - - I-SB-B-3 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Test for Patch Deployment Time: - uuid: 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 - risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities - in production artifacts. - measure: | - Test of the Patch Deployment Time. - This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 3 - level: 3 - implementation: - - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - dependsOn: - - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 - comments: "" - meta: - implementationGuide: Self implementation. This activity is not repeated in - the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure - as well. - tags: - - patching - Static analysis for all self written components: - uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 - risk: Parts in the source code of the frontend or middleware have vulnerabilities. - measure: Usage of static analysis tools for all parts of the middleware and - frontend. Static analysis uses for example string matching algorithms and/or - dataflow analysis. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 4 - implementation: - - uuid: 6a0948a7-4781-4858-9766-f4303971b28b - name: eslint - tags: [] - url: https://eslint.org/ - - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 - name: FindSecurityBugs - tags: [] - - uuid: cccc2882-62ab-4175-afa1-58471017e8ed - name: jsprime - tags: [] - url: https://github.com/dpnishant/jsprime - - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 - name: Fortify Extension for Visual Studio Code - url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code - tags: - - ide - - sast - - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 - name: Setting Up the Visual Studio Code Extension Plugin - url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin - tags: - - ide - - sast - - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb - name: HCL AppScan CodeSweep - url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep - tags: - - ide - - sast - dependsOn: - - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client side components - - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server side components - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - references: - samm2: - - V-ST-A-2 - - I-SB-B-3 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Usage of multiple analyzers: - uuid: 297be001-8d94-41ee-ab29-207020d423c0 - risk: Each vulnerability analyzer has different opportunities. By using just - one analyzer, some vulnerabilities might not be found. - measure: Usage of multiple static tools to find more vulnerabilities. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 - usefulness: 1 - level: 4 - dependsOn: - - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server side) - - 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 # Software Composition Analysis (client side) - - ee68331f-9b1d-4f61-844b-b2ea04753a84 # Static analysis for all self written components - implementation: [] - references: - samm2: - - V-ST-A-3 - iso27001-2017: - - 12.6.1 - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.25 - - 8.27 - comments: "" - tags: - - none - Dead code elimination: - uuid: a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d - risk: Dead code increases the attack surface (use of hard coded credentials - and variables, sensitive information) - measure: Collection of unused code and then manual removal of unused code. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 5 - implementation: - - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 - comments: "" - tags: - - none - Exclusion of source code duplicates: - uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 - risk: Duplicates in source code might influence the stability of the application. - measure: Automatic Detection and manual removal of duplicates in source code. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 5 - implementation: - - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - dependsOn: - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - Not explicitly covered by ISO 27001 - too specific - - 14.2.1 - - 14.2.5 - iso27001-2022: - - Not explicitly covered by ISO 27001 - too specific - - 8.25 - - 8.27 - comments: "" - tags: - - none - Static analysis for all components/libraries: - uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 - risk: Used components like libraries and legacy applications might have vulnerabilities - measure: Usage of a static analysis for all used components. - difficultyOfImplementation: - knowledge: 2 - time: 4 - resources: 2 - usefulness: 3 - level: 5 - dependsOn: - - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client side components - - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server side components - - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components - implementation: [] - references: - samm2: - - V-ST-A-2 - - I-SB-B-3 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Stylistic analysis: - uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 - risk: Unclear or obfuscated code might have unexpected behavior. - measure: Analysis of compliance to style guides of the source code ensures that - source code formatting rules are met (e.g. indentation, loops, ...). - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 5 - implementation: - - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb - name: PMD - tags: [] - - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe - name: How to enforce a consistent coding style in your projects - url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm - tags: - - ide - - linting - - uuid: aa5ded61-5380-4da6-9474-afc36a397682 - name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding - tags: - - ide - - linting - - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f - name: Super-Linter - tags: - - linting - - scm - url: https://github.com/github/super-linter - description: | - Lint code bases to catch common errors and enforce code style - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 12.6.1 - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.25 - - 8.27 - comments: "" - tags: - - none - Static depth for infrastructure: - Test for stored secrets in build artifacts: - uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f - risk: Stored secrets in container images or other build artifacts shouldn't - exists because they might be exposed to unauthorized parties. - measure: Test for secrets in container images and other artifacts - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 2 - level: 1 - implementation: - - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - vcs usage is not explicitly covered by ISO 27001 - too specific - - 9.4.3 - - 10.1.2 - iso27001-2022: - - vcs usage is not explicitly covered by ISO 27001 - too specific - - 5.17 - - 8.24 - comments: "" - tags: - - none - Test for stored secrets in code: - uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c - risk: Stored secrets in git history or directly in code shouldn't exists because - they might be exposed to unauthorized parties. - measure: Test for secrets in code and git history - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 2 - level: 1 - implementation: - - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 - name: truffleHog - tags: [] - url: https://github.com/dxa4481/truffleHog - - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 - name: go-pillage-registries - tags: [] - url: https://github.com/nccgroup/go-pillage-registries - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - vcs usage is not explicitly covered by ISO 27001 - too specific - - 9.4.3 - - 10.1.2 - iso27001-2022: - - vcs usage is not explicitly covered by ISO 27001 - too specific - - 5.17 - - 8.24 - comments: "" - tags: - - none - Test cluster deployment resources: - uuid: 621fb6a5-5c0a-4408-826a-068868bb031b - risk: The deployment configuration (e.g. kubernetes deployment resources) might - contain unsecured configurations. - measure: Test the deployment configuration for virtualized environments for - unsecured configurations. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 3 - level: 2 - implementation: - - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba - name: kubesec - tags: [] - url: https://kubesec.io - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - System hardening is not explicitly covered by ISO 27001 - too specific - - 12.6.1 - - 14.2.3 - - 14.2.8 - iso27001-2022: - - System hardening is not explicitly covered by ISO 27001 - too specific - - 8.8 - - 8.32 - - 8.29 - comments: "" - tags: - - none - Test for image lifetime: - uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b - risk: Old container images in production indicate that patch management is not - performed and therefore vulnerabilities might exists. - measure: Check the image age of containers in production. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 2 - level: 2 - implementation: - - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 12.6.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.27 - comments: "" - tags: - - none - Test of virtualized environments: - uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 - risk: Virtualized environments (e.g. via Container Images) might contains - unsecure configurations. - measure: Test virtualized environments for unsecured configurations. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 3 - level: 2 - implementation: - - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 - name: Dive to inspect a container images - tags: [] - url: https://github.com/wagoodman/dive - - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - ISO 27001:2017 mapping is missing - iso27001-2022: - - ISO 27001:2022 mapping is missing - comments: "" - tags: - - none - Test the cloud configuration: - uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc - risk: Standard hardening practices for cloud environments are not performed - leading to vulnerabilities. - measure: With the help of tools, the configuration of virtual environments are - tested. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 1 - usefulness: 4 - level: 2 - implementation: - - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 - name: kube-bench - tags: [] - url: https://github.com/aquasecurity/kube-bench - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - System hardening is not explicitly covered by ISO 27001 - too specific - - 12.6.1 - - 14.2.3 - - 14.2.8 - iso27001-2022: - - System hardening is not explicitly covered by ISO 27001 - too specific - - 8.8 - - 8.32 - - 8.29 - comments: "" - tags: - - none - Test the definition of virtualized environments: - uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e - risk: The definition of virtualized environments (e.g. via Dockerfile) - might contain unsecure configurations. - measure: Test the definition of virtualized environments for unsecured configurations. - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 3 - level: 2 - meta: - implementationGuide: For containier (images), test that the images are following - best practices like distroless or non-root. - implementation: - - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 - name: Dockerfile with hadolint - tags: [] - url: https://github.com/hadolint/hadolint - - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b - name: Deployment with kube-score - tags: [] - url: https://github.com/zegl/kube-score - - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 - name: dockerfilelint - tags: - - sast - - docker - - dockerfile - url: https://github.com/replicatedhq/dockerfilelint - description: dockerfilelint is an node module that analyzes a Dockerfile and - looks for common traps, mistakes and helps enforce best practices. - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - System hardening, virtual environments are not explicitly covered by ISO - 27001 - too specific - - 12.6.1 - - 14.2.3 - - 14.2.8 - - 14.2.1 - iso27001-2022: - - System hardening, virtual environments are not explicitly covered by ISO - 27001 - too specific - - 8.8 - - 8.32 - - 8.29 - - 8.25 - tags: - - none - Test for malware: - uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d - risk: Third party might include malware. Ether due to the maintainer (e.g. - typo squatting of an image name and using the wrong image) or by an attacker - on behalf of the maintainer with stolen credentials. - measure: Check for malware in components (e.g. container images, VM baseline - images, libraries). - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 3 - level: 3 - implementation: - - url: https://github.com/SDA-SE/clusterscanner - uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f - name: ClusterScanner - tags: - - docker - - image - - container - - vulnerability - - misconfiguration - - security-tools - - scanning - description: Discover vulnerabilities and container image misconfiguration - in production environments. - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 12.2.1 - iso27001-2022: - - 8.7 - comments: "" - tags: - - none - Test for new image version: - uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e - risk: When a new version of an image is available, it might fix security vulnerabilities. - measure: Check for new images of containers in production. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 1 - usefulness: 2 - level: 3 - implementation: [] - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 12.6.1 - - 14.2.5 - - 12.2.1 - iso27001-2022: - - 8.8 - - 8.7 - - 8.27 - comments: "" - tags: - - none - Correlate known vulnerabilities in infrastructure with new image versions: - uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 - risk: TODO. - measure: TODO - difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 4 - usefulness: 1 - level: 4 - dependsOn: - - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for images - implementation: - - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 12.6.1 - - 14.2.1 - iso27001-2022: - - 8.8 - - 8.25 - comments: "" - tags: - - none - Software Composition Analysis: - uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad - risk: Known vulnerabilities in infrastructure components like container images - might get exploited. - measure: Check for known vulnerabilities - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 1 - usefulness: 4 - level: 4 - description: Subscribing to Github projects and reading release notes might - help. Software Composition Analysis for infrastructure might help, but is - often too fine-granular. - implementation: - - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy - tags: [] - url: https://github.com/aquasecurity/trivy - - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 - name: Registries like quay - tags: [] - description: Registries like quay, dockerhub provide (commercial) offerings, - often not suitable for distroless images - - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). - url: https://github.com/DependencyTrack/dependency-track - tags: - - sca - - inventory - - OpenSource - - Supply Chain - - vulnerability - - inventory - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - comments: "" - tags: - - none - Test of infrastructure components for known vulnerabilities: - uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 - risk: Infrastructure components might have vulnerabilities. - measure: Test for known vulnerabilities in infrastructure components. Often, - the only way to respond to known vulnerabilities in operating system packages - is to accept the risk and wait for a patch. As the patch needs to be applied - fast when it is available, this activity depends on 'Usage of a maximum life - for images'. - difficultyOfImplementation: - knowledge: 2 - time: 5 - resources: 2 - usefulness: 1 - level: 4 - dependsOn: - - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for images - implementation: - - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc - name: Anchore.io - tags: [] - url: https://anchore.com/ - - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 - name: Clair - tags: [] - url: https://github.com/quay/clair - - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 - name: OpenSCAP - tags: [] - url: https://www.open-scap.org/ - - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 - name: Vuls - tags: [] - url: https://github.com/future-architect/vuls - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 12.6.1 - - 14.2.1 - iso27001-2022: - - 8.8 - - 8.25 - comments: "" - tags: - - none - Test-Intensity: - Default settings for intensity: - uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d - risk: Time pressure and ignorance might lead to false predictions for the test - intensity. - measure: The intensity of the used tools are not modified to save time. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 1 - level: 1 - implementation: [] - references: - samm2: - - V-ST-A-1 - iso27001-2017: - - 12.6.1 - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.25 - - 8.27 - comments: "" - tags: - - none - Regular automated tests: - uuid: 598897a2-358e-441f-984c-e12ec4f6110a - risk: After pushing source code to the version control system, any delay in - receiving feedback on defects makes them harder for the developer to remediate. - measure: On each push and/or at given intervals automatic security tests are - performed. - difficultyOfImplementation: - knowledge: 1 - time: 1 - resources: 1 - usefulness: 2 - level: 2 - implementation: [] - references: - samm2: - - I-SB-A-3 - - V-ST-A-3 - iso27001-2017: - - 14.2.3 - - 14.2.8 - - 14.2.9 - iso27001-2022: - - 8.32 - - 8.29 - comments: "" - tags: - - none - Deactivating of unneeded tests: - uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 - risk: As tools cover a wide range of different vulnerability tests, they might - not match the used components. Therefore, they need more time and resources - as they need and the feedback loops takes too much time. - measure: Unneeded tests are deactivated. For example in case the service is - using a Mongo database and no mysql database, the dynamic scan doesn't need - to test for sql injections. - difficultyOfImplementation: - knowledge: 2 - time: 3 - resources: 1 - usefulness: 1 - level: 3 - implementation: [] - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 12.6.1 - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.25 - - 8.27 - comments: "" - tags: - - none - High test intensity: - uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 - risk: A too small intensity or a too high confidence might lead to not visible - vulnerabilities. - measure: A deep scan with high test intensity and a low confidence threshold - is performed. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 5 - usefulness: 3 - level: 3 - implementation: [] - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 12.6.1 - - 14.2.1 - - 14.2.5 - iso27001-2022: - - 8.8 - - 8.25 - - 8.27 - comments: "" - tags: - - none - Creation and application of a testing concept: - uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe - risk: Scans might use a too small or too high test intensity. - measure: A testing concept considering the amount of time per scan/intensity - is created and applied. A dynamic analysis needs more time than a static analysis. - The dynamic scan, depending on the test intensity might be performed on every - commit, every night, every week or once in a month. - difficultyOfImplementation: - knowledge: 3 - time: 3 - resources: 3 - usefulness: 2 - level: 4 - implementation: [] - references: - samm2: - - V-ST-A-2 - iso27001-2017: - - 14.2.2 - - 14.2.3 - - 14.2.1 - - 14.2.5 - - 12.6.1 - iso27001-2022: - - 8.25 - - 8.32 - - 8.27 - - 8.8 - comments: "" - tags: - - none -... diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index ef9ab0f..a7c1a37 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -3,13 +3,16 @@ require_once "functions.php"; $errorMsg = array(); -$implementationReferenceFile = "src/assets/YAML/default/implementations.yaml"; +$targetFolder = "generated"; +$inputFolder = "src/assets/YAML"; +$implementationReferenceFile = "$inputFolder/default/implementations.yaml"; -$files = glob("src/assets/YAML/default/*/*.yaml"); +$files = glob("$inputFolder/default/*/*.yaml"); $dimensions = array(); foreach ($files as $filename) { echo "Reading $filename\n"; if (preg_match("/_meta.yaml/", $filename)) continue; + $dimension = getDimensions($filename); if (array_key_exists("_yaml_references", $dimension)) { unset($dimension['_yaml_references']); @@ -18,7 +21,7 @@ } $dimensions = sortActivitiesByLevel($dimensions); -$files = glob("src/assets/YAML/custom/*/*.yaml"); +$files = glob("$inputFolder/custom/*/*.yaml"); $dimensionsCustom = array(); $dimensionsAggregated = array(); foreach ($files as $filename) { @@ -84,13 +87,6 @@ $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"] = array(); $dimensionsAggregated[$dimension][$subdimension][$activityName]["references"]["openCRE"][] = "https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/" . $subdimension . "/" . $dimensionsAggregated[$dimension][$subdimension][$activityName]["uuid"]; } - // can be removed in 2025 - if (array_key_exists("isImplemented", $activity)) { - unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["isImplemented"]); - } - if (array_key_exists("evidence", $activity)) { - unset($dimensionsAggregated[$dimension][$subdimension][$activityName]["evidence"]); - } if (array_key_exists("dependsOn", $activity)) { foreach($activity['dependsOn'] as $index => $dependsOnName) { if(!is_string($dependsOnName)) { @@ -180,25 +176,28 @@ 'publisher' => 'https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/' ) ); -$metaString = yaml_emit($metaDocument); +$modelString = yaml_emit_with_header($metaDocument, $dimensionsAggregated); -// Combine both documents with proper YAML document separators -if (substr(rtrim($metaString), -3) === '...') { - // Remove trailing ... from meta document and add proper separator - $metaString = substr(rtrim($metaString), 0, -3); +// Post-process to add activity name as comment for `dependsOn` +preg_match_all('/\{!([0-9a-z-]{30,})!\}/', $modelString, $matches); +$uuids = array_unique($matches[1]); +foreach ($uuids as $uuid) { + $name = getActivityNameByUuid($uuid, $dimensionsAggregated); + // echo "Adding dependsOn-comment for $uuid: $name\n"; + $modelString = str_replace("'{!$uuid!}'", "$uuid # $name", $modelString); } -$combinedYaml = $metaString . $dimensionsString; +$targetGeneratedFile = getcwd() . "/$targetFolder/model.yaml"; +echo "\nSaved generated model: '$targetGeneratedFile'\n"; +file_put_contents($targetGeneratedFile, $modelString); -// Store generated data -$targetGeneratedFile = getcwd() . "/src/assets/YAML/activities.yaml"; -echo "\nStoring to $targetGeneratedFile\n"; -file_put_contents($targetGeneratedFile, $combinedYaml); // Store dependency graph -$graphFilename = getcwd() . "/src/assets/YAML/generated/dependency-tree.md"; +$graphFilename = getcwd() . "/$targetFolder/dependency-tree.md"; $graphFile = fopen($graphFilename, "w"); -fwrite($graphFile, "```mermaid\n\n"); +$graphIntro = "## DSOMM Activity Dependencies\n\nThe activities in this DSOMM Model have the following dependencies."; +fwrite($graphFile, $graphIntro."\n\n"); +fwrite($graphFile, "```mermaid\n"); fwrite($graphFile, "graph LR\n\n"); // List all nodes foreach ($activityIndex as $activityName => $key) { @@ -234,7 +233,7 @@ // Close the file fwrite($graphFile, "```\n"); fclose($graphFile); -echo "\nSaved dependency graph '$graphFilename'\n\n"; +echo "Saved dependency graph: '$graphFilename'\n\n"; @@ -357,12 +356,30 @@ function isActivityExisting($dimensions, $activityName) return false; } +/** + * Creates a yaml string from $metaDocument plus $document separated with '---' + */ +function yaml_emit_with_header($metaDocument, $document) { + $metaString = yaml_emit($metaDocument); + $documentString = yaml_emit($document); + + // Combine both documents with proper YAML document separation + if (substr(rtrim($metaString), -3) === '...') { + // Remove trailing ... from meta document + $metaString = substr(rtrim($metaString), 0, -3); + } + + return $metaString . $documentString; +} + /** + * Merges two arrays recursively (just like the standard `array_merge_recursive()`), + * but will not create duplicates if the keys are numeric. * * @param array $array1 * @param array $array2 - * @return unknown + * @return merged array */ function array_merge_recursive_ex(array $array1, array $array2) { @@ -385,7 +402,7 @@ function array_merge_recursive_ex(array $array1, array $array2) /* -* Traverse an array in-place and replaces yaml pointers. + * Traverse an array in-place and replaces yaml pointers. */ function resolveYamlReferences(&$data, $references, &$errorMsg) { From 04023def82651c23115ffde168301fada264e0e5 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 30 Nov 2025 18:12:55 +0100 Subject: [PATCH 145/370] Renamed `Versioning` to `Version control` and added description --- .../DevelopmentAndSourceControl.yaml | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index 3005ec0..9e3b89b 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -84,12 +84,18 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 - Versioning: + Version control: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f - risk: Deployment of untracked artifacts. + description: + Use a _version control system_ like Github, Gitlab, Bitbucket, etc to version your source code. + + Also known as _source control_, _revision control_, or _source code management_. + risk: q + Without version control, it is challenging to track changes, collaborate effectively, and maintain a history of code modifications. + Rollback to earlier versions is hard. measure: >- - Version artifacts in order to identify deployed features and issues. - This includes application and infrastructure code, jenkins configuration, container and virtual machine images. + Version your source code in order to identify deployed features and issues. + This includes application and infrastructure code, jenkins configuration, container and virtual machine images definitions. difficultyOfImplementation: knowledge: 3 time: 3 From 1cf5f0ff487366b3ff88fe920a25f862ca1dac75 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 30 Nov 2025 23:11:17 +0100 Subject: [PATCH 146/370] Included feedback from PR #46 --- .../default/BuildAndDeployment/Deployment.yaml | 16 ++++++---------- .../EducationAndGuidance.yaml | 3 ++- .../default/InformationGathering/Monitoring.yaml | 3 +-- .../TestAndVerification/Consolidation.yaml | 16 +++++++--------- .../StaticDepthForApplications.yaml | 13 +++++++++---- 5 files changed, 25 insertions(+), 26 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 0f3fc59..129f0e4 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -70,14 +70,15 @@ Build and Deployment: Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a description: | - A defined deployment process is a documented and automated set of steps for releasing software into production. It ensures that deployments are consistent, secure, and auditable, reducing the risk of errors and unauthorized changes. This process should include validation, approval, and rollback mechanisms. + A defined deployment process is a documented and automated set of steps for releasing software into production. It ensures that deployments are consistent, secure, and auditable, reducing the risk of errors and unauthorized changes. risk: >- Deployment based human routines are error prone, and of insecure or malfunctioning artifacts. measure: >- - Defining a deployment process ensures that there are - established criteria in terms of functionalities, - security, compliance, and performance, - and that the artifacts meet them. + Defining a deployment process ensures that there are established criteria in terms of functionalities, security, compliance, and performance, and that the artifacts meet them. + assessment: | + - Deployment process is documented and available to relevant staff + - All deployment steps are automated + - Provide audit logs or evidence of deployments level: 1 difficultyOfImplementation: knowledge: 2 @@ -98,11 +99,6 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 - assessment: | - - Deployment process is documented and available to relevant staff - - All deployment steps are automated - - Rollback procedures are defined and tested [Keep??? Delete???] - - Provide audit logs or evidence of deployments isImplemented: false evidence: "" comments: "" diff --git a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml index a03f143..4395b7b 100755 --- a/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml +++ b/src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml @@ -420,7 +420,8 @@ Culture and Organization: measure: | Make security consulting available to teams on request, ensuring that expert advice is accessible when needed to address security concerns during development. assessment: | - Records show that teams have access to security consulting services and have used them when needed. Documentation of consultations and resulting actions is available for review. + - Show evidence that an it security expert is available for questions at least quarterly. + - Documentation of consultations and resulting actions is available for review. difficultyOfImplementation: knowledge: 3 time: 1 diff --git a/src/assets/YAML/default/InformationGathering/Monitoring.yaml b/src/assets/YAML/default/InformationGathering/Monitoring.yaml index 28cc425..247edb8 100755 --- a/src/assets/YAML/default/InformationGathering/Monitoring.yaml +++ b/src/assets/YAML/default/InformationGathering/Monitoring.yaml @@ -366,10 +366,9 @@ Information Gathering: risk: | Without monitoring system metrics, it is difficult to detect incidents or performance issues, leading to delayed response, reduced availability, and increased risk of undetected attacks. measure: | - Collect and monitor key system metrics, including CPU, memory, and disk usage. Set up alerts for abnormal resource consumption or patterns that may indicate incidents or attacks. + Collect and monitor key system metrics, including CPU, memory, and disk usage. assessment: | - Basic system metrics are monitored and reviewed regularly - - Alerting outside given thresholds are implemented level: 1 difficultyOfImplementation: knowledge: 2 diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 299396d..2892e1f 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -138,13 +138,13 @@ Test and Verification: Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 description: | - Security tests may produce false positives—findings that are incorrectly identified as vulnerabilities. + Security tests may produce false positives (or _"false alarms"_), findings that are incorrectly identified as vulnerabilities. - It is important distinguish these from true vulnerabilities to avoid wasting time and resources on non-issues. + It is important distinguish these from true positive vulnerabilities to avoid wasting time and resources on non-issues. False positive treatment ensures that findings from security tests are triaged and documented, allowing teams to distinguish between real vulnerabilities and false positives. This reduces unnecessary work and helps maintain focus on true risks. - Some positive findings might be considered an accepted risk by the organization. This must also be documented. + Some positive findings might be considered an _accepted risk_ by the organization. This must also be documented. risk: | If false positives are not managed, teams may ignore all findings, leading to real vulnerabilities being overlooked and increasing the risk of exploitation. Specially, if tests are automated an run daily. measure: | @@ -278,18 +278,17 @@ Test and Verification: - 5.25 tags: ["vuln-action", "defect-management"] comments: "" - Treatment of defects with severity high or higher: + Treatment of defects with high or critical severity: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 description: | All security problems that are rated as "high" or "critical" must be fixed before the software can be released or used in production. This means that if a serious vulnerability is found, it cannot be ignored or postponed. risk: | If serious security problems are not fixed, attackers could exploit them to steal data, disrupt services, or cause other harm. Ignoring these issues puts the organization, its customers, and its reputation at risk. measure: | - - Make it a rule that all high or critical security findings must be fixed before the software is approved for release or use. + - Make it a rule that all _high_ or _critical_ security findings must be fixed before the software is approved for release or use. - Track these issues and make sure they are resolved quickly. - - Pay extra attention to Known Exploited Vulnerabilities (KEV) from CISA and EPSS scores when prioritizing fixes. assessment: | - There is clear evidence that all high or critical security issues are tracked and fixed before release. No high or critical issues remain open in production systems. + - Provide evidence that vulnerabilities are treated within the defined time frame in production. For example via the DSOMM activity [Number of vulnerabilities/severity](./activity-description?uuid=bc548cba-cb82-4f76-bd4b-325d9d256279) or [Patching mean time to resolution via PR](./activity-description?uuid=86d490b9-d798-4a5b-a011-ab9688014c46) with extra deployment statistics. comments: False positive analysis, specially for static analysis, is time consuming. level: 1 difficultyOfImplementation: @@ -307,12 +306,11 @@ Test and Verification: - 8.8 - 5.25 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/cisa-kev - $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy - $ref: src/assets/YAML/default/implementations.yaml#/implementations/grype tags: ["vuln-action", "defect-management"] evidence: "" - Treatment of defects with severity middle: + Treatment of defects with medium severity: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. measure: Vulnerabilities with severity middle are added to the quality gate. diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 0388402..03d912c 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -322,16 +322,21 @@ Test and Verification: comments: "" Exploit likelihood estimation: uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad - risk: |- + description: | + Severity-based vulnerability triage alone generates a lot false positives, requiring a more refined approach. + + Use the likelihood of exploitation by using *known exploited vulnerabilities* (CISA KEV), or prediction models such as + *Exploit Prediction Scoring System* (EPSS). + risk: | Without proper prioritization, organizations may waste time and effort on low-risk vulnerabilities while neglecting critical ones. - measure: Estimate the likelihood of exploitation by using data (CISA KEV) from the past or prediction models (e.g. Exploit Prediction Scoring System, EPSS). - description: Severity-based vulnerability triage alone generates a lot false positives, requiring a more refined approach. + measure: | + Use CISA KEV and EPSS to prioritize vulnerabilities that are more likely to be exploited. difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 4 - level: 3 + level: 2 dependsOn: - d918cd44-a972-43e9-a974-eff3f4a5dcfe # SCA for server implementation: From 3521a806716c787c8ae468a8a2b359d76d88dd9f Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sun, 30 Nov 2025 23:13:52 +0100 Subject: [PATCH 147/370] Renamed `Versioning` to `Version control` and added description --- .../Implementation/DevelopmentAndSourceControl.yaml | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index 3d02cb1..c94bd01 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -84,12 +84,17 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 - Versioning: + Version control: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f - risk: Deployment of untracked artifacts. - description: Use a version control system platform like Github, Gitlab, Bitbucket, gittea,... to version your code. + description: + Use a _version control system_ like Github, Gitlab, Bitbucket, etc to version your source code. + + Also known as _source control_, _revision control_, or _source code management_. + risk: + Without version control, it is challenging to track changes, collaborate effectively, and maintain a history of code modifications. + Rollback to earlier versions is hard. measure: >- - Version artifacts in order to identify deployed features and issues. + Version your source code in order to identify deployed features and issues. This includes application and infrastructure code, jenkins configuration, container and virtual machine images definitions. difficultyOfImplementation: knowledge: 3 From ecb9c96ff0412220558222b0fe47b2c749da1263 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 1 Dec 2025 19:15:49 +0100 Subject: [PATCH 148/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 56 ++++++++++-------------- 1 file changed, 24 insertions(+), 32 deletions(-) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index 2cda5da..b54f3c8 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -323,10 +323,9 @@ Build and Deployment: description: | Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: - sca @@ -494,10 +493,9 @@ Build and Deployment: description: | Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: - sca @@ -589,10 +587,9 @@ Build and Deployment: description: | Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: - sca @@ -5081,10 +5078,9 @@ Test and Verification: description: | The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: - sca @@ -5127,10 +5123,9 @@ Test and Verification: - vulnerability url: https://owasp.org/www-project-dependency-check/ - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: - sca @@ -6218,10 +6213,9 @@ Test and Verification: - vulnerability url: https://owasp.org/www-project-dependency-check/ - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: - sca @@ -6513,10 +6507,9 @@ Test and Verification: tags: [] url: https://docs.npmjs.com/cli/audit - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: - sca @@ -7312,10 +7305,9 @@ Test and Verification: description: Registries like quay, dockerhub provide (commercial) offerings, often not suitable for distroless images - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 - name: Dependency-Track is an intelligent Component Analysis platform that - allows organizations to identify and reduce risk in the software supply - chain. Dependency-Track takes a unique and highly beneficial approach by - leveraging the capabilities of Software Bill of Materials (SBOM). + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). url: https://github.com/DependencyTrack/dependency-track tags: - sca From 59518f968cdcc52890942cbc3a49acfac2d563c7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 1 Dec 2025 19:35:37 +0100 Subject: [PATCH 149/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- src/assets/YAML/generated/generated.yaml | 649 +++++++++++++++++++++++ 1 file changed, 649 insertions(+) diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml index b54f3c8..bbd4520 100644 --- a/src/assets/YAML/generated/generated.yaml +++ b/src/assets/YAML/generated/generated.yaml @@ -44,6 +44,10 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Defined%20build%20process + isImplemented: false + evidence: "" comments: "" tags: - none @@ -87,6 +91,10 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Building%20and%20testing%20of%20artifacts%20in%20virtual%20environments + isImplemented: false + evidence: "" comments: "" tags: - none @@ -141,6 +149,10 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Pinning%20of%20artifacts + isImplemented: false + evidence: "" comments: "" SBOM of components: uuid: 2858ac12-0179-40d9-9acf-1b839c030473 @@ -173,6 +185,10 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/SBOM%20of%20components + isImplemented: false + evidence: "" comments: "" tags: - none @@ -210,6 +226,10 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Signing%20of%20code + isImplemented: false + evidence: "" comments: "" tags: - none @@ -257,6 +277,10 @@ Build and Deployment: - 14.2.6 iso27001-2022: - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Signing%20of%20artifacts + isImplemented: false + evidence: "" comments: "" tags: - none @@ -295,6 +319,10 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Defined%20deployment%20process + isImplemented: false + evidence: "" comments: "" tags: - none @@ -353,6 +381,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Inventory%20of%20production%20components tags: - inventory Defined decommissioning process: @@ -381,6 +411,10 @@ Build and Deployment: - 11.2.7 iso27001-2022: - 7.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Defined%20decommissioning%20process + isImplemented: false + evidence: "" comments: "" tags: - none @@ -419,6 +453,9 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Environment%20depending%20configuration%20parameters%20%28secrets%29 + isImplemented: false tags: - secret Evaluation of the trust of used components: @@ -464,6 +501,10 @@ Build and Deployment: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Evaluation%20of%20the%20trust%20of%20used%20components + isImplemented: false + evidence: "" comments: "" tags: - none @@ -523,6 +564,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Inventory%20of%20production%20artifacts tags: - inventory Handover of confidential parameters: @@ -559,6 +602,9 @@ Build and Deployment: - 8.24 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Handover%20of%20confidential%20parameters + isImplemented: false tags: - secret Inventory of production dependencies: @@ -618,6 +664,8 @@ Build and Deployment: iso27001-2022: - 5.9 - 5.12 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Inventory%20of%20production%20dependencies comments: "" tags: - inventory @@ -658,6 +706,10 @@ Build and Deployment: - 8.19 - 8.32 - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Rolling%20update%20on%20deployment + isImplemented: false + evidence: "" comments: "" tags: - none @@ -692,6 +744,10 @@ Build and Deployment: - 8.33 - 8.29 - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Same%20artifact%20for%20environments + isImplemented: false + evidence: "" comments: "" tags: - none @@ -737,6 +793,10 @@ Build and Deployment: - 8.31 d3f: - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Usage%20of%20feature%20toggles + isImplemented: false + evidence: "" comments: "" tags: - none @@ -776,6 +836,10 @@ Build and Deployment: - 8.32 - 8.19 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Blue%2FGreen%20Deployment + isImplemented: false + evidence: "" comments: "" tags: - none @@ -803,6 +867,10 @@ Build and Deployment: - 8.8 - 8.19 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/A%20patch%20policy%20is%20defined + isImplemented: false + evidence: "" comments: "" tags: - patching @@ -852,6 +920,8 @@ Build and Deployment: iso27001-2022: - "8.8" - "8.27" + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Automated%20PRs%20for%20patches comments: "" tags: - patching @@ -891,6 +961,8 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Automated%20merge%20of%20automated%20PRs comments: "" tags: - patching @@ -922,6 +994,10 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Nightly%20build%20of%20images%20%28base%20images%29 + isImplemented: false + evidence: "" comments: "" tags: - patching @@ -964,6 +1040,9 @@ Build and Deployment: - 14.2.1 iso27001-2022: - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Reduction%20of%20the%20attack%20surface + evidence: "" comments: "" tags: - patching @@ -1000,6 +1079,9 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Usage%20of%20a%20maximum%20lifetime%20for%20images + evidence: "" comments: "" tags: - patching @@ -1039,6 +1121,8 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Automated%20deployment%20of%20automated%20PRs comments: "" tags: - patching @@ -1085,6 +1169,10 @@ Build and Deployment: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Usage%20of%20a%20short%20maximum%20lifetime%20for%20images + isImplemented: false + evidence: "" comments: "" tags: - patching @@ -1205,6 +1293,10 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Conduction%20of%20simple%20threat%20modeling%20on%20technical%20level + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1231,6 +1323,10 @@ Culture and Organization: iso27001-2022: - 5.1 - 5.4 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Information%20security%20targets%20are%20communicated + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1261,6 +1357,10 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Conduction%20of%20simple%20threat%20modeling%20on%20business%20level + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1301,6 +1401,10 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Creation%20of%20simple%20abuse%20stories + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1349,6 +1453,10 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Creation%20of%20threat%20modeling%20processes%20and%20standards + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1444,6 +1552,10 @@ Culture and Organization: - May be part of risk assessment - 5.12 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Conduction%20of%20advanced%20threat%20modeling + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1485,6 +1597,10 @@ Culture and Organization: - 5.8 - May be part of risk assessment - 5.9 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Creation%20of%20advanced%20abuse%20stories + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1523,6 +1639,8 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Ad-Hoc%20Security%20trainings%20for%20software%20developers tags: - none Security consulting on request: @@ -1558,6 +1676,10 @@ Culture and Organization: - 5.2 - 5.6 - 5.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Security%20consulting%20on%20request + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1597,6 +1719,10 @@ Culture and Organization: - Security champions are missing in ISO 27001 most likely - 5.4 - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Each%20team%20has%20a%20security%20champion + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1640,6 +1766,10 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Regular%20security%20training%20for%20all + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1675,6 +1805,10 @@ Culture and Organization: iso27001-2022: - Security champions are missing in ISO 27001 - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Regular%20security%20training%20of%20security%20champions + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1715,6 +1849,10 @@ Culture and Organization: but nothing to promote good behavior. iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Reward%20of%20good%20communication + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1758,6 +1896,10 @@ Culture and Organization: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Security%20code%20review + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1787,6 +1929,10 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Conduction%20of%20build-it%2C%20break-it%2C%20fix-it%20contests + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1810,6 +1956,8 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Office%20Hours tags: - none Security Coaching: @@ -1842,6 +1990,10 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Security%20Coaching + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1866,6 +2018,10 @@ Culture and Organization: - 16.1.6 iso27001-2022: - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Security-Lessoned-Learned + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1916,6 +2072,10 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Simple%20mob%20hacking + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1945,6 +2105,10 @@ Culture and Organization: - 7.1.1 iso27001-2022: - 6.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Aligning%20security%20in%20teams + isImplemented: false + evidence: "" comments: "" tags: - none @@ -1970,6 +2134,10 @@ Culture and Organization: iso27001-2022: - Mutual security testing is not explicitly required in ISO 27001 may be - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Conduction%20of%20collaborative%20team%20security%20checks + isImplemented: false + evidence: "" comments: "" tags: - none @@ -2000,6 +2168,10 @@ Culture and Organization: - 6.3 - 5.24 - 5.26 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Conduction%20of%20war%20games + isImplemented: false + evidence: "" comments: "" tags: - none @@ -2035,6 +2207,10 @@ Culture and Organization: - 7.2.2 iso27001-2022: - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Regular%20security%20training%20for%20externals + isImplemented: false + evidence: "" comments: "" tags: - none @@ -2068,6 +2244,10 @@ Culture and Organization: - 6.3 - 8.8 - 8.34 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Conduction%20of%20collaborative%20security%20checks%20with%20developers%20and%20system%20administrators + isImplemented: false + evidence: "" comments: "" tags: - none @@ -2099,6 +2279,8 @@ Culture and Organization: - 17.1.1 iso27001-2022: - 5.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Process/subsection/Definition%20of%20simple%20BCDR%20practices%20for%20critical%20components tags: - none Determining the protection requirement: @@ -2158,6 +2340,8 @@ Culture and Organization: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Process/subsection/Determining%20the%20protection%20requirement tags: - vulnerability-mgmt - metrics @@ -2186,6 +2370,10 @@ Culture and Organization: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Process/subsection/Approval%20by%20reviewing%20any%20new%20version + isImplemented: false + evidence: "" comments: "" tags: - none @@ -2210,6 +2398,10 @@ Culture and Organization: iso27001-2022: - 8.32 - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Process/subsection/Definition%20of%20a%20change%20management%20process + isImplemented: false + evidence: "" comments: "" tags: - none @@ -2271,6 +2463,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%201%20%2850%25%29 comments: "" tags: - none @@ -2317,6 +2511,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/Context-aware%20output%20encoding comments: "" tags: - none @@ -2361,6 +2557,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/Parametrization comments: "" tags: - none @@ -2422,6 +2620,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%201 comments: "" tags: - none @@ -2479,6 +2679,8 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/Containers%20are%20running%20as%20non-root tags: - none App. Hardening Level 2 (75%): @@ -2515,6 +2717,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%202%20%2875%25%29 + isImplemented: false comments: "" dependsOn: - cf819225-30cb-4702-8e32-60225eedc33d # App. Hardening Level 1 @@ -2616,6 +2821,9 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%202 + isImplemented: false comments: "" dependsOn: - 03643ca2-03c2-472b-8e19-956bf02fe9b7 # App. Hardening Level 2 (75%) @@ -2655,6 +2863,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%203 dependsOn: - ffe86caf-2fec-4630-b514-2db83983984d # App. Hardening Level 2 tags: @@ -2690,6 +2900,8 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Versioning tags: - none Require a PR before merging: @@ -2731,6 +2943,8 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Require%20a%20PR%20before%20merging tags: - none Block force pushes: @@ -2773,6 +2987,8 @@ Implementation: iso27001-2022: - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Block%20force%20pushes tags: - none Dismiss stale PR approvals: @@ -2820,6 +3036,8 @@ Implementation: - Peer review - four eyes principle is not explicitly required by ISO 27001 - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Dismiss%20stale%20PR%20approvals tags: - none Require status checks to pass: @@ -2864,6 +3082,8 @@ Implementation: iso27001-2022: - 5.3 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Require%20status%20checks%20to%20pass tags: - none .gitignore: @@ -2891,6 +3111,8 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/.gitignore tags: - none Local development linting & style checks performed: @@ -2924,6 +3146,10 @@ Implementation: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Local%20development%20linting%20%26%20style%20checks%20performed + isImplemented: false + evidence: "" comments: "" tags: - none @@ -2965,6 +3191,10 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/MFA%20for%20admins + isImplemented: false + evidence: "" comments: "" tags: - none @@ -2996,6 +3226,10 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Simple%20access%20control%20for%20systems + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3022,6 +3256,10 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20edge%20encryption%20at%20transit + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3046,6 +3284,8 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Applications%20are%20running%20in%20virtualized%20environments comments: "" tags: - none @@ -3079,6 +3319,10 @@ Implementation: iso27001-2022: - 8.13 - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Backup + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3143,6 +3387,10 @@ Implementation: - 13.1.3 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Baseline%20Hardening%20of%20the%20environment + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3182,6 +3430,10 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Isolated%20networks%20for%20virtual%20environments + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3224,6 +3476,10 @@ Implementation: - 8.25 d3f: - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/MFA + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3247,6 +3503,10 @@ Implementation: - 10.1 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20an%20security%20account + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3270,6 +3530,10 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20encryption%20at%20rest + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3298,6 +3562,10 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20test%20and%20production%20environments + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3329,6 +3597,10 @@ Implementation: - 8.6 - 8.22 - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Virtual%20environments%20are%20limited + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3362,6 +3634,10 @@ Implementation: iso27001-2022: - Virtual environments are not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Filter%20outgoing%20traffic + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3390,6 +3666,10 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Immutable%20infrastructure + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3438,6 +3718,10 @@ Implementation: - Not explicitly covered by ISO 27001 - too specific - 5.37 - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Infrastructure%20as%20Code + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3478,6 +3762,10 @@ Implementation: - System hardening is not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Limitation%20of%20system%20events + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3512,6 +3800,10 @@ Implementation: - 9.4.1 iso27001-2022: - 8.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Role%20based%20authentication%20and%20authorization + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3536,6 +3828,10 @@ Implementation: - 10.1 iso27001-2022: - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20internal%20encryption%20at%20transit + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3575,6 +3871,10 @@ Implementation: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20security%20by%20default%20for%20components + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3613,6 +3913,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/WAF%20baseline comments: ~ tags: - none @@ -3678,6 +3980,10 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Hardening%20of%20the%20Environment + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3709,6 +4015,10 @@ Implementation: iso27001-2022: - 8.31 - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Production%20near%20environments%20are%20used%20by%20developers + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3746,6 +4056,10 @@ Implementation: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20a%20chaos%20technology + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3783,6 +4097,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/WAF%20medium comments: ~ tags: - none @@ -3827,6 +4143,8 @@ Implementation: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/WAF%20Advanced comments: ~ tags: - none @@ -3867,6 +4185,10 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Centralized%20system%20logging + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3895,6 +4217,8 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Centralized%20application%20logging tags: - none Logging of security events: @@ -3950,9 +4274,13 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Logging%20of%20security%20events risk: |- * No track of security-relevant events makes it harder to analyze an incident. * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. + isImplemented: false + evidence: "" comments: "" tags: - none @@ -3978,6 +4306,8 @@ Information Gathering: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Analyze%20logs tags: - none Visualized logging: @@ -4011,6 +4341,10 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Visualized%20logging + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4039,6 +4373,10 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Correlation%20of%20security%20events + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4087,6 +4425,10 @@ Information Gathering: - Not explicitly covered by ISO 27001 - too specific - 8.15 - 5.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/PII%20logging%20concept + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4125,6 +4467,8 @@ Information Gathering: - 12.4.1 iso27001-2022: - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Simple%20application%20metrics comments: "" tags: - none @@ -4151,6 +4495,10 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Simple%20budget%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4180,6 +4528,10 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Simple%20system%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4209,6 +4561,10 @@ Information Gathering: - 6.8 - 5.25 - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Alerting + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4236,6 +4592,10 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Monitoring%20of%20costs + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4260,6 +4620,10 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Visualized%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4285,6 +4649,10 @@ Information Gathering: - 12.1.3 iso27001-2022: - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Advanced%20availability%20and%20stability%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4317,6 +4685,10 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Audit%20of%20system%20events + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4342,6 +4714,10 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Deactivation%20of%20unused%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4365,6 +4741,10 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Grouping%20of%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4393,6 +4773,10 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Targeted%20alerting + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4418,6 +4802,10 @@ Information Gathering: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Advanced%20app.