Skip to content

Commit bafdb6a

Browse files
authored
Merge pull request #46 from vbakke/feat/v4-review-level-1
Review of level 1 activities
2 parents d90e8fa + 398e1bf commit bafdb6a

File tree

18 files changed

+346
-212
lines changed

18 files changed

+346
-212
lines changed

src/assets/YAML/default/BuildAndDeployment/Build.yaml

Lines changed: 25 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ Build and Deployment:
2828
level: 2
2929
implementation:
3030
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools
31-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technologi
31+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology
3232
references:
3333
samm2:
3434
- I-SB-A-2
@@ -42,34 +42,36 @@ Build and Deployment:
4242
Defined build process:
4343
uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b
4444
description: |
45-
A *build process* include more than just compiling your source code.
46-
It also includes steps such as managing (third party) dependencies,
47-
environment configuration, running the unit tests, etc.
48-
49-
A *defined build process* has automated these steps to ensure consistency.
45+
A *build process* includes more than just compiling your source code. It also covers:
46+
- Managing (third party) dependencies
47+
- Environment configuration
48+
- Running unit and integration tests
49+
- Security scanning and compliance checks
50+
- Artifact creation and storage
51+
- Deployment preparation
5052
51-
This can be done with a Jenkinsfile, Maven, or similar tools.
53+
Basing the build process on human memory may lead to inconsistencies and security misconfigurations.
54+
55+
A *defined build process* can automate these steps to ensure consistency, avoiding accidental omissions or misconfigurations. Use tools such as Jenkins, GitHub Actions, GitLab CI, or Maven to codify the process.
56+
57+
A simplified, but still a *defined build process*, may be a checklist of the steps to be performed.
5258
risk:
53-
Performing builds without a defined process is error prone; for example,
54-
as a result of incorrect security related configuration.
59+
Without a defined and automated build process the risk increase for accidental mistakes, forgetting test activities, and insecure misconfigurations.
5560
measure:
56-
A well defined build process lowers the possibility of errors during
57-
the build process.
61+
Find a tool that suits your environment. Add your manual build steps, include steps for running tests, scanning and preparation for deployment.
62+
assessment: |
63+
- Show your build pipeline configuration (e.g., Jenkinsfile, GitHub Actions workflow) and an exemplary job (build + test + security scan).
64+
level: 1
5865
difficultyOfImplementation:
5966
knowledge: 2
6067
time: 3
6168
resources: 2
6269
usefulness: 4
63-
level: 1
64-
assessment: |
65-
- Show your build pipeline and an exemplary job (build + test).
66-
- Show that every team member has access.
67-
- Show that failed jobs are fixed.
68-
69-
Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/)
7070
implementation:
71+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkins
72+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/maven
7173
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools
72-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technologi
74+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology
7375
references:
7476
samm2:
7577
- I-SB-A-1
@@ -144,7 +146,9 @@ Build and Deployment:
144146
resources: 3
145147
usefulness: 3
146148
level: 2
147-
implementation: []
149+
implementation:
150+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy
151+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/syft
148152
references:
149153
samm2:
150154
- I-SB-B-1
@@ -156,6 +160,7 @@ Build and Deployment:
156160
- 5.9
157161
- 5.12
158162
isImplemented: false
163+
tags: ["inventory", "scanning", "sca"]
159164
evidence: ""
160165
comments: ""
161166
Signing of artifacts:

src/assets/YAML/default/BuildAndDeployment/Deployment.yaml

Lines changed: 53 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -69,23 +69,58 @@ Build and Deployment:
6969
comments: ""
7070
Defined deployment process:
7171
uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a
72+
description: |
73+
A *defined deployment process* is a documented and standardized procedure for releasing software into production, ensuring consistency and reducing the risk of errors.
7274
risk: >-
73-
Deployment of insecure or malfunctioning artifacts.
75+
Deployments relying on human memory are prone to errors, making experienced long-ter staff critical.
7476
measure: >-
75-
Defining a deployment process ensures that there are
76-
established criteria in terms of functionalities,
77-
security, compliance, and performance,
78-
and that the artifacts meet them.
77+
Establish a written deployment process documented in README files, wikis, or implemented as executable scripts and automated steps.
78+
assessment: |
79+
- Deployment process is documented and available to relevant staff
80+
- Logs of deployments are documented and availabe to relevant staff
81+
level: 1
82+
difficultyOfImplementation:
83+
knowledge: 1
84+
time: 1
85+
resources: 1
86+
usefulness: 1
87+
dependsOn:
88+
- f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process
89+
- 066084c6-1135-4635-9cc5-9e75c7c5459f # Version control
90+
implementation:
91+
references:
92+
samm2:
93+
- I-SD-A-1
94+
iso27001-2017:
95+
- 12.1.1
96+
- 14.2.2
97+
iso27001-2022:
98+
- 5.37
99+
- 8.32
100+
Automated deployment process:
101+
uuid: 67e1a9aa-9fbf-4ec5-a2de-400f01960c51
102+
description: |
103+
An *automated deployment process* implements the defined deployment steps using automation tools, ensuring consistency, auditability, and minimizing the risk of human errors or unauthorized changes.
104+
risk: >-
105+
Deployments relying on manual routines increase the risk of errors, insecure configurations, or deploying malfunctioning artifacts.
106+
measure: >-
107+
Automating the deployment process enforces predefined criteria for security, compliance, and performance, ensuring reliable artifact delivery.
108+
assessment: |
109+
- Deployment process is documented and available to relevant staff
110+
- All deployment steps are automated
111+
- Provide audit logs or evidence of deployments
112+
level: 1
79113
difficultyOfImplementation:
80114
knowledge: 2
81115
time: 2
82-
resources: 1
116+
resources: 2
83117
usefulness: 4
84-
level: 1
85118
dependsOn:
86119
- f6f7737f-25a9-4317-8de2-09bf59f29b5b # Def. Build Process
120+
- 74938a3f-1269-49b9-9d0f-c43a79a1985a # Def. Deployment Process
87121
implementation:
88122
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools
123+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkins
89124
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/docker
90125
references:
91126
samm2:
@@ -96,9 +131,6 @@ Build and Deployment:
96131
iso27001-2022:
97132
- 5.37
98133
- 8.32
99-
isImplemented: false
100-
evidence: ""
101-
comments: ""
102134
Environment depending configuration parameters (secrets):
103135
uuid: df428c9d-efa0-4226-9f47-a15bb53f822b
104136
risk: >-
@@ -209,21 +241,28 @@ Build and Deployment:
209241
tags:
210242
- inventory
211243
- sbom
244+
- scanning
245+
- sca
212246
Inventory of production components:
213247
uuid: 2a44b708-734f-4463-b0cb-86dc46344b2f
248+
description: |
249+
An inventory of production components is a complete, up-to-date list of all applications running in production. This enables effective vulnerability management, incident response, and compliance. Without it, organizations risk running unmaintained or unauthorized software.
214250
risk: |-
215251
An organization is unaware of components like applications in production. Not knowing existing applications in production leads to not assessing it.
216252
measure: |-
217253
A documented inventory of components in production exists (gathered manually or automatically). For example a manually created document with applications in production.
218254
In a kubernetes cluster, namespaces can be automatically gathered and documented, e.g. in a JSON in a S3 bucket/git repository, dependency track.
255+
assessment: |
256+
- Inventory of all production applications with application name, owner, and date of last review
257+
- Inventory is accessible to development, security and operations teams
219258
dependsOn:
220-
- Defined deployment process
259+
- 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process
260+
level: 1
221261
difficultyOfImplementation:
222262
knowledge: 1
223263
time: 1
224264
resources: 1
225265
usefulness: 4
226-
level: 1
227266
implementation:
228267
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/backstage
229268
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependencyTrack
@@ -248,7 +287,7 @@ Build and Deployment:
248287
is deployed.
249288
measure: A documented inventory of artifacts in production like container images exists (gathered manually or automatically).
250289
dependsOn:
251-
- Defined deployment process
290+
- 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process
252291
- 2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
253292
difficultyOfImplementation:
254293
knowledge: 2
@@ -287,7 +326,7 @@ Build and Deployment:
287326
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/webserver
288327
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/rolling-update
289328
dependsOn:
290-
- Defined deployment process
329+
- 67e1a9aa-9fbf-4ec5-a2de-400f01960c51 # Automated deployment process
291330
references:
292331
samm2:
293332
- I-SD-A-2