%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4452,6 +4840,10 @@ Information Gathering: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Coverage%20and%20control%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4481,6 +4873,10 @@ Information Gathering: iso27001-2022: - 8.15 - 8.2 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Defense%20metrics + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4507,6 +4903,8 @@ Information Gathering: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.26 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Screens%20with%20metric%20visualization comments: "" tags: - none @@ -4530,6 +4928,10 @@ Information Gathering: - not explicitly covered by ISO 27001 iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Metrics%20are%20combined%20with%20tests + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4559,6 +4961,8 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Number%20of%20vulnerabilities%2Fseverity tags: - vulnerability-mgmt - metrics @@ -4601,6 +5005,8 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Number%20of%20vulnerabilities%2Fseverity%2Flayer tags: - vulnerability-mgmt - metrics @@ -4635,6 +5041,8 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Patching%20mean%20time%20to%20resolution%20via%20PR tags: - patching - metrics @@ -4694,6 +5102,8 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Fix%20rate%20per%20repo%2Fproduct tags: - vulnerability-mgmt - metrics @@ -4753,6 +5163,8 @@ Information Gathering: iso27001-2022: - 5.25 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Generation%20of%20response%20statistics tags: - vulnerability-mgmt - metrics @@ -4816,6 +5228,8 @@ Information Gathering: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/SLA%20per%20criticality tags: - vulnerability-mgmt - metrics @@ -4846,6 +5260,8 @@ Information Gathering: - 16.1.4 iso27001-2022: - 5.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Patching%20mean%20time%20to%20resolution%20via%20production tags: - patching - metrics @@ -4885,6 +5301,10 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20tests/subsection/Security%20unit%20tests%20for%20important%20components + isImplemented: false + evidence: "" tags: - none Security integration tests for important components: @@ -4908,6 +5328,10 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20tests/subsection/Security%20integration%20tests%20for%20important%20components + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4935,6 +5359,10 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20tests/subsection/Smoke%20Test + isImplemented: false + evidence: "" comments: "" tags: - none @@ -4960,6 +5388,10 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20tests/subsection/High%20coverage%20of%20security%20related%20module%20and%20integration%20tests + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5011,6 +5443,10 @@ Test and Verification: iso27001-2022: - Not explicitly covered by ISO 27001 - too specific - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Simple%20false%20positive%20treatment + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5035,10 +5471,13 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20with%20severity%20high%20or%20higher implementation: [] tags: - vuln-action - defect-management + evidence: "" Artifact-based false positive treatment: uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f risk: Without artifact-specific false positive handling, teams must repeatedly @@ -5100,6 +5539,8 @@ Test and Verification: iso27001-2022: - 5.25 - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Artifact-based%20false%20positive%20treatment tags: - false-positive - defect-management @@ -5165,6 +5606,10 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Simple%20visualization%20of%20defects + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5203,6 +5648,8 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Fix%20based%20on%20accessibility tags: - vuln-action - defect-management @@ -5243,6 +5690,8 @@ Test and Verification: - 6.8 - 5.25 - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Global%20false%20positive%20treatment tags: - false-positive - defect-management @@ -5320,6 +5769,8 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Integration%20in%20development%20process tags: - vulnerability-mgmt - vmm-measurements @@ -5362,6 +5813,10 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Integration%20of%20vulnerability%20issues%20into%20the%20development%20process + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5426,6 +5881,8 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20per%20protection%20requirement tags: - vulnerability-mgmt - metrics @@ -5450,6 +5907,8 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20with%20severity%20middle implementation: [] tags: - vuln-action @@ -5514,6 +5973,8 @@ Test and Verification: - 5.25 - 5.26 - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Usage%20of%20a%20vulnerability%20management%20system tags: - none Advanced visualization of defects: @@ -5563,6 +6024,10 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Advanced%20visualization%20of%20defects + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5593,6 +6058,10 @@ Test and Verification: - 5.12 - 5.13 - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Reproducible%20defect%20tickets + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5616,6 +6085,8 @@ Test and Verification: iso27001-2022: - 8.8 - 5.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20all%20defects tags: - vuln-action - defect-management @@ -5645,11 +6116,15 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20client%20side%20dynamic%20components implementation: - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb name: Ajax Spider tags: [] url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5690,6 +6165,10 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Simple%20Scan + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5716,6 +6195,8 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Usage%20of%20different%20roles implementation: - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 name: Zest @@ -5724,7 +6205,9 @@ Test and Verification: - zap description: | Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + isImplemented: false assessment: For REST APIs, multiple OAuth2 scopes are used. + evidence: "" comments: "" tags: - none @@ -5774,6 +6257,10 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20hidden%20endpoints + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5799,6 +6286,8 @@ Test and Verification: - not explicitly covered by ISO 27001 - too specific iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20more%20input%20vectors implementation: - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b name: Schemathesis @@ -5809,6 +6298,8 @@ Test and Verification: url: https://github.com/schemathesis/schemathesis description: | Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5840,6 +6331,10 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20sequential%20operations + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5875,6 +6370,10 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Usage%20of%20multiple%20scanners + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5909,6 +6408,10 @@ Test and Verification: - part of periodic review, PDCA iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20analysis + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5933,6 +6436,8 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20service%20to%20service%20communication implementation: - uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 name: Citrus Fresh Integration Testing @@ -5942,6 +6447,8 @@ Test and Verification: url: https://citrusframework.org/ description: Integration Test framework with focus on messaging applications and Microservices. + isImplemented: false + evidence: "" comments: "" tags: - none @@ -5982,6 +6489,10 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20for%20exposed%20services + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6015,6 +6526,8 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20network%20segmentation comments: "" tags: - none @@ -6060,6 +6573,10 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20of%20the%20configuration%20of%20cloud%20environments + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6090,6 +6607,10 @@ Test and Verification: iso27001-2022: - 8.19 - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20for%20unauthorized%20installation + isImplemented: false + evidence: "" dependsOn: - 0de465a6-55a7-4343-af79-948bb5ff10ba # Evaluation of the trust of used components tags: @@ -6119,6 +6640,10 @@ Test and Verification: - 9.4.3 iso27001-2022: - 5.17 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Weak%20password%20test + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6146,6 +6671,10 @@ Test and Verification: - 8.6 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Load%20tests + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6183,6 +6712,10 @@ Test and Verification: - 8.22 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20for%20unused%20Resources + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6253,6 +6786,8 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Software%20Composition%20Analysis%20%28server%20side%29 tags: - vmm-testing Test for Time to Patch: @@ -6294,6 +6829,8 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Test%20for%20Time%20to%20Patch comments: "" meta: implementationGuide: Usage of a version control platform API (e.g. github @@ -6334,6 +6871,8 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Test%20libyear comments: "" meta: implementationGuide: | @@ -6385,6 +6924,9 @@ Test and Verification: - 8.25 - 8.27 - 8.28 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/API%20design%20validation + isImplemented: false dependsOn: - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components tags: @@ -6427,6 +6969,8 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Exploit%20likelihood%20estimation tags: - none Local development security checks performed: @@ -6479,6 +7023,10 @@ Test and Verification: iso27001-2022: - Hardening is not explicitly covered by ISO 27001 - too specific - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Local%20development%20security%20checks%20performed + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6535,6 +7083,10 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Software%20Composition%20Analysis%20%28client%20side%29 + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6595,6 +7147,10 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Static%20analysis%20for%20important%20client%20side%20components + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6651,6 +7207,10 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Static%20analysis%20for%20important%20server%20side%20components + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6685,6 +7245,8 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Test%20for%20Patch%20Deployment%20Time comments: "" meta: implementationGuide: Self implementation. This activity is not repeated in @@ -6746,6 +7308,10 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Static%20analysis%20for%20all%20self%20written%20components + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6776,6 +7342,10 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Usage%20of%20multiple%20analyzers + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6807,6 +7377,8 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Dead%20code%20elimination comments: "" tags: - none @@ -6837,6 +7409,8 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Exclusion%20of%20source%20code%20duplicates comments: "" tags: - none @@ -6863,6 +7437,10 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Static%20analysis%20for%20all%20components%2Flibraries + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6912,6 +7490,10 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Stylistic%20analysis + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6947,6 +7529,10 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20stored%20secrets%20in%20build%20artifacts + isImplemented: false + evidence: "" comments: "" tags: - none @@ -6981,6 +7567,10 @@ Test and Verification: - vcs usage is not explicitly covered by ISO 27001 - too specific - 5.17 - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20stored%20secrets%20in%20code + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7014,6 +7604,10 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20cluster%20deployment%20resources + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7051,6 +7645,10 @@ Test and Verification: iso27001-2022: - 8.8 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20image%20lifetime + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7090,6 +7688,10 @@ Test and Verification: - ISO 27001:2017 mapping is missing iso27001-2022: - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20of%20virtualized%20environments + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7123,6 +7725,10 @@ Test and Verification: - 8.8 - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20the%20cloud%20configuration + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7175,6 +7781,9 @@ Test and Verification: - 8.32 - 8.29 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20the%20definition%20of%20virtualized%20environments + isImplemented: false tags: - none Test for malware: @@ -7211,6 +7820,10 @@ Test and Verification: - 12.2.1 iso27001-2022: - 8.7 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20malware + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7236,6 +7849,10 @@ Test and Verification: - 8.8 - 8.7 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20new%20image%20version + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7277,6 +7894,10 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Correlate%20known%20vulnerabilities%20in%20infrastructure%20with%20new%20image%20versions + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7323,6 +7944,10 @@ Test and Verification: - 12.6.1 iso27001-2022: - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Software%20Composition%20Analysis + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7368,6 +7993,10 @@ Test and Verification: iso27001-2022: - 8.8 - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20of%20infrastructure%20components%20for%20known%20vulnerabilities + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7395,6 +8024,10 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Default%20settings%20for%20intensity + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7422,6 +8055,10 @@ Test and Verification: iso27001-2022: - 8.32 - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Regular%20automated%20tests + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7451,6 +8088,10 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Deactivating%20of%20unneeded%20tests + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7478,6 +8119,10 @@ Test and Verification: - 8.8 - 8.25 - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/High%20test%20intensity + isImplemented: false + evidence: "" comments: "" tags: - none @@ -7509,6 +8154,10 @@ Test and Verification: - 8.32 - 8.27 - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Creation%20and%20application%20of%20a%20testing%20concept + isImplemented: false + evidence: "" comments: "" tags: - none From 50e89875c8aed80c45cd0df186d98069b24db717 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 1 Dec 2025 21:24:38 +0100 Subject: [PATCH 150/370] Deployment: Split 'Defined deployment process' --- .../BuildAndDeployment/Deployment.yaml | 40 ++++++++++++++++--- 1 file changed, 34 insertions(+), 6 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 129f0e4..aa0032c 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -70,11 +70,40 @@ Build and Deployment: Defined deployment process: uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a description: | - A defined deployment process is a documented and automated set of steps for releasing software into production. It ensures that deployments are consistent, secure, and auditable, reducing the risk of errors and unauthorized changes. + A *defined deployment process* is a documented and standardized procedure for releasing software into production, ensuring consistency and reducing the risk of errors. risk: >- - Deployment based human routines are error prone, and of insecure or malfunctioning artifacts. + Deployments relying on human memory are prone to errors, making experienced long-ter staff critical. measure: >- - Defining a deployment process ensures that there are established criteria in terms of functionalities, security, compliance, and performance, and that the artifacts meet them. + Establish a written deployment process documented in README files, wikis, or implemented as executable scripts and automated steps. + assessment: | + - Deployment process is documented and available to relevant staff + - Logs of deployments are documented and availabe to relevant staff + level: 1 + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process + implementation: + references: + samm2: + - I-SD-A-1 + iso27001-2017: + - 12.1.1 + - 14.2.2 + iso27001-2022: + - 5.37 + - 8.32 + Automated deployment process: + uuid: 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 + description: | + An *automated deployment process* implements the defined deployment steps using automation tools, ensuring consistency, auditability, and minimizing the risk of human errors or unauthorized changes. + risk: >- + Deployments relying on manual routines increase the risk of errors, insecure configurations, or deploying malfunctioning artifacts. + measure: >- + Automating the deployment process enforces predefined criteria for security, compliance, and performance, ensuring reliable artifact delivery. assessment: | - Deployment process is documented and available to relevant staff - All deployment steps are automated @@ -87,8 +116,10 @@ Build and Deployment: usefulness: 4 dependsOn: - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Def. Deployment Process implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkins - $ref: src/assets/YAML/default/implementations.yaml#/implementations/docker references: samm2: @@ -99,9 +130,6 @@ Build and Deployment: iso27001-2022: - 5.37 - 8.32 - isImplemented: false - evidence: "" - comments: "" Environment depending configuration parameters (secrets): uuid: df428c9d-efa0-4226-9f47-a15bb53f822b risk: >- From 7a2911050ed8511126c95dc0c5159f9da48007c3 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 1 Dec 2025 23:05:19 +0100 Subject: [PATCH 151/370] Split dependencies between Defined and Automated deploy process --- .../YAML/default/BuildAndDeployment/Deployment.yaml | 7 ++++--- .../Implementation/DevelopmentAndSourceControl.yaml | 2 -- .../Implementation/InfrastructureHardening.yaml | 12 ++++++------ .../TestAndVerification/ApplicationTests.yaml | 2 +- 4 files changed, 11 insertions(+), 12 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index aa0032c..b94da49 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -86,6 +86,7 @@ Build and Deployment: usefulness: 4 dependsOn: - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process + - 066084c6-1135-4635-9cc5-9e75c7c5459f # Version control implementation: references: samm2: @@ -253,7 +254,7 @@ Build and Deployment: - Inventory of all production applications with application name, owner, and date of last review - Inventory is accessible to development, security and operations teams dependsOn: - - Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process level: 1 difficultyOfImplementation: knowledge: 1 @@ -284,7 +285,7 @@ Build and Deployment: is deployed. measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically). dependsOn: - - Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components difficultyOfImplementation: knowledge: 2 @@ -323,7 +324,7 @@ Build and Deployment: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/webserver - $ref: src/assets/YAML/default/implementations.yaml#/implementations/rolling-update dependsOn: - - Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process references: samm2: - I-SD-A-2 diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index 3d02cb1..038cefc 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -97,8 +97,6 @@ Implementation: resources: 3 usefulness: 5 level: 1 - dependsOn: - - Defined deployment process implementation: [] references: samm2: diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 1e5a7a2..44b775c 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -113,7 +113,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/a-complete-backup-of - $ref: src/assets/YAML/default/implementations.yaml#/implementations/a-point-in-time-reco dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process references: samm2: - TODO @@ -292,7 +292,7 @@ Implementation: usefulness: 4 level: 4 dependsOn: - - Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process - Infrastructure as Code implementation: [] references: @@ -314,7 +314,7 @@ Implementation: or to modify information unauthorized on systems. measure: The usage of a (role based) access control helps to restrict system - access to authorized users. And enhancement is to use attribute based access control. + access to authorized users. And enhancement is to use *attribute based access control*. difficultyOfImplementation: knowledge: 2 time: 3 @@ -325,7 +325,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/directory-service - $ref: src/assets/YAML/default/implementations.yaml#/implementations/plugins dependsOn: - - Defined deployment process + - Defined deployment process # Does RBAC require a defined build and deployment process? - Defined build process references: samm2: @@ -350,7 +350,7 @@ Implementation: usefulness: 5 level: 1 dependsOn: - - Defined deployment process + - Defined deployment process # Does simple access control require a defined deployment process? implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/http-basic-authentic - $ref: src/assets/YAML/default/implementations.yaml#/implementations/vpn @@ -605,7 +605,7 @@ Implementation: usefulness: 4 level: 2 dependsOn: - - Defined deployment process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: [] references: samm2: diff --git a/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml b/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml index b4bb808..4266f36 100755 --- a/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml +++ b/src/assets/YAML/default/TestAndVerification/ApplicationTests.yaml @@ -100,7 +100,7 @@ Test and Verification: level: 4 implementation: [] dependsOn: - - Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process references: samm2: - V-RT-A-3 From cf9954dd1048a96750be4ac12aa9f70c37865a34 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Fri, 5 Dec 2025 17:53:35 +0100 Subject: [PATCH 152/370] Updated with PR feedback --- .../YAML/default/BuildAndDeployment/Deployment.yaml | 8 ++++---- .../default/Implementation/InfrastructureHardening.yaml | 5 ----- 2 files changed, 4 insertions(+), 9 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index b94da49..152979b 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -80,10 +80,10 @@ Build and Deployment: - Logs of deployments are documented and availabe to relevant staff level: 1 difficultyOfImplementation: - knowledge: 2 - time: 2 + knowledge: 1 + time: 1 resources: 1 - usefulness: 4 + usefulness: 1 dependsOn: - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process - 066084c6-1135-4635-9cc5-9e75c7c5459f # Version control @@ -113,7 +113,7 @@ Build and Deployment: difficultyOfImplementation: knowledge: 2 time: 2 - resources: 1 + resources: 2 usefulness: 4 dependsOn: - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 44b775c..3995780 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -324,9 +324,6 @@ Implementation: implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/directory-service - $ref: src/assets/YAML/default/implementations.yaml#/implementations/plugins - dependsOn: - - Defined deployment process # Does RBAC require a defined build and deployment process? - - Defined build process references: samm2: - O-EM-A-2 @@ -349,8 +346,6 @@ Implementation: resources: 3 usefulness: 5 level: 1 - dependsOn: - - Defined deployment process # Does simple access control require a defined deployment process? implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/http-basic-authentic - $ref: src/assets/YAML/default/implementations.yaml#/implementations/vpn From 462a2a324c06f7ff6ad9c6820bad80451f64d7cc Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Fri, 5 Dec 2025 18:30:22 +0100 Subject: [PATCH 153/370] Add placeholder for generated files --- generated/README.md | 1 + 1 file changed, 1 insertion(+) create mode 100644 generated/README.md diff --git a/generated/README.md b/generated/README.md new file mode 100644 index 0000000..8794d48 --- /dev/null +++ b/generated/README.md @@ -0,0 +1 @@ +GitHub Actions will update these generated files. \ No newline at end of file From 70f193320796ddaef500424b61f9364dc599147a Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Fri, 5 Dec 2025 18:57:46 +0100 Subject: [PATCH 154/370] Fixed references to previous yaml file --- .github/workflows/main.yml | 4 ++-- .gitignore | 2 +- README.md | 20 +++++--------------- yaml-generation/generateDimensions.bash | 6 +++--- yaml-generation/generateDimensions.bat | 6 +++--- 5 files changed, 14 insertions(+), 24 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index e0634c7..28c4f72 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -58,9 +58,9 @@ jobs: docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 docker cp yaml:/var/www/html/generated/model.yaml generated/model.yaml docker cp yaml:/var/www/html/generated/dependency-tree.md generated/dependency-tree.md - - name: Replace version placeholder in activities.yaml + - name: Replace version placeholder in model.yaml run: | - sed -i "s/__VERSION_PLACEHOLDER__/${{ steps.get-version.outputs.version }}/g" src/assets/YAML/activities.yaml + sed -i "s/__VERSION_PLACEHOLDER__/${{ steps.get-version.outputs.version }}/g" src/assets/YAML/model.yaml - name: Commit all changed files back to the repository uses: planetscale/ghcommit-action@v0.1.6 with: diff --git a/.gitignore b/.gitignore index 6f22dad..b4a1f7d 100644 --- a/.gitignore +++ b/.gitignore @@ -48,5 +48,5 @@ Thumbs.db # Generated /src/assets/YAML/generated/generated.yaml /generated/model.yaml -dependency-tree.md +/generated/dependency-tree.md url-test-results.txt \ No newline at end of file diff --git a/README.md b/README.md index d7242c8..096553f 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,6 @@ # OWASP DevSecOps Maturity Model Data -This GitHub project ([DevSecOps-MaturityModel-data](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data)) contains the source for the model itself, used by the DSOMM applciation [DevSecOps-MaturityModel](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel). +This GitHub project ([DevSecOps-MaturityModel-data](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data)) contains the source for the DSOMM *model*. The model is used by the DSOMM applciation [DevSecOps-MaturityModel](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel). The source files include dimensions, activities, descriptions, measures, and other model data used by the application. @@ -12,7 +12,7 @@ Contributions that improve the DSOMM model are welcome. Please edit the source f ### Testing -After making changes, generate a new `activities.yaml` and use it in a local DSOMM application to verify there are no technical issues. +After making changes, generate a new `model.yaml` and use it in a local DSOMM application to verify there are no technical issues. ## Usage @@ -28,11 +28,7 @@ Depending on your platform use either `generateDimensions.bash` (Linux) or `gene `cd yaml-generation` -3. Install dependencies: - - `./generateDimensions.bash --install` - -4. Generate `activities.yaml`: +3. Generate `model.yaml`: `./generateDimensions.bash` @@ -42,14 +38,14 @@ Depending on your platform use either `generateDimensions.bash` (Linux) or `gene To start a local DSOMM instance on http://localhost:8080, run: - `./generateDimensions.bash --start-dsomm` + - `./generateDimensions.bash --start-dsomm` ### Test referenced URLs To test all URLs referenced by `implementations.yaml` and save results to `url-test-results.txt`, run: - `./generateDimensions.bash --test-urls` + - `./generateDimensions.bash --test-urls` ### Using Podman instead of Docker @@ -57,12 +53,6 @@ To test all URLs referenced by `implementations.yaml` and save results to `url-t If you prefer Podman over Docker, set the environement variable `DOCKER_CMD` to `podman`, or edit the script for you operating system. -## Development -cd yaml-generation -docker run --rm -v $(pwd):/app composer install -cd .. -docker run -ti -v $(pwd)/yaml-generation:/var/www/html/yaml-generation -v $(pwd)/src/assets/YAML/:/var/www/html/src/assets/YAML/ wurstbrot/dsomm-yaml-generation - ## Credits - The "Test and Verification" dimension is based on Christian Schneider's Security DevOps Maturity Model (SDOMM). diff --git a/yaml-generation/generateDimensions.bash b/yaml-generation/generateDimensions.bash index 8f6499a..f6ef31d 100755 --- a/yaml-generation/generateDimensions.bash +++ b/yaml-generation/generateDimensions.bash @@ -2,7 +2,7 @@ # Usage: # ./generateDimensions.bash --install First time, install composer dependencies -# ./generateDimensions.bash Generate activities.yaml +# ./generateDimensions.bash Generate model.yaml # ./generateDimensions.bash --test-urls Test URLs in implementations.yaml cd "$(dirname "$0")"/.. @@ -17,12 +17,12 @@ MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}:/app" wurstbrot/dso if [ "$1" = "--start-dsomm" ]; then echo "Starting local DSOMM application..." - MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml" -p 8080:8080 wurstbrot/dsomm + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}/generated/model.yaml:/generated/model.yaml" -p 8080:8080 wurstbrot/dsomm elif [ "$1" = "--test-urls" ]; then echo "Test URLs in implementations.yaml..." MSYS_NO_PATHCONV=1 $DOCKER_CMD run -e TEST_REFERENCED_URLS=true -ti --rm --volume "${PWD}:/app" wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' | tee url-test-results.txt else - echo "Generating activities.yaml..." + echo "Generating model.yaml..." MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}:/app" wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' fi diff --git a/yaml-generation/generateDimensions.bat b/yaml-generation/generateDimensions.bat index 646daab..d68274b 100644 --- a/yaml-generation/generateDimensions.bat +++ b/yaml-generation/generateDimensions.bat @@ -2,7 +2,7 @@ REM Usage: REM ./generateDimensions.bash --install First time, install composer dependencies -REM ./generateDimensions.bash Generate activities.yaml +REM ./generateDimensions.bash Generate model.yaml REM ./generateDimensions.bash --test-urls Test URLs in implementations.yaml setlocal @@ -19,14 +19,14 @@ echo Installing composer dependencies... if "%~1"=="--start-dsomm" ( echo Start local DSOMM application... - %DOCKER_CMD% run -ti --rm --volume "%CD%/src/assets/YAML/generated/generated.yaml:/srv/assets/YAML/generated/generated.yaml" -p 8080:8080 wurstbrot/dsomm + %DOCKER_CMD% run -ti --rm --volume "%CD%/generated/model.yaml:/generated/model.yaml" -p 8080:8080 wurstbrot/dsomm ) else if "%~1"=="--test-urls" ( echo Test URLs in implementations.yaml... %DOCKER_CMD% run -e TEST_REFERENCED_URLS=true -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" | tee url-test-results.txt ) else ( - echo Generate activities.yaml... + echo Generate model.yaml... %DOCKER_CMD% run -e %argument% -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" ) From 3ccbd868961cacb7360245cb6ffde1d3a0f9009b Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 6 Dec 2025 13:21:12 +0100 Subject: [PATCH 155/370] Fix docker volume mapping for `--start-dsomm` Improved Usage documentation --- README.md | 4 +++- yaml-generation/generateDimensions.bash | 9 +++++---- yaml-generation/generateDimensions.bat | 8 ++++---- 3 files changed, 12 insertions(+), 9 deletions(-) diff --git a/README.md b/README.md index 096553f..7254906 100644 --- a/README.md +++ b/README.md @@ -12,7 +12,7 @@ Contributions that improve the DSOMM model are welcome. Please edit the source f ### Testing -After making changes, generate a new `model.yaml` and use it in a local DSOMM application to verify there are no technical issues. +After making changes, generate a new `model.yaml` and start a local DSOMM application to verify there are no technical issues. (See below.) ## Usage @@ -40,6 +40,8 @@ To start a local DSOMM instance on http://localhost:8080, run: - `./generateDimensions.bash --start-dsomm` + This will down the latest DSOMM docker image and spin it up as a docker container. + ### Test referenced URLs diff --git a/yaml-generation/generateDimensions.bash b/yaml-generation/generateDimensions.bash index f6ef31d..3fa3d50 100755 --- a/yaml-generation/generateDimensions.bash +++ b/yaml-generation/generateDimensions.bash @@ -1,9 +1,9 @@ #!/bin/bash # Usage: -# ./generateDimensions.bash --install First time, install composer dependencies -# ./generateDimensions.bash Generate model.yaml -# ./generateDimensions.bash --test-urls Test URLs in implementations.yaml +# ./generateDimensions.bash Generate model.yaml +# ./generateDimensions.bash --test-urls Test URLs in implementations.yaml +# ./generateDimensions.bash --start-dsomm Run local DSOMM with generated model.yaml cd "$(dirname "$0")"/.. @@ -17,7 +17,8 @@ MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}:/app" wurstbrot/dso if [ "$1" = "--start-dsomm" ]; then echo "Starting local DSOMM application..." - MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}/generated/model.yaml:/generated/model.yaml" -p 8080:8080 wurstbrot/dsomm + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}/generated/model.yaml:/srv/assets/YAML/default/model.yaml" -p 8080:8080 wurstbrot/dsomm + elif [ "$1" = "--test-urls" ]; then echo "Test URLs in implementations.yaml..." MSYS_NO_PATHCONV=1 $DOCKER_CMD run -e TEST_REFERENCED_URLS=true -ti --rm --volume "${PWD}:/app" wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' | tee url-test-results.txt diff --git a/yaml-generation/generateDimensions.bat b/yaml-generation/generateDimensions.bat index d68274b..36ea1de 100644 --- a/yaml-generation/generateDimensions.bat +++ b/yaml-generation/generateDimensions.bat @@ -1,9 +1,9 @@ @echo off REM Usage: -REM ./generateDimensions.bash --install First time, install composer dependencies -REM ./generateDimensions.bash Generate model.yaml -REM ./generateDimensions.bash --test-urls Test URLs in implementations.yaml +REM ./generateDimensions.bash Generate model.yaml +REM ./generateDimensions.bash --test-urls Test URLs in implementations.yaml +REM ./generateDimensions.bash --start-dsomm Run local DSOMM with generated model.yaml setlocal REM Change working directory to the project root @@ -19,7 +19,7 @@ echo Installing composer dependencies... if "%~1"=="--start-dsomm" ( echo Start local DSOMM application... - %DOCKER_CMD% run -ti --rm --volume "%CD%/generated/model.yaml:/generated/model.yaml" -p 8080:8080 wurstbrot/dsomm + %DOCKER_CMD% run -ti --rm --volume "%CD%/generated/model.yaml:/srv/assets/YAML/default/model.yaml" -p 8080:8080 wurstbrot/dsomm ) else if "%~1"=="--test-urls" ( echo Test URLs in implementations.yaml... From 1578bb271fed802ac0b52e09157631e07c26ea2b Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 6 Dec 2025 15:08:46 +0100 Subject: [PATCH 156/370] Generate `publisher` automatically --- yaml-generation/generateDimensions.bash | 2 +- yaml-generation/generateDimensions.bat | 2 +- yaml-generation/generateDimensions.php | 9 +++++++-- 3 files changed, 9 insertions(+), 4 deletions(-) diff --git a/yaml-generation/generateDimensions.bash b/yaml-generation/generateDimensions.bash index 3fa3d50..4d19d13 100755 --- a/yaml-generation/generateDimensions.bash +++ b/yaml-generation/generateDimensions.bash @@ -25,5 +25,5 @@ elif [ "$1" = "--test-urls" ]; then else echo "Generating model.yaml..." - MSYS_NO_PATHCONV=1 $DOCKER_CMD run -ti --rm --volume "${PWD}:/app" wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' + MSYS_NO_PATHCONV=1 $DOCKER_CMD run -e USERNAME=${USER:-$USERNAME} -ti --rm --volume "${PWD}:/app" wurstbrot/dsomm-yaml-generation bash -c 'cd /app/ && php yaml-generation/generateDimensions.php' fi diff --git a/yaml-generation/generateDimensions.bat b/yaml-generation/generateDimensions.bat index 36ea1de..9ea6b72 100644 --- a/yaml-generation/generateDimensions.bat +++ b/yaml-generation/generateDimensions.bat @@ -27,7 +27,7 @@ if "%~1"=="--start-dsomm" ( ) else ( echo Generate model.yaml... - %DOCKER_CMD% run -e %argument% -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" + %DOCKER_CMD% run -e USERNAME=%USERNAME% -ti --rm --volume "%CD%:/app" wurstbrot/dsomm-yaml-generation bash -c "cd /app/ && php yaml-generation/generateDimensions.php" ) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index a7c1a37..766074c 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -7,6 +7,12 @@ $inputFolder = "src/assets/YAML"; $implementationReferenceFile = "$inputFolder/default/implementations.yaml"; +if (getenv('GITHUB_ACTIONS')) { + $publisher = 'https://github.com/' . getenv('GITHUB_REPOSITORY'); +} else { + $publisher = getenv('USERNAME'); +} + $files = glob("$inputFolder/default/*/*.yaml"); $dimensions = array(); foreach ($files as $filename) { @@ -157,7 +163,6 @@ } - // Post-process to add activity name as comment for `dependsOn` $dimensionsString = yaml_emit($dimensionsAggregated); preg_match_all('/\{!([0-9a-z-]{30,})!\}/', $dimensionsString, $matches); @@ -173,7 +178,7 @@ 'meta' => array( 'version' => '__VERSION_PLACEHOLDER__', 'released' => date('Y-m-d'), - 'publisher' => 'https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/' + 'publisher' => $publisher ) ); $modelString = yaml_emit_with_header($metaDocument, $dimensionsAggregated); From c37ef594e518e6eb106fa26154282c9eccfb4b7a Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Sat, 6 Dec 2025 17:54:01 +0100 Subject: [PATCH 157/370] Updated external URLs --- .../Implementation/ApplicationHardening.yaml | 3 + .../DevelopmentAndSourceControl.yaml | 3 +- .../InfrastructureHardening.yaml | 9 ++- .../StaticDepthForApplications.yaml | 3 +- src/assets/YAML/default/implementations.yaml | 76 ++++++++++--------- yaml-generation/generateDimensions.php | 22 +++++- 6 files changed, 73 insertions(+), 43 deletions(-) diff --git a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml index d1e9555..fde532a 100755 --- a/src/assets/YAML/default/Implementation/ApplicationHardening.yaml +++ b/src/assets/YAML/default/Implementation/ApplicationHardening.yaml @@ -40,6 +40,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-asvs - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-masvs - $ref: src/assets/YAML/default/implementations.yaml#/implementations/apimaturity + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-myths references: samm2: - D-SR-A-2 @@ -172,6 +173,7 @@ Implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-asvs - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-masvs - $ref: src/assets/YAML/default/implementations.yaml#/implementations/apimaturity + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-myths references: samm2: - D-SR-A-3 @@ -202,6 +204,7 @@ Implementation: implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-asvs - $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-masvs + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-myths references: samm2: - D-SR-A-3 diff --git a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml index 66dde7c..9a49570 100755 --- a/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml +++ b/src/assets/YAML/default/Implementation/DevelopmentAndSourceControl.yaml @@ -16,7 +16,8 @@ Implementation: description: "" implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/stylecop - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sonarqube + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sonarqube-lint + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/eslint references: samm2: - V-ST-A-1 diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 3995780..071a863 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -675,7 +675,8 @@ Implementation: level: 3 dependsOn: - Context-aware output encoding - implementation: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-myths references: samm2: - O-EM-A-1 @@ -713,7 +714,8 @@ Implementation: level: 4 dependsOn: - WAF baseline - implementation: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-myths references: samm2: - O-EM-A-2 @@ -756,7 +758,8 @@ Implementation: level: 5 dependsOn: - WAF medium - implementation: [] + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/api-myths references: samm2: - O-EM-A-2 diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 03d912c..5a375bc 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -304,7 +304,8 @@ Test and Verification: implementation: - $ref: src/assets/YAML/default/implementations.yaml#/implementations/pmd - $ref: src/assets/YAML/default/implementations.yaml#/implementations/stylecop - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sonarqube + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/eslint + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sonarqube-lint - $ref: src/assets/YAML/default/implementations.yaml#/implementations/github-super-linter references: samm2: diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index ac92802..89dbf84 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -9,7 +9,7 @@ implementations: uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 name: Enforcement of commit signing tags: [signing] - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule description: |- Usage of branch protection rules signing-of-commits: @@ -92,15 +92,15 @@ implementations: kubernetes-admission: uuid: 2a76300f-6b1f-4a51-b925-134c36b723af name: - Kubernetes Admission Controller can whitelist registries and/or whitelist - a signing key. + Kubernetes Admission Controller can whitelist registries and/or whitelist a signing key. tags: [] url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + test-url-expects: [403] dependabot: uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 name: dependabot tags: ["auto-pr", "patching"] - url: https://dependabot.com/ + url: https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide renovate: uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 name: renovate @@ -141,12 +141,13 @@ implementations: uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a name: Fedora CoreOS tags: [] - url: https://getfedora.org/coreos + url: https://fedoraproject.org/coreos/ distroless-usage: uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd name: Distroless or Alpine tags: [] url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + test-url-expects: [403] threat-modeling-play: uuid: fd0f282b-a065-4464-beed-770c604a5f52 name: Threat Modeling Playbook @@ -181,10 +182,10 @@ implementations: uuid: bb5b8988-021b-452a-a914-bd36887b6860 name: "Don't Forget EVIL User stories" tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development + url: https://medium.com/serious-scrum/evil-user-storys-story-telling-for-it-security-e4a9ec94193c + test-url-expects: [403] description: - "[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories)\ - \ and [Practical Security Stories and Security Tasks for Agile Development Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)" + "Do not Forget _Evil_ User Stories and [Practical Security Stories and Security Tasks for Agile Development Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)" libyear: uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 name: libyear @@ -196,7 +197,7 @@ implementations: uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a name: OWASP Juice Shop tags: [training] - url: https://github.com/bkimminich/juice-shop + url: https://github.com/juice-shop/juice-shop description: |- In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday" owasp-cheatsheet-series: @@ -253,7 +254,7 @@ implementations: uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 name: OWASP MASVS tags: [] - url: https://github.com/OWASP/owasp-masvs + url: https://github.com/OWASP/masvs cis-kubernetes-benchmark: uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff name: CIS Kubernetes Benchmark for Security @@ -290,7 +291,7 @@ implementations: uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 name: Attack Matrix Kubernetes tags: [mitre] - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + url: https://www.microsoft.com/en-US/security/blog/2020/04/02/attack-matrix-kubernetes/ description: |- Attack matrix for kubernetes istio: @@ -378,12 +379,12 @@ implementations: uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 name: HTTP-Basic Authentication tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication vpn: uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e name: VPN tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + url: https://d3fend.mitre.org/dao/artifact/d3f:VPNServer/ for-applications-ch: uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c name: "For applications: Check default encoding" @@ -401,7 +402,7 @@ implementations: uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 name: authentication tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ ### ??? rsyslog: uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 name: rsyslog @@ -410,7 +411,7 @@ implementations: logstash: uuid: 7a8fad2e-d642-4972-8501-74591b23feab name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + url: https://www.elastic.co/docs/reference/logstash/getting-started-with-logstash tags: [tool, logging] fluentd: uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 @@ -441,10 +442,10 @@ implementations: uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 name: ELK-Stack tags: [] - url: https://www.elastic.co/elk-stack + url: https://www.elastic.co/elastic-stack/ https-ht-transpare: uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare + name: https://ht.transpare ### ??? tags: [] url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf @@ -461,7 +462,7 @@ implementations: uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d name: JUnit tags: [unittest] - url: https://junit.org/junit5/ + url: https://junit.org/ karma: uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 name: Karma @@ -518,7 +519,7 @@ implementations: uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 name: OWASP Code Pulse tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse + url: https://owasp.org/www-project-code-pulse/ ajax-spider: uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb name: Ajax Spider @@ -573,7 +574,7 @@ implementations: uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce name: HTC Hydra tags: [password] - url: https://www.htc-cs.com/en/products/htc-hydra/ + url: https://www.htc-cs.com/en/products/htc-hydra/ ### ??? netassert: uuid: fffa6fb9-1fae-4852-88dc-c7086961330c name: netassert @@ -588,7 +589,7 @@ implementations: uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a name: OWASP Amass tags: [] - url: https://github.com/OWASP/Amass + url: https://github.com/owasp-amass/amass k8spurger: uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 name: K8sPurger @@ -630,6 +631,7 @@ implementations: name: npm audit tags: [] url: https://docs.npmjs.com/cli/audit + test-url-expects: [301] sigmahq: uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 name: SigmaHQ @@ -641,7 +643,7 @@ implementations: tags: [] url: https://github.com/wagoodman/dive clusterscanner: - url: https://github.com/SDA-SE/clusterscanner + url: https://github.com/SDA-SE/cluster-image-scanner uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f name: ClusterScanner tags: @@ -699,7 +701,7 @@ implementations: uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 name: truffleHog tags: [] - url: https://github.com/dxa4481/truffleHog + url: https://github.com/trufflesecurity/trufflehog go-pillage-registrie: uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 name: go-pillage-registries @@ -736,38 +738,40 @@ implementations: threat-matrix-for-storage: uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + url: https://www.microsoft.com/en-US/security/blog/2021/04/08/threat-matrix-for-storage/ tags: [documentation, storage, cluster, kubernetes] defend-the-core-kubernetes: uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af name: Defend the core kubernetes security at every layer - url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ tags: [documentation, cluster, kubernetes] business-friendly-vulnerability-metrics: uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde name: Business friendly vulnerability management metrics url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + test-url-expects: [403] tags: [documentation, vulnerability, vulnerability management system] kubescape: uuid: 893d9f37-2142-4490-996c-e43b55064d3d name: kubescape - url: https://github.com/armosec/kubescape + url: https://github.com/kubescape/kubescape tags: [kubernetes, vulnerability, misconfiguration] description: _Testing if Kubernetes is deployed securely as defined in Kubernetes Hardening Guidance by to NSA and CISA_ azuredevops: uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + url: https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops tags: [source-code-protection, scm] github-policies: uuid: 99211481-de9c-4358-880e-628366416a27 name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches tags: [source-code-protection, scm] - sonarqube: + sonarqube-lint: uuid: aa5ded61-5380-4da6-9474-afc36a397682 name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + url: https://medium.com/@elenavilchik/in-depth-linting-of-your-typescript-while-coding-1d084affbf0 + test-url-expects: [403] tags: [ide, linting] stylecop: uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe @@ -778,26 +782,29 @@ implementations: uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 name: Fortify Extension for Visual Studio Code url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + test-url-expects: [404] tags: [ide, sast] appscan-vscode-extension: uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb name: HCL AppScan CodeSweep url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + test-url-expects: [404] tags: [ide, sast] checkmarx-vscode-extension: uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 name: Setting Up the Visual Studio Code Extension Plugin url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + test-url-expects: [302] tags: [ide, sast] pre-commit-microsoft: uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + url: https://learn.microsoft.com/en-us/security/zero-trust/develop/secure-devops-environments-zero-trust tags: [pre-commit] pre-commit-synopsis: uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + url: https://www.blackduck.com/blog/devsecops-pipeline-checklist/ tags: [pre-commit] dependencyTrack: uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 @@ -831,7 +838,7 @@ implementations: uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 name: Coverage.py tags: [testing, coverage] - url: https://github.com/nedbat/coveragepy + url: https://github.com/coveragepy/coveragepy description: | Code coverage measurement for Python github-dependabot: @@ -888,6 +895,7 @@ implementations: name: terraform tags: [IaC] url: https://www.terraform.io/ + test-url-expects: [308] description: | Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. packj: @@ -897,7 +905,7 @@ implementations: url: https://github.com/ossillate-inc/packj description: | Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. - apiMyth: + api-myths: uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 name: Top 5 API Security Myths That Are Crushing Your Business tags: [documentation, waf] diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index a45d121..da49b30 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -234,7 +234,7 @@ function assertUniqueRefByKey($references, $keyToAssert, &$errorMsg) { $value = $reference[$keyToAssert]; // echo "$key: $value\n"; if (array_key_exists($value, $all_values)) { - array_push($errorMsg, "Duplicate '$keyToAssert' in reference file: " . $all_values[$value] . " and $key: $printable_keyToAssert='$value'"); + array_push($errorMsg, "Duplicate '$keyToAssert' in reference file: '" . $all_values[$value] . "' and '$key': $printable_keyToAssert='$value'"); } else { $all_values[$value] = $key; } @@ -267,7 +267,7 @@ function assertLiveUrlsInRefs($all_references, &$errorMsg) { if (array_key_exists('url', $reference)) { $url = $reference['url']; echo " $key: $url\n"; - $err = assertLiveUrl($reference['url']); + $err = assertLiveUrl($reference['url'], $reference['test-url-expects'] ?? []); if ($err) { echo " # $err\n"; array_push($errorMsg, "Dead ref URL ($key): $err"); @@ -280,11 +280,12 @@ function assertLiveUrlsInRefs($all_references, &$errorMsg) { } -function assertLiveUrl($url):string { +function assertLiveUrl($url, $expectedStatusCodes = []):string { $useragent = 'Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:135.0) Gecko/20100101 Firefox/135.0'; $curl = curl_init($url); curl_setopt($curl, CURLOPT_USERAGENT, $useragent); + curl_setopt($curl, CURLOPT_HTTPHEADER, ['Accept-Language: en-US,en']); curl_setopt($curl, CURLOPT_NOBODY, true); curl_setopt($curl, CURLOPT_HEADER, true); curl_setopt($curl, CURLOPT_FOLLOWLOCATION, false); @@ -305,7 +306,7 @@ function assertLiveUrl($url):string { curl_close($curl); - if ($statusCode == 200) { + if (isExpectedStatusCode($statusCode, $expectedStatusCodes)) { return ""; } if ($statusCode == 301 || $statusCode == 302) { @@ -314,6 +315,19 @@ function assertLiveUrl($url):string { return "Status code: $statusCode: $url"; } +function isExpectedStatusCode($statusCode, $expectedStatusCodes) { + if (count($expectedStatusCodes) == 0) { + return $statusCode == 200; + } + + foreach ($expectedStatusCodes as $expectedStatusCode) { + if ($statusCode == $expectedStatusCode) { + return true; + } + } + return false; +} + /** From f7f5f16e648ca162aea0c440a6f5dcc630a22b8d Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Mon, 8 Dec 2025 20:36:07 +0100 Subject: [PATCH 158/370] Updated with feedback from PR --- .../YAML/default/InformationGathering/Monitoring.yaml | 3 +-- src/assets/YAML/default/implementations.yaml | 10 ++-------- 2 files changed, 3 insertions(+), 10 deletions(-) diff --git a/src/assets/YAML/default/InformationGathering/Monitoring.yaml b/src/assets/YAML/default/InformationGathering/Monitoring.yaml index 247edb8..2d0b6f8 100755 --- a/src/assets/YAML/default/InformationGathering/Monitoring.yaml +++ b/src/assets/YAML/default/InformationGathering/Monitoring.yaml @@ -127,8 +127,7 @@ Information Gathering: level: 4 dependsOn: - Visualized metrics - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/https-ht-transpare + implementation: [] references: samm2: - O-IM-A-2 diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 89dbf84..6a25607 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -402,7 +402,7 @@ implementations: uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 name: authentication tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ ### ??? + url: https://d3fend.mitre.org/dao/artifact/d3f:AuthenticationServer/ rsyslog: uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 name: rsyslog @@ -443,12 +443,6 @@ implementations: name: ELK-Stack tags: [] url: https://www.elastic.co/elastic-stack/ - https-ht-transpare: - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare ### ??? - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf prometheus: uuid: ddf221df-3517-42e4-b23d-c1d9a162744c name: Prometheus @@ -574,7 +568,7 @@ implementations: uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce name: HTC Hydra tags: [password] - url: https://www.htc-cs.com/en/products/htc-hydra/ ### ??? + url: https://github.com/vanhauser-thc/thc-hydra netassert: uuid: fffa6fb9-1fae-4852-88dc-c7086961330c name: netassert From 1f98fa1d832fe6cf313295264342ba0a8990f154 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 09:22:19 +0100 Subject: [PATCH 159/370] BREAKING CHANGE: add folder generated to container --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index a5be9e1..3fec5f0 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,7 @@ FROM php:apache-bullseye RUN apt-get update && apt-get -y install apt-utils libyaml-dev wget unzip && wget -O composer-setup.php https://getcomposer.org/installer && php composer-setup.php --install-dir=/usr/local/bin --filename=composer COPY yaml-generation /var/www/html/yaml-generation +COPY generated /var/www/html/generated COPY src /var/www/html/src RUN cd /var/www/html/yaml-generation && composer install \ --ignore-platform-reqs \ From 64afb88800384db932ef76372c1b256ae55ba1df Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 09:35:48 +0100 Subject: [PATCH 160/370] Update GitHub Actions workflow to simplify steps Removed version placeholder replacement step in workflow. --- .github/workflows/main.yml | 11 +++++------ 1 file changed, 5 insertions(+), 6 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 28c4f72..975bbb7 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -53,14 +53,13 @@ jobs: file: Dockerfile platforms: linux/amd64,linux/arm64 tags: wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }},wurstbrot/dsomm-yaml-generation:latest + build-args: | + VERSION=${{ steps.get-version.outputs.version }} - name: Extract generated files from docker image run: | docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 - docker cp yaml:/var/www/html/generated/model.yaml generated/model.yaml - docker cp yaml:/var/www/html/generated/dependency-tree.md generated/dependency-tree.md - - name: Replace version placeholder in model.yaml - run: | - sed -i "s/__VERSION_PLACEHOLDER__/${{ steps.get-version.outputs.version }}/g" src/assets/YAML/model.yaml + docker cp yaml:/var/www/html/generated/model.yaml generated/model.yaml + docker cp yaml:/var/www/html/generated/dependency-tree.md generated/dependency-tree.md - name: Commit all changed files back to the repository uses: planetscale/ghcommit-action@v0.1.6 with: @@ -68,4 +67,4 @@ jobs: repo: ${{ github.repository }} branch: ${{ github.head_ref || github.ref_name }} env: - GITHUB_TOKEN: ${{secrets.ACCESS_TOKEN}} \ No newline at end of file + GITHUB_TOKEN: ${{secrets.ACCESS_TOKEN}} From 37958b54e20b80b4401980a28b07616c964f35d5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 09:38:17 +0100 Subject: [PATCH 161/370] fix: Modify YAML generation to include version placeholder Update YAML generation command to replace version placeholder. --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 3fec5f0..9e2d2d9 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,6 +11,6 @@ RUN cd /var/www/html/yaml-generation && composer install \ --prefer-dist RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml -RUN cd /var/www/html && php yaml-generation/generateDimensions.php +RUN cd /var/www/html && php yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/{VERSION}/g" /var/www/html/generated/model.yaml workdir /var/www/html CMD php yaml-generation/generateDimensions.php From c45eba4919ef7ab2338326a1d64142afa313befe Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 09:41:35 +0100 Subject: [PATCH 162/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 22dc533..29d4405 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [1.21.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.0...v1.21.1) (2025-12-15) + + +### Bug Fixes + +* Modify YAML generation to include version placeholder ([37958b5](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/37958b54e20b80b4401980a28b07616c964f35d5)) + ## [1.20.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.20.0...v1.20.1) (2025-11-24) From d2f92ec4074f92688ed1c721476aa36a3e442c50 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 09:51:11 +0100 Subject: [PATCH 163/370] BREAKING CHANGE: new structure --- .github/workflows/main.yml | 4 ++-- Dockerfile | 2 +- yaml-generation/generateDimensions.php | 24 ++++++++++++------------ 3 files changed, 15 insertions(+), 15 deletions(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 975bbb7..3e70bbe 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -54,12 +54,12 @@ jobs: platforms: linux/amd64,linux/arm64 tags: wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }},wurstbrot/dsomm-yaml-generation:latest build-args: | - VERSION=${{ steps.get-version.outputs.version }} + DSOMM_VERSION=${{ steps.get-version.outputs.version }} - name: Extract generated files from docker image run: | docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 docker cp yaml:/var/www/html/generated/model.yaml generated/model.yaml - docker cp yaml:/var/www/html/generated/dependency-tree.md generated/dependency-tree.md + docker cp yaml:/var/www/html/generated/dependency-tree.md generated/dependency-tree.md - name: Commit all changed files back to the repository uses: planetscale/ghcommit-action@v0.1.6 with: diff --git a/Dockerfile b/Dockerfile index 9e2d2d9..70196ba 100644 --- a/Dockerfile +++ b/Dockerfile @@ -11,6 +11,6 @@ RUN cd /var/www/html/yaml-generation && composer install \ --prefer-dist RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml -RUN cd /var/www/html && php yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/{VERSION}/g" /var/www/html/generated/model.yaml +RUN cd /var/www/html && php yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/{DSOMM_VERSION}/g" /var/www/html/generated/model.yaml workdir /var/www/html CMD php yaml-generation/generateDimensions.php diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index 8c4ad58..ed79ec1 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -7,7 +7,7 @@ $inputFolder = "src/assets/YAML"; $implementationReferenceFile = "$inputFolder/default/implementations.yaml"; -if (getenv('GITHUB_ACTIONS')) { +if (getenv('DSOMM_VERSION')) { // version comes as an arg to Dockerfile $publisher = 'https://github.com/' . getenv('GITHUB_REPOSITORY'); } else { $publisher = getenv('USERNAME'); @@ -69,7 +69,7 @@ if (!array_key_exists("level", $activity)) { array_push($errorMsg,"Missing 'level' attribute in activity: '$activityName'"); } - + // echo "$subdimension | $activityName\n"; if (!array_key_exists("uuid", $activity)) { array_push($errorMsg, "'$activityName' is missing an uuid in '$dimension'"); @@ -98,7 +98,7 @@ if(!is_string($dependsOnName)) { array_push($errorMsg, "The 'dependsOn' is not a string '" . json_encode($dependsOnName) . "' (in $activityName)"); continue; - } + } // Load dependsOnName and dependsOnUuid, depending on actual content $uuidRegExp = "/(uuid:)?\s*([0-9a-f]{6,}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{6,})/"; @@ -109,7 +109,7 @@ array_push($errorMsg,"DependsOn non-existing activity uuid: $dependsOnUuid (in activity: '$activityName')"); } else if ($matches[1] != "") { echo "WARNING: DependsOn is prefixed by deprecated 'uuid:' for $dependsOnUuid (in activity: '$activityName'). Use activity name, or the uuid only\n"; - } + } } else { $dependsOnUuid = getUuidByActivityName($dependsOnName, $dimensionsAggregated); if (is_null(getUuidByActivityName($dependsOnName, $dimensionsAggregated))) { @@ -118,7 +118,7 @@ } // Trick emit_yaml() to have uuid plus a comment in a string. Removed in post-processing below. $dimensionsAggregated[$dimension][$subdimension][$activityName]["dependsOn"][$index] = "{!$dependsOnUuid!}"; - + // Build dependency graph if (!array_key_exists($activityName, $activityIndex)) { @@ -243,7 +243,7 @@ function buildOpenCreUrl($dimension, $subdimension, $activityName) { $baseUrl = "https://www.opencre.org/node/standard/"; $DSOMM = "DevSecOps Maturity Model (DSOMM)"; - $url = $baseUrl . rawurlencode($DSOMM) . + $url = $baseUrl . rawurlencode($DSOMM) . "/section/" . rawurlencode($subdimension) . "/subsection/" . rawurlencode($activityName); return $url; @@ -280,7 +280,7 @@ function assertUniqueRefByKey($references, $keyToAssert, &$errorMsg) { function assertSecureUrlsInRefs($all_references, &$errorMsg) { foreach ($all_references as $references) { foreach ($references as $id => $reference) { - foreach ($reference as $key => $value) { + foreach ($reference as $key => $value) { if (is_string($value)) { // echo "KEY: $key VAL: " . var_dump($value) . "\n"; if (str_contains($value,'http://')) { @@ -326,23 +326,23 @@ function assertLiveUrl($url):string { curl_setopt($curl, CURLOPT_TIMEOUT, 5); curl_setopt($curl, CURLOPT_CONNECTTIMEOUT, 5); $response = curl_exec($curl); - + if (curl_errno($curl)) { echo curl_error($curl); curl_close($curl); return "No reply"; } - + // Extract header info $statusCode = curl_getinfo($curl, CURLINFO_HTTP_CODE); $redirectUrl = curl_getinfo($curl, CURLINFO_REDIRECT_URL ); curl_close($curl); - if ($statusCode == 200) { + if ($statusCode == 200) { return ""; } - if ($statusCode == 301 || $statusCode == 302) { + if ($statusCode == 301 || $statusCode == 302) { return "Status code $statusCode redirects to: $redirectUrl"; } return "Status code: $statusCode: $url"; @@ -380,7 +380,7 @@ function yaml_emit_with_header($metaDocument, $document) { // Remove trailing ... from meta document $metaString = substr(rtrim($metaString), 0, -3); } - + return $metaString . $documentString; } From 133646e2aa2f58faf926d96dbd665a3fc0ec41da Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 09:58:11 +0100 Subject: [PATCH 164/370] fix: new structure --- Dockerfile | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 70196ba..2a075ff 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,7 @@ FROM php:apache-bullseye + +ARG DSOMM_VERSION=dev + RUN apt-get update && apt-get -y install apt-utils libyaml-dev wget unzip && wget -O composer-setup.php https://getcomposer.org/installer && php composer-setup.php --install-dir=/usr/local/bin --filename=composer COPY yaml-generation /var/www/html/yaml-generation COPY generated /var/www/html/generated @@ -11,6 +14,6 @@ RUN cd /var/www/html/yaml-generation && composer install \ --prefer-dist RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml -RUN cd /var/www/html && php yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/{DSOMM_VERSION}/g" /var/www/html/generated/model.yaml +RUN cd /var/www/html && php yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/${DSOMM_VERSION}/g" /var/www/html/generated/model.yaml workdir /var/www/html CMD php yaml-generation/generateDimensions.php From a62422954c611cb27dc486363e7e204425139c9c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:01:37 +0100 Subject: [PATCH 165/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 29d4405..7b7d8b6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [1.21.2](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.1...v1.21.2) (2025-12-15) + + +### Bug Fixes + +* new structure ([133646e](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/133646e2aa2f58faf926d96dbd665a3fc0ec41da)) + ## [1.21.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.0...v1.21.1) (2025-12-15) From 02edcf582c0e102038eda2bf52603519a6ceea5a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:07:22 +0100 Subject: [PATCH 166/370] feat: new structure\n\nBREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml --- .github/workflows/main.yml | 1 + Dockerfile | 1 + 2 files changed, 2 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 3e70bbe..d1912b3 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -55,6 +55,7 @@ jobs: tags: wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }},wurstbrot/dsomm-yaml-generation:latest build-args: | DSOMM_VERSION=${{ steps.get-version.outputs.version }} + GITHUB_REPOSITORY=${{ GITHUB_REPOSITORY }} - name: Extract generated files from docker image run: | docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 diff --git a/Dockerfile b/Dockerfile index 2a075ff..a5a1156 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,7 @@ FROM php:apache-bullseye ARG DSOMM_VERSION=dev +ARG GITHUB_REPOSITORY=DevSecOpsMaturityModel-data RUN apt-get update && apt-get -y install apt-utils libyaml-dev wget unzip && wget -O composer-setup.php https://getcomposer.org/installer && php composer-setup.php --install-dir=/usr/local/bin --filename=composer COPY yaml-generation /var/www/html/yaml-generation From 0fe4f11e02e177ec885b41df41b336c615477769 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:08:32 +0100 Subject: [PATCH 167/370] fix: GIT_REPO includey --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index d1912b3..51c739d 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -55,7 +55,7 @@ jobs: tags: wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }},wurstbrot/dsomm-yaml-generation:latest build-args: | DSOMM_VERSION=${{ steps.get-version.outputs.version }} - GITHUB_REPOSITORY=${{ GITHUB_REPOSITORY }} + GITHUB_REPOSITORY=${GITHUB_REPOSITORY} - name: Extract generated files from docker image run: | docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 From 83ae8246a25b8fe9df36af6668077d4616e2f76c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:12:04 +0100 Subject: [PATCH 168/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 7b7d8b6..0876927 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,15 @@ +# [1.22.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.2...v1.22.0) (2025-12-15) + + +### Bug Fixes + +* GIT_REPO includey ([0fe4f11](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/0fe4f11e02e177ec885b41df41b336c615477769)) + + +### Features + +* new structure\n\nBREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml ([02edcf5](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/02edcf582c0e102038eda2bf52603519a6ceea5a)) + ## [1.21.2](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.1...v1.21.2) (2025-12-15) From dff5ba435305ea73ac731e7e28c52f1d1c495d6d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:15:40 +0100 Subject: [PATCH 169/370] feat: new structure\n\nBREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index a5a1156..62f8c90 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,6 +15,6 @@ RUN cd /var/www/html/yaml-generation && composer install \ --prefer-dist RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml -RUN cd /var/www/html && php yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/${DSOMM_VERSION}/g" /var/www/html/generated/model.yaml +RUN cd /var/www/html && GITHUB_REPOSITORY="${GITHUB_REPOSITORY}" php yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/${DSOMM_VERSION}/g" /var/www/html/generated/model.yaml workdir /var/www/html CMD php yaml-generation/generateDimensions.php From d0f644134c4f6429f8ff47cf0a1506d8b3ed0d10 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:19:09 +0100 Subject: [PATCH 170/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index 0876927..9b1b330 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [1.23.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.22.0...v1.23.0) (2025-12-15) + + +### Features + +* new structure\n\nBREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml ([dff5ba4](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/dff5ba435305ea73ac731e7e28c52f1d1c495d6d)) + # [1.22.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.2...v1.22.0) (2025-12-15) From 74932622e77448f48e5b17f1ffdb8cc312286e59 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:22:08 +0100 Subject: [PATCH 171/370] fix: use correct GitHub repository context in workflow MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Replace ${GITHUB_REPOSITORY} with ${{ github.repository }} in Docker build args to properly access the repository name from GitHub Actions context. 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- .github/workflows/main.yml | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 51c739d..86595d1 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -55,12 +55,14 @@ jobs: tags: wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }},wurstbrot/dsomm-yaml-generation:latest build-args: | DSOMM_VERSION=${{ steps.get-version.outputs.version }} - GITHUB_REPOSITORY=${GITHUB_REPOSITORY} + GITHUB_REPOSITORY=${{ github.repository }} - name: Extract generated files from docker image run: | docker run -d --name=yaml --entrypoint="/bin/sleep" wurstbrot/dsomm-yaml-generation:${{ steps.get-version.outputs.version }} 60 docker cp yaml:/var/www/html/generated/model.yaml generated/model.yaml docker cp yaml:/var/www/html/generated/dependency-tree.md generated/dependency-tree.md + - name: Force add ignored file + run: git add -f generated/model.yaml generated/dependency-tree.md - name: Commit all changed files back to the repository uses: planetscale/ghcommit-action@v0.1.6 with: From 74288642b3f6e8a4b150398007a11789e17b711f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:26:21 +0100 Subject: [PATCH 172/370] =?UTF-8?q?=F0=9F=A4=96=20fmt?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 + generated/dependency-tree.md | 270 ++ generated/model.yaml | 8169 ++++++++++++++++++++++++++++++++++ 3 files changed, 8446 insertions(+) create mode 100644 generated/dependency-tree.md create mode 100644 generated/model.yaml diff --git a/CHANGELOG.md b/CHANGELOG.md index 9b1b330..721c5c1 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [1.23.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.23.0...v1.23.1) (2025-12-15) + + +### Bug Fixes + +* use correct GitHub repository context in workflow ([7493262](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/74932622e77448f48e5b17f1ffdb8cc312286e59)) + # [1.23.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.22.0...v1.23.0) (2025-12-15) diff --git a/generated/dependency-tree.md b/generated/dependency-tree.md new file mode 100644 index 0000000..0cd12d6 --- /dev/null +++ b/generated/dependency-tree.md @@ -0,0 +1,270 @@ +## DSOMM Activity Dependencies + +The activities in this DSOMM Model have the following dependencies. + +```mermaid +graph LR + +0(L2 Pinning of artifacts) +1(L1 Defined build process) +2(L2 SBOM of components) +3(L3 Signing of code) +4(L5 Signing of artifacts) +5(L1 Defined deployment process) +6(L1 Inventory of production components) +7(L2 Inventory of production artifacts) +8(L3 Handover of confidential parameters) +9(L2 Environment depending configuration parameters secrets) +10(L3 Inventory of production dependencies) +11(L3 Rolling update on deployment) +12(L4 Same artifact for environments) +13(L4 Usage of feature toggles) +14(L5 Blue/Green Deployment) +15(L4 Smoke Test) +16(L2 Automated merge of automated PRs) +17(L1 Automated PRs for patches) +18(L3 Automated deployment of automated PRs) +19(L3 Creation of simple abuse stories) +20(L1 Conduction of simple threat modeling on technical level) +21(L3 Creation of threat modeling processes and standards) +22(L4 Conduction of advanced threat modeling) +23(L5 Creation of advanced abuse stories) +24(L2 Regular security training of security champions) +25(L2 Each team has a security champion) +26(L2 Determining the protection requirement) +27(L2 App. Hardening Level 1) +28(L1 App. Hardening Level 1 50%) +29(L3 App. Hardening Level 2 75%) +30(L4 App. Hardening Level 2) +31(L5 App. Hardening Level 3) +32(L1 Versioning) +33(L3 Block force pushes) +34(L2 Require a PR before merging) +35(L3 Dismiss stale PR approvals) +36(L3 Require status checks to pass) +37(L1 Simple access control for systems) +38(L2 Backup) +39(L2 MFA) +40(L1 MFA for admins) +41(L2 Usage of test and production environments) +42(L2 Virtual environments are limited) +43(L2 Applications are running in virtualized environments) +44(L3 Immutable infrastructure) +45(L3 Infrastructure as Code) +46(L3 Limitation of system events) +47(L3 Audit of system events) +48(L3 Role based authentication and authorization) +49(L3 Usage of security by default for components) +50(L3 WAF baseline) +51(L1 Context-aware output encoding) +52(L4 Production near environments are used by developers) +53(L4 WAF medium) +54(L5 WAF Advanced) +55(L2 Centralized application logging) +56(L2 Alerting) +57(L3 Visualized logging) +58(L1 Centralized system logging) +59(L5 Correlation of security events) +60(L2 Visualized metrics) +61(L2 Monitoring of costs) +62(L1 Simple application metrics) +63(L1 Simple system metrics) +64(L3 Advanced availability and stability metrics) +65(L3 Deactivation of unused metrics) +66(L3 Targeted alerting) +67(L4 Advanced app. metrics) +68(L4 Coverage and control metrics) +69(L4 Defense metrics) +70(L3 Filter outgoing traffic) +71(L4 Screens with metric visualization) +72(L3 Grouping of metrics) +73(L5 Metrics are combined with tests) +74(L2 Patching mean time to resolution via PR) +75(L3 Generation of response statistics) +76(L3 Usage of a vulnerability management system) +77(L4 Patching mean time to resolution via production) +78(L2 Artifact-based false positive treatment) +79(L1 Simple false positive treatment) +80(L3 Fix based on accessibility) +81(L1 Treatment of defects with severity high or higher) +82(L3 Global false positive treatment) +83(L3 Exploit likelihood estimation) +84(L3 Office Hours) +85(L2 Coverage of client side dynamic components) +86(L2 Usage of different roles) +87(L2 Simple Scan) +88(L3 Coverage of hidden endpoints) +89(L3 Coverage of more input vectors) +90(L3 Coverage of sequential operations) +91(L4 Usage of multiple scanners) +92(L5 Coverage of service to service communication) +93(L2 Test for exposed services) +94(L2 Isolated networks for virtual environments) +95(L2 Test network segmentation) +96(L3 Test for unauthorized installation) +97(L2 Evaluation of the trust of used components) +98(L2 Software Composition Analysis server side) +99(L2 Test for Time to Patch) +100(L2 Test libyear) +101(L3 API design validation) +102(L3 Software Composition Analysis client side) +103(L3 Static analysis for important client side components) +104(L3 Static analysis for important server side components) +105(L3 Test for Patch Deployment Time) +106(L4 Static analysis for all self written components) +107(L4 Usage of multiple analyzers) +108(L5 Dead code elimination) +109(L5 Exclusion of source code duplicates) +110(L5 Static analysis for all components/libraries) +111(L4 Correlate known vulnerabilities in infrastructure with new image versions) +112(L2 Usage of a maximum lifetime for images) +113(L4 Test of infrastructure components for known vulnerabilities) + + +1 --> 0 +1 --> 2 +1 --> 3 +1 --> 4 +1 --> 5 +1 --> 12 +1 --> 48 +1 --> 49 +1 --> 87 +1 --> 98 +1 --> 100 +1 --> 102 +1 --> 103 +1 --> 104 +1 --> 105 +1 --> 108 +1 --> 109 +0 --> 4 +5 --> 6 +5 --> 7 +5 --> 11 +5 --> 32 +5 --> 37 +5 --> 38 +5 --> 41 +5 --> 48 +5 --> 52 +5 --> 15 +6 --> 7 +6 --> 26 +6 --> 80 +6 --> 98 +6 --> 101 +6 --> 102 +6 --> 103 +6 --> 104 +6 --> 106 +6 --> 110 +9 --> 8 +7 --> 10 +2 --> 10 +12 --> 13 +15 --> 14 +17 --> 16 +17 --> 74 +17 --> 77 +17 --> 99 +17 --> 105 +16 --> 18 +20 --> 19 +20 --> 21 +20 --> 22 +21 --> 19 +21 --> 22 +19 --> 23 +25 --> 24 +25 --> 76 +28 --> 27 +27 --> 29 +29 --> 30 +30 --> 31 +34 --> 33 +34 --> 35 +34 --> 36 +40 --> 39 +43 --> 42 +45 --> 44 +45 --> 52 +47 --> 46 +51 --> 50 +50 --> 53 +53 --> 54 +56 --> 55 +56 --> 59 +56 --> 66 +58 --> 57 +55 --> 57 +57 --> 59 +60 --> 56 +60 --> 64 +60 --> 47 +60 --> 65 +60 --> 67 +60 --> 68 +60 --> 69 +62 --> 61 +62 --> 60 +62 --> 64 +62 --> 67 +63 --> 61 +63 --> 60 +70 --> 69 +72 --> 71 +72 --> 73 +76 --> 75 +76 --> 82 +74 --> 77 +79 --> 78 +81 --> 80 +78 --> 82 +83 --> 76 +83 --> 102 +84 --> 76 +86 --> 85 +86 --> 88 +86 --> 89 +86 --> 90 +86 --> 91 +87 --> 86 +87 --> 92 +94 --> 93 +94 --> 95 +97 --> 96 +98 --> 83 +98 --> 107 +103 --> 106 +103 --> 110 +104 --> 106 +104 --> 110 +102 --> 107 +106 --> 107 +112 --> 111 +112 --> 113 + +O --> 1 +O --> 9 +O --> 17 +O --> 20 +O --> 25 +O --> 28 +O --> 34 +O --> 40 +O --> 43 +O --> 45 +O --> 51 +O --> 58 +O --> 62 +O --> 63 +O --> 70 +O --> 72 +O --> 79 +O --> 81 +O --> 84 +O --> 94 +O --> 97 +O --> 112 +``` diff --git a/generated/model.yaml b/generated/model.yaml new file mode 100644 index 0000000..1b70e91 --- /dev/null +++ b/generated/model.yaml @@ -0,0 +1,8169 @@ +--- +meta: + version: 1.23.1 + released: "2025-12-15" + publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data +--- +Build and Deployment: + Build: + Defined build process: + uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b + description: "A *build process* include more than just compiling your source + code. \nIt also includes steps such as managing (third party) dependencies, + \nenvironment configuration, running the unit tests, etc. \n\nA *defined build + process* has automated these steps to ensure consistency.\n\nThis can be done + with a Jenkinsfile, Maven, or similar tools.\n" + risk: Performing builds without a defined process is error prone; for example, + as a result of incorrect security related configuration. + measure: A well defined build process lowers the possibility of errors during + the build process. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 2 + usefulness: 4 + level: 1 + assessment: | + - Show your build pipeline and an exemplary job (build + test). + - Show that every team member has access. + - Show that failed jobs are fixed. + + Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + references: + samm2: + - I-SB-A-1 + iso27001-2017: + - 12.1.1 + - 14.2.2 + iso27001-2022: + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Defined%20build%20process + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Building and testing of artifacts in virtual environments: + uuid: a340f46b-6360-4cb8-847b-a0d3483d09d3 + description: |- + While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of + vulnerable libraries or because they are altered during the delivery phase. + risk: |- + While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of + vulnerable libraries or because they are altered during the delivery phase. + measure: Each step during within the build and testing phase is performed in + a separate virtual environments, which is destroyed afterward. + meta: + implementationGuide: Depending on your environment, usage of virtual machines + or container technology is a good way. After the build, the filesystem should + not be used again in other builds. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 2 + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + references: + samm2: + - I-SB-A-2 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Building%20and%20testing%20of%20artifacts%20in%20virtual%20environments + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Pinning of artifacts: + uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 + risk: Unauthorized manipulation of artifacts might be difficult to spot. For + example, this may result in using images with malicious code. Also, intended + major changes, which are automatically used in an image used might break the + functionality. + measure: Pinning of artifacts ensure that changes are performed only when intended. + comment: The usage of pinning requires a good processes for patching. Therefore, + choose this activity wisely. + meta: + implementationGuide: Pinning artifacts in Dockerfile refers to the practice + of using specific, immutable versions of base images and dependencies in + your build process. Instead of using the latest tag for your base image, + select a specific version or digest. For example, replace FROM node:latest, + to FROM node@sha256:abcdef12. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + tags: + - inventory + implementation: + - uuid: 9368abfb-cf37-477a-9091-a804d2de9148 + name: Signing of containers + tags: + - signing + - container + - build + url: https://www.aquasec.com/cloud-native-academy/supply-chain-security/container-image-signing/ + description: Container technology automatically creates a hash for images, + which can be used. + - uuid: 638b3691-c9a5-45fa-9ba8-e40aeea32766 + name: Immutable images + tags: + - deployment + - container + - build + url: https://kubernetes.io/blog/2022/09/29/enforce-immutability-using-cel/#immutablility-after-first-modification + description: Immutable images are an other way, e.g. by using a registry, + which doesn't allow overriding of images. + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - I-SB-B-1 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Pinning%20of%20artifacts + isImplemented: false + evidence: "" + comments: "" + SBOM of components: + uuid: 2858ac12-0179-40d9-9acf-1b839c030473 + description: |- + SBOM (Software Bill of Materials) is a document that lists all components, libraries, + and dependencies used in a software application or container image. Creating an SBOM + during the build process can help ensure transparency, security, and license compliance + for your application. + risk: In case a vulnerability of severity high or critical exists, it needs + to be known where an artifacts with that vulnerability is deployed with which + dependencies. + measure: Creation of an SBOM of components (e.g. application and container image + content) during build. + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - I-SB-B-1 + - D-TA-A-1 + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/SBOM%20of%20components + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Signing of code: + uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 + risk: Execution or usage of malicious code or data e.g. via executables, libraries + or container images. + measure: Digitally signing commits helps to prevent unauthorized manipulation + of source code. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - I-SB-A-2 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Signing%20of%20code + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Signing of artifacts: + uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 + risk: Execution or usage of malicious code or data e.g. via executables, libraries + or container images. + measure: Digitally signing artifacts for all steps during the build and especially + docker images, helps to ensure their integrity and authenticity. + description: "To perform a push to a GitHub repository, you must be authenticated. + It's important to note that GitHub does not verify if the authenticated user's + email address matches the one in the commit.\nTo clearly identify the author + of a commit for reviewers, commit signing is recommended.\n\nGitHub actions + such as [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) + do not automatically sign commits and may encounter issues as a result. \n\nTo + address this, you can refer to a working configuration example in the [workflow + folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) + of DSOMM, which demonstrates how to use semantic release action in conjunction + with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action).\nFor + added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) + provided by your organization for a specific repository. Store the Personal + Access Token (PAT) as a secret in your project." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 5 + implementation: + - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 # Pinning of artifacts + references: + samm2: + - I-SB-A-1 + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/Signing%20of%20artifacts + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Deployment: + Defined deployment process: + uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a + risk: Deployment of insecure or malfunctioning artifacts. + measure: Defining a deployment process ensures that there are established criteria + in terms of functionalities, security, compliance, and performance, and that + the artifacts meet them. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + references: + samm2: + - I-SD-A-1 + iso27001-2017: + - 12.1.1 + - 14.2.2 + iso27001-2022: + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Defined%20deployment%20process + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Inventory of production components: + uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + risk: An organization is unaware of components like applications in production. + Not knowing existing applications in production leads to not assessing it. + measure: |- + A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. + In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + references: + samm2: + - I-SB-B-1 + - D-TA-B-1 + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Inventory%20of%20production%20components + tags: + - inventory + Defined decommissioning process: + uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 + description: |- + The decommissioning process in the context of Docker and Kubernetes involves + retiring Docker containers, images, and Kubernetes resources that are no longer + needed or have been replaced. This process must be carefully executed to avoid + impacting other services and applications. + risk: Unused applications are not maintained and may contain vulnerabilities. + Once exploited they can be used to attack other applications or to perform + lateral movements within the organization. + measure: A clear decommissioning process ensures the removal of unused applications + from the `Inventory of production components` and if implemented from `Inventory + of production artifacts`. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 2 + references: + samm2: + - O-OM-B-2 + iso27001-2017: + - 11.2.7 + iso27001-2022: + - 7.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Defined%20decommissioning%20process + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Environment depending configuration parameters (secrets): + uuid: df428c9d-efa0-4226-9f47-a15bb53f822b + risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. + container images) through process listing (e.g. ps -ef). + measure: Set configuration parameters via environment variables stored using + specific platform functionalities or secrets management systems (e.g. Kubernetes + secrets or Hashicorp Vault). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. + references: + samm2: + - I-SD-B-1 + iso27001-2017: + - 9.4.5 + - 14.2.6 + iso27001-2022: + - 8.4 + - 8.31 + d3f: + - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Environment%20depending%20configuration%20parameters%20%28secrets%29 + isImplemented: false + tags: + - secret + Evaluation of the trust of used components: + uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba + risk: Application and system components like Open Source libraries or images + can have implementation flaws or deployment flaws. Developers or operations + might start random images in the production cluster which have malicious code + or known vulnerabilities. + measure: Each components source is evaluated to be trusted. For example the + source, number of developers included, email configuration used by maintainers + to prevent maintainer account theft, typo-squatting, ... Create image assessment + criteria, perform an evaluation of images and create a whitelist of artifacts/container + images/virtual machine images. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Evaluation%20of%20the%20trust%20of%20used%20components + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Inventory of production artifacts: + uuid: 83057028-0b77-4d2e-8135-40969768ae88 + risk: In case a vulnerability of severity high or critical exists, it needs + to be known where an artifacts (e.g. container image) with that vulnerability + is deployed. + measure: A documented inventory of artifacts in production like container images + exists (gathered manually or automatically). + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + references: + samm2: + - I-SB-B-1 + - D-TA-B-1 + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Inventory%20of%20production%20artifacts + tags: + - inventory + Handover of confidential parameters: + uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a + risk: Parameters are often used to set credentials, for example by starting + containers or applications; these parameters can often be seen by any one + listing running processes on the target system. + measure: Encryption ensures confidentiality of credentials e.g. from unauthorized + access on the file system. Also, the usage of a credential management system + can help protect credentials. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: "" + dependsOn: + - df428c9d-efa0-4226-9f47-a15bb53f822b # Environment depending configuration parameters (secrets) + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 14.1.3 + - 13.1.3 + - 9.4.3 + - 9.4.1 + - 10.1.2 + iso27001-2022: + - 8.33 + - 8.22 + - 5.17 + - 8.3 + - 8.24 + d3f: + - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Handover%20of%20confidential%20parameters + isImplemented: false + tags: + - secret + Inventory of production dependencies: + uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 + risk: Delayed identification of components and their vulnerabilities in production. + In case a vulnerability is known by the organization, it needs to be known + where an artifacts with that vulnerability is deployed with which dependencies. + measure: A documented inventory of dependencies used in artifacts like container + images and containers exists. + dependsOn: + - 83057028-0b77-4d2e-8135-40969768ae88 # Inventory of production artifacts + - 2858ac12-0179-40d9-9acf-1b839c030473 # SBOM of components + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 3 + implementation: + - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca + name: Backstage + tags: + - documentation + - inventory + url: https://github.com/backstage/backstage + description: | + Backstage is an open-source platform designed to create developer portals. At its core is a centralized software catalog that brings organization to your microservices and infrastructure. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 879bd03f-8de1-43d6-b492-d974181bfa6c + name: Image Metadata Collector + tags: + - documentation + - inventory + - kubernetes + url: https://github.com/SDA-SE/image-metadata-collector/ + description: | + Collects namespaces and namespaces including responsible team and contact info through annotations/labels from Kubernetes clusters. Results are available in JSON and can be uploaded to S3, github and an API. + references: + samm2: + - I-SB-B-3 + - I-SB-B-2 + - I-SB-B-1 + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Inventory%20of%20production%20dependencies + comments: "" + tags: + - inventory + - sbom + Rolling update on deployment: + uuid: 85d52588-f542-4225-a338-20dc22a5508d + risk: While a deployment is performed, the application can not be reached. + measure: A deployment without downtime is performed*. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 3 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + references: + samm2: + - I-SD-A-2 + - I-SD-A-3 + iso27001-2017: + - 12.5.1 + - 14.2.2 + - 17.2.1 + iso27001-2022: + - 8.19 + - 8.32 + - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Rolling%20update%20on%20deployment + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Same artifact for environments: + uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f + risk: Building of an artifact for different environments means that an untested + artifact might reach the production environment. + measure: Building an artifact once and deploying it to different environments + means that only tested artifacts are allowed to reach the production environment + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 4 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - I-SD-A-2 + - I-SD-A-3 + iso27001-2017: + - 14.3.1 + - 14.2.8 + - 12.1.4 + iso27001-2022: + - 8.33 + - 8.29 + - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Same%20artifact%20for%20environments + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of feature toggles: + uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad + risk: Using environment variables to enable or disable features can lead to + a situation where a feature is accidentally enabled in the production environment. + measure: Usage of environment independent configuration parameter, called static + feature toggles, mitigates the risk of accidentally enabling insecure features + in production. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 2 + level: 4 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + dependsOn: + - a854b48d-83bd-4f8d-8621-a0bdd470837f # Same artifact for environments + references: + samm2: + - I-SD-A-2 + iso27001-2017: + - 14.3.1 + - 14.2.8 + - 14.2.9 + - 12.1.4 + iso27001-2022: + - 8.33 + - 8.29 + - 8.31 + d3f: + - ApplicationConfigurationHardening + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Usage%20of%20feature%20toggles + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Blue/Green Deployment: + uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 + risk: A new artifact's version can have unknown defects. + measure: |- + Using a blue/green deployment strategy increases application availability + and reduces deployment risk by simplifying the rollback process if a deployment fails. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 5 + implementation: + - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + dependsOn: + - 73aaae0b-5d68-4953-9fa4-fd25bf665f2a # Smoke Test + references: + samm2: + - I-SD-A-3 + iso27001-2017: + - 17.2.1 + - 12.1.1 + - 12.1.2 + - 12.1.4 + - 12.5.1 + - 14.2.9 + iso27001-2022: + - 8.14 + - 5.37 + - 8.31 + - 8.32 + - 8.19 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Blue%2FGreen%20Deployment + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Patch Management: + A patch policy is defined: + uuid: 99415139-6b50-441b-89e1-0aa59accd43d + risk: Vulnerabilities in running artifacts stay for long and might get exploited. + measure: A patch policy for all artifacts (e.g. in images) is defined. How often + is an image rebuilt? + difficultyOfImplementation: + knowledge: 3 + time: 1 + resources: 2 + usefulness: 4 + level: 1 + implementation: [] + references: + samm2: + - O-EM-B-1 + iso27001-2017: + - 12.6.1 + - 12.5.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.19 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/A%20patch%20policy%20is%20defined + isImplemented: false + evidence: "" + comments: "" + tags: + - patching + Automated PRs for patches: + uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 + risk: Components with known (or unknown) vulnerabilities might stay for long + and get exploited, even when a patch is available. + measure: |- + Fast patching of third party component is needed. The DevOps way is to have an automated pull request for new components. This includes + * Applications * Virtualized operating system components (e.g. container images) * Operating Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform) + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 1 + implementation: + - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + references: + samm2: + - O-EM-B-1 + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - "8.8" + - "8.27" + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Automated%20PRs%20for%20patches + comments: "" + tags: + - patching + Automated merge of automated PRs: + uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb + description: Automated merges of automated created PRs for outdated dependencies. + risk: Vulnerabilities in running artifacts stay for too long and might get exploited. + measure: | + A good practice is to merge trusted dependencies (e.g. spring boot) after a grace period like one week. + Often, patches, fixes and minor updates are automatically merged. Be aware that automated merging requires a high + automated test coverage. Enforcement of merging of pull requests after a grace period. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + dependsOn: + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + implementation: + - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Automated%20merge%20of%20automated%20PRs + comments: "" + tags: + - patching + Nightly build of images (base images): + uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 + description: |- + A base image is a pre-built image that serves as a starting point for building + new images or containers. These base images usually include an operating system, + necessary dependencies, libraries, and other components that are required to run + a specific application or service. Nightly builds of custom base images refer to + an automated process that occurs daily or on a scheduled basis, usually during + nighttime or off-peak hours, to create updated versions of custom base images. + risk: Vulnerabilities in running containers stay for too long and might get + exploited. + measure: Custom base images are getting build at least nightly. In case the + packages in the base image e.g. centos has changed, the build server + triggers the build of depending images. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Nightly%20build%20of%20images%20%28base%20images%29 + isImplemented: false + evidence: "" + comments: "" + tags: + - patching + Reduction of the attack surface: + uuid: 16e39c8f-5336-4001-88ed-a552d2447531 + description: |- + Distroless images are minimal, stripped-down base images that contain only the + essential components required to run your application. They do not include package + managers, shells, or any other tools that are commonly found in standard Linux + distributions. Using distroless images can help reduce the attack surface and + overall size of your container images. + risk: Components, dependencies, files or file access rights might have vulnerabilities, + but the they are not needed. + measure: Removal of unneeded components, dependencies, files or file access + rights. For container images the usage of distroless images is recommended. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + references: + samm2: + - I-SB-B-2 + iso27001-2017: + - hardening is missing in ISO 27001 + - 14.2.1 + iso27001-2022: + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Reduction%20of%20the%20attack%20surface + evidence: "" + comments: "" + tags: + - patching + Usage of a maximum lifetime for images: + uuid: 485a3383-7f2e-4dba-bb84-479377070904 + description: |- + The maximum lifetime for a Docker container refers to the duration a container + should be allowed to run before it is considered outdated, stale, or insecure. + There is not a fixed, universally applicable maximum lifetime for a Docker + container, as it varies depending on the specific use case, application + requirements, and security needs. As a best practice, it is essential to define + a reasonable maximum lifetime for containers to ensure that you consistently + deploy the most recent, patched, and secure versions of both your custom base + images and third-party images. + risk: Vulnerabilities in images of running containers stay for too long and + might get exploited. Long running containers have potential memory leaks. + A compromised container might get killed by restarting the container (e.g. + in case the attacker has not reached the persistence layer). + measure: A short maximum lifetime for images is defined, e.g. 30 days. The project + images, based on the nightly builded images, are deployed at leased once within + the defined lifetime. Third Party images are deployed at leased once within + the defined lifetime. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-B-1 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Usage%20of%20a%20maximum%20lifetime%20for%20images + evidence: "" + comments: "" + tags: + - patching + Automated deployment of automated PRs: + uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d + description: Automated merges of automated created PRs for outdated dependencies. + risk: Even if automated dependencies PRs are merged, they might not be deployed. + This results in vulnerabilities in running artifacts stay for too long and + might get exploited. + measure: | + After merging of an automated dependency PR, automated deployment is needed, + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + dependsOn: + - f2594f8f-1cd6-45f9-af29-eaf3315698eb # Automated merge of automated PRs + implementation: + - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f + name: argoCD + tags: + - deployment + url: https://argo-cd.readthedocs.io/en/stable/ + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Automated%20deployment%20of%20automated%20PRs + comments: "" + tags: + - patching + Usage of a short maximum lifetime for images: + uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e + description: |- + The maximum lifetime for a Docker container refers to the duration a container + should be allowed to run before it is considered outdated, stale, or insecure. + There is not a fixed, universally applicable maximum lifetime for a Docker + container, as it varies depending on the specific use case, application + requirements, and security needs. As a best practice, it is essential to define + a reasonable maximum lifetime for containers to ensure that you consistently + deploy the most recent, patched, and secure versions of both your custom base + images and third-party images. + risk: Vulnerabilities in running containers stay for too long and might get + exploited. + measure: | + A good practice is to perform the build and deployment daily or even just-in-time, when a new component (e.g. package) for the image is available. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service outage + will occur to the end users. \n(2) twice a day a rebuild of images is done. + The rebuilds are put into a automated testing pipeline. If the testing has + no blocking issues the new images will be released for deployment during + the next \"restart\" of a container. What has to be done, is to ensure the + new containers are deployed in some canary deployment manner, this will + ensure that if (and only if) something buggy has been introduced which breaks + functionality the canary deployment will make sure the \"older version\" + is being used and not the buggy newer one." + references: + samm2: + - O-EM-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Usage%20of%20a%20short%20maximum%20lifetime%20for%20images + isImplemented: false + evidence: "" + comments: "" + tags: + - patching +Culture and Organization: + Design: + Conduction of simple threat modeling on technical level: + uuid: 47419324-e263-415b-815d-e7161b6b905e + risk: Technical related threats are discovered too late in the development and + deployment process. + measure: Threat modeling of technical features is performed during the product + sprint planning. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + - uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + description: | + # OWASP SAMM Description + Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. + + Threat modeling is a team exercise, including product owners, architects, security champions, and security testers. At this maturity level, expose teams and stakeholders to threat modeling to increase security awareness and to create a shared vision on the security of the system. + + At maturity level 1, you perform threat modeling ad-hoc for high-risk applications and use simple threat checklists, such as STRIDE. Avoid lengthy workshops and overly detailed lists of low-relevant threats. Perform threat modeling iteratively to align to more iterative development paradigms. If you add new functionality to an existing application, look only into the newly added functions instead of trying to cover the entire scope. A good starting point is the existing diagrams that you annotate during discussion workshops. Always make sure to persist the outcome of a threat modeling discussion for later use. + + Your most important tool to start threat modeling is a whiteboard, smartboard, or a piece of paper. Aim for security awareness, a simple process, and actionable outcomes that you agree upon with your team. Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. + + Source: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + # OWASP Project Integration Description + There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. + + A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). + + OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). + + There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. + + > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ + + ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") + + Last, if the organizations maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. + + ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") + + This practice has the side effect that it trains non-security specialists to think like attackers. + + The outcomes of this stage should help lay the foundation of secure design and considerations. + + **Example Low Maturity Scenario:** + + Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. + + Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. + + Frontend serves data over GraphQL as a thin layer between caching system and end user. + + GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. + + Source: OWASP Project Integration Project + references: + samm2: + - D-TA-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Conduction%20of%20simple%20threat%20modeling%20on%20technical%20level + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Information security targets are communicated: + uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 + risk: Employees don't know their organizations security targets. Therefore security + is not considered during development and administration as much as it should + be. + measure: Transparent and timely communication of the security targets by senior + management is essential to ensure teams' buy-in and support. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - G-SM-A-2 + iso27001-2017: + - 5.1.1 + - 7.2.1 + iso27001-2022: + - 5.1 + - 5.4 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Information%20security%20targets%20are%20communicated + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Conduction of simple threat modeling on business level: + uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 + risk: Business related threats are discovered too late in the development and + deployment process. + measure: Threat modeling of business functionality is performed during the product + backlog creation to facilitate early detection of security defects. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - D-TA-B-1 + - D-TA-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Conduction%20of%20simple%20threat%20modeling%20on%20business%20level + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Creation of simple abuse stories: + uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 + risk: User stories mostly don't consider security implications. Security flaws + are discovered too late in the development and deployment process. + measure: Abuse stories are created during the creation of user stories. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: Don't Forget EVIL User stories + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + dependsOn: + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level + - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes and standards + references: + samm2: + - D-TA-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 6.1.5 + - May be part of risk assessment + - 8.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 5.8 + - May be part of risk assessment + - 5.9 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Creation%20of%20simple%20abuse%20stories + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Creation of threat modeling processes and standards: + uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e + risk: Inadequate identification of business and technical risks. + measure: Creation of threat modeling processes and standards through the organization + helps to enhance the security culture and provide more structure to the threat + model exercises. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 3 + level: 3 + description: "" + implementation: + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + dependsOn: + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level + references: + samm2: + - D-TA-B-3 + - D-TA-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Creation%20of%20threat%20modeling%20processes%20and%20standards + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Conduction of advanced threat modeling: + uuid: ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 + risk: Inadequate identification of business and technical risks. + measure: Threat modeling is performed by using reviewing user stories and producing + security driven data flow diagrams. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 3 + level: 4 + dependsOn: + - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level + - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes and standards + description: | + **Example High Maturity Scenario:** + + Based on a detailed threat model defined and updated through code, the team decides the following: + + * Local encrypted caches need to expire and auto-purged. + * Communication channels encrypted and authenticated. + * All secrets persisted in shared secrets store. + * Frontend designed with permissions model integration. + * Permissions matrix defined. + * Input is escaped output is encoded appropriately using well established libraries. + + Source: OWASP Project Integration Project + implementation: + - uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + - uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + references: + samm2: + - D-TA-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Conduction%20of%20advanced%20threat%20modeling + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Creation of advanced abuse stories: + uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e + risk: Simple user stories are not going deep enough. Relevant security considerations + are performed. Security flaws are discovered too late in the development and + deployment process + measure: Advanced abuse stories are created as part of threat modeling activities. + difficultyOfImplementation: + knowledge: 4 + time: 2 + resources: 1 + usefulness: 4 + level: 5 + dependsOn: + - bacf85b6-5bc0-405d-b5ba-a5d971467cc1 # Creation of simple abuse stories + implementation: + - uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: Don't Forget EVIL User stories + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + references: + samm2: + - D-TA-B-2 + - V-RT-B-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 6.1.5 + - May be part of risk assessment + - 8.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 5.8 + - May be part of risk assessment + - 5.9 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Design/subsection/Creation%20of%20advanced%20abuse%20stories + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Education and Guidance: + Ad-Hoc Security trainings for software developers: + uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 + risk: Understanding security is hard and personnel needs to be trained on it. + Otherwise, flaws like an SQL Injection might be introduced into the software + which might get exploited. + measure: Provide security awareness training for all personnel involved in software + development Ad-Hoc. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-1 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Ad-Hoc%20Security%20trainings%20for%20software%20developers + tags: + - none + Security consulting on request: + uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 + risk: Not asking a security expert when questions regarding security appear + might lead to flaws. + measure: Security consulting to teams is given on request. The security consultants + can be internal or external. + difficultyOfImplementation: + knowledge: 3 + time: 1 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-1 + - G-EG-B-1 + iso27001-2017: + - security consulting is missing in ISO 27001 may be + - 6.1.1 + - 6.1.4 + - 6.1.5 + iso27001-2022: + - Security consulting is missing in ISO 27001 may be + - 5.2 + - 5.6 + - 5.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Security%20consulting%20on%20request + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Each team has a security champion: + uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 + risk: No one feels directly responsible for security and the security champion + does not have enough time to allocate to each team. + measure: Each team defines an individual to be responsible for security. These + individuals are often referred to as 'security champions' + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + description: | + Implement a program where each software development team has a member considered a "Security Champion" who is the liaison between Information Security and developers. Depending on the size and structure of the team the "Security Champion" may be a software developer, tester, or a product manager. The "Security Champion" has a set number of hours per week for Information Security related activities. They participate in periodic briefings to increase awareness and expertise in different security disciplines. "Security Champions" have additional training to help develop these roles as Software Security subject-matter experts. You may need to customize the way you create and support "Security Champions" for cultural reasons. + + The goals of the position are to increase effectiveness and efficiency of application security and compliance and to strengthen the relationship between various teams and Information Security. To achieve these objectives, "Security Champions" assist with researching, verifying, and prioritizing security and compliance related software defects. They are involved in all Risk Assessments, Threat Assessments, and Architectural Reviews to help identify opportunities to remediate security defects by making the architecture of the application more resilient and reducing the attack threat surface. + + [Source: OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/) + implementation: + - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + references: + samm2: + - G-EG-B-1 + - G-EG-B-2 + iso27001-2017: + - Security champions are missing in ISO 27001 most likely + - 7.2.1 + - 7.2.2 + iso27001-2022: + - Security champions are missing in ISO 27001 most likely + - 5.4 + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Each%20team%20has%20a%20security%20champion + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Regular security training for all: + uuid: 9768f154-357a-4c06-af6f-d66570677c9b + risk: Understanding security is hard. + measure: Provide security awareness training for all internal personnel involved + in software development on a regular basis like twice in a year for 1-3 days. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 4 + level: 2 + description: | + Conduct security awareness training for all roles currently involved in the management, development, testing, or auditing of the software. The goal is to increase the awareness of application security threats and risks, security best practices, and secure software design principles. Develop training internally or procure it externally. Ideally, deliver training in person so participants can have discussions as a team, but Computer-Based Training (CBT) is also an option. + + Course content should include a range of topics relevant to application security and privacy, while remaining accessible to a non-technical audience. Suitable concepts are secure design principles including Least Privilege, Defense-in-Depth, Fail Secure (Safe), Complete Mediation, Session Management, Open Design, and Psychological Acceptability. Additionally, the training should include references to any organization-wide standards, policies, and procedures defined to improve application security. The OWASP Top 10 vulnerabilities should be covered at a high level. + + Training is mandatory for all employees and contractors involved with software development and includes an auditable sign-off to demonstrate compliance. Consider incorporating innovative ways of delivery (such as gamification) to maximize its effectiveness and combat desensitization. + + [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-1 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Regular%20security%20training%20for%20all + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Regular security training of security champions: + uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 + risk: Understanding security is hard, even for security champions. + measure: Regular security training of security champions. + assessment: | + - Process Documentation: TODO + - Training Content: TOODO + difficultyOfImplementation: + knowledge: 4 + time: 2 + resources: 2 + usefulness: 5 + level: 2 + implementation: + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + dependsOn: + - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion + references: + samm2: + - D-TA-B-2 + - G-EG-A-1 + iso27001-2017: + - Security champions are missing in ISO 27001 + - 7.2.2 + iso27001-2022: + - Security champions are missing in ISO 27001 + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Regular%20security%20training%20of%20security%20champions + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Reward of good communication: + uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c + risk: Employees are not getting excited about security. + measure: Good communication and transparency encourages cross-organizational + support. Gamification of security is also known to help, examples include + T-Shirts, mugs, cups, gift cards and 'High-Fives'. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + references: + samm2: + - G-EG-B-1 + iso27001-2017: + - not required by ISO 27001 + - interestingly enough A7.2.3 is requiring a process to handle misconduct + but nothing to promote good behavior. + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Reward%20of%20good%20communication + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Security code review: + uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 + risk: Understanding security is hard. + measure: | + The following areas of code tend to have a high-risk of containing security vulnerabilities: + - Crypto implementations / usage + - Parser, unparser + - System configuration + - Authentication, authorization + - Session management + - Request throttling + - :unicorn: (self-developed code, only used in that one software) + description: | + ### Benefits + - New vulnerabilities may be found before reaching production. + - Old vulnerabilities are found and fixed. + assessment: | + - Present the performed reviews (including participants, findings, consequences) and assess whether it is reasonable. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + credits: | + AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + references: + samm2: + - V-ST-B-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Security%20code%20review + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Conduction of build-it, break-it, fix-it contests: + uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 + risk: Understanding security is hard, even for security champions and the conduction + of security training often focuses on breaking a component instead of building + a component secure. + measure: The build-it, break-it, fix-it contest allows to train people with + security related roles like security champions the build, break and fix part + of a secure application. This increases the learning of building secure components. + difficultyOfImplementation: + knowledge: 5 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + references: + samm2: + - G-EG-A-2 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Conduction%20of%20build-it%2C%20break-it%2C%20fix-it%20contests + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Office Hours: + uuid: 185d5a74-19dc-4422-be07-44ea35226783 + risk: Developers and Operations are not in contact with the security team and + therefore do not ask prior implementation of (known or unknown) threats- + measure: As a security team, be open for questions and hints during defined + office hours. x x d + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 3 + implementation: ~ + references: + samm2: + - G-EG-A-1 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Office%20Hours + tags: + - none + Security Coaching: + uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 + risk: Training does not change behaviour. Therefore, even if security practices + are understood, it's likely that they are not performed. + measure: By coaching teams on security topics using for example the samman coaching + method, teams internalize security practices as new habits in their development + process. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + implementation: + - uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + level: 3 + references: + samm2: + - G-EG-B-3 + iso27001-2017: + - 7.1.1 + iso27001-2022: + - 6.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Security%20Coaching + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Security-Lessoned-Learned: + uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 + risk: After an incident, a similar incident might reoccur. + measure: Running a 'lessons learned' session after an incident helps drive continuous + improvement. Regular meetings with security champions are a good place to + share and discuss lessons learned. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - G-EG-B-3 + - O-IM-B-3 + iso27001-2017: + - 16.1.6 + iso27001-2022: + - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Security-Lessoned-Learned + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Simple mob hacking: + uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de + risk: Understanding security is hard. + measure: | + Participate with your whole team in a simple mob hacking session organized by the Security Champion Guild. + In the session the guild presents a vulnerable application and together you look at possible exploits. + Just like in mob programming there is one driver and several navigators. + description: | + ### Guidelines for your simple mob hacking session + - All exploits happen via the user interface. + - No need for security/hacking tools. + - No need for deep technical or security knowledge. + - Use an insecure training app, e.g., [DVWA](https://dvwa.co.uk/) or [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/). + - Encourage active participation, e.g., use small groups. + - Allow enough time for everyone to run at least one exploit. + + ### Benefits + - The team gets an idea of how exploits can look like and how easy applications can be attacked. + - The team understands functional correct working software can be highly insecure and easy to exploit. + difficultyOfImplementation: + knowledge: 5 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + credits: | + AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + references: + samm2: + - G-EG-A-2 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Simple%20mob%20hacking + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Aligning security in teams: + uuid: f994a55d-71bb-45a4-a887-0a213d72c504 + risk: The concept of Security Champions might suggest that only he/she is responsible + for security. However, everyone in the project team should be responsible + for security. + measure: By aligning security Subject Matter Experts with project teams, a higher + security standard can be achieved. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 1 + usefulness: 5 + implementation: + - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + level: 4 + references: + samm2: + - G-EG-B-3 + iso27001-2017: + - 7.1.1 + iso27001-2022: + - 6.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Aligning%20security%20in%20teams + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Conduction of collaborative team security checks: + uuid: 35446784-7610-40d9-af9e-d43f3173bf8c + risk: Development teams limited insight over security practices. + measure: Mutual security testing the security of other teams project enhances + security awareness and knowledge. + difficultyOfImplementation: + resources: 2 + knowledge: 4 + time: 4 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - G-EG-A-1 + - G-EG-A-2 + iso27001-2017: + - Mutual security testing is not explicitly required in ISO 27001 may be + - 7.2.2 + iso27001-2022: + - Mutual security testing is not explicitly required in ISO 27001 may be + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Conduction%20of%20collaborative%20team%20security%20checks + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Conduction of war games: + uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 + risk: Understanding incident response plans during an incident is hard and ineffective. + measure: War Games like activities help train for incidents. Security SMEs create + attack scenarios in a testing environment enabling the trainees to learn how + to react in case of an incident. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 4 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - G-EG-A-2 + - O-IM-B-2 + iso27001-2017: + - War games are not explicitly required in ISO 27001 may be + - 7.2.2 + - 16.1 + - 16.1.5 + iso27001-2022: + - War games are not explicitly required in ISO 27001 may be + - 6.3 + - 5.24 + - 5.26 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Conduction%20of%20war%20games + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Regular security training for externals: + uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 + risk: Understanding security is hard. + measure: Provide security awareness training for all personnel including externals + involved in software development on a regular basis. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 + usefulness: 4 + level: 4 + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-A-2 + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Regular%20security%20training%20for%20externals + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Conduction of collaborative security checks with developers and system administrators: + uuid: 95caef96-36ed-458c-a087-5c35d4f9dec2 + risk: Security checks by external companies do not increase the understanding + of an application/system for internal employees. + measure: Periodically security reviews of source code (SCA), in which security + SME, developers and operations are involved, are effective at increasing the + robustness of software and the security knowledge of the teams involved. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 5 + implementation: [] + references: + samm2: + - G-EG-A-2 + - G-EG-B-2 + iso27001-2017: + - Mutual review of source code is not explicitly required in ISO 27001 may + be + - 7.2.2 + - 12.6.1 + - 12.7.1 + iso27001-2022: + - Mutual review of source code is not explicitly required in ISO 27001 may + be + - 6.3 + - 8.8 + - 8.34 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Education%20and%20Guidance/subsection/Conduction%20of%20collaborative%20security%20checks%20with%20developers%20and%20system%20administrators + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Process: + Definition of simple BCDR practices for critical components: + uuid: c72da779-86cc-45b1-a339-190ce5093171 + description: A _Business Continuity and Disaster Recovery_ (BCDR) is a plan + and a process that helps a business to return to normal operations if a disaster + occurs. + risk: If the disaster recovery actions are not clear, you risk slow reaction + and remediation delays. This applies to cyber attacks as well as natural emergencies, + such as a power outage. + measure: By understanding and documenting a business continuity and disaster + recovery (BCDR) plan, the overall availability of systems and applications + is increased. Success factors like responsibilities, Service Level Agreements, + Recovery Point Objectives, Recovery Time Objectives or Failover must be fully + documented and understood by the people involved in the recovery. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 4 + level: 1 + implementation: [] + references: + samm2: + - O-IM-B-2 + iso27001-2017: + - 17.1.1 + iso27001-2022: + - 5.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Process/subsection/Definition%20of%20simple%20BCDR%20practices%20for%20critical%20components + tags: + - none + Determining the protection requirement: + uuid: 72737130-472c-4984-80f8-9ab2f1c2ed5d + risk: "Not defining the protection requirement of applications can lead to wrong + prioritization, delayed remediation of \ncritical security issues, increasing + the risk of exploitation and potential damage to the organization." + measure: "Defining the protection requirement. \nThe protection requirements + for an application should consider:\n- Processed data criticality\n- Application + accessibility (internal vs. external)\n- Regulatory compliance\n- Other relevant + factors" + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + dependsOn: + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - O-OM-A-2 + - G-PC-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Process/subsection/Determining%20the%20protection%20requirement + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + Approval by reviewing any new version: + uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 + risk: An individual might forget to implement security measures to protect source + code or infrastructure components. + measure: On each new version (e.g. Pull Request) of source code or infrastructure + components a security peer review of the changes is performed (two eyes principle) + and approval given by the reviewer. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: [] + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Process/subsection/Approval%20by%20reviewing%20any%20new%20version + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Definition of a change management process: + uuid: b4193d32-3948-47e2-a326-3748c48019a1 + risk: The impact of a change is not controlled because these are not recorded + or documented. + measure: Each change of a system is automatically recorded and adequately logged. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: [] + iso27001-2017: + - 14.2.2 + - 12.1.2 + - 12.4.1 + iso27001-2022: + - 8.32 + - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Process/subsection/Definition%20of%20a%20change%20management%20process + isImplemented: false + evidence: "" + comments: "" + tags: + - none +Implementation: + Application Hardening: + App. Hardening Level 1 (50%): + uuid: b597928e-54d6-48a5-a806-8003dcd56aab + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 1 + * OWASP Mobile Application Security Verification Standard + + in all applications provides a good baseline. Implement 50% of the recommendations. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + description: | + To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jumpstart the development process, but also do so securely. + + [...] + + ### Planning aka Requirements Gathering & Analysis + The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. + + ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) + + Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. + + These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. + + In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. + + Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + - uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + references: + samm2: + - D-SR-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%201%20%2850%25%29 + comments: "" + tags: + - none + Context-aware output encoding: + uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 + description: "**Input validation** stops malicious data from entering your system. + \\\n**Output encoding** neutralizes malicious data before rendering to user, + or the next system.\n\nInput validation and output encoding work together. + Apply both. \n\n**Context-aware output encoding** encodes data differently, + depending on its context. In the sample below the `{{bad_data}}` must be encoded + differently, depending on its context, to render safe HTML.\n\n```html\n
{{bad_data}}
\nClick me\n\n\n```\n" + risk: If an attacker manages to slip though your input validation, the attacker + may gain control over the user session or execute arbitrary actions. + measure: "* Use modern secure frameworks such as React/Angular/Vue/Svelte. The + default method here renders data in a safe way.\n* Use established and well-maintained + encoding libraries such as OWASP\u2019s Java Encoder and Microsoft\u2019s + AntiXSS.\n* Implement content security policies (CSP) to restrict the types + of content that can be loaded and executed.\n" + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: 2d61e48f-bade-4332-a383-adc50c29673a + name: OWASP DOM based XSS Prevention CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/DOM_based_XSS_Prevention_Cheat_Sheet.html + tags: [] + - uuid: ae97c9b0-308c-4dab-bff9-bf3330a897dc + name: CWE-838 Inappropriate Encoding for Output Context + tags: + - documentation + - cwe + url: https://cwe.mitre.org/data/definitions/838.html + references: + samm2: + - D-SR-A-1 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/Context-aware%20output%20encoding + comments: "" + tags: + - none + Parametrization: + uuid: 00e91a8a-3972-4692-8679-674ab8547486 + description: | + By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well. + + This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed. + + Pay attention to these two lines of code. They seem similar, but behave very differently. + + * `sql.execute("SELECT * FROM table WHERE ID = " + id);` + * `sql.execute("SELECT * FROM table WHERE ID = ?", id);` + The second line is parameterized. The same principle applies to other types, such as command line execution, etc. + risk: "Systems vulnerable to injections may lead to data breaches, loss of data, + \nunauthorized alteration of data, or complete database compromise or downtime.\n\nThis + applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc.\n" + measure: | + * Identify which of the types your application is using. Check that you use: + * Use _parametrized queries_ (or _prepared statements_) + * For database queries, you may also use: + * Use _stored procedures_ () + * Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: d880fa0f-9dbb-454e-a003-d844fad31ab4 + name: OWASP Parameterization CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Query_Parameterization_Cheat_Sheet.html + tags: [] + references: + samm2: + - D-SR-A-1 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/Parametrization + comments: "" + tags: + - none + App. Hardening Level 1: + uuid: cf819225-30cb-4702-8e32-60225eedc33d + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 1 + * OWASP Mobile Application Security Verification Standard + + in all applications provides a good baseline. Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + dependsOn: + - b597928e-54d6-48a5-a806-8003dcd56aab # App. Hardening Level 1 (50%) + description: | + To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely. + + [...] + + ### Planning aka Requirements Gathering & Analysis + The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. + + ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) + + Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. + + These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. + + In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. + + Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + - uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + references: + samm2: + - D-SR-A-3 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%201 + comments: "" + tags: + - none + Containers are running as non-root: + uuid: a86c1fbc-28fd-4610-89a3-a7f73acfe45f + risk: |- + There are various reasons to run a container as non-root. Samples are listed: + ## Container Escape Vectors + + - Root privileges significantly increase the chance of breaking container isolation + - Root access can be leveraged to exploit kernel vulnerabilities + - Compromised root containers provide attackers with maximum privileges inside the container + - Greater potential for escaping container boundaries to the host system + + ## Host System Vulnerabilities + + Root containers can potentially: + + - Mount sensitive host filesystems + - Access critical device files + - Modify host network settings + - Interact with host system processes + - Override security controls + + ## Resource Management Issues + + Root privileges may allow containers to: + + - Bypass resource quotas and limits + - Modify control group (cgroup) settings + - Interfere with other containers' resources + - Circumvent memory and CPU restrictions + + Security Boundary Weakening + + - Violates the principle of least privilege + - Provides unnecessary elevated permissions + - Expands the potential attack surface + - Increases the impact of a successful compromise + measure: "Containers are running as non-root. This can be enforced in the image + itself or during runtime parameters \n(e.g. `podman run --user [...]`)." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/Containers%20are%20running%20as%20non-root + tags: + - none + App. Hardening Level 2 (75%): + uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 2 + * OWASP Mobile Application Security Verification Standard Level 2 + + Implement 75% of the recommendations. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-A-3 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%202%20%2875%25%29 + isImplemented: false + comments: "" + dependsOn: + - cf819225-30cb-4702-8e32-60225eedc33d # App. Hardening Level 1 + tags: + - none + Secure headers: + uuid: 29318d60-18ce-4526-80ea-f5928e49f639 + risk: | + Missing or misconfigured security headers can lead to various security vulnerabilities, e.g.: + - Cross-Site Scripting (XSS) due to missing Content Security Policy + - Clickjacking attacks due to missing X-Frame-Options + - Information disclosure through Server header exposure + - SSL/TLS downgrade attacks due to missing HSTS + - Cross-site scripting and injection due to missing security headers + measure: | + Implement and enforce security headers across all applications and services + + Implementation Methods: + 1. Reverse Proxy/Load Balancer: Configure at nginx/Apache level + 2. Web Application: Implement in the application middleware + 3. Service Mesh: Configure at the ingress controller level + 4. Standard Docker Image: Use secure base images with preset headers + + Remove or Secure: + - Server header: Hide server version information + - X-Powered-By: Remove technology stack information + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + implementation: + - uuid: 370b7f35-4da7-4833-89d6-7266b82ea07e + name: OWASP Secure Headers Project + tags: + - header + - documentation + url: https://owasp.org/www-project-secure-headers/ + description: "The OWASP Secure Headers Project (also called OSHP) describes + HTTP response headers that your application can use \nto increase the security + of your application. Once set, these HTTP response headers can restrict + modern browsers \nfrom running into easily preventable vulnerabilities. + The OWASP Secure Headers Project intends to raise awareness\nand use of + these headers." + meta: + implementationGuide: | + Essential headers: + - Content-Security-Policy: Define trusted sources for content + - Strict-Transport-Security: Enforce HTTPS connections + - X-Frame-Options: Prevent clickjacking attacks + - X-Content-Type-Options: Prevent MIME-type sniffing + - X-XSS-Protection: Enable browser's XSS filtering + - Referrer-Policy: Control information in the Referrer header + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/cre/620-421 + tags: + - none + App. Hardening Level 2: + uuid: ffe86caf-2fec-4630-b514-2db83983984d + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 2 + * OWASP Mobile Application Security Verification Standard Level 2 + + Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 4 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%202 + isImplemented: false + comments: "" + dependsOn: + - 03643ca2-03c2-472b-8e19-956bf02fe9b7 # App. Hardening Level 2 (75%) + tags: + - none + App. Hardening Level 3: + uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 3 + * OWASP Mobile Application Security Verification Standard + + Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 + usefulness: 4 + level: 5 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-A-3 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20Hardening/subsection/App.%20Hardening%20Level%203 + dependsOn: + - ffe86caf-2fec-4630-b514-2db83983984d # App. Hardening Level 2 + tags: + - none + Development and Source Control: + Versioning: + uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f + risk: Deployment of untracked artifacts. + description: Use a version control system platform like Github, Gitlab, Bitbucket, + gittea,... to version your code. + measure: Version artifacts in order to identify deployed features and issues. + This includes application and infrastructure code, jenkins configuration, + container and virtual machine images definitions. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 1 + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + implementation: [] + references: + samm2: + - O-EM-A-1 + - I-SB-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + - 14.2.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Versioning + tags: + - none + Require a PR before merging: + uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + risk: Intentional or accidental alterations in critical branches like main (or + master). + measure: Define source code management system policies (e.g. branch protection + rules, mandatory code reviews from at least one person, ...) to ensure that + changes to critical branches are only possible under defined conditions. These + policies can be implemented at repository level or organization level, depending + on the source code management system. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 2 + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Require%20a%20PR%20before%20merging + tags: + - none + Block force pushes: + uuid: c7d99b18-c3e1-4d22-b2e3-9aa9146c0b17 + risk: "Misuse of force push can lead to loss of work. It may overwrite remote + \nbranches without warning, potentially erasing valuable contributions from + team members. This can disrupt collaboration, \ncause data loss, and create + confusion in the development process.\n\nBypassing the pull request process + might remove an important code review step. \nThis increases the risk of merging + low-quality or buggy code into the main branch, potentially introducing bugs + in the codebase." + measure: Mandate blocking of force pushes in the version control platform. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Block%20force%20pushes + tags: + - none + Dismiss stale PR approvals: + uuid: ea6f69f7-54a5-4922-ac15-a77ff0c16162 + risk: Intentional or accidental alterations in critical branches like main (or + master) through post-approval code additions. + measure: Implement a policy where any commits made after a pull request has + been approved automatically revoke that approval, necessitating a fresh review + and re-approval process. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Dismiss%20stale%20PR%20approvals + tags: + - none + Require status checks to pass: + uuid: ac8730a2-ccc0-465c-9550-d91edae9d5ee + risk: Organizations risk introducing broken builds, quality issues, and security + vulnerabilities into their codebase. + measure: Mandate passing of security related specified status checks, like successful + builds or static application security tests, before proceeding. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - e7598ac4-b082-4e56-b7df-e2c6b426a5e2 # Require a PR before merging + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.3 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Require%20status%20checks%20to%20pass + tags: + - none + .gitignore: + uuid: 363a3eea-baf9-4010-88ca-bb8186a2989d + risk: Unintended leakage of secrets, debug, or workstation specific data + measure: .gitignore files help prevent accidental commits of secrets, debug, + or workstation specific data + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 5 + level: 4 + dependsOn: [] + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + - 14.2.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/.gitignore + tags: + - none + Local development linting & style checks performed: + uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 + risk: Insecure or unmaintainable code base. + measure: Integrate static code analysis tools in IDEs. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 5 + description: "" + implementation: + - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + - uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Local%20development%20linting%20%26%20style%20checks%20performed + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Infrastructure Hardening: + MFA for admins: + uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 + risk: One factor authentication is more vulnerable to brute force attacks and + is considered less secure. + measure: Two ore more factor authentication for all privileged accounts on systems + and applications + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 1 + implementation: + - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey - Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 9.2.4 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.17 + - 5.3 + - 8.25 + d3f: + - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/MFA%20for%20admins + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Simple access control for systems: + uuid: 82e499d1-f463-4a4b-be90-68812a874af6 + risk: Attackers a gaining access to internal systems and application interfaces + measure: All internal systems are using simple authentication + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 1 + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + implementation: + - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 9.4.1 + iso27001-2022: + - 8.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Simple%20access%20control%20for%20systems + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of edge encryption at transit: + uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 + risk: Evil actors might be able to perform a man in the middle attack and sniff + confidential information (e.g. authentication factors like passwords). + measure: |- + By using encryption at the edge of traffic in transit, it is impossible + or at least harder to sniff credentials or information being outside of the organization. + + Using standard secure protocols like HTTPS is recommended. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20edge%20encryption%20at%20transit + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Applications are running in virtualized environments: + uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 + risk: Through a vulnerability in one service on a server, the attacker gains + access to other services running on the same server. + measure: Applications are running in a dedicated and isolated virtualized environments. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Applications%20are%20running%20in%20virtualized%20environments + comments: "" + tags: + - none + Backup: + uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc + risk: If errors are experienced during the deployment process you want to deploy + an old release. However, due to changes in the database this is often unfeasible. + measure: Performing automated periodical backups are used. Backup before deployment + can help facilitate deployments whilst testing the backup restore processes. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + references: + samm2: + - TODO + iso27001-2017: + - 12.3 + - 14.2.6 + iso27001-2022: + - 8.13 + - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Backup + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Baseline Hardening of the environment: + uuid: 5992c38c-8597-4035-89db-d15820d81c3a + risk: Using default configurations for a cluster environment leads to potential + risks. + measure: Harden environments according to best practices. Level 1 and partially + level 2 from hardening practices like 'CIS Kubernetes Bench for Security' + should be considered. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 4 + level: 2 + implementation: + - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Benchmark for Security + tags: [] + url: https://www.cisecurity.org/benchmark/kubernetes + - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Benchmark for Security + tags: [] + url: https://www.cisecurity.org/benchmark/docker + - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + - uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/containers/ + description: Attack matrix for containers + - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - system hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Baseline%20Hardening%20of%20the%20environment + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Isolated networks for virtual environments: + uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 + risk: Virtual environments in default settings are able to access other virtual + environments on the network stack. By using virtual machines, it is often + possible to connect to other virtual machines. By using docker, one bridge + is used by default so that all containers on one host can communicate with + each other. + measure: The communication between virtual environments is controlled and regulated. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 2 + dependsOn: [] + implementation: + - uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Isolated%20networks%20for%20virtual%20environments + isImplemented: false + evidence: "" + comments: "" + tags: + - none + MFA: + uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de + risk: One factor authentication is more vulnerable to brute force attacks and + is considered less secure. + measure: Two ore more factor authentication for all accounts on all (important) + systems and applications + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 2 + dependsOn: + - 8098e416-e1ed-4ae4-a561-83efbe76bf57 # MFA for admins + implementation: + - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey - Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - 9.2.4 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.17 + - 5.3 + - 8.25 + d3f: + - Multi-factorAuthentication + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/MFA + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of an security account: + uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 + risk: Having security auditing in the same account as infrastructure and applications + at the cloud provide might cause evil administrators (or threat actors taking + over an account of an administrator) to alter evidence like audit logs. + measure: Usage of a separate account dedicated for security activities. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 + usefulness: 4 + level: 2 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20an%20security%20account + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of encryption at rest: + uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 + risk: Evil actors might be able to access data and read information, e.g. from + physical hard disks. + measure: By using encryption at rest, it is impossible or at least harder to + to read information. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20encryption%20at%20rest + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of test and production environments: + uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 + risk: Security tests are not running regularly because test environments are + missing + measure: A test and a production like environment is used + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 4 + level: 2 + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.4 + - 17.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.31 + - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20test%20and%20production%20environments + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Virtual environments are limited: + uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca + risk: Denial of service (internally by an attacker or unintentionally by a bug) + on one service effects other services + measure: All virtual environments are using resource limits on hard disks, memory + and CPU + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + dependsOn: + - 3a94d55e-fd82-4996-9eb3-20d23ff2a873 # Applications are running in virtualized environments + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 12.1.3 + - 13.1.3 + - 17.2.1 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.6 + - 8.22 + - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Virtual%20environments%20are%20limited + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Filter outgoing traffic: + uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d + risk: A compromised infrastructure component might try to send out stolen data. + measure: Having a whitelist and explicitly allowing egress traffic provides + the ability to stop unauthorized data leakage. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 2 + level: 3 + dependsOn: [] + implementation: + - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Filter%20outgoing%20traffic + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Immutable infrastructure: + uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 + risk: The availability of IT systems might be disturbed due to components failures + measure: Redundancies in the IT systems + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + dependsOn: + - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code + implementation: + - uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 17.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Immutable%20infrastructure + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Infrastructure as Code: + uuid: 8b994601-575e-4ea5-b228-accb18c8e514 + risk: No tracking of changes in systems might lead to errors in the configuration. + In additions, it might lead to unauthorized changes. An examples is jenkins. + measure: Systems are setup by code. A full environment can be provisioned. In + addition, software like Jenkins 2 can be setup and configured in in code too. + The code should be stored in a version control system. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 4 + usefulness: 4 + level: 3 + implementation: + - uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + - uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Infrastructure%20as%20Code + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Limitation of system events: + uuid: e5386abf-9154-4752-a1a8-c3a8900f732d + risk: System events (system calls) can lead to privilege escalation. + measure: System calls are limited. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 5 + level: 3 + dependsOn: + - 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 # Audit of system events + implementation: + - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Limitation%20of%20system%20events + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Role based authentication and authorization: + uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 + risk: Everyone is able to get unauthorized access to information on systems + or to modify information unauthorized on systems. + measure: The usage of a (role based) access control helps to restrict system + access to authorized users. And enhancement is to use attribute based access + control. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - 9.4.1 + iso27001-2022: + - 8.3 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Role%20based%20authentication%20and%20authorization + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of internal encryption at transit: + uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 + risk: Evil actors within the organization of traffic in transit might be able + to perform a man in the middle attack and sniff confidential information (e.g. + authentication factors like passwords) + measure: By using encryption internally, e.g. inside of a cluster, it is impossible + or at least harder to sniff credentials. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 3 + usefulness: 4 + level: 3 + implementation: "" + references: + samm2: + - I-SD-B-2 + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20internal%20encryption%20at%20transit + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of security by default for components: + uuid: 11b3848e-e931-4146-a35d-35409ada24ee + risk: Components (images, libraries, applications) are not hardened. + measure: Hardening of components is important, specially for image on which + other teams base on. Hardening should be performed on the operation system + and on the services inside (e.g. Nginx or a Java-Application). + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20security%20by%20default%20for%20components + isImplemented: false + evidence: "" + comments: "" + tags: + - none + WAF baseline: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b + risk: Vulnerable input, such as exploits, can infiltrate the application via + numerous entry points, posing a significant security threat. + measure: |- + Implementing a web application firewall (WAF) is a critical security control. At a baseline level, the objective is to finely balance the reduction of false positives, maintaining user experience, against a potential increase in the less noticeable false negatives. + Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. + description: | + A baseline WAF configuration provides essential defense against common vulnerabilities, acting as a first line of automated threat detection and response. + Steps: + - Configure WAF in alert mode to establish traffic patterns + - Analyze alerts and adjust sensitivity to optimize for fewer false positives + - Gradually switch to a proactive blocking stance as confidence in the accuracy of the rules increases + + It's crucial to monitor and update the WAF configuration to adapt to evolving threats and minimize the potential for both false positives and false negatives. + + There are debates on how useful a WAF is for APIs. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 3 + usefulness: 3 + level: 3 + dependsOn: + - e1f37abb-d848-4a3a-b3df-65e91a89dcb7 # Context-aware output encoding + implementation: [] + references: + samm2: + - O-EM-A-1 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/WAF%20baseline + comments: ~ + tags: + - none + Hardening of the Environment: + uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 + risk: Using default configurations for a cluster environment leads to potential + risks. + measure: Harden environments according to best practices. Level 2 and partially + level 3 from hardening practices like 'CIS Kubernetes Bench for Security' + should be considered. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Benchmark for Security + tags: [] + url: https://www.cisecurity.org/benchmark/kubernetes + - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Benchmark for Security + tags: [] + url: https://www.cisecurity.org/benchmark/docker + - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + - uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/containers/ + description: Attack matrix for containers + - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Hardening%20of%20the%20Environment + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Production near environments are used by developers: + uuid: e14de741-94b3-447c-8b07-eea947d82e61 + risk: In case an errors occurs in production, the developer need to be able + to create a production near environment on a local development environment. + measure: Usage of infrastructure as code helps to create a production near environment. + The developer needs to be trained in order to setup a local development environment. + In addition, it should be possible to create production like test data. Often + personal identifiable information is anonymized in order to comply with data + protection laws. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 4 + level: 4 + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code + implementation: [] + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - 12.1.4 + - 17.2.1 + iso27001-2022: + - 8.31 + - 8.14 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Production%20near%20environments%20are%20used%20by%20developers + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of a chaos technology: + uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe + risk: Due to manual changes on a system, they are not replaceable anymore. In + case of a crash it might happen that a planned redundant system is unavailable. + In addition, it is hard to replay manual changes. + measure: A randomized periodically shutdown of systems makes sure, that nobody + will perform manual changes to a system. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 5 + usefulness: 3 + level: 4 + implementation: + - uuid: c117e79b-8223-4e55-9da5-efbf5d741c15 + name: Chaos Monkey + tags: + - chaos + - testing + url: https://github.com/Netflix/chaosmonkey + description: Chaos Monkey is a resiliency tool that helps applications tolerate + random instance failures. Chaos Monkey randomly terminates virtual machine + instances and containers that run inside of your production environment. + Exposing engineers to failures more frequently incentivizes them to build + resilient services. + references: + samm2: + - O-EM-A-3 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 17.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/Usage%20of%20a%20chaos%20technology + isImplemented: false + evidence: "" + comments: "" + tags: + - none + WAF medium: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium + risk: The threat from malicious inputs remains high, with exploits seeking to + exploit any vulnerabilities present at the various points of entry to the + application. + measure: |- + A WAF deployed with a medium level of protection strengthens the security posture by striking a more advanced balance between the detection of genuine threats and the minimization of false alarms. + Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. + description: "A medium-level WAF configuration builds upon the baseline to offer + a more nuanced and responsive defense mechanism against a wider array of threats.\n\nSample + steps:\n - Implement an enhanced set of WAF rules based on baseline data\n + \ - Continuous monitoring and fine-tuning of the WAF configuration\n - Develop + a strategic incident response plan utilizing WAF insights \n \nThe + medium configuration requires diligent management and continuous improvement + to address new vulnerabilities while maintaining the integrity of application + access.\n\nThere are debates on how useful a WAF is for APIs.\n" + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 4 + usefulness: 3 + level: 4 + dependsOn: + - f0e01814-3b88-4bd0-a3a9-f91db001d20b # WAF baseline + implementation: [] + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/WAF%20medium + comments: ~ + tags: + - none + WAF Advanced: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced + risk: The presence of sophisticated threats necessitates a robust defense strategy + where application inputs are meticulously scrutinized for security breaches, + including advanced persistent threats and zero-day vulnerabilities. + measure: |- + An advanced WAF protection level includes rigorous input validation, rejecting any parameters not explicitly required, and custom rule sets that are dynamically updated in response to emerging threats. + The advanced WAF setup is designed to ensure all data is in the correct format and any superfluous input parameters are automatically rejected. It includes machine learning algorithms to detect anomalies, custom-developed rules for real-time traffic analysis, and seamless integration with existing security infrastructures to adapt to the ever-changing threat landscape. + description: | + This advanced configuration goes beyond typical WAF implementations by enforcing strict input format checks and parameter validation to prevent any unauthorized or malformed data from compromising the application. + + Sample Steps: + - Implement strict data type and format validation rules to ensure only correctly formatted data is processed. + - Establish a denylist for all parameters that are not explicitly required, blocking them by default. + - Develop and continuously refine custom rulesets based on the application's traffic patterns, user behavior, and known vulnerabilities. + - Integrate machine learning algorithms to enhance anomaly detection and automatic rule adjustment. + - Correlate and analyze WAF logs with other security systems like SIEM for comprehensive threat intelligence. + - Conduct regular red team exercises to test and validate the effectiveness of the WAF configurations against simulated advanced attack scenarios. + - Activate automated threat response mechanisms to immediately neutralize detected threats. + + Embracing an advanced WAF setup requires a proactive approach, with continuous improvement and updating of security measures to ensure all inputs are scrutinized and validated, thus maintaining a resilient security posture against sophisticated attacks. + + There are debates on how useful a WAF is for APIs. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 5 + usefulness: 4 + level: 5 + dependsOn: + - f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium # WAF medium + implementation: [] + references: + samm2: + - O-EM-A-2 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Infrastructure%20Hardening/subsection/WAF%20Advanced + comments: ~ + tags: + - none +Information Gathering: + Logging: + Centralized system logging: + uuid: 4eced38a-7904-4c45-adb0-50b663065540 + risk: Local stored system logs can be unauthorized manipulated by attackers + or might be corrupt after an incident. In addition, it is hard to perform + a aggregation of logs. + measure: By using centralized logging logs are protected against unauthorized + modification. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 1 + implementation: + - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Centralized%20system%20logging + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Centralized application logging: + uuid: fe875e17-ae4a-45f8-a359-244aa4fcbc04 + risk: Local stored logs can be unauthorized manipulated by attackers with system + access or might be corrupt after an incident. In addition, it is hard to perform + an correlation of logs. This leads attacks, which can be performed silently. + measure: A centralized logging system is used and applications logs (including + application exceptions) are shipped to it. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 5 + level: 2 + dependsOn: + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting + implementation: [] + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Centralized%20application%20logging + tags: + - none + Logging of security events: + uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb + description: | + Implement logging of security relevant events. The following events tend to be security relevant: + - successful/failed login/logout + - creation, change, and deletion of users + - errors during input validation and output creation + - exceptions and errors with security in their name + - transactions of value (e.g., financial transactions, costly operations) + - :unicorn: (special things of your application) + measure: Security-relevant events like login/logout or creation, change, deletion + of users should be logged. + assessment: | + - Show which events are logged. + - Show a test for one event logging. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 2 + credits: | + [AppSecure-nrw](https://github.com/AppSecure-nrw/security-belts/blob/master/orange/logging-of-security-events.md) + implementation: + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - 12.4.1 + iso27001-2022: + - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Logging%20of%20security%20events + risk: |- + * No track of security-relevant events makes it harder to analyze an incident. + * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Analyze logs: + uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 + risk: Not aware of attacks happening. + measure: Check logs for keywords. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Analyze%20logs + tags: + - none + Visualized logging: + uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 + risk: System and application protocols are not visualized properly which leads + to no or very limited logging assessment. Specially developers might have + difficulty to read applications logs with unusually tools like the Linux tool + 'cat' + measure: Protocols are visualized in a simple to use real time monitoring system. + The GUI gives the ability to search for special attributes in the protocol. + difficultyOfImplementation: + knowledge: 1 + time: 3 + resources: 3 + usefulness: 4 + level: 3 + dependsOn: + - 4eced38a-7904-4c45-adb0-50b663065540 # Centralized system logging + - fe875e17-ae4a-45f8-a359-244aa4fcbc04 # Centralized application logging + implementation: + - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Visualized%20logging + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Correlation of security events: + uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 + risk: Detection of security related events with hints on different systems/tools/metrics + is not possible. + measure: Events are correlated on one system. For example the correlation and + visualization of failed login attempts combined with successful login attempts. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 4 + usefulness: 3 + level: 5 + dependsOn: + - 7c735089-6a83-419f-8b27-c1e676cedea1 # Visualized logging + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/Correlation%20of%20security%20events + isImplemented: false + evidence: "" + comments: "" + tags: + - none + PII logging concept: + uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 + risk: Personal identifiable information (PII) is logged and the privacy law + (e.g. General Data Protection Regulation) is not followed. + measure: A concept how to log PII is documented and applied. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + references: + samm2: + - O-OM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + - 18.1.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + - 5.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Logging/subsection/PII%20logging%20concept + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Monitoring: + Simple application metrics: + uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 + risk: Attacks on an application are not recognized. + measure: |- + Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: + - Authentication attempts (successful/failed logins) + - Transaction volumes and patterns (e.g. orders, payments) + - API call rates and response times + - User session metrics + - Resource utilization + + Example: An e-commerce application normally processes 100 orders per hour. A sudden spike to 1000 orders per hour could indicate either: + - A legitimate event (unannounced marketing campaign, viral social media post) + - A security incident (automated bulk purchase bots, credential stuffing attack) + + By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 5 + level: 1 + implementation: + - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - 12.4.1 + iso27001-2022: + - 8.15 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Simple%20application%20metrics + comments: "" + tags: + - none + Simple budget metrics: + uuid: f08a3219-6941-43ec-8762-4aff739f4664 + risk: Not getting notified about reaching the end of the budget (e.g. due to + a denial of service) creates unexpected costs. + measure: Cloud providers often provide insight into budgets. A threshold and + alarming for the budget is set. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 5 + level: 1 + implementation: + - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Simple%20budget%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Simple system metrics: + uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 + risk: Without simple metrics analysis of incidents are hard. In case an application + uses a lot of CPU from time to time, it is hard for a developer to find out + the source with Linux commands. + measure: Gathering of system metrics helps to identify incidents and specially + bottlenecks like in CPU usage, memory usage and hard disk usage. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 5 + assessment: | + Are system metrics gathered? + level: 1 + implementation: + - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Simple%20system%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Alerting: + uuid: 8a442d8e-0eb1-4793-a513-571aef982edd + risk: Incidents are discovered after they happened. + measure: | + Thresholds for metrics are set. In case the thresholds are reached, alarms are send out. Which should get attention due to the critically. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 2 + dependsOn: + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + - I-DM-A-3 + iso27001-2017: + - 16.1.2 + - 16.1.4 + - 12.1.4 + iso27001-2022: + - 6.8 + - 5.25 + - 8.31 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Alerting + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Monitoring of costs: + uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e + risk: Not monitoring costs might lead to unexpected high resource consumption + and a high invoice. + measure: Implement cost budgets. Setting of an alert threshold and sending out + errors when it is reached. In the best case, a second threshold with a limit + is set so that the cost can not go higher. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Monitoring%20of%20costs + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Visualized metrics: + uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 + risk: Not visualized metrics lead to restricted usage of metrics. + measure: Metrics are visualized in real time in a user friendly way. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - 3d1f4c3b-f713-46d9-933a-54a014a26c03 # Simple system metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Visualized%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Advanced availability and stability metrics: + uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 + risk: Trends and advanced attacks are not detected. + measure: Advanced metrics are gathered in relation to availability and stability. + For example unplanned downtime's per year. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Advanced%20availability%20and%20stability%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Audit of system events: + uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 + risk: System events (system calls) trends and attacks are not detected. + measure: Gathering of system calls. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + implementation: + - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Audit%20of%20system%20events + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Deactivation of unused metrics: + uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 + risk: High resources are used while gathering unused metrics. + measure: Deactivation of unused metrics helps to free resources. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 3 + dependsOn: + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + implementation: [] + references: + samm2: + - O-IM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Deactivation%20of%20unused%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Grouping of metrics: + uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b + risk: The analysis of metrics takes long. + measure: Meaningful grouping of metrics helps to speed up analysis. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 + usefulness: 2 + level: 3 + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.6 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Grouping%20of%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Targeted alerting: + uuid: d6f06ae8-401a-4f44-85df-1079247fa030 + risk: People are bored (ignorant) of incident alarm messages, as they are not + responsible to react. + measure: By the definition of target groups for incidents people are only getting + alarms for incidents they are in charge for. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 3 + dependsOn: + - 8a442d8e-0eb1-4793-a513-571aef982edd # Alerting + implementation: [] + references: + samm2: + - O-IM-A-2 + - I-DM-A-3 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.26 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Targeted%20alerting + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Advanced app. metrics: + uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf + risk: People are not looking into tests results. Vulnerabilities not recolonized, + even they are detected by tools. + measure: All defects from the dimension Test- and Verification are instrumented. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - e9a6d403-a467-445e-b98a-74f0c29da0b1 # Simple application metrics + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Advanced%20app.