src/assets/YAML/default/BuildAndDeployment/PatchManagement.yaml

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -4,16 +4,23 @@ Build and Deployment:
44
Patch Management:
55
A patch policy is defined:
66
uuid: 99415139-6b50-441b-89e1-0aa59accd43d
7-
risk: Vulnerabilities in running artifacts stay for long and might get exploited.
7+
description: |
8+
A patch policy defines how and when software components, images, and dependencies are updated. A patch policy ensures that all these artifacts are regularly reviewed and updated, reducing the window of exposure to known threats. The policy should specify the frequency, responsibilities, and documentation requirements for patching.
9+
risk: Vulnerabilities in running artifacts may persist for a long time and might be exploited.
810
measure:
9-
A patch policy for all artifacts (e.g. in images) is defined. How often
11+
Define a patch policy for all artifacts (e.g. in images) is defined. How often
1012
is an image rebuilt?
13+
assessment: |
14+
- Patch policy is documented and accessible to relevant staff.
15+
- The policy defines patch frequency and responsible roles.
16+
- Patch actions and exceptions are logged and reviewed.
17+
- Evidence of regular patching and policy review is available.
18+
level: 1
1119
difficultyOfImplementation:
1220
knowledge: 3
1321
time: 1
1422
resources: 2
1523
usefulness: 4
16-
level: 1
1724
implementation: []
1825
references:
1926
samm2:
@@ -33,23 +40,27 @@ Build and Deployment:
3340
- patching
3441
Automated PRs for patches:
3542
uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488
36-
risk:
37-
Components with known (or unknown) vulnerabilities might stay for long and get exploited,
38-
even when a patch is available.
39-
measure:
40-
Fast patching of third party component is needed. The DevOps way is
41-
to have an automated pull request for new components. This includes
42-
43+
description: |
44+
Automated PRs for patches ensure that updates for outdated or vulnerable dependencies are created and proposed without manual intervention. Tools continuously monitor for new versions or security advisories and immediately generate pull requests to update affected components in code, container images, or infrastructure. This process ensures that available patches are quickly visible to developers and can be reviewed and merged with minimal delay, reducing the risk window for known vulnerabilities.
45+
risk: |
46+
Components with known vulnerabilities might persist for a long time and be exploited, even when a patch is available.
47+
measure: |
48+
Fast patching of third-party components is needed. The DevOps way is to have an automated pull request for new components. This includes:
4349
* Applications
44-
* Virtualized operating system components (e.g. container images)
45-
* Operating Systems
46-
* Infrastructure as Code/GitOps (e.g. argocd based on a git repository or terraform)
50+
* Virtualized operating system components (e.g., container images)
51+
* Operating systems
52+
* Infrastructure as Code/GitOps (e.g., ArgoCD based on a git repository or Terraform)
53+
assessment: |
54+
- Automated PR tooling is enabled for all relevant repositories.
55+
- PRs are created automatically for outdated or vulnerable dependencies.
56+
- PRs are reviewed and merged according to the defined patch policy.
57+
- Evidence of automated PRs and patching activity is available.
58+
level: 1
4759
difficultyOfImplementation:
4860
knowledge: 2
4961
time: 2
5062
resources: 2
5163
usefulness: 4
52-
level: 1
5364
implementation:
5465
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/dependabot
5566
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkins
@@ -245,7 +256,7 @@ Build and Deployment:
245256
comments: ""
246257
tags:
247258
- patching
248-
Automated deployment of automated PRs:
259+
Automated deployment of automated PRs: &automerge-PR
249260
uuid: 08f27c26-2c6a-47fe-9458-5e88f188085d
250261
<<: *automerge-PR
251262
risk:

src/assets/YAML/default/CultureAndOrganization/Design.yaml

Lines changed: 20 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -88,25 +88,6 @@ Culture and Organization:
8888
comments: ""
8989
Conduction of simple threat modeling on technical level:
9090
uuid: 47419324-e263-415b-815d-e7161b6b905e
91-
risk:
92-
Technical related threats are discovered too late in the development and
93-
deployment process.
94-
measure:
95-
Threat modeling of technical features is performed during the product
96-
sprint planning.
97-
difficultyOfImplementation:
98-
knowledge: 2
99-
time: 3
100-
resources: 1
101-
usefulness: 3
102-
level: 1
103-
implementation:
104-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/whiteboard
105-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/miro-or-any-other-c
106-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/draw-io
107-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-modeling-play
108-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-samm
109-
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-matrix-for-storage
11091
description: |
11192
# OWASP SAMM Description
11293
Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment.
@@ -150,6 +131,26 @@ Culture and Organization:
150131
GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes.
151132
152133
Source: OWASP Project Integration Project
134+
risk:
135+
Technical related threats are discovered too late in the development and deployment process.
136+
measure: |
137+
Perform threat modeling of technical features during product sprint planning using simple checklists and diagrams. Document identified threats and mitigations for new or changed functionality.
138+
assessment: |
139+
- Evidence of threat modeling activities exists for high-risk applications, including annotated diagrams and documented threats/mitigations.
140+
- Activities are performed during sprint planning and involve relevant stakeholders. Outcomes are recorded and accessible for review.
141+
level: 1
142+
difficultyOfImplementation:
143+
knowledge: 2
144+
time: 3
145+
resources: 1
146+
usefulness: 3
147+
implementation:
148+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/whiteboard
149+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/miro-or-any-other-c
150+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/draw-io
151+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-modeling-play
152+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/owasp-samm
153+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/threat-matrix-for-storage
153154
references:
154155
samm2:
155156
- D-TA-B-2

0 commit comments

Comments
 (0)