%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Coverage and control metrics: + uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d + risk: The effectiveness of configuration, patch and vulnerability management + is unknown. + measure: "Usage of Coverage- and control-metrics to show the effectiveness of + the security program. Coverage is the degree in \n which a specific + security control for a specific target group is applied with all resources.\n + \ The control degree shows the actual application of security standards + and security-guidelines. Examples are gathering information on anti-virus, + anti-rootkits, patch management, server configuration and vulnerability management." + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + implementation: + - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Coverage%20and%20control%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Defense metrics: + uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 + risk: IDS/IPS systems like packet- or application-firewalls detect and prevent + attacks. It is not known how many attacks has been detected and blocked. + measure: | + Gathering of defense metrics like TCP/UDP sources enables to assume the geographic location of the request. + Assuming a Kubernetes cluster with an egress-traffic filter (e.g. IP/domain based), an alert might be send out in case of every violation. For ingress-traffic, alerting might not even be considered. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics + - 6df508ef-86fc-4c22-bd9f-646c3127ce7d # Filter outgoing traffic + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - 12.4.1 + - 13.1.1 + iso27001-2022: + - 8.15 + - 8.2 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Defense%20metrics + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Screens with metric visualization: + uuid: 8746647c-638c-473f-8e17-82c068e4c311 + risk: Security related information is discovered too late during an incident. + measure: By having an internal accessible screen with a security related dashboards + helps to visualize incidents. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 5 + level: 4 + dependsOn: + - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.26 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Screens%20with%20metric%20visualization + comments: "" + tags: + - none + Metrics are combined with tests: + uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 + risk: Changes might cause high load due to programming errors. + measure: Metrics during tests helps to identify programming errors. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 2 + usefulness: 5 + level: 5 + dependsOn: + - 42170a71-d4c8-47af-bd71-bf36875fd05b # Grouping of metrics + implementation: [] + references: + samm2: + - O-IM-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Monitoring/subsection/Metrics%20are%20combined%20with%20tests + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test KPI: + Number of vulnerabilities/severity: + uuid: bc548cba-cb82-4f76-bd4b-325d9d256279 + risk: Failing to convey the number of vulnerabilities by severity might undermine + the effectiveness of product teams. This might lead to ignorance of findings. + measure: Measurement and communication of vulnerabilities per severity for components + like applications. At least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Number%20of%20vulnerabilities%2Fseverity + tags: + - vulnerability-mgmt + - metrics + - vmm-measurement + Number of vulnerabilities/severity/layer: + uuid: 0ec92899-a5cb-4649-984b-2fb1d6c784ad + risk: Failing to convey the number of vulnerabilities by severity and layer + (app/infra) might undermine the effectiveness of product teams. This might + lead to ignorance of findings. + measure: Measurement and communication of vulnerabilities per severity for components + like applications and split it depending on the layer (e.g. app/infra). At + least quarterly. + description: |- + Communication can be performed in a simple way, e.g. text based during the build process. + This activity depends on at least one security testing implementation. + Layers to consider (SCA): + - Cloud provider (if insights are possible) + - Runtimes, e.g. Kubernetes nodes + - Base images and container images + - Application + + Layers to consider SAST/DAST: + - Cloud provider + - Runtime, e.g. Kubernetes + - Base images and container images + - Application + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: [] + implementation: [] + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Number%20of%20vulnerabilities%2Fseverity%2Flayer + tags: + - vulnerability-mgmt + - metrics + - vmm-measurement + Patching mean time to resolution via PR: + uuid: 86d490b9-d798-4a5b-a011-ab9688014c46 + risk: Without measuring Mean Time to Resolution (MTTR) related to patching, + it is challenging to identify delays in the patching process. Unaddressed + vulnerabilities can be exploited by attackers, leading to potential security + breaches and data loss. + measure: "Measurement and communication of patching Mean Time to Resolution + (MTTR) in alignment with Service Level Agreements (SLAs), conducted at least + on a quarterly basis.\nThis includes the measurement of the existence of a + properly configured automated pull request (PR) tool (e.g., Dependabot or + Renovate) in a repository. \nIn addition, the measurement of the time from + opening an automated PR to merging it.\n\nAverage time to patch is visualized + per component/project/team." + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + implementation: [] + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Patching%20mean%20time%20to%20resolution%20via%20PR + tags: + - patching + - metrics + - vmm-measurements + Fix rate per repo/product: + uuid: cf0d600e-114d-4887-9059-d81c53805f0d + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of the number of vulnerabilities handled + per severity level for components such as applications, ensuring alignment + with SLAs. \nThe rate should be broken down by team, product, application, + repository, and/or service. This analysis should be conducted at least quarterly." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Fix%20rate%20per%20repo%2Fproduct + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + Generation of response statistics: + uuid: c922981b-65ed-40f3-a947-96fee9a0125f + risk: No or delayed reaction to findings leads to potential exploitation of + findings. + measure: Creation and response statistics (e.g. Mean Time to Resolution) of + findings. This is also referred to as _Mean Time to Resolve_. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + dependsOn: + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-B-2 + - I-SB-B-3 + iso27001-2017: + - 16.1.4 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Generation%20of%20response%20statistics + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) + generates statistics from OWASP DefectDojo and places the results in a [Github + repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). + SLA per criticality: + uuid: 51f3fce5-b5c8-4683-8c41-e785fe4f3b5f + risk: "Not communicating how many applications are adhering to SLAs based on + the criticality of vulnerabilities can lead to delayed remediation of \ncritical + security issues, increasing the risk of exploitation and potential damage + to the organization." + measure: "Measurement and communication of how many of the vulnerabilities handling + per severity for components like applications are aligned to SLAs. \nThis + is performed for the hole organization and doesn't need to be broken down + (yet) on team/product/application. \nAt least quarterly." + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-B-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/SLA%20per%20criticality + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + Patching mean time to resolution via production: + uuid: 77ffc53e-9f3d-41f4-92d3-02f04f9b6b0f + risk: Without measuring Mean Time to Resolution (MTTR) related to patching, + it is challenging to identify delays in the patching process. Unaddressed + vulnerabilities can be exploited by attackers, leading to potential security + breaches and data loss. + measure: |- + Measurement and communication of the time from the availability of a patch to its deployment in production in alignment with Service Level Agreements (SLAs), conducted at least on a quarterly basis. + Average time to patch is visualized per component/project/team. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + usefulness: 3 + level: 4 + dependsOn: + - 86d490b9-d798-4a5b-a011-ab9688014c46 # Patching mean time to resolution via PR + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + implementation: [] + references: + samm2: + - I-DM-B-2 + iso27001-2017: + - 16.1.4 + iso27001-2022: + - 5.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20KPI/subsection/Patching%20mean%20time%20to%20resolution%20via%20production + tags: + - patching + - metrics + - vmm-measurements +Test and Verification: + Application tests: + Security unit tests for important components: + uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 + risk: Vulnerabilities are rising due to code changes. + measure: Usage of unit tests to test important security related features like + authentication and authorization. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 2 + comments: | + The integration of module tests takes place during development instead, it highlights vulnerabilities in sub-routines, functions, modules, libraries etc. checked. + A sample implementation of unit tests are explained in the video [Shift-Left-Security with the Security Test Pyramid - Andreas Falk](https://www.youtube.com/watch?v=TzFZy3f7d8E) starting with minute 9. + implementation: + - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + references: + samm2: + - V-RT-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20tests/subsection/Security%20unit%20tests%20for%20important%20components + isImplemented: false + evidence: "" + tags: + - none + Security integration tests for important components: + uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment. + measure: Implementation of essential security related integration tests. For + example for authentication and authorization. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 2 + level: 3 + references: + samm2: + - V-RT-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20tests/subsection/Security%20integration%20tests%20for%20important%20components + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Smoke Test: + uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a + risk: During a deployment an error might happen which leads to non-availability + of the system, a part of the system or a feature. + measure: Integration tests are performed against the production environment + after each deployment. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 4 + implementation: [] + dependsOn: + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + references: + samm2: + - V-RT-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20tests/subsection/Smoke%20Test + isImplemented: false + evidence: "" + comments: "" + tags: + - none + High coverage of security related module and integration tests: + uuid: 67667c97-c33e-4306-a4e5-e7b1d8e10c5a + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment in not important components. + measure: Implementation of security related tests via unit tests and integration + tests. Including the test of libraries, in case the are not tested already. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 3 + usefulness: 3 + level: 5 + implementation: [] + references: + samm2: + - V-RT-B-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Application%20tests/subsection/High%20coverage%20of%20security%20related%20module%20and%20integration%20tests + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Consolidation: + Simple false positive treatment: + uuid: c1acc8af-312e-4503-a817-a26220c993a0 + risk: As false positive occur during each test, all vulnerabilities might be + ignored. Specially, if tests are automated an run daily. + measure: |- + Findings from security tests must be triaged and outcomes persisted/documented to: + - Prevent re-analysis of known issues in subsequent test runs + - Track accepted risks vs false positives + - Enable consistent decision-making across teams + + At this maturity level, a simple tracking system suffices - tools need only distinguish between "triaged" and "untriaged" findings, without complex categorization. Some tools refer to this as "suppression" of findings. + + Samples for false positive handling: + - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) + - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) + - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + references: + samm2: + - I-DM-A-1 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.6 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Simple%20false%20positive%20treatment + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Treatment of defects with severity high or higher: + uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 + risk: Vulnerabilities with severity high or higher are not visible. + measure: Vulnerabilities with severity high or higher are added to the quality + gate. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + comments: False positive analysis, specially for static analysis, is time consuming. + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20with%20severity%20high%20or%20higher + implementation: [] + tags: + - vuln-action + - defect-management + evidence: "" + Artifact-based false positive treatment: + uuid: 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f + risk: Without artifact-specific false positive handling, teams must repeatedly + triage the same findings across different versions or deployments of the same + component, leading to inefficient use of security resources. + measure: "Implement false positive marking and temporary acceptance of findings + \nbased on specific artifacts (applications, components, or repositories).\nThis + allows teams to suppress findings for specific versions or builds\nwhile maintaining + visibility for future releases." + description: |- + Artifact-based false positive treatment enables more granular control + over finding suppression by linking decisions to specific code artifacts, + container images, or application versions. This approach helps maintain + security oversight while reducing repeated analysis overhead. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - c1acc8af-312e-4503-a817-a26220c993a0 # Simple false positive treatment + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + references: + samm2: + - I-DM-A-2 + - I-DM-B-2 + - I-SB-B-3 + iso27001-2017: + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Artifact-based%20false%20positive%20treatment + tags: + - false-positive + - defect-management + Simple visualization of defects: + uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 + risk: The security level of a component is not visible. Therefore, the motivation + to enhance the security is not give. + measure: Vulnerabilities are simple visualized. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Simple%20visualization%20of%20defects + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Fix based on accessibility: + uuid: 0c10a7f7-f78f-49f2-943d-19fdef248fed + risk: Overwhelming volume of security findings from automated testing tools. + This might lead to ignorance of findings. + measure: Implement a simple risk-based prioritization framework for vulnerability + remediation based on accessibility of the applications. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + meta: + implementationGuide: |- + Develop a scoring system for asset accessibility, considering factors like: + - Whether the asset is internet-facing (highly recommended) + - The number of network hops required to reach the asset (recommended) + - Authentication requirements for access (recommended) + dependsOn: + - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: ~ + references: + samm2: + - I-DM-A-3 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Fix%20based%20on%20accessibility + tags: + - vuln-action + - defect-management + Global false positive treatment: + uuid: 9e3a7c2f-1b4d-4e8a-a5c6-7f2b9d1e3a8c + risk: Without centralized false positive management across environments, organizations + face inconsistent security decisions, duplicated analysis efforts, and potential + security gaps when the same findings are handled differently across applications + and teams. + measure: "Implement global false positive and acceptance management that applies + \nconsistently across all applications. This enables organization-wide security + decisions and reduces redundant \nanalysis of common false positives." + description: "Global false positive treatment allows (security) teams to make + \norganization-wide decisions about specific vulnerabilities or finding \npatterns. + When a finding is marked as a false positive or temporarily \naccepted at + the global level, this decision automatically applies to \nall applications + in the specified environment, ensuring consistency \nand operational efficiency." + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - 8f2b4d5a-3c1e-4b7a-9d8f-2e6c4a1b5d7f # Artifact-based false positive treatment + - 85ba5623-84be-4219-8892-808837be582d # Usage of a vulnerability management system + implementation: ~ + references: + samm2: + - I-DM-B-2 + - I-DM-A-3 + - I-SB-B-3 + iso27001-2017: + - 16.1.3 + - 16.1.4 + - 16.1.6 + iso27001-2022: + - 6.8 + - 5.25 + - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Global%20false%20positive%20treatment + tags: + - false-positive + - defect-management + Integration in development process: + uuid: aaffa73f-59f6-4267-b0ab-732f3d13e90d + risk: "Not integrating vulnerability handling into the development process may + result in product teams ignoring findings. \n\nSecurity joke: We will gain + 100% false negatives." + measure: Integration of findings into the development process. E.g. adding findings + to the backlog of products teams. + description: |- + Validating Findings by Security Engineers Pros: + - Ensures accuracy and relevance of findings before they reach product teams + - Reduces false positives, saving development teams time and effort + - Might provides a layer of expertise in assessing the severity and impact of vulnerabilities + + Validating Findings by Security Engineers Cons: + - Requires a sufficient number of skilled security engineers, which might be challenging for some organizations + - May slow down the process if security engineers are overloaded with validation tasks + - For Software Composition Analysis findings (known vulnerabilities) I, as a sec. eng., struggle to analysis if it is a false positive/true positive due to a lack of insights in the application + + Pushing Findings Directly to Product Teams Pros: + - Accelerates the process by immediately notifying product teams of potential vulnerabilities + - Empowers product teams to take swift action in addressing security issues + Pushing Findings Directly to Product Teams Cons: + - Increases the workload on product teams, potentially leading to frustration + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 889444eb-de68-4367-bada-a66f8cb9733a + name: Jira + tags: + - documentation + - issue + - proprietary + url: https://jira.atlassian.com/ + description: Jira is a bug tracking and project management tool developed + by Atlassian, used by development teams for tracking issues, planning sprints, + and managing software releases. It offers features for creating and managing + tasks, assigning them to team members, and monitoring progress through customizable + workflows and dashboards. + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-A-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Integration%20in%20development%20process + tags: + - vulnerability-mgmt + - vmm-measurements + Integration of vulnerability issues into the development process: + uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e + risk: To read console output of the build server to search for vulnerabilities + might be difficult. Also, to check a vulnerability management system might + not be a daily task for a developer. + measure: Vulnerabilities are tracked in the teams issue system (e.g. jira). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 2 + level: 3 + implementation: + - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side / + client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.4 + - 16.1.5 + - 16.1.6 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.25 + - 5.26 + - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Integration%20of%20vulnerability%20issues%20into%20the%20development%20process + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Treatment of defects per protection requirement: + uuid: 2b7cc923-bdaf-43e3-8fb4-a995b7783969 + risk: "Not defining the protection requirement of applications can lead to wrong + prioritization, delayed remediation of \ncritical security issues, increasing + the risk of exploitation and potential damage to the organization." + measure: "Defining the protection requirement and the corresponding handling + of vulnerabilities per severity for components like applications are aligned + to SLAs. \n This is performed for the hole organization and doesn't need to + be broken down (yet) on team/product/application. \n At least quarterly." + description: |- + The protection requirements for an application should consider: + - Data criticality + - Application accessibility (internal vs. external) + - Regulatory compliance + - Other relevant factors + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + dependsOn: [] + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-A-2 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20per%20protection%20requirement + tags: + - vulnerability-mgmt + - metrics + - vmm-measurements + Treatment of defects with severity middle: + uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 + risk: Vulnerabilities with severity middle are not visible. + measure: Vulnerabilities with severity middle are added to the quality gate. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + comments: False positive analysis, specially for static analysis, is time consuming. + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20with%20severity%20middle + implementation: [] + tags: + - vuln-action + - defect-management + Usage of a vulnerability management system: + uuid: 85ba5623-84be-4219-8892-808837be582d + risk: Maintenance of false positives in each tool enforces a high workload. + In addition a correlation of the same finding from different tools is not + possible. + measure: Aggregation of vulnerabilities in one tool reduce the workload to handle + them, e.g. mark as false positives. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 2 + dependsOn: + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation + - 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 # Each team has a security champion + - 185d5a74-19dc-4422-be07-44ea35226783 # Office Hours + level: 3 + description: "For known vulnerabilities a processes to estimate the exploit + ability of a vulnerability is recommended.\n\nTo implement a security culture + including training, office hours and security champions can help integrating + \nsecurity scanning at scale. Such activities help to understand why a vulnerability + is potentially critical and needs handling." + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3 + name: SecObserve + tags: + - vulnerability management system + url: https://github.com/SecObserve/SecObserve + description: | + SecObserve is an open source vulnerability and license management system for software development teams and cloud environments. It supports a variety of open source vulnerability scanners and integrates into CI/CD pipelines. + references: + samm2: + - I-DM-A-3 + iso27001-2017: + - 12.6.1 + - 16.1.3 + - 16.1.4 + - 16.1.5 + - 16.1.6 + iso27001-2022: + - 8.8 + - 6.8 + - 5.25 + - 5.26 + - 5.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Usage%20of%20a%20vulnerability%20management%20system + tags: + - none + Advanced visualization of defects: + uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 + risk: Correlation of the vulnerabilities of different tools to have an overview + of the the overall security level per component/project/team is not given. + measure: Findings are visualized per component/project/team. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 1 + usefulness: 2 + level: 4 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + references: + samm2: + - I-DM-A-3 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Advanced%20visualization%20of%20defects + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Reproducible defect tickets: + uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 + risk: Vulnerability descriptions are hard to understand by staff from operations + and development. + measure: Vulnerabilities include the test procedure to give the staff from operations + and development the ability to reproduce vulnerabilities. This enhances the + understanding of vulnerabilities and therefore the fix have a higher quality. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Reproducible%20defect%20tickets + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Treatment of all defects: + uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d + risk: Vulnerabilities with severity low are not visible. + measure: All vulnerabilities are added to the quality gate. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 1 + usefulness: 2 + level: 5 + implementation: [] + references: + samm2: + - I-DM-A-2 + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20all%20defects + tags: + - vuln-action + - defect-management + comments: "" + Dynamic depth for applications: + Coverage of client side dynamic components: + uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e + risk: Parts of the service are not covered during the scan, because JavaScript + is not getting executed. Therefore, the coverage of client-side dynamic components + is limited, leading to potential security risks and undetected vulnerabilities. + measure: Usage of a spider which executes dynamic content like JavaScript, e.g. + via Selenium. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 4 + level: 2 + dependsOn: + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20client%20side%20dynamic%20components + implementation: + - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Simple Scan: + uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 + risk: Deficient security tests are performed. Simple vulnerabilities are not + detected and missing security configurations (e.g. headers) are not set. Fast + feedback is not given. + measure: A simple scan is performed to get a security baseline. In case the + test is done in under 10 minutes, it should be part of the build and deployment + process. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 1 + level: 2 + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + implementation: + - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Simple%20Scan + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of different roles: + uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 + risk: Parts of the service are not covered during the scan, because a login + is not performed. + measure: Integration of authentication with all roles used in the service. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 2 + level: 2 + dependsOn: + - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Usage%20of%20different%20roles + implementation: + - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + isImplemented: false + assessment: For REST APIs, multiple OAuth2 scopes are used. + evidence: "" + comments: "" + tags: + - none + Coverage of hidden endpoints: + uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 + risk: Hidden endpoints of the service are not getting tracked. + measure: Hidden endpoints are getting detected and included in the vulnerability + scan. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 5 + level: 3 + implementation: + - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + dependsOn: + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20hidden%20endpoints + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Coverage of more input vectors: + uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc + risk: Parts of the service are not covered. For example specially formatted + or coded parameters are not getting detected as parameter (e.g. parameters + in REST-like URLs, parameters in JSON-Format or base64-coded parameters). + measure: Special parameter and special encodings are defined, so that they get + fuzzed by the used vulnerability scanners. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 1 + usefulness: 4 + level: 3 + dependsOn: + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + references: + samm2: + - V-RT-B-1 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20more%20input%20vectors + implementation: + - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Coverage of sequential operations: + uuid: 845f06ec-148c-4c67-9755-7041911dcca5 + risk: Sequential operations like workflows (e.g. login -> put products in the + basket + measure: Sequential operations are defined and checked by the vulnerability + scanner in the defined order. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 5 + level: 3 + implementation: + - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + dependsOn: + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 14.2.8 + - 14.2.3 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20sequential%20operations + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of multiple scanners: + uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea + risk: Each vulnerability scanner has different opportunities. By using just + one scanner, some vulnerabilities might not be found. + measure: Usage of multiple spiders and scanner enhance the coverage and the + vulnerabilities. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 1 + level: 4 + dependsOn: + - 65a2d7d9-5441-46bf-a4e3-f76919857750 # Usage of different roles + implementation: + - uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Usage%20of%20multiple%20scanners + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Coverage analysis: + uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 + risk: Parts of the service are not still covered by tests. + measure: Check that there are no missing paths in the application with coverage-tools. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 3 + usefulness: 4 + level: 5 + implementation: + - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + - part of periodic review, PDCA + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20analysis + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Coverage of service to service communication: + uuid: 22aab0ef-76ce-4b8c-979c-3699784330db + risk: Service to service communication is not covered. + measure: Service to service communication is dumped and checked. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 2 + usefulness: 3 + level: 5 + dependsOn: + - 07796811-37f9-467c-9ff2-48f346e77ff3 # Simple Scan + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20applications/subsection/Coverage%20of%20service%20to%20service%20communication + implementation: + - uuid: 000b55f9-e6fd-4649-8290-27876a0409e2 + name: Citrus Fresh Integration Testing + tags: + - framework + - testing + url: https://citrusframework.org/ + description: Integration Test framework with focus on messaging applications + and Microservices. + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Dynamic depth for infrastructure: + Test for exposed services: + uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 + risk: Standard network segmentation and firewalling has not been performed, + leading to world open cluster management ports. + measure: With the help of tools the network configuration of unintentional exposed + cluster(s) are tested. To identify clusters, all subdomains might need to + be identified with a tool like OWASP Amass to perform port scans based o the + result. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + dependsOn: + - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments + usefulness: 2 + level: 2 + implementation: + - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20for%20exposed%20services + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test network segmentation: + uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 + risk: Wrong or no network segmentation of pods makes it easier for an attacker + to access a database and extract or modify data. + measure: Cluster internal test needs to be performed. Integration of fine granulated + network segmentation (also between pods in the same namespace). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + dependsOn: + - 4ce24abd-8ba6-494c-828d-4d193e28e4a1 # Isolated networks for virtual environments + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20network%20segmentation + comments: "" + tags: + - none + Test of the configuration of cloud environments: + uuid: 7bb70764-9392-4462-935d-e55b2e148199 + risk: Standard hardening practices for cloud environments are not performed + leading to vulnerabilities. + measure: With the help of tools the configuration of virtual environments are + tested. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + - uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + references: + samm2: [] + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20of%20the%20configuration%20of%20cloud%20environments + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test for unauthorized installation: + uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a + risk: Unapproved components are used. + measure: Components must be whitelisted. Regular scans on the docker infrastructure + (e.g. cluster) need to be performed, to verify that only standardized base + images are used. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + comments: By preventing teams from trying out new components, innovation might + be hampered + references: + samm2: [] + iso27001-2017: + - 12.5.1 + - 12.6.1 + iso27001-2022: + - 8.19 + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20for%20unauthorized%20installation + isImplemented: false + evidence: "" + dependsOn: + - 0de465a6-55a7-4343-af79-948bb5ff10ba # Evaluation of the trust of used components + tags: + - none + Weak password test: + uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f + risk: Weak passwords in components like applications or systems, specially for + privileged accounts, lead to take over of that account. + measure: Automatic brute force attacks are performed. Specially the usage of + standard accounts like 'admin' and employee user-ids is recommended. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 1 + level: 3 + implementation: + - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 9.4.3 + iso27001-2022: + - 5.17 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Weak%20password%20test + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Load tests: + uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd + risk: As it is unknown how many requests the systems and applications can serve, + due to an unexpected load the availability is disturbed. + measure: Load test against the production system or a production near system + is performed. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 5 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - V-RT-AB-1 + iso27001-2017: + - 12.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.6 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Load%20tests + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test for unused Resources: + uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 + risk: Unused resources, specially secrets, might be still valid, but are exposing + information. As an attacker, I compromise a system, gather credentials and + try to use them. + measure: Test for unused resources helps to identify unused resources. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 5 + implementation: + - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Dynamic%20depth%20for%20infrastructure/subsection/Test%20for%20unused%20Resources + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Static depth for applications: + Software Composition Analysis (server side): + uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + description: Use a tool like trivy and concentrate on application related vulnerabilities. + At this stage, ignore vulnerabilities in container base images used in the + service. + risk: Server side components might have vulnerabilities. + measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) + are performed. + difficultyOfImplementation: + knowledge: 1 + time: 3 + resources: 1 + usefulness: 5 + level: 2 + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + references: + samm2: + - V-ST-A-2 + - I-SB-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Software%20Composition%20Analysis%20%28server%20side%29 + tags: + - vmm-testing + Test for Time to Patch: + uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f + risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities + in production artifacts. + measure: |- + Test of the Time to Patch (e.g. based on Mean Time to Close automatic PRs) + This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: + - auto-pr + - patching + url: https://dependabot.com/ + - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 + name: renovate + tags: + - auto-pr + - patching + url: https://github.com/renovatebot/renovate + dependsOn: + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Test%20for%20Time%20to%20Patch + comments: "" + meta: + implementationGuide: Usage of a version control platform API (e.g. github + API) can be used to fetch the information. Consider that `Measure libyears` + might be an alternative to this activity. + tags: + - patching + Test libyear: + uuid: 87b54313-fafd-4860-930f-5ef132b3e4ad + risk: Vulnerabilities in running artifacts stay for long and might get exploited. + measure: Test `libyear`, which provides a good insight how good patch management + is. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 2fff917f-205e-4eab-2e0e-1fab8c04bf33 + name: libyear + tags: + - patching + - build + url: https://libyear.com/ + description: A simple measure of software dependency freshness. It is a single + number telling you how up-to-date your dependencies are. + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Test%20libyear + comments: "" + meta: + implementationGuide: | + `libyear` can be integrated into the build process and flag or even better break the build in case the defined threshold (e.g. 30 years) is reached. + An alternative approach is to determine `libyear` based on deployed artifacts (which requires more effort in implementation). + tags: + - patching + API design validation: + uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 + risk: Creation of insecure or non-compliant API. + measure: | + Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP + and validate the specification using specific tools. + Checks should be integrated in IDEs and CI/CD pipelines. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.25 + - 8.27 + - 8.28 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/API%20design%20validation + isImplemented: false + dependsOn: + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + tags: + - none + Exploit likelihood estimation: + uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + risk: Without proper prioritization, organizations may waste time and effort + on low-risk vulnerabilities while neglecting critical ones. + measure: Estimate the likelihood of exploitation by using data (CISA KEV) from + the past or prediction models (e.g. Exploit Prediction Scoring System, EPSS). + description: Severity-based vulnerability triage alone generates a lot false + positives, requiring a more refined approach. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server side) + implementation: + - uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. + - uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will be + exploited. + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Exploit%20likelihood%20estimation + tags: + - none + Local development security checks performed: + uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b + risk: Creating and developing code contains code smells and quality issues. + measure: | + Integration of quality and linting plugins with interactive development environment (IDEs). + Implement pre-commit checks to prevent secrets & other security issues being commit to source code. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Local%20development%20security%20checks%20performed + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Software Composition Analysis (client side): + uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 + risk: Client side components might have vulnerabilities. + measure: Tests for known vulnerabilities in components via Software Composition + Analysis of the frontend are performed. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 3 + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + - f2f0f274-c1a0-4501-92fe-7fc4452bc8ad # Exploit likelihood estimation + implementation: + - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + references: + samm2: + - V-ST-A-2 + - I-SB-B-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Software%20Composition%20Analysis%20%28client%20side%29 + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Static analysis for important client side components: + uuid: e237176b-bec5-447d-a926-e37d6dd60e4b + risk: Important parts in the source code of the frontend have vulnerabilities. + measure: Usage of static analysis tools for important parts of the frontend + are used. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Static%20analysis%20for%20important%20client%20side%20components + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Static analysis for important server side components: + uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 + risk: Important parts in the source code of the middleware have vulnerabilities. + measure: Usage of static analysis tools for important parts of the middleware + are used. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Static%20analysis%20for%20important%20server%20side%20components + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test for Patch Deployment Time: + uuid: 0cb2c39a-3cec-4353-b3ab-8d70daf4c9d2 + risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities + in production artifacts. + measure: | + Test of the Patch Deployment Time. + This activity is not repeated in the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure as well. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - 8ae0b92c-10e0-4602-ba22-7524d6aed488 # Automated PRs for patches + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Test%20for%20Patch%20Deployment%20Time + comments: "" + meta: + implementationGuide: Self implementation. This activity is not repeated in + the Sub-Dimension "Static depth for infrastructure", but it applies to infrastructure + as well. + tags: + - patching + Static analysis for all self written components: + uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 + risk: Parts in the source code of the frontend or middleware have vulnerabilities. + measure: Usage of static analysis tools for all parts of the middleware and + frontend. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 4 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client side components + - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server side components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Static%20analysis%20for%20all%20self%20written%20components + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Usage of multiple analyzers: + uuid: 297be001-8d94-41ee-ab29-207020d423c0 + risk: Each vulnerability analyzer has different opportunities. By using just + one analyzer, some vulnerabilities might not be found. + measure: Usage of multiple static tools to find more vulnerabilities. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 1 + level: 4 + dependsOn: + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server side) + - 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 # Software Composition Analysis (client side) + - ee68331f-9b1d-4f61-844b-b2ea04753a84 # Static analysis for all self written components + implementation: [] + references: + samm2: + - V-ST-A-3 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Usage%20of%20multiple%20analyzers + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Dead code elimination: + uuid: a8d7d1f1-fc24-49ab-8fb6-f3a03da9c61d + risk: Dead code increases the attack surface (use of hard coded credentials + and variables, sensitive information) + measure: Collection of unused code and then manual removal of unused code. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Dead%20code%20elimination + comments: "" + tags: + - none + Exclusion of source code duplicates: + uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + risk: Duplicates in source code might influence the stability of the application. + measure: Automatic Detection and manual removal of duplicates in source code. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Exclusion%20of%20source%20code%20duplicates + comments: "" + tags: + - none + Static analysis for all components/libraries: + uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 + risk: Used components like libraries and legacy applications might have vulnerabilities + measure: Usage of a static analysis for all used components. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 + usefulness: 3 + level: 5 + dependsOn: + - e237176b-bec5-447d-a926-e37d6dd60e4b # Static analysis for important client side components + - 6c05c837-8c99-46e2-828b-7c903e27dba4 # Static analysis for important server side components + - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components + implementation: [] + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Static%20analysis%20for%20all%20components%2Flibraries + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Stylistic analysis: + uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 + risk: Unclear or obfuscated code might have unexpected behavior. + measure: Analysis of compliance to style guides of the source code ensures that + source code formatting rules are met (e.g. indentation, loops, ...). + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + - uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Stylistic%20analysis + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Static depth for infrastructure: + Test for stored secrets in build artifacts: + uuid: d5e6303c-d5c6-4d59-b258-a3b9de38a07f + risk: Stored secrets in container images or other build artifacts shouldn't + exists because they might be exposed to unauthorized parties. + measure: Test for secrets in container images and other artifacts + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20stored%20secrets%20in%20build%20artifacts + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test for stored secrets in code: + uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c + risk: Stored secrets in git history or directly in code shouldn't exists because + they might be exposed to unauthorized parties. + measure: Test for secrets in code and git history + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20stored%20secrets%20in%20code + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test cluster deployment resources: + uuid: 621fb6a5-5c0a-4408-826a-068868bb031b + risk: The deployment configuration (e.g. kubernetes deployment resources) might + contain unsecured configurations. + measure: Test the deployment configuration for virtualized environments for + unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20cluster%20deployment%20resources + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test for image lifetime: + uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b + risk: Old container images in production indicate that patch management is not + performed and therefore vulnerabilities might exists. + measure: Check the image age of containers in production. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 2 + level: 2 + implementation: + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20image%20lifetime + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test of virtualized environments: + uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 + risk: Virtualized environments (e.g. via Container Images) might contains + unsecure configurations. + measure: Test virtualized environments for unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20of%20virtualized%20environments + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test the cloud configuration: + uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc + risk: Standard hardening practices for cloud environments are not performed + leading to vulnerabilities. + measure: With the help of tools, the configuration of virtual environments are + tested. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20the%20cloud%20configuration + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test the definition of virtualized environments: + uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e + risk: The definition of virtualized environments (e.g. via Dockerfile) + might contain unsecure configurations. + measure: Test the definition of virtualized environments for unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + meta: + implementationGuide: For containier (images), test that the images are following + best practices like distroless or non-root. + implementation: + - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile and + looks for common traps, mistakes and helps enforce best practices. + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - System hardening, virtual environments are not explicitly covered by ISO + 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + - 14.2.1 + iso27001-2022: + - System hardening, virtual environments are not explicitly covered by ISO + 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20the%20definition%20of%20virtualized%20environments + isImplemented: false + tags: + - none + Test for malware: + uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d + risk: Third party might include malware. Ether due to the maintainer (e.g. + typo squatting of an image name and using the wrong image) or by an attacker + on behalf of the maintainer with stolen credentials. + measure: Check for malware in components (e.g. container images, VM baseline + images, libraries). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.2.1 + iso27001-2022: + - 8.7 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20malware + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test for new image version: + uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e + risk: When a new version of an image is available, it might fix security vulnerabilities. + measure: Check for new images of containers in production. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 2 + level: 3 + implementation: [] + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.5 + - 12.2.1 + iso27001-2022: + - 8.8 + - 8.7 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20for%20new%20image%20version + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Correlate known vulnerabilities in infrastructure with new image versions: + uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 + risk: TODO. + measure: TODO + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 4 + usefulness: 1 + level: 4 + dependsOn: + - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for images + implementation: + - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 12.6.1 + - 14.2.1 + iso27001-2022: + - 8.8 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Correlate%20known%20vulnerabilities%20in%20infrastructure%20with%20new%20image%20versions + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Software Composition Analysis: + uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad + risk: Known vulnerabilities in infrastructure components like container images + might get exploited. + measure: Check for known vulnerabilities + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 4 + level: 4 + description: Subscribing to Github projects and reading release notes might + help. Software Composition Analysis for infrastructure might help, but is + often too fine-granular. + implementation: + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track + description: | + Dependency-Track is an intelligent Component Analysis platform that allows organizations to identify and reduce risk in the software supply chain. Dependency-Track takes a unique and highly beneficial approach by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - inventory + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Software%20Composition%20Analysis + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test of infrastructure components for known vulnerabilities: + uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 + risk: Infrastructure components might have vulnerabilities. + measure: Test for known vulnerabilities in infrastructure components. Often, + the only way to respond to known vulnerabilities in operating system packages + is to accept the risk and wait for a patch. As the patch needs to be applied + fast when it is available, this activity depends on 'Usage of a maximum life + for images'. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 2 + usefulness: 1 + level: 4 + dependsOn: + - 485a3383-7f2e-4dba-bb84-479377070904 # Usage of a maximum lifetime for images + implementation: + - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 12.6.1 + - 14.2.1 + iso27001-2022: + - 8.8 + - 8.25 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Test%20of%20infrastructure%20components%20for%20known%20vulnerabilities + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Test-Intensity: + Default settings for intensity: + uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d + risk: Time pressure and ignorance might lead to false predictions for the test + intensity. + measure: The intensity of the used tools are not modified to save time. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 1 + implementation: [] + references: + samm2: + - V-ST-A-1 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Default%20settings%20for%20intensity + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Regular automated tests: + uuid: 598897a2-358e-441f-984c-e12ec4f6110a + risk: After pushing source code to the version control system, any delay in + receiving feedback on defects makes them harder for the developer to remediate. + measure: On each push and/or at given intervals automatic security tests are + performed. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 2 + implementation: [] + references: + samm2: + - I-SB-A-3 + - V-ST-A-3 + iso27001-2017: + - 14.2.3 + - 14.2.8 + - 14.2.9 + iso27001-2022: + - 8.32 + - 8.29 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Regular%20automated%20tests + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Deactivating of unneeded tests: + uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 + risk: As tools cover a wide range of different vulnerability tests, they might + not match the used components. Therefore, they need more time and resources + as they need and the feedback loops takes too much time. + measure: Unneeded tests are deactivated. For example in case the service is + using a Mongo database and no mysql database, the dynamic scan doesn't need + to test for sql injections. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 1 + level: 3 + implementation: [] + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Deactivating%20of%20unneeded%20tests + isImplemented: false + evidence: "" + comments: "" + tags: + - none + High test intensity: + uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 + risk: A too small intensity or a too high confidence might lead to not visible + vulnerabilities. + measure: A deep scan with high test intensity and a low confidence threshold + is performed. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/High%20test%20intensity + isImplemented: false + evidence: "" + comments: "" + tags: + - none + Creation and application of a testing concept: + uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe + risk: Scans might use a too small or too high test intensity. + measure: A testing concept considering the amount of time per scan/intensity + is created and applied. A dynamic analysis needs more time than a static analysis. + The dynamic scan, depending on the test intensity might be performed on every + commit, every night, every week or once in a month. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - V-ST-A-2 + iso27001-2017: + - 14.2.2 + - 14.2.3 + - 14.2.1 + - 14.2.5 + - 12.6.1 + iso27001-2022: + - 8.25 + - 8.32 + - 8.27 + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Creation%20and%20application%20of%20a%20testing%20concept + isImplemented: false + evidence: "" + comments: "" + tags: + - none +... From 6693c9e6cd2e1d27343fe98ee3e116af749a5114 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:32:58 +0100 Subject: [PATCH 173/370] feat!: new structure\n\nBREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml --- .github/workflows/main.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index 86595d1..cc64f89 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -66,7 +66,7 @@ jobs: - name: Commit all changed files back to the repository uses: planetscale/ghcommit-action@v0.1.6 with: - commit_message: "🤖 fmt" + commit_message: "🤖 push ${{ steps.get-version.outputs.version }}" repo: ${{ github.repository }} branch: ${{ github.head_ref || github.ref_name }} env: From 4fc201f9e7e6c8210670cad65d37d8b3d82b9c9c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:37:14 +0100 Subject: [PATCH 174/370] feat!: new structure BREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml --- CHANGELOG.md | 36 ------------------------------------ 1 file changed, 36 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 721c5c1..6a1b8f9 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,39 +1,3 @@ -## [1.23.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.23.0...v1.23.1) (2025-12-15) - - -### Bug Fixes - -* use correct GitHub repository context in workflow ([7493262](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/74932622e77448f48e5b17f1ffdb8cc312286e59)) - -# [1.23.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.22.0...v1.23.0) (2025-12-15) - - -### Features - -* new structure\n\nBREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml ([dff5ba4](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/dff5ba435305ea73ac731e7e28c52f1d1c495d6d)) - -# [1.22.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.2...v1.22.0) (2025-12-15) - - -### Bug Fixes - -* GIT_REPO includey ([0fe4f11](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/0fe4f11e02e177ec885b41df41b336c615477769)) - - -### Features - -* new structure\n\nBREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml ([02edcf5](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/02edcf582c0e102038eda2bf52603519a6ceea5a)) - -## [1.21.2](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.1...v1.21.2) (2025-12-15) - - -### Bug Fixes - -* new structure ([133646e](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/133646e2aa2f58faf926d96dbd665a3fc0ec41da)) - -## [1.21.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.21.0...v1.21.1) (2025-12-15) - - ### Bug Fixes * Modify YAML generation to include version placeholder ([37958b5](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/37958b54e20b80b4401980a28b07616c964f35d5)) From b645bdd7cc8b6ccc5a0368f28217941a213a479f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:40:57 +0100 Subject: [PATCH 175/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.24.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 10 ++++++++++ generated/model.yaml | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 6a1b8f9..33c973b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,13 @@ +# [1.24.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.23.1...v1.24.0) (2025-12-15) + + +* feat!: new structure ([4fc201f](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/4fc201f9e7e6c8210670cad65d37d8b3d82b9c9c)) + + +### BREAKING CHANGES + +* generated moved to root with model.yaml instead of generated.yaml + ### Bug Fixes * Modify YAML generation to include version placeholder ([37958b5](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/37958b54e20b80b4401980a28b07616c964f35d5)) diff --git a/generated/model.yaml b/generated/model.yaml index 1b70e91..15ba66a 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 1.23.1 + version: 1.24.0 released: "2025-12-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- From 2766a0ac2ced849735e5d63f351bc85d5137a0af Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:52:43 +0100 Subject: [PATCH 176/370] feat!: new structure BREAKING CHANGE: generated moved to root with model.yaml instead of generated.yaml --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 62f8c90..b8945b4 100644 --- a/Dockerfile +++ b/Dockerfile @@ -17,4 +17,5 @@ RUN cd /var/www/html/yaml-generation && composer install \ RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml RUN cd /var/www/html && GITHUB_REPOSITORY="${GITHUB_REPOSITORY}" php yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/${DSOMM_VERSION}/g" /var/www/html/generated/model.yaml workdir /var/www/html -CMD php yaml-generation/generateDimensions.php +CMD php yaml-generation/generateDimensions.ph + From 9ebb424226e643e23a694343aac1e58a87f5d34f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 15 Dec 2025 10:56:01 +0100 Subject: [PATCH 177/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 10 ++++++++++ generated/model.yaml | 2 +- 2 files changed, 11 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 33c973b..2f53751 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,13 @@ +# [1.25.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.24.0...v1.25.0) (2025-12-15) + + +* feat!: new structure ([2766a0a](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/2766a0ac2ced849735e5d63f351bc85d5137a0af)) + + +### BREAKING CHANGES + +* generated moved to root with model.yaml instead of generated.yaml + # [1.24.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.23.1...v1.24.0) (2025-12-15) diff --git a/generated/model.yaml b/generated/model.yaml index 15ba66a..e1959ec 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 1.24.0 + version: 1.25.0 released: "2025-12-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- From 30557e7057085c535532c9103d90444e2b08a8eb Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 16 Dec 2025 07:29:35 +0100 Subject: [PATCH 178/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index e1959ec..262bd10 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-15" + released: "2025-12-16" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From afacbad3bb08012bc380047b928ebdc2c571adf5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 17 Dec 2025 07:29:16 +0100 Subject: [PATCH 179/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 262bd10..248a317 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-16" + released: "2025-12-17" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 39b4a2555afc39514a086f019e7eef8d760e15c4 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 18 Dec 2025 07:29:25 +0100 Subject: [PATCH 180/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 248a317..26930cc 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-17" + released: "2025-12-18" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 8d8e2599eb650507172e16f046c756845e55958a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 19 Dec 2025 07:28:25 +0100 Subject: [PATCH 181/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 26930cc..eca9110 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-18" + released: "2025-12-19" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From aa7211b4e857d5d9f4634d8c5d31697ae63551e0 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Fri, 19 Dec 2025 10:02:00 +0100 Subject: [PATCH 182/370] Included feedback from PR. Added tags (scannig, sca, ...) --- src/assets/YAML/default/BuildAndDeployment/Build.yaml | 1 + src/assets/YAML/default/BuildAndDeployment/Deployment.yaml | 2 ++ .../YAML/default/BuildAndDeployment/PatchManagement.yaml | 2 +- src/assets/YAML/default/InformationGathering/Logging.yaml | 2 +- src/assets/YAML/default/TestAndVerification/Consolidation.yaml | 3 ++- .../TestAndVerification/StaticDepthForApplications.yaml | 2 ++ .../TestAndVerification/StaticDepthForInfrastructure.yaml | 1 + 7 files changed, 10 insertions(+), 3 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Build.yaml b/src/assets/YAML/default/BuildAndDeployment/Build.yaml index a423082..6f61666 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Build.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Build.yaml @@ -160,6 +160,7 @@ Build and Deployment: - 5.9 - 5.12 isImplemented: false + tags: ["inventory", "scanning", "sca"] evidence: "" comments: "" Signing of artifacts: diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 152979b..451abfc 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -241,6 +241,8 @@ Build and Deployment: tags: - inventory - sbom + - scanning + - sca Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f description: | diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index b5d098f..3f705a6 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -225,7 +225,7 @@ Build and Deployment: comments: "" tags: - patching - Automated merge of automated PRs: &automerge-PR + Automated merge of automated PRs: uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: |- Automated merges of automated created PRs for outdated dependencies. diff --git a/src/assets/YAML/default/InformationGathering/Logging.yaml b/src/assets/YAML/default/InformationGathering/Logging.yaml index a82d64e..a718b45 100755 --- a/src/assets/YAML/default/InformationGathering/Logging.yaml +++ b/src/assets/YAML/default/InformationGathering/Logging.yaml @@ -37,7 +37,7 @@ Information Gathering: Locally stored system logs can be manipulated by attackers unauthorized or might be corrupt or lost after an incident. In addition, it is hard to perform aggregation of logs. measure: | - Implement a centralized logging solution for all critical systems. - - System logs must be securely transmitted and stored in a central repository, protected from unauthorized access and modification. + - System logs must be stored in a central repository, protected from unauthorized access and modification. - Ensure that log collection is automated and covers all relevant system events. level: 1 difficultyOfImplementation: diff --git a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml index 2892e1f..c012cca 100755 --- a/src/assets/YAML/default/TestAndVerification/Consolidation.yaml +++ b/src/assets/YAML/default/TestAndVerification/Consolidation.yaml @@ -180,6 +180,7 @@ Test and Verification: - Not explicitly covered by ISO 27001 - too specific - 5.27 isImplemented: false + tags: ["false-positive", "defect-management", "scanning", "sca", "sats", "dast"] evidence: "" comments: "" Artifact-based false positive treatment: @@ -221,7 +222,7 @@ Test and Verification: iso27001-2022: - 5.25 - 5.27 - tags: ["false-positive", "defect-management"] + tags: ["false-positive", "defect-management", "scanning", "sca", "sats", "dast"] Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml index 5a375bc..21a7637 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForApplications.yaml @@ -379,6 +379,7 @@ Test and Verification: iso27001-2022: - 8.8 isImplemented: false + tags: ["defect-management", "sca"] evidence: "" comments: "" Software Composition Analysis (server side): @@ -414,6 +415,7 @@ Test and Verification: - 8.8 tags: - vmm-testing + tags: ["false-positive", "defect-management", "scanning", "sca", "sats", "dast"] Usage of multiple analyzers: uuid: 297be001-8d94-41ee-ab29-207020d423c0 risk: diff --git a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml index c0d569d..47e6d25 100755 --- a/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml +++ b/src/assets/YAML/default/TestAndVerification/StaticDepthForInfrastructure.yaml @@ -53,6 +53,7 @@ Test and Verification: iso27001-2022: - 8.8 isImplemented: false + tags: ["scanning", "sca"] evidence: "" comments: "" Test for malware: From f098fbc52b664470034c06b8006b923db815a2ad Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Fri, 19 Dec 2025 10:46:59 +0100 Subject: [PATCH 183/370] Revert wrong delete --- .../YAML/default/BuildAndDeployment/PatchManagement.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml index 3f705a6..3360754 100755 --- a/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml @@ -225,7 +225,7 @@ Build and Deployment: comments: "" tags: - patching - Automated merge of automated PRs: + Automated merge of automated PRs: &automerge-PR uuid: f2594f8f-1cd6-45f9-af29-eaf3315698eb description: |- Automated merges of automated created PRs for outdated dependencies. @@ -256,7 +256,7 @@ Build and Deployment: comments: "" tags: - patching - Automated deployment of automated PRs: + Automated deployment of automated PRs: &automerge-PR uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d <<: *automerge-PR risk: From acfb6c2ea4487d91390306ecfe687420c029e4ea Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 20 Dec 2025 07:26:55 +0100 Subject: [PATCH 184/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index eca9110..44ed66f 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-19" + released: "2025-12-20" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 956e2658e83a98cb9d7a007c6a8ee8c3500ef04b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 21 Dec 2025 07:26:34 +0100 Subject: [PATCH 185/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 44ed66f..f07cc76 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-20" + released: "2025-12-21" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 02f7eac1435aa3392fa26825d78af881133d0b0d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 22 Dec 2025 07:30:53 +0100 Subject: [PATCH 186/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f07cc76..2747999 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-21" + released: "2025-12-22" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 67ae84e536abf83f4cf8ea54a24ba6c706e2d21e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 23 Dec 2025 07:29:49 +0100 Subject: [PATCH 187/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 2747999..e15e8ac 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-22" + released: "2025-12-23" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d1871a0edf45bf18833c3006e013b8ea77a88084 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 24 Dec 2025 07:29:49 +0100 Subject: [PATCH 188/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index e15e8ac..8065cac 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-23" + released: "2025-12-24" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From b4e9151e67e65f77aebc9504f0ab6e4d4950e218 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 25 Dec 2025 07:29:26 +0100 Subject: [PATCH 189/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 8065cac..b90632f 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-24" + released: "2025-12-25" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d5c34f65ba62ba0d300cc3bda44e870fcdb5d3f9 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 26 Dec 2025 07:28:44 +0100 Subject: [PATCH 190/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index b90632f..4c62aa4 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-25" + released: "2025-12-26" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d6752928f2c4942438d01da026052865bb35b6a0 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 27 Dec 2025 07:27:04 +0100 Subject: [PATCH 191/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4c62aa4..88132f6 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-26" + released: "2025-12-27" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From e7ff99a03705a104e1683e47d842d54dfb34b7a2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 28 Dec 2025 07:27:24 +0100 Subject: [PATCH 192/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 88132f6..bb99ded 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-27" + released: "2025-12-28" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 64ac92183d9ed421127fcff10a30efcffac893b4 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 30 Dec 2025 07:29:19 +0100 Subject: [PATCH 193/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index bb99ded..af37ccc 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-28" + released: "2025-12-30" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 7cdc2a63ca204748fbc3eadee9b0af5eb5e28062 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 31 Dec 2025 07:30:01 +0100 Subject: [PATCH 194/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index af37ccc..22ce4b6 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-30" + released: "2025-12-31" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 34ee2adcc58a9e67ca3569dc2ceaa5a279640efa Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 1 Jan 2026 07:29:35 +0100 Subject: [PATCH 195/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 22ce4b6..a9563a7 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2025-12-31" + released: "2026-01-01" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c9bc57a9648b5639700c728abeb880c09acc411a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 2 Jan 2026 07:29:57 +0100 Subject: [PATCH 196/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index a9563a7..ad1e245 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2026-01-01" + released: "2026-01-02" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 62175d749225c3201db8763bb3e55502941f0b07 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 3 Jan 2026 07:27:30 +0100 Subject: [PATCH 197/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index ad1e245..1715309 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2026-01-02" + released: "2026-01-03" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 42fb635e0f0bc51c657ca1d96d782504d384d8c8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 4 Jan 2026 07:28:10 +0100 Subject: [PATCH 198/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.25.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 1715309..c9a1c5e 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 1.25.0 - released: "2026-01-03" + released: "2026-01-04" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From b9eef67f450590e89d7b8763e453a712fb954075 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 5 Jan 2026 09:24:42 +0100 Subject: [PATCH 199/370] fix\!: build MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit BREAKING CHANGE: Updated Docker build process and YAML generation structure 🤖 Generated with [Claude Code](https://claude.ai/code) Co-Authored-By: Claude --- Dockerfile | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/Dockerfile b/Dockerfile index a5be9e1..497af18 100644 --- a/Dockerfile +++ b/Dockerfile @@ -10,6 +10,6 @@ RUN cd /var/www/html/yaml-generation && composer install \ --prefer-dist RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml -RUN cd /var/www/html && php yaml-generation/generateDimensions.php -workdir /var/www/html -CMD php yaml-generation/generateDimensions.php +RUN cd /var/www/html && mkdir /var/www/html/generated && php /var/www/html/yaml-generation/generateDimensions.php +WORKDIR /var/www/html +CMD [ "php", "yaml-generation/generateDimensions.php" ] From fd323ebfd1ef5483006ae2577e8d5742607aa7eb Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 5 Jan 2026 09:28:38 +0100 Subject: [PATCH 200/370] fix: generated folder --- Dockerfile | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index d726c80..acd540f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -15,7 +15,7 @@ RUN cd /var/www/html/yaml-generation && composer install \ --prefer-dist RUN pecl channel-update pecl.php.net && pecl install yaml && docker-php-ext-enable yaml -RUN cd /var/www/html && mkdir /var/www/html/generated && GITHUB_REPOSITORY="${GITHUB_REPOSITORY}" php /var/www/html/yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/${DSOMM_VERSION}/g" /var/www/html/generated/model.yaml +RUN cd /var/www/html && GITHUB_REPOSITORY="${GITHUB_REPOSITORY}" php /var/www/html/yaml-generation/generateDimensions.php && sed -i "s/__VERSION_PLACEHOLDER__/${DSOMM_VERSION}/g" /var/www/html/generated/model.yaml WORKDIR /var/www/html -CMD [ "php", "yaml-generation/generateDimensions.php" ] \ No newline at end of file +CMD [ "php", "yaml-generation/generateDimensions.php" ] From edf0fb7239153c11efbcb1638fcad6b96d7257ea Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 5 Jan 2026 09:32:21 +0100 Subject: [PATCH 201/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.26.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 19 +++++++++++++++++++ generated/model.yaml | 4 ++-- 2 files changed, 21 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 2f53751..cb3014b 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,22 @@ +# [1.26.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.25.0...v1.26.0) (2026-01-05) + + +* fix\!: build ([b9eef67](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/b9eef67f450590e89d7b8763e453a712fb954075)) + + +### Bug Fixes + +* generated folder ([fd323eb](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/fd323ebfd1ef5483006ae2577e8d5742607aa7eb)) + + +### BREAKING CHANGES + +* Updated Docker build process and YAML generation structure + +🤖 Generated with [Claude Code](https://claude.ai/code) + +Co-Authored-By: Claude + # [1.25.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.24.0...v1.25.0) (2025-12-15) diff --git a/generated/model.yaml b/generated/model.yaml index c9a1c5e..f5ef01c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: - version: 1.25.0 - released: "2026-01-04" + version: 1.26.0 + released: "2026-01-05" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 713322d6c92e61d25e5f2f9406e863efe6eb8093 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 5 Jan 2026 09:54:58 +0100 Subject: [PATCH 202/370] Update CHANGELOG.md --- CHANGELOG.md | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/CHANGELOG.md b/CHANGELOG.md index cb3014b..5af78d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,13 @@ +# [4.0.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.25.0...v1.26.0) (2026-01-05) + + +* enhance version number to 4 + + +### Bug Fixes + +* generated folder ([fd323eb](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/fd323ebfd1ef5483006ae2577e8d5742607aa7eb)) + # [1.26.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.25.0...v1.26.0) (2026-01-05) From 0ae3b4f77f068642fb6b4440814b81427d683712 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 5 Jan 2026 09:58:17 +0100 Subject: [PATCH 203/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f5ef01c..988ac6d 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 1.26.0 + version: 4.0.0 released: "2026-01-05" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- From fffeae5153c283050f08128752c22fcbe367e7ff Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 6 Jan 2026 07:30:20 +0100 Subject: [PATCH 204/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 988ac6d..b4e72f4 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-05" + released: "2026-01-06" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 013abf5405abe2b7ac4dd41a3afbc65d927a9407 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 7 Jan 2026 07:30:24 +0100 Subject: [PATCH 205/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index b4e72f4..31d750e 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-06" + released: "2026-01-07" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 6f70d116ad2d9e224ac4761c00f2be685e3b5ae0 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 8 Jan 2026 07:30:39 +0100 Subject: [PATCH 206/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 31d750e..de45930 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-07" + released: "2026-01-08" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From cc8b7cb834e511a5be0011fbd19922d9048b80f0 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 9 Jan 2026 07:30:22 +0100 Subject: [PATCH 207/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index de45930..861491c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-08" + released: "2026-01-09" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From f47d7ce5ad90d5489d7389f3ac017122c44a547c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 10 Jan 2026 07:27:04 +0100 Subject: [PATCH 208/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 861491c..86c6fdf 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-09" + released: "2026-01-10" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 7aebfcf63d06ab5226564dd1b45b61abba30aa0a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 11 Jan 2026 07:27:56 +0100 Subject: [PATCH 209/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 86c6fdf..2fdda3c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-10" + released: "2026-01-11" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From a23b0ec348e8867a2da1faa7d0483f6118231d95 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 12 Jan 2026 07:32:47 +0100 Subject: [PATCH 210/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 2fdda3c..8f2ef7e 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-11" + released: "2026-01-12" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From e897a291ca76060c179835249f58540da940c6c3 Mon Sep 17 00:00:00 2001 From: Stephen Paulger Date: Mon, 12 Jan 2026 10:31:24 +0000 Subject: [PATCH 211/370] Replace broken sonarqube like --- src/assets/YAML/default/implementations.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 3354fe0..d0e8303 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -752,7 +752,7 @@ implementations: sonarqube: uuid: aa5ded61-5380-4da6-9474-afc36a397682 name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + url: https://medium.com/@elenavilchik/in-depth-linting-of-your-typescript-while-coding-1d084affbf0 tags: [ide, linting] stylecop: uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe From 796815179581fd68bf2b182150254fcbc7fb58cb Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 12 Jan 2026 12:49:36 +0100 Subject: [PATCH 212/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/generated/model.yaml b/generated/model.yaml index 8f2ef7e..3ac84af 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -3140,7 +3140,7 @@ Implementation: - linting - uuid: aa5ded61-5380-4da6-9474-afc36a397682 name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + url: https://medium.com/@elenavilchik/in-depth-linting-of-your-typescript-while-coding-1d084affbf0 tags: - ide - linting @@ -7472,7 +7472,7 @@ Test and Verification: - linting - uuid: aa5ded61-5380-4da6-9474-afc36a397682 name: In-Depth Linting of Your TypeScript While Coding - url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + url: https://medium.com/@elenavilchik/in-depth-linting-of-your-typescript-while-coding-1d084affbf0 tags: - ide - linting From 1f95f924aca637245a897692f583bdd2e0cb081d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 13 Jan 2026 07:29:59 +0100 Subject: [PATCH 213/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 3ac84af..b89f1a9 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-12" + released: "2026-01-13" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 0f144cdc4325bcc9662c67eb64cb6f1610607890 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 14 Jan 2026 07:30:02 +0100 Subject: [PATCH 214/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index b89f1a9..12b1bf8 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-13" + released: "2026-01-14" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 6526c5d1e6a6586dfd0004cefa01be5b4f9cd259 Mon Sep 17 00:00:00 2001 From: Vegard Bakke Date: Wed, 14 Jan 2026 21:59:49 +0100 Subject: [PATCH 215/370] Update Simple access control --- .../default/Implementation/InfrastructureHardening.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 071a863..6d789b5 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -336,10 +336,12 @@ Implementation: comments: "" Simple access control for systems: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 - risk: Attackers a gaining access to internal systems and application interfaces + description: Basic access control for internal systems is implemented. + risk: Attackers a gaining access to other internal systems and application interfaces is one breach occurs. measure: All internal systems are using simple authentication assessment: | - - Demonstrate that every team member has appropriate access (least privilege). + - Presenting the documentation of the review of all user privileges yearly. + - Presenting the admin count and validating that there are less than 5 admins per system. difficultyOfImplementation: knowledge: 3 time: 3 From d90e8fadc4676e2baa32411e01b38badb645347c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Jan 2026 07:29:45 +0100 Subject: [PATCH 216/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 12b1bf8..305d6d4 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.0.0 - released: "2026-01-14" + released: "2026-01-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 28e5ccae5b83b947bf4006214089afc4335c08ac Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Jan 2026 08:26:48 +0100 Subject: [PATCH 217/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.0.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/dependency-tree.md | 439 +++++++++--------- generated/model.yaml | 867 +++++++++++++++++++++++------------ 2 files changed, 785 insertions(+), 521 deletions(-) diff --git a/generated/dependency-tree.md b/generated/dependency-tree.md index 0cd12d6..8c75351 100644 --- a/generated/dependency-tree.md +++ b/generated/dependency-tree.md @@ -10,39 +10,39 @@ graph LR 2(L2 SBOM of components) 3(L3 Signing of code) 4(L5 Signing of artifacts) -5(L1 Defined deployment process) -6(L1 Inventory of production components) -7(L2 Inventory of production artifacts) -8(L3 Handover of confidential parameters) -9(L2 Environment depending configuration parameters secrets) -10(L3 Inventory of production dependencies) -11(L3 Rolling update on deployment) -12(L4 Same artifact for environments) -13(L4 Usage of feature toggles) -14(L5 Blue/Green Deployment) -15(L4 Smoke Test) -16(L2 Automated merge of automated PRs) -17(L1 Automated PRs for patches) -18(L3 Automated deployment of automated PRs) -19(L3 Creation of simple abuse stories) -20(L1 Conduction of simple threat modeling on technical level) -21(L3 Creation of threat modeling processes and standards) -22(L4 Conduction of advanced threat modeling) -23(L5 Creation of advanced abuse stories) -24(L2 Regular security training of security champions) -25(L2 Each team has a security champion) -26(L2 Determining the protection requirement) -27(L2 App. Hardening Level 1) -28(L1 App. Hardening Level 1 50%) -29(L3 App. Hardening Level 2 75%) -30(L4 App. Hardening Level 2) -31(L5 App. Hardening Level 3) -32(L1 Versioning) -33(L3 Block force pushes) -34(L2 Require a PR before merging) -35(L3 Dismiss stale PR approvals) -36(L3 Require status checks to pass) -37(L1 Simple access control for systems) +5(L1 Automated deployment process) +6(L1 Defined deployment process) +7(L1 Version control) +8(L1 Inventory of production components) +9(L2 Inventory of production artifacts) +10(L3 Handover of confidential parameters) +11(L2 Environment depending configuration parameters secrets) +12(L3 Inventory of production dependencies) +13(L3 Rolling update on deployment) +14(L4 Same artifact for environments) +15(L4 Usage of feature toggles) +16(L5 Blue/Green Deployment) +17(L4 Smoke Test) +18(L2 Automated merge of automated PRs) +19(L1 Automated PRs for patches) +20(L3 Automated deployment of automated PRs) +21(L3 Creation of simple abuse stories) +22(L1 Conduction of simple threat modeling on technical level) +23(L3 Creation of threat modeling processes and standards) +24(L4 Conduction of advanced threat modeling) +25(L5 Creation of advanced abuse stories) +26(L2 Regular security training of security champions) +27(L2 Each team has a security champion) +28(L2 Determining the protection requirement) +29(L2 App. Hardening Level 1) +30(L1 App. Hardening Level 1 50%) +31(L3 App. Hardening Level 2 75%) +32(L4 App. Hardening Level 2) +33(L5 App. Hardening Level 3) +34(L3 Block force pushes) +35(L2 Require a PR before merging) +36(L3 Dismiss stale PR approvals) +37(L3 Require status checks to pass) 38(L2 Backup) 39(L2 MFA) 40(L1 MFA for admins) @@ -53,72 +53,71 @@ graph LR 45(L3 Infrastructure as Code) 46(L3 Limitation of system events) 47(L3 Audit of system events) -48(L3 Role based authentication and authorization) -49(L3 Usage of security by default for components) -50(L3 WAF baseline) -51(L1 Context-aware output encoding) -52(L4 Production near environments are used by developers) -53(L4 WAF medium) -54(L5 WAF Advanced) -55(L2 Centralized application logging) -56(L2 Alerting) -57(L3 Visualized logging) -58(L1 Centralized system logging) -59(L5 Correlation of security events) -60(L2 Visualized metrics) -61(L2 Monitoring of costs) -62(L1 Simple application metrics) -63(L1 Simple system metrics) -64(L3 Advanced availability and stability metrics) -65(L3 Deactivation of unused metrics) -66(L3 Targeted alerting) -67(L4 Advanced app. metrics) -68(L4 Coverage and control metrics) -69(L4 Defense metrics) -70(L3 Filter outgoing traffic) -71(L4 Screens with metric visualization) -72(L3 Grouping of metrics) -73(L5 Metrics are combined with tests) -74(L2 Patching mean time to resolution via PR) -75(L3 Generation of response statistics) -76(L3 Usage of a vulnerability management system) -77(L4 Patching mean time to resolution via production) -78(L2 Artifact-based false positive treatment) -79(L1 Simple false positive treatment) -80(L3 Fix based on accessibility) -81(L1 Treatment of defects with severity high or higher) -82(L3 Global false positive treatment) -83(L3 Exploit likelihood estimation) -84(L3 Office Hours) -85(L2 Coverage of client side dynamic components) -86(L2 Usage of different roles) -87(L2 Simple Scan) -88(L3 Coverage of hidden endpoints) -89(L3 Coverage of more input vectors) -90(L3 Coverage of sequential operations) -91(L4 Usage of multiple scanners) -92(L5 Coverage of service to service communication) -93(L2 Test for exposed services) -94(L2 Isolated networks for virtual environments) -95(L2 Test network segmentation) -96(L3 Test for unauthorized installation) -97(L2 Evaluation of the trust of used components) -98(L2 Software Composition Analysis server side) -99(L2 Test for Time to Patch) -100(L2 Test libyear) -101(L3 API design validation) -102(L3 Software Composition Analysis client side) -103(L3 Static analysis for important client side components) -104(L3 Static analysis for important server side components) -105(L3 Test for Patch Deployment Time) -106(L4 Static analysis for all self written components) -107(L4 Usage of multiple analyzers) -108(L5 Dead code elimination) -109(L5 Exclusion of source code duplicates) -110(L5 Static analysis for all components/libraries) -111(L4 Correlate known vulnerabilities in infrastructure with new image versions) -112(L2 Usage of a maximum lifetime for images) -113(L4 Test of infrastructure components for known vulnerabilities) +48(L3 Usage of security by default for components) +49(L3 WAF baseline) +50(L1 Context-aware output encoding) +51(L4 Production near environments are used by developers) +52(L4 WAF medium) +53(L5 WAF Advanced) +54(L2 Centralized application logging) +55(L2 Alerting) +56(L3 Visualized logging) +57(L1 Centralized system logging) +58(L5 Correlation of security events) +59(L2 Visualized metrics) +60(L2 Monitoring of costs) +61(L1 Simple application metrics) +62(L1 Simple system metrics) +63(L3 Advanced availability and stability metrics) +64(L3 Deactivation of unused metrics) +65(L3 Targeted alerting) +66(L4 Advanced app. metrics) +67(L4 Coverage and control metrics) +68(L4 Defense metrics) +69(L3 Filter outgoing traffic) +70(L4 Screens with metric visualization) +71(L3 Grouping of metrics) +72(L5 Metrics are combined with tests) +73(L2 Patching mean time to resolution via PR) +74(L3 Generation of response statistics) +75(L3 Usage of a vulnerability management system) +76(L4 Patching mean time to resolution via production) +77(L2 Artifact-based false positive treatment) +78(L1 Simple false positive treatment) +79(L3 Fix based on accessibility) +80(L1 Treatment of defects with high or critical severity) +81(L3 Global false positive treatment) +82(L2 Exploit likelihood estimation) +83(L3 Office Hours) +84(L2 Coverage of client side dynamic components) +85(L2 Usage of different roles) +86(L2 Simple Scan) +87(L3 Coverage of hidden endpoints) +88(L3 Coverage of more input vectors) +89(L3 Coverage of sequential operations) +90(L4 Usage of multiple scanners) +91(L5 Coverage of service to service communication) +92(L2 Test for exposed services) +93(L2 Isolated networks for virtual environments) +94(L2 Test network segmentation) +95(L3 Test for unauthorized installation) +96(L2 Evaluation of the trust of used components) +97(L2 Software Composition Analysis server side) +98(L2 Test for Time to Patch) +99(L2 Test libyear) +100(L3 API design validation) +101(L3 Software Composition Analysis client side) +102(L3 Static analysis for important client side components) +103(L3 Static analysis for important server side components) +104(L3 Test for Patch Deployment Time) +105(L4 Static analysis for all self written components) +106(L4 Usage of multiple analyzers) +107(L5 Dead code elimination) +108(L5 Exclusion of source code duplicates) +109(L5 Static analysis for all components/libraries) +110(L4 Correlate known vulnerabilities in infrastructure with new image versions) +111(L2 Usage of a maximum lifetime for images) +112(L4 Test of infrastructure components for known vulnerabilities) 1 --> 0 @@ -126,145 +125,145 @@ graph LR 1 --> 3 1 --> 4 1 --> 5 -1 --> 12 +1 --> 6 +1 --> 14 1 --> 48 -1 --> 49 -1 --> 87 -1 --> 98 -1 --> 100 +1 --> 86 +1 --> 97 +1 --> 99 +1 --> 101 1 --> 102 1 --> 103 1 --> 104 -1 --> 105 +1 --> 107 1 --> 108 -1 --> 109 0 --> 4 -5 --> 6 -5 --> 7 -5 --> 11 -5 --> 32 -5 --> 37 -5 --> 38 -5 --> 41 -5 --> 48 -5 --> 52 -5 --> 15 -6 --> 7 -6 --> 26 -6 --> 80 -6 --> 98 -6 --> 101 -6 --> 102 -6 --> 103 -6 --> 104 -6 --> 106 -6 --> 110 -9 --> 8 -7 --> 10 -2 --> 10 -12 --> 13 -15 --> 14 +6 --> 5 +6 --> 38 +6 --> 41 +7 --> 6 +5 --> 8 +5 --> 9 +5 --> 13 +5 --> 51 +5 --> 17 +8 --> 9 +8 --> 28 +8 --> 79 +8 --> 97 +8 --> 100 +8 --> 101 +8 --> 102 +8 --> 103 +8 --> 105 +8 --> 109 +11 --> 10 +9 --> 12 +2 --> 12 +14 --> 15 17 --> 16 -17 --> 74 -17 --> 77 -17 --> 99 -17 --> 105 -16 --> 18 -20 --> 19 -20 --> 21 -20 --> 22 -21 --> 19 -21 --> 22 -19 --> 23 -25 --> 24 -25 --> 76 -28 --> 27 -27 --> 29 -29 --> 30 -30 --> 31 -34 --> 33 -34 --> 35 -34 --> 36 +19 --> 18 +19 --> 73 +19 --> 76 +19 --> 98 +19 --> 104 +18 --> 20 +22 --> 21 +22 --> 23 +22 --> 24 +23 --> 21 +23 --> 24 +21 --> 25 +27 --> 26 +27 --> 75 +30 --> 29 +29 --> 31 +31 --> 32 +32 --> 33 +35 --> 34 +35 --> 36 +35 --> 37 40 --> 39 43 --> 42 45 --> 44 -45 --> 52 +45 --> 51 47 --> 46 -51 --> 50 -50 --> 53 -53 --> 54 -56 --> 55 -56 --> 59 -56 --> 66 -58 --> 57 -55 --> 57 -57 --> 59 -60 --> 56 -60 --> 64 -60 --> 47 -60 --> 65 -60 --> 67 -60 --> 68 -60 --> 69 -62 --> 61 +50 --> 49 +49 --> 52 +52 --> 53 +55 --> 54 +55 --> 58 +55 --> 65 +57 --> 56 +54 --> 56 +56 --> 58 +59 --> 55 +59 --> 63 +59 --> 47 +59 --> 64 +59 --> 66 +59 --> 67 +59 --> 68 +61 --> 60 +61 --> 59 +61 --> 63 +61 --> 66 62 --> 60 -62 --> 64 -62 --> 67 -63 --> 61 -63 --> 60 -70 --> 69 -72 --> 71 -72 --> 73 -76 --> 75 -76 --> 82 -74 --> 77 -79 --> 78 -81 --> 80 -78 --> 82 -83 --> 76 -83 --> 102 -84 --> 76 +62 --> 59 +69 --> 68 +71 --> 70 +71 --> 72 +75 --> 74 +75 --> 81 +73 --> 76 +78 --> 77 +80 --> 79 +77 --> 81 +82 --> 75 +82 --> 101 +83 --> 75 +85 --> 84 +85 --> 87 +85 --> 88 +85 --> 89 +85 --> 90 86 --> 85 -86 --> 88 -86 --> 89 -86 --> 90 86 --> 91 -87 --> 86 -87 --> 92 -94 --> 93 -94 --> 95 -97 --> 96 -98 --> 83 -98 --> 107 -103 --> 106 -103 --> 110 -104 --> 106 -104 --> 110 -102 --> 107 -106 --> 107 -112 --> 111 -112 --> 113 +93 --> 92 +93 --> 94 +96 --> 95 +97 --> 82 +97 --> 106 +102 --> 105 +102 --> 109 +103 --> 105 +103 --> 109 +101 --> 106 +105 --> 106 +111 --> 110 +111 --> 112 O --> 1 -O --> 9 -O --> 17 -O --> 20 -O --> 25 -O --> 28 -O --> 34 +O --> 7 +O --> 11 +O --> 19 +O --> 22 +O --> 27 +O --> 30 +O --> 35 O --> 40 O --> 43 O --> 45 -O --> 51 -O --> 58 +O --> 50 +O --> 57 +O --> 61 O --> 62 -O --> 63 -O --> 70 -O --> 72 -O --> 79 -O --> 81 -O --> 84 -O --> 94 -O --> 97 -O --> 112 +O --> 69 +O --> 71 +O --> 78 +O --> 80 +O --> 83 +O --> 93 +O --> 96 +O --> 111 ``` diff --git a/generated/model.yaml b/generated/model.yaml index 305d6d4..63f2f22 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -8,28 +8,41 @@ Build and Deployment: Build: Defined build process: uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b - description: "A *build process* include more than just compiling your source - code. \nIt also includes steps such as managing (third party) dependencies, - \nenvironment configuration, running the unit tests, etc. \n\nA *defined build - process* has automated these steps to ensure consistency.\n\nThis can be done - with a Jenkinsfile, Maven, or similar tools.\n" - risk: Performing builds without a defined process is error prone; for example, - as a result of incorrect security related configuration. - measure: A well defined build process lowers the possibility of errors during - the build process. + description: | + A *build process* includes more than just compiling your source code. It also covers: + - Managing (third party) dependencies + - Environment configuration + - Running unit and integration tests + - Security scanning and compliance checks + - Artifact creation and storage + - Deployment preparation + + Basing the build process on human memory may lead to inconsistencies and security misconfigurations. + + A *defined build process* can automate these steps to ensure consistency, avoiding accidental omissions or misconfigurations. Use tools such as Jenkins, GitHub Actions, GitLab CI, or Maven to codify the process. + + A simplified, but still a *defined build process*, may be a checklist of the steps to be performed. + risk: Without a defined and automated build process the risk increase for accidental + mistakes, forgetting test activities, and insecure misconfigurations. + measure: Find a tool that suits your environment. Add your manual build steps, + include steps for running tests, scanning and preparation for deployment. + assessment: | + - Show your build pipeline configuration (e.g., Jenkinsfile, GitHub Actions workflow) and an exemplary job (build + test + security scan). + level: 1 difficultyOfImplementation: knowledge: 2 time: 3 resources: 2 usefulness: 4 - level: 1 - assessment: | - - Show your build pipeline and an exemplary job (build + test). - - Show that every team member has access. - - Show that failed jobs are fixed. - - Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) implementation: + - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + - uuid: eb6de6b9-e060-4902-ae6f-604ffc386b63 + name: Maven + tags: [] + url: https://maven.apache.org/ - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 name: CI/CD tools tags: @@ -179,7 +192,17 @@ Build and Deployment: resources: 3 usefulness: 3 level: 2 - implementation: [] + implementation: + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: Trivy + tags: [] + url: https://github.com/aquasecurity/trivy + - uuid: 7543a6f2-3850-47a9-bb2f-0987e2af6f6a + name: Syft + tags: + - sbom + - dependency + url: https://github.com/anchore/syft references: samm2: - I-SB-B-1 @@ -193,10 +216,12 @@ Build and Deployment: openCRE: - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Build/subsection/SBOM%20of%20components isImplemented: false + tags: + - inventory + - scanning + - sca evidence: "" comments: "" - tags: - - none Signing of code: uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 risk: Execution or usage of malicious code or data e.g. via executables, libraries @@ -220,7 +245,7 @@ Build and Deployment: name: Enforcement of commit signing tags: - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule description: Usage of branch protection rules dependsOn: - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process @@ -290,20 +315,27 @@ Build and Deployment: tags: - none Deployment: - Defined deployment process: - uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a - risk: Deployment of insecure or malfunctioning artifacts. - measure: Defining a deployment process ensures that there are established criteria - in terms of functionalities, security, compliance, and performance, and that - the artifacts meet them. + Automated deployment process: + uuid: 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 + description: | + An *automated deployment process* implements the defined deployment steps using automation tools, ensuring consistency, auditability, and minimizing the risk of human errors or unauthorized changes. + risk: Deployments relying on manual routines increase the risk of errors, insecure + configurations, or deploying malfunctioning artifacts. + measure: Automating the deployment process enforces predefined criteria for + security, compliance, and performance, ensuring reliable artifact delivery. + assessment: | + - Deployment process is documented and available to relevant staff + - All deployment steps are automated + - Provide audit logs or evidence of deployments + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 - resources: 1 + resources: 2 usefulness: 4 - level: 1 dependsOn: - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 name: CI/CD tools @@ -311,10 +343,48 @@ Build and Deployment: - ci-cd url: https://martinfowler.com/articles/continuousIntegration.html description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba name: Docker url: https://github.com/moby/moby tags: [] + references: + samm2: + - I-SD-A-1 + iso27001-2017: + - 12.1.1 + - 14.2.2 + iso27001-2022: + - 5.37 + - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Automated%20deployment%20process + tags: + - none + Defined deployment process: + uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a + description: | + A *defined deployment process* is a documented and standardized procedure for releasing software into production, ensuring consistency and reducing the risk of errors. + risk: Deployments relying on human memory are prone to errors, making experienced + long-ter staff critical. + measure: Establish a written deployment process documented in README files, + wikis, or implemented as executable scripts and automated steps. + assessment: | + - Deployment process is documented and available to relevant staff + - Logs of deployments are documented and availabe to relevant staff + level: 1 + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + dependsOn: + - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process + - 066084c6-1135-4635-9cc5-9e75c7c5459f # Version control + implementation: ~ references: samm2: - I-SD-A-1 @@ -326,26 +396,28 @@ Build and Deployment: - 8.32 openCRE: - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Defined%20deployment%20process - isImplemented: false - evidence: "" - comments: "" tags: - none Inventory of production components: uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f + description: | + An inventory of production components is a complete, up-to-date list of all applications running in production. This enables effective vulnerability management, incident response, and compliance. Without it, organizations risk running unmaintained or unauthorized software. risk: An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it. measure: |- A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production. In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track. + assessment: | + - Inventory of all production applications with application name, owner, and date of last review + - Inventory is accessible to development, security and operations teams dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 4 - level: 1 implementation: - uuid: 2210e02b-a856-4da4-8732-5acd77e20fca name: Backstage @@ -486,6 +558,8 @@ Build and Deployment: a signing key. tags: [] url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + test-url-expects: + - 403 - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a name: packj tags: @@ -521,7 +595,7 @@ Build and Deployment: measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically). dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components difficultyOfImplementation: knowledge: 2 @@ -675,6 +749,8 @@ Build and Deployment: tags: - inventory - sbom + - scanning + - sca Rolling update on deployment: uuid: 85d52588-f542-4225-a338-20dc22a5508d risk: While a deployment is performed, the application can not be reached. @@ -698,7 +774,7 @@ Build and Deployment: name: rolling update tags: [] dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process references: samm2: - I-SD-A-2 @@ -851,15 +927,23 @@ Build and Deployment: Patch Management: A patch policy is defined: uuid: 99415139-6b50-441b-89e1-0aa59accd43d - risk: Vulnerabilities in running artifacts stay for long and might get exploited. - measure: A patch policy for all artifacts (e.g. in images) is defined. How often - is an image rebuilt? + description: | + A patch policy defines how and when software components, images, and dependencies are updated. A patch policy ensures that all these artifacts are regularly reviewed and updated, reducing the window of exposure to known threats. The policy should specify the frequency, responsibilities, and documentation requirements for patching. + risk: Vulnerabilities in running artifacts may persist for a long time and might + be exploited. + measure: Define a patch policy for all artifacts (e.g. in images) is defined. + How often is an image rebuilt? + assessment: | + - Patch policy is documented and accessible to relevant staff. + - The policy defines patch frequency and responsible roles. + - Patch actions and exceptions are logged and reviewed. + - Evidence of regular patching and policy review is available. + level: 1 difficultyOfImplementation: knowledge: 3 time: 1 resources: 2 usefulness: 4 - level: 1 implementation: [] references: samm2: @@ -881,24 +965,34 @@ Build and Deployment: - patching Automated PRs for patches: uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 - risk: Components with known (or unknown) vulnerabilities might stay for long - and get exploited, even when a patch is available. - measure: |- - Fast patching of third party component is needed. The DevOps way is to have an automated pull request for new components. This includes - * Applications * Virtualized operating system components (e.g. container images) * Operating Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform) + description: | + Automated PRs for patches ensure that updates for outdated or vulnerable dependencies are created and proposed without manual intervention. Tools continuously monitor for new versions or security advisories and immediately generate pull requests to update affected components in code, container images, or infrastructure. This process ensures that available patches are quickly visible to developers and can be reviewed and merged with minimal delay, reducing the risk window for known vulnerabilities. + risk: | + Components with known vulnerabilities might persist for a long time and be exploited, even when a patch is available. + measure: | + Fast patching of third-party components is needed. The DevOps way is to have an automated pull request for new components. This includes: + * Applications + * Virtualized operating system components (e.g., container images) + * Operating systems + * Infrastructure as Code/GitOps (e.g., ArgoCD based on a git repository or Terraform) + assessment: | + - Automated PR tooling is enabled for all relevant repositories. + - PRs are created automatically for outdated or vulnerable dependencies. + - PRs are reviewed and merged according to the defined patch policy. + - Evidence of automated PRs and patching activity is available. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 4 - level: 1 implementation: - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 name: dependabot tags: - auto-pr - patching - url: https://dependabot.com/ + url: https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 name: Jenkins tags: [] @@ -908,6 +1002,8 @@ Build and Deployment: tags: - IaC url: https://www.terraform.io/ + test-url-expects: + - 308 description: | Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 @@ -952,7 +1048,7 @@ Build and Deployment: tags: - auto-pr - patching - url: https://dependabot.com/ + url: https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 name: renovate tags: @@ -1032,11 +1128,13 @@ Build and Deployment: - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a name: Fedora CoreOS tags: [] - url: https://getfedora.org/coreos + url: https://fedoraproject.org/coreos/ - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd name: Distroless or Alpine tags: [] url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + test-url-expects: + - 403 references: samm2: - I-SB-B-2 @@ -1092,7 +1190,6 @@ Build and Deployment: - patching Automated deployment of automated PRs: uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d - description: Automated merges of automated created PRs for outdated dependencies. risk: Even if automated dependencies PRs are merged, they might not be deployed. This results in vulnerabilities in running artifacts stay for too long and might get exploited. @@ -1112,6 +1209,8 @@ Build and Deployment: tags: - IaC url: https://www.terraform.io/ + test-url-expects: + - 308 description: | Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. - uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f @@ -1120,17 +1219,13 @@ Build and Deployment: - deployment url: https://argo-cd.readthedocs.io/en/stable/ references: - samm2: - - O-EM-B-2 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 + samm2: [] + iso27001-2017: [] + iso27001-2022: [] openCRE: - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Patch%20Management/subsection/Automated%20deployment%20of%20automated%20PRs - comments: "" tags: - - patching + - none Usage of a short maximum lifetime for images: uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e description: |- @@ -1154,7 +1249,7 @@ Build and Deployment: level: 4 implementation: - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d - name: "Sample concept: \n(1" + name: Sample concept tags: [] description: "Sample concept: \n(1) each container has a set lifetime and is killed / replaced with a new container multiple times a day where you @@ -1185,16 +1280,62 @@ Culture and Organization: Design: Conduction of simple threat modeling on technical level: uuid: 47419324-e263-415b-815d-e7161b6b905e + description: | + # OWASP SAMM Description + Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. + + Threat modeling is a team exercise, including product owners, architects, security champions, and security testers. At this maturity level, expose teams and stakeholders to threat modeling to increase security awareness and to create a shared vision on the security of the system. + + At maturity level 1, you perform threat modeling ad-hoc for high-risk applications and use simple threat checklists, such as STRIDE. Avoid lengthy workshops and overly detailed lists of low-relevant threats. Perform threat modeling iteratively to align to more iterative development paradigms. If you add new functionality to an existing application, look only into the newly added functions instead of trying to cover the entire scope. A good starting point is the existing diagrams that you annotate during discussion workshops. Always make sure to persist the outcome of a threat modeling discussion for later use. + + Your most important tool to start threat modeling is a whiteboard, smartboard, or a piece of paper. Aim for security awareness, a simple process, and actionable outcomes that you agree upon with your team. Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. + + Source: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + # OWASP Project Integration Description + There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. + + A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). + + OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). + + There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. + + > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ + + ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") + + Last, if the organizations maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. + + ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") + + This practice has the side effect that it trains non-security specialists to think like attackers. + + The outcomes of this stage should help lay the foundation of secure design and considerations. + + **Example Low Maturity Scenario:** + + Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. + + Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. + + Frontend serves data over GraphQL as a thin layer between caching system and end user. + + GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. + + Source: OWASP Project Integration Project risk: Technical related threats are discovered too late in the development and deployment process. - measure: Threat modeling of technical features is performed during the product - sprint planning. + measure: | + Perform threat modeling of technical features during product sprint planning using simple checklists and diagrams. Document identified threats and mitigations for new or changed functionality. + assessment: | + - Evidence of threat modeling activities exists for high-risk applications, including annotated diagrams and documented threats/mitigations. + - Activities are performed during sprint planning and involve relevant stakeholders. Outcomes are recorded and accessible for review. + level: 1 difficultyOfImplementation: knowledge: 2 time: 3 resources: 1 usefulness: 3 - level: 1 implementation: - uuid: c0533602-11b7-4838-93cc-a40556398163 name: Whiteboard @@ -1236,55 +1377,12 @@ Culture and Organization: url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + url: https://www.microsoft.com/en-US/security/blog/2021/04/08/threat-matrix-for-storage/ tags: - documentation - storage - cluster - kubernetes - description: | - # OWASP SAMM Description - Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. - - Threat modeling is a team exercise, including product owners, architects, security champions, and security testers. At this maturity level, expose teams and stakeholders to threat modeling to increase security awareness and to create a shared vision on the security of the system. - - At maturity level 1, you perform threat modeling ad-hoc for high-risk applications and use simple threat checklists, such as STRIDE. Avoid lengthy workshops and overly detailed lists of low-relevant threats. Perform threat modeling iteratively to align to more iterative development paradigms. If you add new functionality to an existing application, look only into the newly added functions instead of trying to cover the entire scope. A good starting point is the existing diagrams that you annotate during discussion workshops. Always make sure to persist the outcome of a threat modeling discussion for later use. - - Your most important tool to start threat modeling is a whiteboard, smartboard, or a piece of paper. Aim for security awareness, a simple process, and actionable outcomes that you agree upon with your team. Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. - - Source: https://owaspsamm.org/model/design/threat-assessment/stream-b/ - # OWASP Project Integration Description - There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. - - A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). - - OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). - - There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. - - > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ - - ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") - - Last, if the organizations maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. - - ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") - - This practice has the side effect that it trains non-security specialists to think like attackers. - - The outcomes of this stage should help lay the foundation of secure design and considerations. - - **Example Low Maturity Scenario:** - - Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. - - Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. - - Frontend serves data over GraphQL as a thin layer between caching system and end user. - - GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. - - Source: OWASP Project Integration Project references: samm2: - D-TA-B-2 @@ -1384,10 +1482,11 @@ Culture and Organization: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 name: Don't Forget EVIL User stories tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + url: https://medium.com/serious-scrum/evil-user-storys-story-telling-for-it-security-e4a9ec94193c + test-url-expects: + - 403 + description: Do not Forget _Evil_ User Stories and [Practical Security Stories + and Security Tasks for Agile Development Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf) dependsOn: - 47419324-e263-415b-815d-e7161b6b905e # Conduction of simple threat modeling on technical level - dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e # Creation of threat modeling processes and standards @@ -1538,7 +1637,7 @@ Culture and Organization: url: https://github.com/Threagile/threagile - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 name: Threat Matrix for Storage - url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + url: https://www.microsoft.com/en-US/security/blog/2021/04/08/threat-matrix-for-storage/ tags: - documentation - storage @@ -1582,10 +1681,11 @@ Culture and Organization: - uuid: bb5b8988-021b-452a-a914-bd36887b6860 name: Don't Forget EVIL User stories tags: [] - url: https://www.owasp.org/index.php/Agile_Software_Development - description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) - and [Practical Security Stories and Security Tasks for Agile Development - Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + url: https://medium.com/serious-scrum/evil-user-storys-story-telling-for-it-security-e4a9ec94193c + test-url-expects: + - 403 + description: Do not Forget _Evil_ User Stories and [Practical Security Stories + and Security Tasks for Agile Development Environments](https://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf) references: samm2: - D-TA-B-2 @@ -1612,23 +1712,28 @@ Culture and Organization: Education and Guidance: Ad-Hoc Security trainings for software developers: uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 - risk: Understanding security is hard and personnel needs to be trained on it. - Otherwise, flaws like an SQL Injection might be introduced into the software - which might get exploited. - measure: Provide security awareness training for all personnel involved in software - development Ad-Hoc. + description: | + Ad-hoc security training provides basic awareness of software security risks and best practices to developers and other personnel involved in software development. These trainings are delivered as needed, without a fixed schedule, to address immediate knowledge gaps or respond to emerging threats. + risk: | + Without any security training, personnel may lack awareness of common software vulnerabilities (such as SQL Injection and vulnerable dependencies), increasing the risk of introducing exploitable flaws into applications. + measure: | + Provide security awareness training for all personnel involved in software development on an ad-hoc basis, ensuring that relevant topics are covered when new risks or needs are identified. + assessment: | + - Conduct security training for developers and relevant personnel + - Training materials are available + - Attendance records are available + level: 1 difficultyOfImplementation: knowledge: 2 time: 1 resources: 1 usefulness: 3 - level: 1 implementation: - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a name: OWASP Juice Shop tags: - training - url: https://github.com/bkimminich/juice-shop + url: https://github.com/juice-shop/juice-shop description: In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 @@ -1650,16 +1755,21 @@ Culture and Organization: - none Security consulting on request: uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 - risk: Not asking a security expert when questions regarding security appear - might lead to flaws. - measure: Security consulting to teams is given on request. The security consultants - can be internal or external. + level: 1 + description: | + Security consulting on request allows teams to seek expert advice on security-related questions or challenges as they arise. This support can be provided by internal or external security consultants and helps address specific concerns during software development. + risk: | + If teams do not consult security experts when questions arise, security flaws may be introduced or remain undetected, increasing the risk of vulnerabilities in the software. + measure: | + Make security consulting available to teams on request, ensuring that expert advice is accessible when needed to address security concerns during development. + assessment: | + - Show evidence that an it security expert is available for questions at least quarterly. + - Documentation of consultations and resulting actions is available for review. difficultyOfImplementation: knowledge: 3 time: 1 resources: 1 usefulness: 3 - level: 1 implementation: - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 name: OWASP Cheatsheet Series @@ -1755,7 +1865,7 @@ Culture and Organization: name: OWASP Juice Shop tags: - training - url: https://github.com/bkimminich/juice-shop + url: https://github.com/juice-shop/juice-shop description: In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 @@ -2062,7 +2172,7 @@ Culture and Organization: name: OWASP Juice Shop tags: - training - url: https://github.com/bkimminich/juice-shop + url: https://github.com/juice-shop/juice-shop description: In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 @@ -2196,7 +2306,7 @@ Culture and Organization: name: OWASP Juice Shop tags: - training - url: https://github.com/bkimminich/juice-shop + url: https://github.com/juice-shop/juice-shop description: In case you do not have the budget to hire an external security expert, an option is to use the OWASP JuiceShop on a "hacking Friday" - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 @@ -2259,23 +2369,23 @@ Culture and Organization: Process: Definition of simple BCDR practices for critical components: uuid: c72da779-86cc-45b1-a339-190ce5093171 - description: A _Business Continuity and Disaster Recovery_ (BCDR) is a plan - and a process that helps a business to return to normal operations if a disaster - occurs. - risk: If the disaster recovery actions are not clear, you risk slow reaction - and remediation delays. This applies to cyber attacks as well as natural emergencies, - such as a power outage. - measure: By understanding and documenting a business continuity and disaster - recovery (BCDR) plan, the overall availability of systems and applications - is increased. Success factors like responsibilities, Service Level Agreements, - Recovery Point Objectives, Recovery Time Objectives or Failover must be fully - documented and understood by the people involved in the recovery. + description: | + Business Continuity and Disaster Recovery (BCDR) is a plan and a process that enable an organization to quickly restore normal operations after a disruptive event, such as a cyberattack or natural disaster. + risk: | + If the disaster recovery actions are not clear, you risk slow reaction and remediation delays. + This applies to cyber attacks as well as natural emergencies, such as a power outage. + measure: | + Develop, document, and communicate a BCDR plan for all critical components. The plan must define roles and responsibilities, Service Level Agreements (SLAs), Recovery Point Objectives (RPOs), Recovery Time Objectives (RTOs), and failover procedures. Ensure all relevant personnel are trained and the plan is reviewed and updated regularly. + assessment: "- There is a documented BCDR plan covering all critical components + of the application(s).\n- The plan clearly defines responsibilities, SLAs, + RPOs, RTOs, and failover steps. \n- Relevant staff are aware of the plan, + and evidence of regular review and testing is available.\n" + level: 1 difficultyOfImplementation: knowledge: 4 time: 3 resources: 2 usefulness: 4 - level: 1 implementation: [] references: samm2: @@ -2324,6 +2434,8 @@ Culture and Organization: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde name: Business friendly vulnerability management metrics url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + test-url-expects: + - 403 tags: - documentation - vulnerability @@ -2453,12 +2565,20 @@ Implementation: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 name: OWASP MASVS tags: [] - url: https://github.com/OWASP/owasp-masvs + url: https://github.com/OWASP/masvs - uuid: 596cb528-8981-4723-bcc3-22c261f26114 name: API Security Maturity Model for Authorization tags: - api url: https://curity.io/resources/learn/the-api-security-maturity-model/ + - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business references: samm2: - D-SR-A-2 @@ -2610,12 +2730,20 @@ Implementation: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 name: OWASP MASVS tags: [] - url: https://github.com/OWASP/owasp-masvs + url: https://github.com/OWASP/masvs - uuid: 596cb528-8981-4723-bcc3-22c261f26114 name: API Security Maturity Model for Authorization tags: - api url: https://curity.io/resources/learn/the-api-security-maturity-model/ + - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business references: samm2: - D-SR-A-3 @@ -2712,7 +2840,15 @@ Implementation: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 name: OWASP MASVS tags: [] - url: https://github.com/OWASP/owasp-masvs + url: https://github.com/OWASP/masvs + - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business references: samm2: - D-SR-A-3 @@ -2816,7 +2952,7 @@ Implementation: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 name: OWASP MASVS tags: [] - url: https://github.com/OWASP/owasp-masvs + url: https://github.com/OWASP/masvs references: samm2: - D-SR-A-2 @@ -2858,7 +2994,7 @@ Implementation: - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 name: OWASP MASVS tags: [] - url: https://github.com/OWASP/owasp-masvs + url: https://github.com/OWASP/masvs references: samm2: - D-SR-A-3 @@ -2875,13 +3011,16 @@ Implementation: tags: - none Development and Source Control: - Versioning: + Version control: uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f - risk: Deployment of untracked artifacts. - description: Use a version control system platform like Github, Gitlab, Bitbucket, - gittea,... to version your code. - measure: Version artifacts in order to identify deployed features and issues. - This includes application and infrastructure code, jenkins configuration, + description: |- + Use a _version control system_ like Github, Gitlab, Bitbucket, etc to version your source code. + Also known as _source control_, _revision control_, or _source code management_. + risk: Without version control, it is challenging to track changes, collaborate + effectively, and maintain a history of code modifications. Rollback to earlier + versions is hard. + measure: Version your source code in order to identify deployed features and + issues. This includes application and infrastructure code, jenkins configuration, container and virtual machine images definitions. difficultyOfImplementation: knowledge: 3 @@ -2889,8 +3028,6 @@ Implementation: resources: 3 usefulness: 5 level: 1 - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: [] references: samm2: @@ -2906,7 +3043,7 @@ Implementation: - 5.37 - 8.32 openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Versioning + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Development%20and%20Source%20Control/subsection/Version%20control tags: - none Require a PR before merging: @@ -2927,13 +3064,13 @@ Implementation: implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + url: https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops tags: - source-code-protection - scm - uuid: 99211481-de9c-4358-880e-628366416a27 name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches tags: - source-code-protection - scm @@ -2973,13 +3110,13 @@ Implementation: implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + url: https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops tags: - source-code-protection - scm - uuid: 99211481-de9c-4358-880e-628366416a27 name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches tags: - source-code-protection - scm @@ -3014,13 +3151,13 @@ Implementation: implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + url: https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops tags: - source-code-protection - scm - uuid: 99211481-de9c-4358-880e-628366416a27 name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches tags: - source-code-protection - scm @@ -3028,7 +3165,7 @@ Implementation: name: Enforcement of commit signing tags: - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule description: Usage of branch protection rules references: samm2: @@ -3062,13 +3199,13 @@ Implementation: implementation: - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a name: Improve code quality with branch policies - url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + url: https://learn.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops tags: - source-code-protection - scm - uuid: 99211481-de9c-4358-880e-628366416a27 name: About protected branches - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/about-protected-branches tags: - source-code-protection - scm @@ -3076,7 +3213,7 @@ Implementation: name: Enforcement of commit signing tags: - signing - url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/managing-protected-branches/managing-a-branch-protection-rule description: Usage of branch protection rules references: samm2: @@ -3141,9 +3278,15 @@ Implementation: - uuid: aa5ded61-5380-4da6-9474-afc36a397682 name: In-Depth Linting of Your TypeScript While Coding url: https://medium.com/@elenavilchik/in-depth-linting-of-your-typescript-while-coding-1d084affbf0 + test-url-expects: + - 403 tags: - ide - linting + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ references: samm2: - V-ST-A-1 @@ -3205,25 +3348,28 @@ Implementation: - none Simple access control for systems: uuid: 82e499d1-f463-4a4b-be90-68812a874af6 - risk: Attackers a gaining access to internal systems and application interfaces + description: Basic access control for internal systems is implemented. + risk: Attackers a gaining access to other internal systems and application interfaces + is one breach occurs. measure: All internal systems are using simple authentication + assessment: "- Presenting the documentation of the review of all user privileges + yearly. \n- Presenting the admin count and validating that there are less + than 5 admins per system.\n" difficultyOfImplementation: knowledge: 3 time: 3 resources: 3 usefulness: 5 level: 1 - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process implementation: - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 name: HTTP-Basic Authentication tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + url: https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e name: VPN tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + url: https://d3fend.mitre.org/dao/artifact/d3f:VPNServer/ references: samm2: - O-EM-A-1 @@ -3375,7 +3521,7 @@ Implementation: name: Attack Matrix Kubernetes tags: - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + url: https://www.microsoft.com/en-US/security/blog/2020/04/02/attack-matrix-kubernetes/ description: Attack matrix for kubernetes - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af name: Defend the core kubernetes security at every layer @@ -3779,8 +3925,8 @@ Implementation: risk: Everyone is able to get unauthorized access to information on systems or to modify information unauthorized on systems. measure: The usage of a (role based) access control helps to restrict system - access to authorized users. And enhancement is to use attribute based access - control. + access to authorized users. And enhancement is to use *attribute based access + control*. difficultyOfImplementation: knowledge: 2 time: 3 @@ -3795,9 +3941,6 @@ Implementation: - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e name: Plugins tags: [] - dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process - - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: samm2: - O-EM-A-2 @@ -3866,7 +4009,7 @@ Implementation: - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 name: authentication tags: [] - url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + url: https://d3fend.mitre.org/dao/artifact/d3f:AuthenticationServer/ dependsOn: - f6f7737f-25a9-4317-8de2-09bf59f29b5b # Defined build process references: @@ -3908,7 +4051,15 @@ Implementation: level: 3 dependsOn: - e1f37abb-d848-4a3a-b3df-65e91a89dcb7 # Context-aware output encoding - implementation: [] + implementation: + - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business references: samm2: - O-EM-A-1 @@ -3967,7 +4118,7 @@ Implementation: name: Attack Matrix Kubernetes tags: - mitre - url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + url: https://www.microsoft.com/en-US/security/blog/2020/04/02/attack-matrix-kubernetes/ description: Attack matrix for kubernetes - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af name: Defend the core kubernetes security at every layer @@ -4008,7 +4159,7 @@ Implementation: usefulness: 4 level: 4 dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process - 8b994601-575e-4ea5-b228-accb18c8e514 # Infrastructure as Code implementation: [] references: @@ -4092,7 +4243,15 @@ Implementation: level: 4 dependsOn: - f0e01814-3b88-4bd0-a3a9-f91db001d20b # WAF baseline - implementation: [] + implementation: + - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business references: samm2: - O-EM-A-2 @@ -4138,7 +4297,15 @@ Implementation: level: 5 dependsOn: - f0e01814-3b88-4bd0-a3a9-f91db001d20b-medium # WAF medium - implementation: [] + implementation: + - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business references: samm2: - O-EM-A-2 @@ -4157,17 +4324,20 @@ Information Gathering: Logging: Centralized system logging: uuid: 4eced38a-7904-4c45-adb0-50b663065540 - risk: Local stored system logs can be unauthorized manipulated by attackers - or might be corrupt after an incident. In addition, it is hard to perform - a aggregation of logs. - measure: By using centralized logging logs are protected against unauthorized - modification. + description: | + Centralized system logging involves collecting and storing system logs from multiple sources in a secure, central location. This approach improves log integrity, simplifies monitoring, and enables efficient incident response. + risk: | + Locally stored system logs can be manipulated by attackers unauthorized or might be corrupt or lost after an incident. In addition, it is hard to perform aggregation of logs. + measure: | + - Implement a centralized logging solution for all critical systems. + - System logs must be stored in a central repository, protected from unauthorized access and modification. + - Ensure that log collection is automated and covers all relevant system events. + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 2 - level: 1 implementation: - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 name: rsyslog @@ -4177,7 +4347,7 @@ Information Gathering: - logging - uuid: 7a8fad2e-d642-4972-8501-74591b23feab name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + url: https://www.elastic.co/docs/reference/logstash/getting-started-with-logstash tags: - tool - logging @@ -4252,7 +4422,7 @@ Information Gathering: implementation: - uuid: 7a8fad2e-d642-4972-8501-74591b23feab name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + url: https://www.elastic.co/docs/reference/logstash/getting-started-with-logstash tags: - tool - logging @@ -4336,7 +4506,7 @@ Information Gathering: - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 name: ELK-Stack tags: [] - url: https://www.elastic.co/elk-stack + url: https://www.elastic.co/elastic-stack/ references: samm2: - O-IM-A-1 @@ -4405,7 +4575,7 @@ Information Gathering: - logging - uuid: 7a8fad2e-d642-4972-8501-74591b23feab name: logstash - url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + url: https://www.elastic.co/docs/reference/logstash/getting-started-with-logstash tags: - tool - logging @@ -4440,8 +4610,11 @@ Information Gathering: Monitoring: Simple application metrics: uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 - risk: Attacks on an application are not recognized. - measure: |- + description: | + Collecting basic operational data from applications, such as authentication attempts, transaction volumes, and resource usage, will help detect abnormal patterns that may indicate security incidents or system issues. + risk: | + Without monitoring application metrics, attacks or abnormal behaviors may go undetected, increasing the risk of successful exploitation, data breaches, and delayed incident response. + measure: | Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include: - Authentication attempts (successful/failed logins) - Transaction volumes and patterns (e.g. orders, payments) @@ -4454,12 +4627,14 @@ Information Gathering: - A security incident (automated bulk purchase bots, credential stuffing attack) By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response. + assessment: | + - Basic application metrics are collected and reviewed. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 5 - level: 1 implementation: - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c name: Prometheus @@ -4479,16 +4654,21 @@ Information Gathering: - none Simple budget metrics: uuid: f08a3219-6941-43ec-8762-4aff739f4664 - risk: Not getting notified about reaching the end of the budget (e.g. due to - a denial of service) creates unexpected costs. - measure: Cloud providers often provide insight into budgets. A threshold and - alarming for the budget is set. + description: | + Monitoring resource usage and costs to prevent unexpected expenses. This is especially important in cloud environments where resource consumption can quickly exceed planned budgets. + risk: | + Failure to monitor budget metrics can result in unexpected costs, financial loss, and potential service disruption due to resource exhaustion or denial-of-service attacks. + measure: | + Set up budget monitoring and alerting for all critical resources. Use provider tools to track spending and configure alerts when thresholds are reached. Implement hard limits where possible to prevent budget overruns. + assessment: | + - The organization regularly monitors budget metrics + - Alerting outside given thresholds are implemented + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 5 - level: 1 implementation: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 name: collected @@ -4509,19 +4689,20 @@ Information Gathering: - none Simple system metrics: uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 - risk: Without simple metrics analysis of incidents are hard. In case an application - uses a lot of CPU from time to time, it is hard for a developer to find out - the source with Linux commands. - measure: Gathering of system metrics helps to identify incidents and specially - bottlenecks like in CPU usage, memory usage and hard disk usage. + description: | + Monitoring basic system performance data, such as CPU, memory, and disk usage, will help identify performance bottlenecks and potential security incidents. + risk: | + Without monitoring system metrics, it is difficult to detect incidents or performance issues, leading to delayed response, reduced availability, and increased risk of undetected attacks. + measure: | + Collect and monitor key system metrics, including CPU, memory, and disk usage. + assessment: | + - Basic system metrics are monitored and reviewed regularly + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 2 usefulness: 5 - assessment: | - Are system metrics gathered? - level: 1 implementation: - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 name: collected @@ -4832,12 +5013,7 @@ Information Gathering: level: 4 dependsOn: - ded39bcf-4eaa-4c5f-9c94-09acde0a4734 # Visualized metrics - implementation: - - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d - name: https://ht.transpare - tags: [] - url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD - description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + implementation: [] references: samm2: - O-IM-A-2 @@ -5087,6 +5263,8 @@ Information Gathering: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde name: Business friendly vulnerability management metrics url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + test-url-expects: + - 403 tags: - documentation - vulnerability @@ -5146,6 +5324,8 @@ Information Gathering: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde name: Business friendly vulnerability management metrics url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + test-url-expects: + - 403 tags: - documentation - vulnerability @@ -5213,6 +5393,8 @@ Information Gathering: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde name: Business friendly vulnerability management metrics url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + test-url-expects: + - 403 tags: - documentation - vulnerability @@ -5292,7 +5474,7 @@ Test and Verification: name: JUnit tags: - unittest - url: https://junit.org/junit5/ + url: https://junit.org/ - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 name: Karma tags: [] @@ -5354,7 +5536,7 @@ Test and Verification: level: 4 implementation: [] dependsOn: - - 74938a3f-1269-49b9-9d0f-c43a79a1985a # Defined deployment process + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process references: samm2: - V-RT-A-3 @@ -5403,9 +5585,17 @@ Test and Verification: Consolidation: Simple false positive treatment: uuid: c1acc8af-312e-4503-a817-a26220c993a0 - risk: As false positive occur during each test, all vulnerabilities might be - ignored. Specially, if tests are automated an run daily. - measure: |- + description: | + Security tests may produce false positives (or _"false alarms"_), findings that are incorrectly identified as vulnerabilities. + + It is important distinguish these from true positive vulnerabilities to avoid wasting time and resources on non-issues. + + False positive treatment ensures that findings from security tests are triaged and documented, allowing teams to distinguish between real vulnerabilities and false positives. This reduces unnecessary work and helps maintain focus on true risks. + + Some positive findings might be considered an _accepted risk_ by the organization. This must also be documented. + risk: | + If false positives are not managed, teams may ignore all findings, leading to real vulnerabilities being overlooked and increasing the risk of exploitation. Specially, if tests are automated an run daily. + measure: | Findings from security tests must be triaged and outcomes persisted/documented to: - Prevent re-analysis of known issues in subsequent test runs - Track accepted risks vs false positives @@ -5417,12 +5607,14 @@ Test and Verification: - [OWASP Dependency Check](https://jeremylong.github.io/DependencyCheck/general/suppression.html) - [Kubescape with VEX](https://kubescape.io/blog/2023/12/07/kubescape-support-for-vex-generation/) - [OWASP DefectDojo Risk Acceptance](https://docs.defectdojo.com/en/working_with_findings/findings_workflows/risk_acceptances/) and [False Positive Handling](https://docs.defectdojo.com/en/working_with_findings/intro_to_findings/#triage-vulnerabilities-using-finding-status) + assessment: | + A process is defined for triaging and documenting false positives and accepted risks + level: 1 difficultyOfImplementation: knowledge: 1 time: 1 resources: 1 usefulness: 4 - level: 1 implementation: - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb name: OWASP DefectDojo @@ -5451,22 +5643,33 @@ Test and Verification: openCRE: - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Simple%20false%20positive%20treatment isImplemented: false + tags: + - false-positive + - defect-management + - scanning + - sca + - sats + - dast evidence: "" comments: "" - tags: - - none - Treatment of defects with severity high or higher: + Treatment of defects with high or critical severity: uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 - risk: Vulnerabilities with severity high or higher are not visible. - measure: Vulnerabilities with severity high or higher are added to the quality - gate. + description: | + All security problems that are rated as "high" or "critical" must be fixed before the software can be released or used in production. This means that if a serious vulnerability is found, it cannot be ignored or postponed. + risk: | + If serious security problems are not fixed, attackers could exploit them to steal data, disrupt services, or cause other harm. Ignoring these issues puts the organization, its customers, and its reputation at risk. + measure: | + - Make it a rule that all _high_ or _critical_ security findings must be fixed before the software is approved for release or use. + - Track these issues and make sure they are resolved quickly. + assessment: | + - Provide evidence that vulnerabilities are treated within the defined time frame in production. For example via the DSOMM activity [Number of vulnerabilities/severity](./activity-description?uuid=bc548cba-cb82-4f76-bd4b-325d9d256279) or [Patching mean time to resolution via PR](./activity-description?uuid=86d490b9-d798-4a5b-a011-ab9688014c46) with extra deployment statistics. + comments: False positive analysis, specially for static analysis, is time consuming. + level: 1 difficultyOfImplementation: knowledge: 2 time: 2 resources: 1 usefulness: 4 - level: 1 - comments: False positive analysis, specially for static analysis, is time consuming. references: samm2: - I-DM-A-2 @@ -5477,8 +5680,19 @@ Test and Verification: - 8.8 - 5.25 openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20with%20severity%20high%20or%20higher - implementation: [] + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20with%20high%20or%20critical%20severity + implementation: + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: Trivy + tags: [] + url: https://github.com/aquasecurity/trivy + - uuid: 7970af6e-a7d3-4359-a6ea-301d26b16329 + name: Grype + tags: + - sbom + - dependency + - vulnerability + url: https://github.com/anchore/grype tags: - vuln-action - defect-management @@ -5549,6 +5763,10 @@ Test and Verification: tags: - false-positive - defect-management + - scanning + - sca + - sats + - dast Simple visualization of defects: uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 risk: The security level of a component is not visible. Therefore, the motivation @@ -5637,7 +5855,7 @@ Test and Verification: - The number of network hops required to reach the asset (recommended) - Authentication requirements for access (recommended) dependsOn: - - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with severity high or higher + - 44f2c8a9-4aaa-4c72-942d-63f78b89f385 # Treatment of defects with high or critical severity - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components implementation: ~ references: @@ -5866,6 +6084,8 @@ Test and Verification: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde name: Business friendly vulnerability management metrics url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + test-url-expects: + - 403 tags: - documentation - vulnerability @@ -5892,7 +6112,7 @@ Test and Verification: - vulnerability-mgmt - metrics - vmm-measurements - Treatment of defects with severity middle: + Treatment of defects with medium severity: uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 risk: Vulnerabilities with severity middle are not visible. measure: Vulnerabilities with severity middle are added to the quality gate. @@ -5913,7 +6133,7 @@ Test and Verification: - 8.8 - 5.25 openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20with%20severity%20middle + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Consolidation/subsection/Treatment%20of%20defects%20with%20medium%20severity implementation: [] tags: - vuln-action @@ -6012,6 +6232,8 @@ Test and Verification: - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde name: Business friendly vulnerability management metrics url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + test-url-expects: + - 403 tags: - documentation - vulnerability @@ -6396,13 +6618,13 @@ Test and Verification: - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 name: OWASP Code Pulse tags: [] - url: https://www.owasp.org/index.php/OWASP_Code_Pulse + url: https://owasp.org/www-project-code-pulse/ - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 name: Coverage.py tags: - testing - coverage - url: https://github.com/nedbat/coveragepy + url: https://github.com/coveragepy/coveragepy description: | Code coverage measurement for Python references: @@ -6482,7 +6704,7 @@ Test and Verification: - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a name: OWASP Amass tags: [] - url: https://github.com/OWASP/Amass + url: https://github.com/owasp-amass/amass references: samm2: - V-ST-A-1 @@ -6551,7 +6773,7 @@ Test and Verification: implementation: - uuid: 893d9f37-2142-4490-996c-e43b55064d3d name: kubescape - url: https://github.com/armosec/kubescape + url: https://github.com/kubescape/kubescape tags: - kubernetes - vulnerability @@ -6637,7 +6859,7 @@ Test and Verification: name: HTC Hydra tags: - password - url: https://www.htc-cs.com/en/products/htc-hydra/ + url: https://github.com/vanhauser-thc/thc-hydra references: samm2: - V-ST-A-2 @@ -6725,6 +6947,50 @@ Test and Verification: tags: - none Static depth for applications: + Exploit likelihood estimation: + uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad + description: "Severity-based vulnerability triage alone generates a lot false + positives, requiring a more refined approach.\n\nUse the likelihood of exploitation + by using *known exploited vulnerabilities* (CISA KEV), or prediction models + such as \n*Exploit Prediction Scoring System* (EPSS).\n" + risk: | + Without proper prioritization, organizations may waste time and effort on low-risk vulnerabilities while neglecting critical ones. + measure: | + Use CISA KEV and EPSS to prioritize vulnerabilities that are more likely to be exploited. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 2 + dependsOn: + - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server side) + implementation: + - uuid: aa507341-9531-42cd-95cf-d7b51af47086 + name: Known Exploited Vulnerabilities + tags: + - vulnerability + url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog + description: A catalog of vulnerabilities that have been exploited. + - uuid: e39afc58-8195-4600-92c6-11922e3a141b + name: Exploit Prediction Scoring System + tags: + - vulnerability + url: https://www.first.org/epss/ + description: Estimates the likelihood that a software vulnerability will be + exploited. + references: + samm2: + - V-ST-A-2 + - I-SB-B-3 + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Exploit%20likelihood%20estimation + tags: + - none Software Composition Analysis (server side): uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe description: Use a tool like trivy and concentrate on application related vulnerabilities. @@ -6770,6 +7036,8 @@ Test and Verification: name: npm audit tags: [] url: https://docs.npmjs.com/cli/audit + test-url-expects: + - 301 - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 name: Dependabot tags: @@ -6780,7 +7048,7 @@ Test and Verification: description: | Dependabot creates pull requests to keep your dependencies secure and up-to-date. - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy + name: Trivy tags: [] url: https://github.com/aquasecurity/trivy references: @@ -6794,7 +7062,12 @@ Test and Verification: openCRE: - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Software%20Composition%20Analysis%20%28server%20side%29 tags: - - vmm-testing + - false-positive + - defect-management + - scanning + - sca + - sats + - dast Test for Time to Patch: uuid: 13af1227-3dd1-4d4f-a9e9-53deb793c18f risk: Automatic PRs for dependencies are overlooked resulting in known vulnerabilities @@ -6814,7 +7087,7 @@ Test and Verification: tags: - auto-pr - patching - url: https://dependabot.com/ + url: https://docs.github.com/en/code-security/getting-started/dependabot-quickstart-guide - uuid: 8228266e-e04f-40ba-94c8-bfadc5310920 name: renovate tags: @@ -6936,48 +7209,6 @@ Test and Verification: - 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components tags: - none - Exploit likelihood estimation: - uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad - risk: Without proper prioritization, organizations may waste time and effort - on low-risk vulnerabilities while neglecting critical ones. - measure: Estimate the likelihood of exploitation by using data (CISA KEV) from - the past or prediction models (e.g. Exploit Prediction Scoring System, EPSS). - description: Severity-based vulnerability triage alone generates a lot false - positives, requiring a more refined approach. - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 3 - dependsOn: - - d918cd44-a972-43e9-a974-eff3f4a5dcfe # Software Composition Analysis (server side) - implementation: - - uuid: aa507341-9531-42cd-95cf-d7b51af47086 - name: Known Exploited Vulnerabilities - tags: - - vulnerability - url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog - description: A catalog of vulnerabilities that have been exploited. - - uuid: e39afc58-8195-4600-92c6-11922e3a141b - name: Exploit Prediction Scoring System - tags: - - vulnerability - url: https://www.first.org/epss/ - description: Estimates the likelihood that a software vulnerability will be - exploited. - references: - samm2: - - V-ST-A-2 - - I-SB-B-3 - iso27001-2017: - - 12.6.1 - iso27001-2022: - - 8.8 - openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Exploit%20likelihood%20estimation - tags: - - none Local development security checks performed: uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b risk: Creating and developing code contains code smells and quality issues. @@ -6994,29 +7225,35 @@ Test and Verification: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 name: Fortify Extension for Visual Studio Code url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + test-url-expects: + - 404 tags: - ide - sast - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 name: Setting Up the Visual Studio Code Extension Plugin url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + test-url-expects: + - 302 tags: - ide - sast - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb name: HCL AppScan CodeSweep url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + test-url-expects: + - 404 tags: - ide - sast - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 name: DevSecOps control Pre-commit - url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + url: https://learn.microsoft.com/en-us/security/zero-trust/develop/secure-devops-environments-zero-trust tags: - pre-commit - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb name: Building your DevSecOps pipeline 5 essential activities - url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + url: https://www.blackduck.com/blog/devsecops-pipeline-checklist/ tags: - pre-commit references: @@ -7059,6 +7296,8 @@ Test and Verification: name: npm audit tags: [] url: https://docs.npmjs.com/cli/audit + test-url-expects: + - 301 - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 name: Dependency-Track description: | @@ -7091,10 +7330,11 @@ Test and Verification: openCRE: - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20applications/subsection/Software%20Composition%20Analysis%20%28client%20side%29 isImplemented: false + tags: + - defect-management + - sca evidence: "" comments: "" - tags: - - none Static analysis for important client side components: uuid: e237176b-bec5-447d-a926-e37d6dd60e4b risk: Important parts in the source code of the frontend have vulnerabilities. @@ -7127,18 +7367,24 @@ Test and Verification: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 name: Fortify Extension for Visual Studio Code url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + test-url-expects: + - 404 tags: - ide - sast - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 name: Setting Up the Visual Studio Code Extension Plugin url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + test-url-expects: + - 302 tags: - ide - sast - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb name: HCL AppScan CodeSweep url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + test-url-expects: + - 404 tags: - ide - sast @@ -7186,18 +7432,24 @@ Test and Verification: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 name: Fortify Extension for Visual Studio Code url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + test-url-expects: + - 404 tags: - ide - sast - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 name: Setting Up the Visual Studio Code Extension Plugin url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + test-url-expects: + - 302 tags: - ide - sast - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb name: HCL AppScan CodeSweep url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + test-url-expects: + - 404 tags: - ide - sast @@ -7286,18 +7538,24 @@ Test and Verification: - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 name: Fortify Extension for Visual Studio Code url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + test-url-expects: + - 404 tags: - ide - sast - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 name: Setting Up the Visual Studio Code Extension Plugin url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + test-url-expects: + - 302 tags: - ide - sast - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb name: HCL AppScan CodeSweep url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + test-url-expects: + - 404 tags: - ide - sast @@ -7470,9 +7728,15 @@ Test and Verification: tags: - ide - linting + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ - uuid: aa5ded61-5380-4da6-9474-afc36a397682 name: In-Depth Linting of Your TypeScript While Coding url: https://medium.com/@elenavilchik/in-depth-linting-of-your-typescript-while-coding-1d084affbf0 + test-url-expects: + - 403 tags: - ide - linting @@ -7518,7 +7782,7 @@ Test and Verification: - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 name: truffleHog tags: [] - url: https://github.com/dxa4481/truffleHog + url: https://github.com/trufflesecurity/trufflehog - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 name: go-pillage-registries tags: [] @@ -7556,7 +7820,7 @@ Test and Verification: - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 name: truffleHog tags: [] - url: https://github.com/dxa4481/truffleHog + url: https://github.com/trufflesecurity/trufflehog - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 name: go-pillage-registries tags: [] @@ -7628,7 +7892,7 @@ Test and Verification: usefulness: 2 level: 2 implementation: - - url: https://github.com/SDA-SE/clusterscanner + - url: https://github.com/SDA-SE/cluster-image-scanner uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f name: ClusterScanner tags: @@ -7673,7 +7937,7 @@ Test and Verification: name: Dive to inspect a container images tags: [] url: https://github.com/wagoodman/dive - - url: https://github.com/SDA-SE/clusterscanner + - url: https://github.com/SDA-SE/cluster-image-scanner uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f name: ClusterScanner tags: @@ -7805,7 +8069,7 @@ Test and Verification: usefulness: 3 level: 3 implementation: - - url: https://github.com/SDA-SE/clusterscanner + - url: https://github.com/SDA-SE/cluster-image-scanner uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f name: ClusterScanner tags: @@ -7922,7 +8186,7 @@ Test and Verification: often too fine-granular. implementation: - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b - name: https://github.com/aquasecurity/trivy + name: Trivy tags: [] url: https://github.com/aquasecurity/trivy - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 @@ -7952,10 +8216,11 @@ Test and Verification: openCRE: - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Static%20depth%20for%20infrastructure/subsection/Software%20Composition%20Analysis isImplemented: false + tags: + - scanning + - sca evidence: "" comments: "" - tags: - - none Test of infrastructure components for known vulnerabilities: uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 risk: Infrastructure components might have vulnerabilities. @@ -8005,7 +8270,7 @@ Test and Verification: comments: "" tags: - none - Test-Intensity: + Test Intensity: Default settings for intensity: uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d risk: Time pressure and ignorance might lead to false predictions for the test @@ -8030,7 +8295,7 @@ Test and Verification: - 8.25 - 8.27 openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Default%20settings%20for%20intensity + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20Intensity/subsection/Default%20settings%20for%20intensity isImplemented: false evidence: "" comments: "" @@ -8061,7 +8326,7 @@ Test and Verification: - 8.32 - 8.29 openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Regular%20automated%20tests + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20Intensity/subsection/Regular%20automated%20tests isImplemented: false evidence: "" comments: "" @@ -8094,7 +8359,7 @@ Test and Verification: - 8.25 - 8.27 openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Deactivating%20of%20unneeded%20tests + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20Intensity/subsection/Deactivating%20of%20unneeded%20tests isImplemented: false evidence: "" comments: "" @@ -8125,7 +8390,7 @@ Test and Verification: - 8.25 - 8.27 openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/High%20test%20intensity + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20Intensity/subsection/High%20test%20intensity isImplemented: false evidence: "" comments: "" @@ -8160,7 +8425,7 @@ Test and Verification: - 8.27 - 8.8 openCRE: - - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test-Intensity/subsection/Creation%20and%20application%20of%20a%20testing%20concept + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Test%20Intensity/subsection/Creation%20and%20application%20of%20a%20testing%20concept isImplemented: false evidence: "" comments: "" From 58af8725a98bbafd045250ebee0520d1488b9246 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Jan 2026 20:50:36 +0100 Subject: [PATCH 218/370] feat: trigger release --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 7254906..49111fd 100644 --- a/README.md +++ b/README.md @@ -68,3 +68,4 @@ If you prefer Podman over Docker, set the environement variable `DOCKER_CMD` to ## License See the `LICENSE` file in this repository for license details. + From 7b37058752e57fc13f264c28831d49a06cef2743 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Jan 2026 20:54:24 +0100 Subject: [PATCH 219/370] =?UTF-8?q?=F0=9F=A4=96=20push=201.27.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ generated/model.yaml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5af78d8..8740649 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [1.27.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.26.0...v1.27.0) (2026-01-15) + + +### Features + +* trigger release ([58af872](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/58af8725a98bbafd045250ebee0520d1488b9246)) + # [4.0.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.25.0...v1.26.0) (2026-01-05) diff --git a/generated/model.yaml b/generated/model.yaml index 63f2f22..39bb213 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 4.0.0 + version: 1.27.0 released: "2026-01-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- From 61caeca37ed5480de46d1721b7b7d81d6e1e68f2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Jan 2026 21:02:11 +0100 Subject: [PATCH 220/370] =?UTF-8?q?Revert=20"=F0=9F=A4=96=20push=201.27.0"?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit This reverts commit 7b37058752e57fc13f264c28831d49a06cef2743. --- CHANGELOG.md | 7 ------- generated/model.yaml | 2 +- 2 files changed, 1 insertion(+), 8 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 8740649..5af78d8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,10 +1,3 @@ -# [1.27.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.26.0...v1.27.0) (2026-01-15) - - -### Features - -* trigger release ([58af872](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/58af8725a98bbafd045250ebee0520d1488b9246)) - # [4.0.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.25.0...v1.26.0) (2026-01-05) diff --git a/generated/model.yaml b/generated/model.yaml index 39bb213..63f2f22 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 1.27.0 + version: 4.0.0 released: "2026-01-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- From 11254c76c4fe30536e67c81258ce71bbd9a6fe7e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Jan 2026 21:02:11 +0100 Subject: [PATCH 221/370] Revert "feat: trigger release" This reverts commit 58af8725a98bbafd045250ebee0520d1488b9246. --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 49111fd..7254906 100644 --- a/README.md +++ b/README.md @@ -68,4 +68,3 @@ If you prefer Podman over Docker, set the environement variable `DOCKER_CMD` to ## License See the `LICENSE` file in this repository for license details. - From e83e71f62e324abcbc4b1911af56e6ef5543d3af Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Jan 2026 21:05:35 +0100 Subject: [PATCH 222/370] feat: trigger release --- README.md | 1 + 1 file changed, 1 insertion(+) diff --git a/README.md b/README.md index 7254906..49111fd 100644 --- a/README.md +++ b/README.md @@ -68,3 +68,4 @@ If you prefer Podman over Docker, set the environement variable `DOCKER_CMD` to ## License See the `LICENSE` file in this repository for license details. + From f9e2d1c8d91b6962a7449adac3771401bc5d9dc7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 15 Jan 2026 21:08:48 +0100 Subject: [PATCH 223/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ generated/model.yaml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 5af78d8..f11486e 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [4.1.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v4.0.0...v4.1.0) (2026-01-15) + + +### Features + +* trigger release ([e83e71f](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/e83e71f62e324abcbc4b1911af56e6ef5543d3af)) + # [4.0.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.25.0...v1.26.0) (2026-01-05) diff --git a/generated/model.yaml b/generated/model.yaml index 63f2f22..4f243c2 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 4.0.0 + version: 4.1.0 released: "2026-01-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- From 6793d88d0c217d2e1237cca17e4ec8480568271b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 16 Jan 2026 07:30:55 +0100 Subject: [PATCH 224/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4f243c2..7da6035 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-15" + released: "2026-01-16" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 20a5cec245c52cd1f9d08c1b2404db70b0f131da Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 16 Jan 2026 07:52:19 +0100 Subject: [PATCH 225/370] Simplify release rules in .releaserc.json Removed custom release rules for breaking changes. --- .releaserc.json | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.releaserc.json b/.releaserc.json index 759d39b..8ae6300 100644 --- a/.releaserc.json +++ b/.releaserc.json @@ -4,11 +4,7 @@ [ "@semantic-release/commit-analyzer", { - "preset": "angular", - "releaseRules": [ - {"breaking": true, "release": "minor"}, - {"tag": "Breaking", "release": "minor"} - ] + "preset": "angular" } ], "@semantic-release/release-notes-generator", From bab3a1b9647e9317689942846d0374bdf3d018f8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 17 Jan 2026 07:27:12 +0100 Subject: [PATCH 226/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 7da6035..db1e707 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-16" + released: "2026-01-17" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 49fb38145e998bad25f8742f5f89880c627aa785 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 18 Jan 2026 07:27:35 +0100 Subject: [PATCH 227/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index db1e707..c73af1b 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-17" + released: "2026-01-18" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From abe6a825f3c0dfb76ec9bbab2884e3081d2e5d19 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 19 Jan 2026 07:34:45 +0100 Subject: [PATCH 228/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index c73af1b..257c492 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-18" + released: "2026-01-19" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 1966cb3a6b071fbb3f7061cacc34ebd05a9d3819 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 20 Jan 2026 07:32:06 +0100 Subject: [PATCH 229/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 257c492..881f5ce 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-19" + released: "2026-01-20" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d6c52f9cd7c9606e7cb6c932d277b5cde59b2098 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 21 Jan 2026 07:32:15 +0100 Subject: [PATCH 230/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 881f5ce..5c3f3b0 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-20" + released: "2026-01-21" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 4f07995b012ae3bb7b4e876b5a7d15cb22341608 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 22 Jan 2026 07:30:42 +0100 Subject: [PATCH 231/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 5c3f3b0..d5f04dc 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-21" + released: "2026-01-22" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 2e3649c1805aab08b22672066ec6b489fb8fd5e8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 23 Jan 2026 07:30:33 +0100 Subject: [PATCH 232/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index d5f04dc..986007f 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-22" + released: "2026-01-23" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 7de903a1b83cc1446d84bb14821b51313098a940 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 24 Jan 2026 07:28:07 +0100 Subject: [PATCH 233/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 986007f..81eb6c1 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-23" + released: "2026-01-24" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 780d05059f7e7b2d0646bdc26760fd3c712968cf Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 25 Jan 2026 07:27:54 +0100 Subject: [PATCH 234/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 81eb6c1..15b4e9f 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-24" + released: "2026-01-25" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 81be534f21fd0e4dbd391f25f25016dd3acddfd8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 26 Jan 2026 07:33:11 +0100 Subject: [PATCH 235/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 15b4e9f..d16f869 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-25" + released: "2026-01-26" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ac320fce0ca2c1b5d113e85fdc073571503ead4e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 27 Jan 2026 07:31:16 +0100 Subject: [PATCH 236/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index d16f869..192a131 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-26" + released: "2026-01-27" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c0cbd0e7234cd176c531bb760e696f859976dc55 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 28 Jan 2026 07:32:47 +0100 Subject: [PATCH 237/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.1.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 192a131..380e28a 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.1.0 - released: "2026-01-27" + released: "2026-01-28" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From b971cb0d326ffe2630e932a915ff5288771dabb5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 28 Jan 2026 20:41:18 +0100 Subject: [PATCH 238/370] feat: new version feat: new version --- README.md | 1 - 1 file changed, 1 deletion(-) diff --git a/README.md b/README.md index 49111fd..7254906 100644 --- a/README.md +++ b/README.md @@ -68,4 +68,3 @@ If you prefer Podman over Docker, set the environement variable `DOCKER_CMD` to ## License See the `LICENSE` file in this repository for license details. - From cc2b6a7c51981e95087ae483d98e5dba24621a7b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 28 Jan 2026 20:44:13 +0100 Subject: [PATCH 239/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ generated/model.yaml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index f11486e..932faf6 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [4.2.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v4.1.0...v4.2.0) (2026-01-28) + + +### Features + +* new version ([b971cb0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/b971cb0d326ffe2630e932a915ff5288771dabb5)) + # [4.1.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v4.0.0...v4.1.0) (2026-01-15) diff --git a/generated/model.yaml b/generated/model.yaml index 380e28a..20c45f8 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 4.1.0 + version: 4.2.0 released: "2026-01-28" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- From bdb07cf40e9255f57b468021ef6e48fa5b9380c8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 29 Jan 2026 07:43:13 +0100 Subject: [PATCH 240/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 20c45f8..4de92ab 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-01-28" + released: "2026-01-29" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 4f67d4f72333ef031870943b826c942a2caa7459 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 30 Jan 2026 07:44:34 +0100 Subject: [PATCH 241/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4de92ab..f8a74fe 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-01-29" + released: "2026-01-30" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 9f3fd0d7135d46720abd78189bd02a5915c0bd4a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 31 Jan 2026 07:35:02 +0100 Subject: [PATCH 242/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f8a74fe..4e2ef8d 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-01-30" + released: "2026-01-31" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d74a6026e918ff23674af54d95a9a26bd192c9af Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 1 Feb 2026 07:45:29 +0100 Subject: [PATCH 243/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4e2ef8d..ebaa3db 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-01-31" + released: "2026-02-01" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ff388806b0a57ce0b788c63449df8f2b6a0f2ada Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 2 Feb 2026 07:59:39 +0100 Subject: [PATCH 244/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index ebaa3db..c11a181 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-01" + released: "2026-02-02" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 6297c49c67eccd70fe7efcea185ceb4b649ffe73 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 3 Feb 2026 07:45:56 +0100 Subject: [PATCH 245/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index c11a181..f98c2bb 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-02" + released: "2026-02-03" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 5189e1f92c51977b1317b55faa27e3411270ed6f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 4 Feb 2026 07:46:35 +0100 Subject: [PATCH 246/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f98c2bb..c8a5eef 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-03" + released: "2026-02-04" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 4016cc9000487e079f34c16234ded886d3863463 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 5 Feb 2026 07:54:55 +0100 Subject: [PATCH 247/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index c8a5eef..31ec221 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-04" + released: "2026-02-05" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 865d02c2636da57365d614df7646f888f8348db9 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 6 Feb 2026 07:49:48 +0100 Subject: [PATCH 248/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 31ec221..5c1854c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-05" + released: "2026-02-06" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From b528672261c5125d98a28a5f9ee56c10b14642a1 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 7 Feb 2026 07:38:52 +0100 Subject: [PATCH 249/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 5c1854c..3dad025 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-06" + released: "2026-02-07" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 27c8d6400db989a5128f9954b9463a66ae4bc7b7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 8 Feb 2026 07:45:35 +0100 Subject: [PATCH 250/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 3dad025..6123bc1 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-07" + released: "2026-02-08" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 97c904a46ff7a5486b255f4a3f0cbc15483c9ec8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 9 Feb 2026 08:02:02 +0100 Subject: [PATCH 251/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 6123bc1..4365002 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-08" + released: "2026-02-09" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 768e8805534856d5016e1619949b6945c7608245 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 10 Feb 2026 08:01:26 +0100 Subject: [PATCH 252/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4365002..1ad73bb 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-09" + released: "2026-02-10" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From f7eed41613a428329a2fd19c926732cadfa9985e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 11 Feb 2026 07:58:40 +0100 Subject: [PATCH 253/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 1ad73bb..69812d7 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-10" + released: "2026-02-11" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From a59f8e1fc91c76865f7ac246bb12cdb432fef566 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 12 Feb 2026 07:58:39 +0100 Subject: [PATCH 254/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 69812d7..3b25b4d 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-11" + released: "2026-02-12" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 50a97bc9e872d5e6e130cbe7d56197f0a9fd9028 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 13 Feb 2026 07:57:01 +0100 Subject: [PATCH 255/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 3b25b4d..7bfad96 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-12" + released: "2026-02-13" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c3191bc4c62fbaf381a1df38d2f445ac17de8967 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 14 Feb 2026 07:41:40 +0100 Subject: [PATCH 256/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 7bfad96..05fa691 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-13" + released: "2026-02-14" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d50184704723f81a099181fd4a83cd206b12bafa Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 15 Feb 2026 07:47:22 +0100 Subject: [PATCH 257/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 05fa691..70f25c5 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-14" + released: "2026-02-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 1780ab890e53b676d7b59453ceeb52495bdf64da Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 16 Feb 2026 08:00:33 +0100 Subject: [PATCH 258/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 70f25c5..0e39a38 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-15" + released: "2026-02-16" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From cd05aece7cc1d8177857715e6cf853c7a27be095 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 17 Feb 2026 07:55:41 +0100 Subject: [PATCH 259/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 0e39a38..dae7254 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-16" + released: "2026-02-17" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 675be68f472b8a8d0e5cca36d6249532522d8090 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 18 Feb 2026 07:58:50 +0100 Subject: [PATCH 260/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index dae7254..a945304 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-17" + released: "2026-02-18" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 0c3244066577ae7954c71fd64eadeba7d59a7988 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 19 Feb 2026 07:57:53 +0100 Subject: [PATCH 261/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index a945304..a54c57b 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-18" + released: "2026-02-19" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 69274514e8585b126e212cf3c48abdb2726193fa Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 20 Feb 2026 07:53:01 +0100 Subject: [PATCH 262/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index a54c57b..c91599e 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-19" + released: "2026-02-20" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From aa55b1f9333e7c42d960a0aa641cf9f0b23788e3 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 21 Feb 2026 07:38:14 +0100 Subject: [PATCH 263/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index c91599e..877aad9 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-20" + released: "2026-02-21" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 11252d6c128118ae083f7e3493c1b1ffc7f09430 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 23 Feb 2026 08:01:47 +0100 Subject: [PATCH 264/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 877aad9..2cde8a0 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-21" + released: "2026-02-23" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From b97c78ee0e0917faecce57ef0d48cd248e57d392 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 24 Feb 2026 07:57:20 +0100 Subject: [PATCH 265/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 2cde8a0..bfbba1a 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-23" + released: "2026-02-24" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 8f2719da060c545744074f923d7eda7c6c2772d2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 25 Feb 2026 07:59:42 +0100 Subject: [PATCH 266/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index bfbba1a..1e51f15 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-24" + released: "2026-02-25" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ace848160852e86b5f71508cd38ad31f51e18c8d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 26 Feb 2026 07:57:15 +0100 Subject: [PATCH 267/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 1e51f15..de65c5d 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-25" + released: "2026-02-26" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 5dfe826f0126b398f2bd5cd218af322666a53fc5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 27 Feb 2026 07:48:15 +0100 Subject: [PATCH 268/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index de65c5d..8bd437d 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-26" + released: "2026-02-27" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d6979bf58778f04c48a29a2c8c175ccd0a921306 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 28 Feb 2026 07:34:15 +0100 Subject: [PATCH 269/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 8bd437d..9af810e 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-27" + released: "2026-02-28" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 13558a1a13d5d7e33eab3ed890f6e5485b9d3a2c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 1 Mar 2026 07:42:13 +0100 Subject: [PATCH 270/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 9af810e..7946877 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-02-28" + released: "2026-03-01" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 6ecde44a2585eeecfc92773bbc2be4287831681e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 2 Mar 2026 07:54:17 +0100 Subject: [PATCH 271/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 7946877..af8e3aa 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-01" + released: "2026-03-02" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 8974dab0de9ab50de7009113f104a594accd1c9d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 3 Mar 2026 07:46:04 +0100 Subject: [PATCH 272/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index af8e3aa..87c10a4 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-02" + released: "2026-03-03" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 09d99d99962703610c0ff6592671a9a6e5e89564 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 4 Mar 2026 07:43:19 +0100 Subject: [PATCH 273/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 87c10a4..ed77340 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-03" + released: "2026-03-04" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 4326ce19496c1477fe883a46459477da281d75f5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 5 Mar 2026 07:46:34 +0100 Subject: [PATCH 274/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index ed77340..5f81709 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-04" + released: "2026-03-05" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From e97f0caf8f0e1eea93c917c0aaf000e2c925a521 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 6 Mar 2026 07:43:05 +0100 Subject: [PATCH 275/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 5f81709..e42adc2 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-05" + released: "2026-03-06" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From cef39f152d0ea75933b7814c1096c0b74f24d403 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 7 Mar 2026 07:36:31 +0100 Subject: [PATCH 276/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index e42adc2..0b98411 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-06" + released: "2026-03-07" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c20f6e5be2a33c4006edfa66dad20270816c4b61 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 8 Mar 2026 07:39:12 +0100 Subject: [PATCH 277/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 0b98411..1ea81c8 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-07" + released: "2026-03-08" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From dbc4fceaf17a712382b30dcdc91be0ab9deb532a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 9 Mar 2026 07:58:24 +0100 Subject: [PATCH 278/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 1ea81c8..29889c9 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-08" + released: "2026-03-09" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From fb84d708591ea0299183d1b51886f916e6ea4501 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 10 Mar 2026 07:43:58 +0100 Subject: [PATCH 279/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 29889c9..322dcb9 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-09" + released: "2026-03-10" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 039a4016976a5cc588537b4de9d660e3bf53dfae Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 11 Mar 2026 07:47:36 +0100 Subject: [PATCH 280/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 322dcb9..aeef544 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-10" + released: "2026-03-11" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 847d1b087887e7f768627d78dfd60b7661c3ee99 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 12 Mar 2026 07:50:30 +0100 Subject: [PATCH 281/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index aeef544..4e70683 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-11" + released: "2026-03-12" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From fdf0c5e3ff83c0810165a26d1249169332ba50ae Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 13 Mar 2026 07:47:37 +0100 Subject: [PATCH 282/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4e70683..07edf04 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-12" + released: "2026-03-13" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 8179fec30177568854533524e833b67cf3d23f27 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 14 Mar 2026 07:42:13 +0100 Subject: [PATCH 283/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 07edf04..4b95cee 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-13" + released: "2026-03-14" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 3eb245e126f0d54f0fd3cd43265077167e9ebb98 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 15 Mar 2026 07:53:05 +0100 Subject: [PATCH 284/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4b95cee..55fcded 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-14" + released: "2026-03-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 97d66cac4becc271f44cfa52108b5f0e3e5a49e8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 16 Mar 2026 08:12:52 +0100 Subject: [PATCH 285/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 55fcded..955e7d8 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-15" + released: "2026-03-16" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 783d47024964540fdb775dc9ae9383950074dd2a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 17 Mar 2026 08:01:39 +0100 Subject: [PATCH 286/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 955e7d8..2b377b1 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-16" + released: "2026-03-17" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From fd3b58699818447320027bea35b8326d80019973 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 18 Mar 2026 07:59:13 +0100 Subject: [PATCH 287/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 2b377b1..5badd32 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-17" + released: "2026-03-18" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From f43688b311121e4d5decf71edfa26d42b56e07d2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 19 Mar 2026 07:55:27 +0100 Subject: [PATCH 288/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 5badd32..a9fb86e 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-18" + released: "2026-03-19" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From aa9c1c9249b4b71964afd72be3644feeb8d69242 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 20 Mar 2026 07:50:58 +0100 Subject: [PATCH 289/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index a9fb86e..88b6006 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-19" + released: "2026-03-20" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 1535f68fef36c903a630422aec7d2094d9ef7bf7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 21 Mar 2026 07:39:24 +0100 Subject: [PATCH 290/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 88b6006..f9306fe 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-20" + released: "2026-03-21" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d2cde0ee27ef5a0c3412f75638fe755c04b07ad8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 22 Mar 2026 07:46:40 +0100 Subject: [PATCH 291/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f9306fe..60db8a8 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-21" + released: "2026-03-22" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c7a1d5cb2eec3028ccbde5abc88c7846165ba66e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 23 Mar 2026 08:06:27 +0100 Subject: [PATCH 292/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 60db8a8..b42daff 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-22" + released: "2026-03-23" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From a624e3f389f6ce085e26507c22967aaaa7dd1d1d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 24 Mar 2026 08:01:07 +0100 Subject: [PATCH 293/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index b42daff..0bef5b7 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-23" + released: "2026-03-24" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ab853e275f0654dfb4c5089aece920c03d0101d8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 25 Mar 2026 07:59:45 +0100 Subject: [PATCH 294/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 0bef5b7..c04b49c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-24" + released: "2026-03-25" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 14e0945e04d8a92cad08e3a697052939e8803d34 Mon Sep 17 00:00:00 2001 From: Piyush Gupta Date: Mon, 23 Mar 2026 15:17:39 +0530 Subject: [PATCH 295/370] removed depreciated dimensionsString block --- yaml-generation/generateDimensions.php | 10 ---------- 1 file changed, 10 deletions(-) diff --git a/yaml-generation/generateDimensions.php b/yaml-generation/generateDimensions.php index bd057a7..5a504d7 100644 --- a/yaml-generation/generateDimensions.php +++ b/yaml-generation/generateDimensions.php @@ -163,16 +163,6 @@ } -// Post-process to add activity name as comment for `dependsOn` -$dimensionsString = yaml_emit($dimensionsAggregated); -preg_match_all('/\{!([0-9a-z-]{30,})!\}/', $dimensionsString, $matches); -$uuids = array_unique($matches[1]); -foreach ($uuids as $uuid) { - $name = getActivityNameByUuid($uuid, $dimensionsAggregated); - // echo "Adding dependsOn-comment for $uuid: $name\n"; - $dimensionsString = str_replace("'{!$uuid!}'", "$uuid # $name", $dimensionsString); -} - // Store generated data with meta document first $metaDocument = array( 'meta' => array( From 8319622b485aecb627720fe1ef3dbddf946b343f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 26 Mar 2026 08:04:40 +0100 Subject: [PATCH 296/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index c04b49c..3a1b8a5 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-25" + released: "2026-03-26" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 46f8050f3d17a46a870bd44b8218a0b85884dc6d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 27 Mar 2026 08:03:43 +0100 Subject: [PATCH 297/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 3a1b8a5..9175839 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-26" + released: "2026-03-27" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From aec524e2a90539cd452ee339bf2424d49831b66c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 28 Mar 2026 07:55:55 +0100 Subject: [PATCH 298/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 9175839..c9dbeb8 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-27" + released: "2026-03-28" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c066f7201893eeb1eed514b98f0e230af9a8dd48 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 29 Mar 2026 08:59:47 +0200 Subject: [PATCH 299/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index c9dbeb8..32d48a9 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-28" + released: "2026-03-29" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ca8922349470140337f2c5256210d82e561a6564 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 30 Mar 2026 09:24:36 +0200 Subject: [PATCH 300/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 32d48a9..3187cd9 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-29" + released: "2026-03-30" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ba846ddf4516c7837f200ba7125b7ff9a3390bce Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 31 Mar 2026 09:09:19 +0200 Subject: [PATCH 301/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 3187cd9..b2baa39 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-30" + released: "2026-03-31" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From a0fdf9beffef9d727255f8aac1c994ecd07942f9 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 1 Apr 2026 09:16:16 +0200 Subject: [PATCH 302/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index b2baa39..49933c5 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-03-31" + released: "2026-04-01" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From a4cd691086da42ae1e692dbda8fdba350e488fd0 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 2 Apr 2026 09:08:23 +0200 Subject: [PATCH 303/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 49933c5..3cf30c6 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-01" + released: "2026-04-02" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 62bea04c9f1d71c31fc20a014dd27cdc665b6917 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 3 Apr 2026 09:04:23 +0200 Subject: [PATCH 304/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 3cf30c6..e5d011a 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-02" + released: "2026-04-03" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 9c01e902d97584127ca2c0d5a997caf9bff636dd Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 4 Apr 2026 08:57:05 +0200 Subject: [PATCH 305/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index e5d011a..dc106ca 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-03" + released: "2026-04-04" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From fda3b250ae9325b8c10f23318c9f0768eaa60b98 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 5 Apr 2026 09:01:48 +0200 Subject: [PATCH 306/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index dc106ca..6228121 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-04" + released: "2026-04-05" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From b4c530e419a1b552b3d4d6bdaf6a059aecf70a30 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 6 Apr 2026 09:25:28 +0200 Subject: [PATCH 307/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 6228121..f580169 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-05" + released: "2026-04-06" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 1d4d342794103563d2f78fbd29b7f115593ec6d3 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 7 Apr 2026 09:11:19 +0200 Subject: [PATCH 308/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f580169..e507d81 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-06" + released: "2026-04-07" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 722736c1a0a9b2346023b67363af62047801886f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 8 Apr 2026 09:14:08 +0200 Subject: [PATCH 309/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index e507d81..9ee96e6 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-07" + released: "2026-04-08" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From e20fa408a864a02bdef82df13a53d3b764361c6c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 9 Apr 2026 09:17:48 +0200 Subject: [PATCH 310/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 9ee96e6..96dab06 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-08" + released: "2026-04-09" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From f76481bd4c3044f26c8deb991b722c02b4b718e5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 10 Apr 2026 09:22:51 +0200 Subject: [PATCH 311/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 96dab06..4179578 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-09" + released: "2026-04-10" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c6bef4df232602fe87550d461f1e13ef2872f214 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 11 Apr 2026 08:57:44 +0200 Subject: [PATCH 312/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4179578..7968d93 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-10" + released: "2026-04-11" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From b54eef8ceb47b0b4dd17454e9022cbb9a745f756 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 12 Apr 2026 09:10:09 +0200 Subject: [PATCH 313/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 7968d93..01f90da 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-11" + released: "2026-04-12" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ee5fa8e8c5c47e4a7cf1702e9dd72ba8867a2858 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 13 Apr 2026 09:57:39 +0200 Subject: [PATCH 314/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 01f90da..2e0f363 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-12" + released: "2026-04-13" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 41a9eed53074cb4ede0d05e5f328a1a8162b6359 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 14 Apr 2026 09:26:01 +0200 Subject: [PATCH 315/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 2e0f363..900431c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-13" + released: "2026-04-14" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From cfab9ae11eb277540aa47b18e63025cb11391eb7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 15 Apr 2026 09:26:35 +0200 Subject: [PATCH 316/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 900431c..bd9de51 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-14" + released: "2026-04-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From bb72c3be184ff92fd8055248a306cac3524edf28 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 16 Apr 2026 09:27:04 +0200 Subject: [PATCH 317/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index bd9de51..edeef8e 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-15" + released: "2026-04-16" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 45acfd91bf5fabbc59ea18c69a6d5b660f024cd7 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 17 Apr 2026 09:28:00 +0200 Subject: [PATCH 318/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index edeef8e..514e905 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-16" + released: "2026-04-17" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 2505623bd8cbb520b5d7d23573930235a9c9c125 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 18 Apr 2026 09:03:27 +0200 Subject: [PATCH 319/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 514e905..ee14fd7 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-17" + released: "2026-04-18" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From cd78add95f6556a89178bfcf8a66ec027aed588f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 19 Apr 2026 09:15:03 +0200 Subject: [PATCH 320/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index ee14fd7..85bdbc2 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-18" + released: "2026-04-19" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 977f5bcf76775a06ea8b7b6106d368d6368024a2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 20 Apr 2026 10:01:48 +0200 Subject: [PATCH 321/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 85bdbc2..8ed10b8 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-19" + released: "2026-04-20" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 849f000cca4f014eed13a50b9c28bf1c5838f117 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 21 Apr 2026 09:30:29 +0200 Subject: [PATCH 322/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 8ed10b8..d7ad274 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-20" + released: "2026-04-21" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ac437e7ed88fc889bc42288d08baed829b072f3f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 22 Apr 2026 09:27:52 +0200 Subject: [PATCH 323/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index d7ad274..3cf4db9 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-21" + released: "2026-04-22" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 756d404d6b98aa63f92b4f6ad0a042130379367f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 23 Apr 2026 09:46:07 +0200 Subject: [PATCH 324/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 3cf4db9..f67ac79 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-22" + released: "2026-04-23" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 7470767c0b8df9636f811788de94a1c8d58323ad Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 24 Apr 2026 09:57:18 +0200 Subject: [PATCH 325/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f67ac79..3bc4998 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-23" + released: "2026-04-24" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 7223d8deec4082e3be3ff09cdf6b4e8d4e914f5d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 25 Apr 2026 09:10:02 +0200 Subject: [PATCH 326/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 3bc4998..2e43a0b 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-24" + released: "2026-04-25" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From a9584f525be92c5f1748604543123ef771bdad53 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 26 Apr 2026 09:24:46 +0200 Subject: [PATCH 327/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 2e43a0b..198a28c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-25" + released: "2026-04-26" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From f889bca3e8485a9bc67302d42b41d4ba4bbf1b23 Mon Sep 17 00:00:00 2001 From: Venkata Pavan Kumar Gummadi Date: Sun, 26 Apr 2026 22:51:09 -0400 Subject: [PATCH 328/370] feat: add Canary deployment activity to Deployment dimension DSOMM defines Blue/Green Deployment (Level 5) and Rolling update on deployment (Level 3) as standalone activities, but Canary - the third standard progressive-delivery strategy - is only mentioned in passing inside another activity's description. This PR adds Canary deployment as a standalone Level 4 activity, sitting between Rolling and Blue/Green on the risk/cost trade-off curve. Schema, references (SAMM2 / ISO 27001:2017 / ISO 27001:2022), and dependsOn structure follow the patterns of the adjacent activities. --- .../BuildAndDeployment/Deployment.yaml | 64 +++++++++++++++++++ src/assets/YAML/default/implementations.yaml | 5 ++ 2 files changed, 69 insertions(+) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index 451abfc..d2223ad 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -38,6 +38,70 @@ Build and Deployment: isImplemented: false evidence: "" comments: "" + Canary deployment: + uuid: c4204a32-2545-4424-b524-d1cc52b46abd + description: |- + A *canary deployment* gradually shifts a small fraction of production + traffic to a new artifact version while monitoring service-level + indicators and security signals. If error rates, latency, or security + scanners (such as DAST probes against the canary fleet) report + anomalies, traffic is rolled back automatically before the new + version reaches the broader production population. + + Compared to *Blue/Green Deployment*, canary requires only a small + delta in infrastructure cost (commonly 5-10% additional capacity + rather than a doubled environment) but demands more sophisticated + traffic-control infrastructure such as a service mesh, an + application load balancer with weighted routing, or a feature-flag + platform. + risk: |- + A new artifact version can introduce regressions or security + issues. Promoting it to 100% of production traffic in one step + exposes the entire user population to those issues before they + can be detected. + measure: |- + Adopt a canary deployment strategy in which a small percentage of + production traffic (commonly 1-10%) is routed to the new artifact + version for a defined observation window. Promotion to higher + traffic percentages is gated on automated SLI checks (error rate, + latency, saturation) and security checks (DAST, runtime anomaly + detection). Rollback must be automated and triggered by gate + failure without human intervention. + assessment: | + - Canary stage exists in the deployment pipeline with a configured + initial traffic percentage and observation window. + - Automated promotion and rollback gates are defined based on SLIs + and security signals. + - Audit logs of canary deployments and their promotion or rollback + decisions are retained. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/canary-deployment + dependsOn: + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process + references: + samm2: + - I-SD-A-3 + iso27001-2017: + - 12.1.2 # Change management + - 12.5.1 # Installation of software on operational systems + - 14.2.2 # System change control procedures + - 14.2.9 # System acceptance testing + - 17.2.1 # Availability of information processing facilities + iso27001-2022: + - 8.14 + - 8.19 + - 8.29 + - 8.31 + - 8.32 + isImplemented: false + evidence: "" + comments: "" Defined decommissioning process: uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 description: |- diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 63c383b..5c92b49 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -75,6 +75,11 @@ implementations: name: Blue/Green Deployments tags: [] url: https://martinfowler.com/bliki/BlueGreenDeployment.html + canary-deployment: + uuid: cd49f792-a158-4b93-ac55-fd773954b217 + name: Canary release + tags: [] + url: https://martinfowler.com/bliki/CanaryRelease.html docker: uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba name: Docker From 03b33bdd8ede00048a11278ea5562cca878c191c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 27 Apr 2026 10:16:08 +0200 Subject: [PATCH 329/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.2.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 198a28c..5e24087 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.2.0 - released: "2026-04-26" + released: "2026-04-27" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 751d5704e0458cacbab6f5585367e7e40e527685 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 27 Apr 2026 11:05:18 +0200 Subject: [PATCH 330/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.0?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 + generated/dependency-tree.md | 426 ++++++++++++++++++----------------- generated/model.yaml | 73 +++++- 3 files changed, 293 insertions(+), 213 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 932faf6..a63ab39 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +# [4.3.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v4.2.0...v4.3.0) (2026-04-27) + + +### Features + +* add Canary deployment activity to Deployment dimension ([f889bca](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/f889bca3e8485a9bc67302d42b41d4ba4bbf1b23)) + # [4.2.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v4.1.0...v4.2.0) (2026-01-28) diff --git a/generated/dependency-tree.md b/generated/dependency-tree.md index 8c75351..1c7aa3d 100644 --- a/generated/dependency-tree.md +++ b/generated/dependency-tree.md @@ -19,105 +19,106 @@ graph LR 11(L2 Environment depending configuration parameters secrets) 12(L3 Inventory of production dependencies) 13(L3 Rolling update on deployment) -14(L4 Same artifact for environments) -15(L4 Usage of feature toggles) -16(L5 Blue/Green Deployment) -17(L4 Smoke Test) -18(L2 Automated merge of automated PRs) -19(L1 Automated PRs for patches) -20(L3 Automated deployment of automated PRs) -21(L3 Creation of simple abuse stories) -22(L1 Conduction of simple threat modeling on technical level) -23(L3 Creation of threat modeling processes and standards) -24(L4 Conduction of advanced threat modeling) -25(L5 Creation of advanced abuse stories) -26(L2 Regular security training of security champions) -27(L2 Each team has a security champion) -28(L2 Determining the protection requirement) -29(L2 App. Hardening Level 1) -30(L1 App. Hardening Level 1 50%) -31(L3 App. Hardening Level 2 75%) -32(L4 App. Hardening Level 2) -33(L5 App. Hardening Level 3) -34(L3 Block force pushes) -35(L2 Require a PR before merging) -36(L3 Dismiss stale PR approvals) -37(L3 Require status checks to pass) -38(L2 Backup) -39(L2 MFA) -40(L1 MFA for admins) -41(L2 Usage of test and production environments) -42(L2 Virtual environments are limited) -43(L2 Applications are running in virtualized environments) -44(L3 Immutable infrastructure) -45(L3 Infrastructure as Code) -46(L3 Limitation of system events) -47(L3 Audit of system events) -48(L3 Usage of security by default for components) -49(L3 WAF baseline) -50(L1 Context-aware output encoding) -51(L4 Production near environments are used by developers) -52(L4 WAF medium) -53(L5 WAF Advanced) -54(L2 Centralized application logging) -55(L2 Alerting) -56(L3 Visualized logging) -57(L1 Centralized system logging) -58(L5 Correlation of security events) -59(L2 Visualized metrics) -60(L2 Monitoring of costs) -61(L1 Simple application metrics) -62(L1 Simple system metrics) -63(L3 Advanced availability and stability metrics) -64(L3 Deactivation of unused metrics) -65(L3 Targeted alerting) -66(L4 Advanced app. metrics) -67(L4 Coverage and control metrics) -68(L4 Defense metrics) -69(L3 Filter outgoing traffic) -70(L4 Screens with metric visualization) -71(L3 Grouping of metrics) -72(L5 Metrics are combined with tests) -73(L2 Patching mean time to resolution via PR) -74(L3 Generation of response statistics) -75(L3 Usage of a vulnerability management system) -76(L4 Patching mean time to resolution via production) -77(L2 Artifact-based false positive treatment) -78(L1 Simple false positive treatment) -79(L3 Fix based on accessibility) -80(L1 Treatment of defects with high or critical severity) -81(L3 Global false positive treatment) -82(L2 Exploit likelihood estimation) -83(L3 Office Hours) -84(L2 Coverage of client side dynamic components) -85(L2 Usage of different roles) -86(L2 Simple Scan) -87(L3 Coverage of hidden endpoints) -88(L3 Coverage of more input vectors) -89(L3 Coverage of sequential operations) -90(L4 Usage of multiple scanners) -91(L5 Coverage of service to service communication) -92(L2 Test for exposed services) -93(L2 Isolated networks for virtual environments) -94(L2 Test network segmentation) -95(L3 Test for unauthorized installation) -96(L2 Evaluation of the trust of used components) -97(L2 Software Composition Analysis server side) -98(L2 Test for Time to Patch) -99(L2 Test libyear) -100(L3 API design validation) -101(L3 Software Composition Analysis client side) -102(L3 Static analysis for important client side components) -103(L3 Static analysis for important server side components) -104(L3 Test for Patch Deployment Time) -105(L4 Static analysis for all self written components) -106(L4 Usage of multiple analyzers) -107(L5 Dead code elimination) -108(L5 Exclusion of source code duplicates) -109(L5 Static analysis for all components/libraries) -110(L4 Correlate known vulnerabilities in infrastructure with new image versions) -111(L2 Usage of a maximum lifetime for images) -112(L4 Test of infrastructure components for known vulnerabilities) +14(L4 Canary deployment) +15(L4 Same artifact for environments) +16(L4 Usage of feature toggles) +17(L5 Blue/Green Deployment) +18(L4 Smoke Test) +19(L2 Automated merge of automated PRs) +20(L1 Automated PRs for patches) +21(L3 Automated deployment of automated PRs) +22(L3 Creation of simple abuse stories) +23(L1 Conduction of simple threat modeling on technical level) +24(L3 Creation of threat modeling processes and standards) +25(L4 Conduction of advanced threat modeling) +26(L5 Creation of advanced abuse stories) +27(L2 Regular security training of security champions) +28(L2 Each team has a security champion) +29(L2 Determining the protection requirement) +30(L2 App. Hardening Level 1) +31(L1 App. Hardening Level 1 50%) +32(L3 App. Hardening Level 2 75%) +33(L4 App. Hardening Level 2) +34(L5 App. Hardening Level 3) +35(L3 Block force pushes) +36(L2 Require a PR before merging) +37(L3 Dismiss stale PR approvals) +38(L3 Require status checks to pass) +39(L2 Backup) +40(L2 MFA) +41(L1 MFA for admins) +42(L2 Usage of test and production environments) +43(L2 Virtual environments are limited) +44(L2 Applications are running in virtualized environments) +45(L3 Immutable infrastructure) +46(L3 Infrastructure as Code) +47(L3 Limitation of system events) +48(L3 Audit of system events) +49(L3 Usage of security by default for components) +50(L3 WAF baseline) +51(L1 Context-aware output encoding) +52(L4 Production near environments are used by developers) +53(L4 WAF medium) +54(L5 WAF Advanced) +55(L2 Centralized application logging) +56(L2 Alerting) +57(L3 Visualized logging) +58(L1 Centralized system logging) +59(L5 Correlation of security events) +60(L2 Visualized metrics) +61(L2 Monitoring of costs) +62(L1 Simple application metrics) +63(L1 Simple system metrics) +64(L3 Advanced availability and stability metrics) +65(L3 Deactivation of unused metrics) +66(L3 Targeted alerting) +67(L4 Advanced app. metrics) +68(L4 Coverage and control metrics) +69(L4 Defense metrics) +70(L3 Filter outgoing traffic) +71(L4 Screens with metric visualization) +72(L3 Grouping of metrics) +73(L5 Metrics are combined with tests) +74(L2 Patching mean time to resolution via PR) +75(L3 Generation of response statistics) +76(L3 Usage of a vulnerability management system) +77(L4 Patching mean time to resolution via production) +78(L2 Artifact-based false positive treatment) +79(L1 Simple false positive treatment) +80(L3 Fix based on accessibility) +81(L1 Treatment of defects with high or critical severity) +82(L3 Global false positive treatment) +83(L2 Exploit likelihood estimation) +84(L3 Office Hours) +85(L2 Coverage of client side dynamic components) +86(L2 Usage of different roles) +87(L2 Simple Scan) +88(L3 Coverage of hidden endpoints) +89(L3 Coverage of more input vectors) +90(L3 Coverage of sequential operations) +91(L4 Usage of multiple scanners) +92(L5 Coverage of service to service communication) +93(L2 Test for exposed services) +94(L2 Isolated networks for virtual environments) +95(L2 Test network segmentation) +96(L3 Test for unauthorized installation) +97(L2 Evaluation of the trust of used components) +98(L2 Software Composition Analysis server side) +99(L2 Test for Time to Patch) +100(L2 Test libyear) +101(L3 API design validation) +102(L3 Software Composition Analysis client side) +103(L3 Static analysis for important client side components) +104(L3 Static analysis for important server side components) +105(L3 Test for Patch Deployment Time) +106(L4 Static analysis for all self written components) +107(L4 Usage of multiple analyzers) +108(L5 Dead code elimination) +109(L5 Exclusion of source code duplicates) +110(L5 Static analysis for all components/libraries) +111(L4 Correlate known vulnerabilities in infrastructure with new image versions) +112(L2 Usage of a maximum lifetime for images) +113(L4 Test of infrastructure components for known vulnerabilities) 1 --> 0 @@ -126,144 +127,145 @@ graph LR 1 --> 4 1 --> 5 1 --> 6 -1 --> 14 -1 --> 48 -1 --> 86 -1 --> 97 -1 --> 99 -1 --> 101 +1 --> 15 +1 --> 49 +1 --> 87 +1 --> 98 +1 --> 100 1 --> 102 1 --> 103 1 --> 104 -1 --> 107 +1 --> 105 1 --> 108 +1 --> 109 0 --> 4 6 --> 5 -6 --> 38 -6 --> 41 +6 --> 39 +6 --> 42 7 --> 6 5 --> 8 5 --> 9 5 --> 13 -5 --> 51 -5 --> 17 +5 --> 14 +5 --> 52 +5 --> 18 8 --> 9 -8 --> 28 -8 --> 79 -8 --> 97 -8 --> 100 +8 --> 29 +8 --> 80 +8 --> 98 8 --> 101 8 --> 102 8 --> 103 -8 --> 105 -8 --> 109 +8 --> 104 +8 --> 106 +8 --> 110 11 --> 10 9 --> 12 2 --> 12 -14 --> 15 -17 --> 16 -19 --> 18 -19 --> 73 -19 --> 76 -19 --> 98 -19 --> 104 -18 --> 20 -22 --> 21 -22 --> 23 -22 --> 24 -23 --> 21 +15 --> 16 +18 --> 17 +20 --> 19 +20 --> 74 +20 --> 77 +20 --> 99 +20 --> 105 +19 --> 21 +23 --> 22 23 --> 24 -21 --> 25 -27 --> 26 -27 --> 75 -30 --> 29 -29 --> 31 -31 --> 32 +23 --> 25 +24 --> 22 +24 --> 25 +22 --> 26 +28 --> 27 +28 --> 76 +31 --> 30 +30 --> 32 32 --> 33 -35 --> 34 -35 --> 36 -35 --> 37 -40 --> 39 -43 --> 42 -45 --> 44 -45 --> 51 -47 --> 46 -50 --> 49 -49 --> 52 -52 --> 53 -55 --> 54 -55 --> 58 -55 --> 65 -57 --> 56 -54 --> 56 -56 --> 58 -59 --> 55 -59 --> 63 -59 --> 47 -59 --> 64 -59 --> 66 -59 --> 67 -59 --> 68 -61 --> 60 -61 --> 59 -61 --> 63 -61 --> 66 +33 --> 34 +36 --> 35 +36 --> 37 +36 --> 38 +41 --> 40 +44 --> 43 +46 --> 45 +46 --> 52 +48 --> 47 +51 --> 50 +50 --> 53 +53 --> 54 +56 --> 55 +56 --> 59 +56 --> 66 +58 --> 57 +55 --> 57 +57 --> 59 +60 --> 56 +60 --> 64 +60 --> 48 +60 --> 65 +60 --> 67 +60 --> 68 +60 --> 69 +62 --> 61 62 --> 60 -62 --> 59 -69 --> 68 -71 --> 70 -71 --> 72 -75 --> 74 -75 --> 81 -73 --> 76 -78 --> 77 -80 --> 79 -77 --> 81 -82 --> 75 -82 --> 101 -83 --> 75 -85 --> 84 -85 --> 87 -85 --> 88 -85 --> 89 -85 --> 90 +62 --> 64 +62 --> 67 +63 --> 61 +63 --> 60 +70 --> 69 +72 --> 71 +72 --> 73 +76 --> 75 +76 --> 82 +74 --> 77 +79 --> 78 +81 --> 80 +78 --> 82 +83 --> 76 +83 --> 102 +84 --> 76 86 --> 85 +86 --> 88 +86 --> 89 +86 --> 90 86 --> 91 -93 --> 92 -93 --> 94 -96 --> 95 -97 --> 82 -97 --> 106 -102 --> 105 -102 --> 109 -103 --> 105 -103 --> 109 -101 --> 106 -105 --> 106 -111 --> 110 -111 --> 112 +87 --> 86 +87 --> 92 +94 --> 93 +94 --> 95 +97 --> 96 +98 --> 83 +98 --> 107 +103 --> 106 +103 --> 110 +104 --> 106 +104 --> 110 +102 --> 107 +106 --> 107 +112 --> 111 +112 --> 113 O --> 1 O --> 7 O --> 11 -O --> 19 -O --> 22 -O --> 27 -O --> 30 -O --> 35 -O --> 40 -O --> 43 -O --> 45 -O --> 50 -O --> 57 -O --> 61 +O --> 20 +O --> 23 +O --> 28 +O --> 31 +O --> 36 +O --> 41 +O --> 44 +O --> 46 +O --> 51 +O --> 58 O --> 62 -O --> 69 -O --> 71 -O --> 78 -O --> 80 -O --> 83 -O --> 93 -O --> 96 -O --> 111 +O --> 63 +O --> 70 +O --> 72 +O --> 79 +O --> 81 +O --> 84 +O --> 94 +O --> 97 +O --> 112 ``` diff --git a/generated/model.yaml b/generated/model.yaml index 5e24087..ef4a5a4 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 4.2.0 + version: 4.3.0 released: "2026-04-27" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- @@ -794,6 +794,77 @@ Build and Deployment: comments: "" tags: - none + Canary deployment: + uuid: c4204a32-2545-4424-b524-d1cc52b46abd + description: |- + A *canary deployment* gradually shifts a small fraction of production + traffic to a new artifact version while monitoring service-level + indicators and security signals. If error rates, latency, or security + scanners (such as DAST probes against the canary fleet) report + anomalies, traffic is rolled back automatically before the new + version reaches the broader production population. + + Compared to *Blue/Green Deployment*, canary requires only a small + delta in infrastructure cost (commonly 5-10% additional capacity + rather than a doubled environment) but demands more sophisticated + traffic-control infrastructure such as a service mesh, an + application load balancer with weighted routing, or a feature-flag + platform. + risk: |- + A new artifact version can introduce regressions or security + issues. Promoting it to 100% of production traffic in one step + exposes the entire user population to those issues before they + can be detected. + measure: |- + Adopt a canary deployment strategy in which a small percentage of + production traffic (commonly 1-10%) is routed to the new artifact + version for a defined observation window. Promotion to higher + traffic percentages is gated on automated SLI checks (error rate, + latency, saturation) and security checks (DAST, runtime anomaly + detection). Rollback must be automated and triggered by gate + failure without human intervention. + assessment: | + - Canary stage exists in the deployment pipeline with a configured + initial traffic percentage and observation window. + - Automated promotion and rollback gates are defined based on SLIs + and security signals. + - Audit logs of canary deployments and their promotion or rollback + decisions are retained. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - uuid: cd49f792-a158-4b93-ac55-fd773954b217 + name: Canary release + tags: [] + url: https://martinfowler.com/bliki/CanaryRelease.html + dependsOn: + - 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process + references: + samm2: + - I-SD-A-3 + iso27001-2017: + - 12.1.2 + - 12.5.1 + - 14.2.2 + - 14.2.9 + - 17.2.1 + iso27001-2022: + - 8.14 + - 8.19 + - 8.29 + - 8.31 + - 8.32 + openCRE: + - https://www.opencre.org/node/standard/DevSecOps%20Maturity%20Model%20%28DSOMM%29/section/Deployment/subsection/Canary%20deployment + isImplemented: false + evidence: "" + comments: "" + tags: + - none Same artifact for environments: uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f risk: Building of an artifact for different environments means that an untested From dc6af16d6aa497563c2f27110ed4308c20c363d7 Mon Sep 17 00:00:00 2001 From: Venkata Pavan Kumar Gummadi Date: Mon, 27 Apr 2026 06:35:34 -0400 Subject: [PATCH 331/370] fix: correct typo in blue-green-deployment implementation key The implementation key in implementations.yaml was misspelled as 'blue-green-deploymen' (missing trailing 't'). Renames the key to 'blue-green-deployment' and updates the corresponding $ref in BuildAndDeployment/Deployment.yaml. The implementation UUID (4fb3d95c-07c0-4cbb-b396-5054aba751c2) is unchanged, so this is a label-only fix with no semantic impact on existing data files or downstream consumers that look up by UUID. Noted as out-of-scope in PR #76 and is now followed up here as a separate focused PR. --- src/assets/YAML/default/BuildAndDeployment/Deployment.yaml | 2 +- src/assets/YAML/default/implementations.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml index d2223ad..4e5b445 100755 --- a/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml +++ b/src/assets/YAML/default/BuildAndDeployment/Deployment.yaml @@ -15,7 +15,7 @@ Build and Deployment: usefulness: 2 level: 5 implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/blue-green-deploymen + - $ref: src/assets/YAML/default/implementations.yaml#/implementations/blue-green-deployment dependsOn: - Smoke Test references: diff --git a/src/assets/YAML/default/implementations.yaml b/src/assets/YAML/default/implementations.yaml index 5c92b49..8d590ae 100755 --- a/src/assets/YAML/default/implementations.yaml +++ b/src/assets/YAML/default/implementations.yaml @@ -70,7 +70,7 @@ implementations: uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 name: A Point in Time Recovery for databases should be implemented. tags: [] - blue-green-deploymen: + blue-green-deployment: uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 name: Blue/Green Deployments tags: [] From 676ec32b84df2a821f48ee534f64a43f26a97234 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 27 Apr 2026 13:34:05 +0200 Subject: [PATCH 332/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- CHANGELOG.md | 7 +++++++ generated/model.yaml | 2 +- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index a63ab39..61e7414 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,10 @@ +## [4.3.1](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v4.3.0...v4.3.1) (2026-04-27) + + +### Bug Fixes + +* correct typo in blue-green-deployment implementation key ([dc6af16](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/dc6af16d6aa497563c2f27110ed4308c20c363d7)), closes [#76](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/issues/76) + # [4.3.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v4.2.0...v4.3.0) (2026-04-27) diff --git a/generated/model.yaml b/generated/model.yaml index ef4a5a4..707218a 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,6 +1,6 @@ --- meta: - version: 4.3.0 + version: 4.3.1 released: "2026-04-27" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- From 708fae656af9ae5bf218446765f1a69f6117c2d9 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 28 Apr 2026 10:18:06 +0200 Subject: [PATCH 333/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 707218a..f2214b2 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-04-27" + released: "2026-04-28" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 2a93f5c8b177be4f2184edd2fcb23b141315dc84 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 29 Apr 2026 10:10:44 +0200 Subject: [PATCH 334/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f2214b2..035f359 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-04-28" + released: "2026-04-29" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 2e80c497fd895bd2287cf06c118eafc1c8c6335d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 30 Apr 2026 10:14:52 +0200 Subject: [PATCH 335/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 035f359..268f879 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-04-29" + released: "2026-04-30" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 50aebeea6dcecf34acb61f4c514ac4ef1b6a4a9b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 1 May 2026 10:08:59 +0200 Subject: [PATCH 336/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 268f879..46206ea 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-04-30" + released: "2026-05-01" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 34d0b6e4a82d1fe46ca20d97eff4238e6b643cc3 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 2 May 2026 09:27:58 +0200 Subject: [PATCH 337/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 46206ea..dc05e7e 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-01" + released: "2026-05-02" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ba91abf335793a183c2387164beea6c3a3a7be5e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 3 May 2026 09:57:21 +0200 Subject: [PATCH 338/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index dc05e7e..c20e703 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-02" + released: "2026-05-03" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From bff8ce6e79b1b76d7c95fa1c681db186e203497c Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 4 May 2026 10:26:03 +0200 Subject: [PATCH 339/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index c20e703..e6c2f5f 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-03" + released: "2026-05-04" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 07b05e56ef35a3b901f080a78b3b3f0fbbf427b2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 5 May 2026 10:04:31 +0200 Subject: [PATCH 340/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index e6c2f5f..44742a8 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-04" + released: "2026-05-05" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 3aae184fe67554025f639e281cee314c8a4deecd Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 6 May 2026 10:20:25 +0200 Subject: [PATCH 341/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 44742a8..ff24f84 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-05" + released: "2026-05-06" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 837dc262e099c9dfca51d80604af970393dbb8ba Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 7 May 2026 10:29:08 +0200 Subject: [PATCH 342/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index ff24f84..ea447c2 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-06" + released: "2026-05-07" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 1cb3c5f755d4f070c44957ec9e142f786446d36e Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 8 May 2026 09:25:11 +0200 Subject: [PATCH 343/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index ea447c2..f7a8eda 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-07" + released: "2026-05-08" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 2a6069c3c3fb71f2842d80800ca08609335dd30f Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 9 May 2026 09:52:24 +0200 Subject: [PATCH 344/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f7a8eda..b77cbfd 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-08" + released: "2026-05-09" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From d1bd524e38c1d39424c56c42c6b9a51a6bf26bd1 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 10 May 2026 10:04:53 +0200 Subject: [PATCH 345/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index b77cbfd..0f2acad 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-09" + released: "2026-05-10" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 7e6960a395b019891178820272c95cfb514b0055 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 11 May 2026 11:33:43 +0200 Subject: [PATCH 346/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 0f2acad..392c047 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-10" + released: "2026-05-11" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c49ee1cd2b6a3966ae60841351b0e9837724c556 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 12 May 2026 10:35:05 +0200 Subject: [PATCH 347/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 392c047..a106b5c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-11" + released: "2026-05-12" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 519390f75d4418bb5bfa7eee99e4aec463bf07bc Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 13 May 2026 10:40:10 +0200 Subject: [PATCH 348/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index a106b5c..ef6a078 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-12" + released: "2026-05-13" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 437f9bdbae18d0dc03fb645b57ddb8d14721664b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 14 May 2026 10:33:57 +0200 Subject: [PATCH 349/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index ef6a078..0b62cb5 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-13" + released: "2026-05-14" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From df652e7116b30fd3a479646ab60ac69b6794697a Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 15 May 2026 10:45:44 +0200 Subject: [PATCH 350/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 0b62cb5..f95c757 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-14" + released: "2026-05-15" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 13f0e633fdb99436e8a8303ae759e4bb5c4f3900 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 16 May 2026 09:59:19 +0200 Subject: [PATCH 351/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index f95c757..6815402 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-15" + released: "2026-05-16" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 3998d068e59fc12f7015c8a6460dd820a457981d Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 17 May 2026 10:16:46 +0200 Subject: [PATCH 352/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 6815402..075b84b 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-16" + released: "2026-05-17" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 77fcc19d9ece01a6ed5157c06206f268a7f4aaa2 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 18 May 2026 11:54:10 +0200 Subject: [PATCH 353/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 075b84b..8d15289 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-17" + released: "2026-05-18" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From a03f081c33991c239646e402029f83f274bfd9ba Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 19 May 2026 11:42:14 +0200 Subject: [PATCH 354/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 8d15289..ce0e70c 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-18" + released: "2026-05-19" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 03c2b01c4efbf97b7755df8b7fc6f51b0c16660b Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 20 May 2026 11:01:15 +0200 Subject: [PATCH 355/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index ce0e70c..842c6b9 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-19" + released: "2026-05-20" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 74f24a7e42fce6c1ea3475e31ed49d6c95895672 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 21 May 2026 11:33:16 +0200 Subject: [PATCH 356/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 842c6b9..8970287 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-20" + released: "2026-05-21" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 74f9fdcb7328eaf2769237d2437eb4ed0de7e2ab Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 22 May 2026 10:56:35 +0200 Subject: [PATCH 357/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 8970287..5e2268f 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-21" + released: "2026-05-22" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 66272b25daf6b3c2be8d7411cc490ab8e93530a8 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 23 May 2026 10:13:18 +0200 Subject: [PATCH 358/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 5e2268f..eca574f 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-22" + released: "2026-05-23" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 68b9a919d1e02731a98081dae764f742f3246372 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 24 May 2026 10:25:29 +0200 Subject: [PATCH 359/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index eca574f..6c37dfe 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-23" + released: "2026-05-24" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From be6a1016a91f565887e900aa63132da731d2f8ec Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Mon, 25 May 2026 11:58:37 +0200 Subject: [PATCH 360/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 6c37dfe..78a330b 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-24" + released: "2026-05-25" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 00324c5481c7005add53cead9acbbf1eecd06925 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 26 May 2026 11:45:20 +0200 Subject: [PATCH 361/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 78a330b..86a6aca 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-25" + released: "2026-05-26" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From c6a8c8debcb3776505db7e6a307dc25541cfd7ef Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 27 May 2026 11:39:00 +0200 Subject: [PATCH 362/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 86a6aca..9497834 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-26" + released: "2026-05-27" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 18befcdc23f8848f87ed2452e711629636ab0c56 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 28 May 2026 11:55:39 +0200 Subject: [PATCH 363/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 9497834..9718044 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-27" + released: "2026-05-28" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 7da6e9131b1c7eacc66f86f1368e3e44b620c9ac Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 29 May 2026 11:45:41 +0200 Subject: [PATCH 364/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 9718044..b0b43dc 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-28" + released: "2026-05-29" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 5b48000259cc7f95e3b3189b3357fb80fc65f6c1 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sat, 30 May 2026 10:25:00 +0200 Subject: [PATCH 365/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index b0b43dc..426982d 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-29" + released: "2026-05-30" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 3f7f8daa12d9eb4d9501e3d09cd86a1f484ff324 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Sun, 31 May 2026 10:40:51 +0200 Subject: [PATCH 366/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 426982d..4481f14 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-30" + released: "2026-05-31" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 563659bd8526a137b4f1fe0012c55f20d0b5e117 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Tue, 2 Jun 2026 12:16:10 +0200 Subject: [PATCH 367/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 4481f14..45122ef 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-05-31" + released: "2026-06-02" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From 6336eb9ae3859ec7084ebac20faf1232677b74f5 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Wed, 3 Jun 2026 12:52:41 +0200 Subject: [PATCH 368/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 45122ef..e9c3903 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-06-02" + released: "2026-06-03" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From a41b9d568402e2c6473fcf8ddcca00432ceff510 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Thu, 4 Jun 2026 11:51:24 +0200 Subject: [PATCH 369/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index e9c3903..842dd1b 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-06-03" + released: "2026-06-04" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: From ca6e5174aed85a7bdbb845cb7431fec21c224d06 Mon Sep 17 00:00:00 2001 From: Timo Pagel Date: Fri, 5 Jun 2026 11:40:00 +0200 Subject: [PATCH 370/370] =?UTF-8?q?=F0=9F=A4=96=20push=204.3.1?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- generated/model.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/generated/model.yaml b/generated/model.yaml index 842dd1b..53ab713 100644 --- a/generated/model.yaml +++ b/generated/model.yaml @@ -1,7 +1,7 @@ --- meta: version: 4.3.1 - released: "2026-06-04" + released: "2026-06-05" publisher: https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data --- Build and Deployment: