diff --git a/src/assets/YAML/generated/generated.yaml b/src/assets/YAML/generated/generated.yaml new file mode 100644 index 0000000..0d51b32 --- /dev/null +++ b/src/assets/YAML/generated/generated.yaml @@ -0,0 +1,10370 @@ +--- +Build and Deployment: + Build: + Building and testing of artifacts in virtual environments: + uuid: a340f46b-6360-4cb8-847b-a0d3483d09d3 + description: |- + While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of + vulnerable libraries or because they are altered during the delivery phase. + risk: |- + While building and testing artifacts, third party systems, application frameworks + and 3rd party libraries are used. These might be malicious as a result of + vulnerable libraries or because they are altered during the delivery phase. + measure: Each step during within the build and testing phase is performed in + a separate virtual environments, which is destroyed afterward. + meta: + implementationGuide: Depending on your environment, usage of virtual machines + or container technology is a good way. After the build, the filesystem should + not be used again in other builds. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 2 + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + references: + samm2: + - I-SB-2-A + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + isImplemented: false + evidence: "" + comments: "" + Defined build process: + uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b + risk: Performing builds without a defined process is error prone; for example, + as a result of incorrect security related configuration. + measure: A well defined build process lowers the possibility of errors during + the build process. + description: | + Sample evidence as an attribute in the yaml: The build process is defined in [REPLACE-ME Pipeline](https://replace-me/jenkins/job) + in the folder _vars_. Projects are using a _Jenkinsfile_ to use the + defined process. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 2 + usefulness: 4 + level: 1 + assessment: | + - Show your build pipeline and an exemplary job (build + test). + - Show that every team member has access. + - Show that failed jobs are fixed. + + Credits: AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + references: + samm2: + - I-SB-1-A + iso27001-2017: + - 12.1.1 + - 14.2.2 + iso27001-2022: + - 5.37 + - 8.32 + isImplemented: false + evidence: "" + comments: "" + Pinning of artifacts: + uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477 + risk: Unauthorized manipulation of artifacts might be difficult to spot. For + example, this may result in using images with malicious code. Also, intended + major changes, which are automatically used in an image used might break the + functionality. + measure: Pinning of artifacts ensure that changes are performed only when intended. + comment: The usage of pinning requires a good processes for patching. Therefore, + choose this activity wisely. + meta: + implementationGuide: Pinning artifacts in Dockerfile refers to the practice + of using specific, immutable versions of base images and dependencies in + your build process. Instead of using the latest tag for your base image, + select a specific version or digest. For example, replace FROM node:latest, + to FROM node@sha256:abcdef12. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - Container technology automatically creates a hash for images, which can be + used. + - Immutable images are an other way, e.g. by using a registry, which doesn't + allow overriding of images. + dependsOn: + - Defined build process + references: + samm2: + - I-SB-1-A + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + isImplemented: false + evidence: "" + comments: "" + SBOM of components: + uuid: 2858ac12-0179-40d9-9acf-1b839c030473 + description: |- + SBOM (Software Bill of Materials) is a document that lists all components, libraries, + and dependencies used in a software application or container image. Creating an SBOM + during the build process can help ensure transparency, security, and license compliance + for your application. + risk: In case a vulnerability of severity high or critical exists, it needs + to be known where an artifacts with that vulnerability is deployed with which + dependencies. + measure: Creation of an SBOM of components (e.g. application and container image + content) during build. + dependsOn: + - Defined build process + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: [] + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + isImplemented: false + evidence: "" + comments: "" + Signing of artifacts: + uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222 + risk: Execution or usage of malicious code or data e.g. via executables, libraries + or container images. + measure: Digitally signing artifacts for all steps during the build and especially + docker images, helps to ensure their integrity and authenticity. + description: "## Github\nYou need to be authenticated to perform a push to a + Github repository. Github doesn't check if the authenticated user and the + mail address in the commit corresponds. \nTo highlight to reviewers who performed + a commit, signing is needed.\nBe aware that github actions like [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) + will not sign commits and will fail. You find an example working configuration + to use semantic release action together with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action) + in the [workflow folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) + of DSOMM.\n" + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 5 + implementation: + - uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + - uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + dependsOn: + - Defined build process + - Pinning of artifacts + references: + samm2: + - I-SB-1-A + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + isImplemented: false + evidence: "" + comments: "" + Signing of code: + uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665 + risk: Execution or usage of malicious code or data e.g. via executables, libraries + or container images. + measure: Digitally signing commits helps to prevent unauthorized manipulation + of source code. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + dependsOn: + - Defined build process + references: + samm2: + - I-SB-2-A + iso27001-2017: + - 14.2.6 + iso27001-2022: + - 8.31 + isImplemented: false + evidence: "" + comments: "" + Deployment: + Blue/Green Deployment: + uuid: 0cb2626b-fb0d-4a0f-9688-57f787310d97 + risk: A new artifact's version can have unknown defects. + measure: |- + Using a blue/green deployment strategy increases application availability + and reduces deployment risk by simplifying the rollback process if a deployment fails. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 5 + implementation: + - uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + dependsOn: + - Smoke Test + references: + samm2: + - TODO + iso27001-2017: + - 17.2.1 + - 12.1.1 + - 12.1.2 + - 12.1.4 + - 12.5.1 + - 14.2.9 + iso27001-2022: + - 8.14 + - 5.37 + - 8.31 + - 8.32 + - 8.19 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Defined decommissioning process: + uuid: da4ff665-dcb9-4e93-9d20-48cdedc50fc2 + description: |- + The decommissioning process in the context of Docker and Kubernetes involves + retiring Docker containers, images, and Kubernetes resources that are no longer + needed or have been replaced. This process must be carefully executed to avoid + impacting other services and applications. + risk: Unused applications are not maintained and may contain vulnerabilities. + Once exploited they can be used to attack other applications or to perform + lateral movements within the organization. + measure: A clear decommissioning process ensures the removal of unused applications. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 2 + references: + samm2: + - O-OM-2-B + iso27001-2017: + - 11.2.7 + iso27001-2022: + - 7.14 + isImplemented: false + evidence: "" + comments: "" + Defined deployment process: + uuid: 74938a3f-1269-49b9-9d0f-c43a79a1985a + risk: Deployment of insecure or malfunctioning artifacts. + measure: Defining a deployment process ensures that there are established criteria + in terms of functionalities, security, compliance, and performance, and that + the artifacts meet them. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + dependsOn: + - Continuous Integration + implementation: + - uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + references: + samm2: + - I-SD-1-A + iso27001-2017: + - 12.1.1 + - 14.2.2 + iso27001-2022: + - 5.37 + - 8.32 + isImplemented: false + evidence: "" + comments: "" + Environment depending configuration parameters (secrets): + uuid: df428c9d-efa0-4226-9f47-a15bb53f822b + risk: Unauthorized access to secrets stored in source code or in artifacts (e.g. + container images) through process listing (e.g. ps -ef). + measure: Set configuration parameters via environment variables stored using + specific platform functionalities or secrets management systems (e.g. Kubernetes + secrets or Hashicorp Vault). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - signing-of-commits-protection: + uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + signing-of-commits: + uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + ci-cd-tools: + uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + apimaturity: + uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + container-technologi: + uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + cwe25: + uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + docker-content-trust: + uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + in-toto: + uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + a-complete-backup-of: + uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + a-point-in-time-reco: + uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + blue-green-deploymen: + uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + docker: + uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + webserver: + uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + rolling-update: + uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + kubernetes-admission: + uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + dependabot: + uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: [] + url: https://dependabot.com/ + jenkins: + uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + sample-concept-1: + uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service + outage will occur to the end users. \n(2) twice a day a rebuild of images + is done. The rebuilds are put into a automated testing pipeline. If the + testing has no blocking issues the new images will be released for deployment + during the next \"restart\" of a container. What has to be done, is to + ensure the new containers are deployed in some canary deployment manner, + this will ensure that if (and only if) something buggy has been introduced + which breaks functionality the canary deployment will make sure the \"older + version\" is being used and not the buggy newer one." + distroless: + uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + fedora-coreos: + uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + distroless-usage: + uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + threat-modeling-play: + uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + owasp-samm: + uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + whiteboard: + uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + miro-or-any-other-c: + uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + draw-io: + uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + threagile: + uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + don-t-forget-evil-u: + uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: '[Don''t Forget EVIL U' + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + owasp-juice-shop: + uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + owasp-cheatsheet-ser: + uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-juiceshop: + uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 + name: OWASP JuiceShop + tags: [] + url: https://github.com/bkimminich/juice-shop + description: |- + In case you do not have the budget to hire an external security expert, an option + is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + https-cheatsheetse: + uuid: 99080ac7-60cd-46af-93a1-a53a33597cba + name: https://cheatsheetseries.owasp.org/ + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-security-champ: + uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + build-it-break-it-fi: + uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + motivate-people: + uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + owasp-top-10-maturit: + uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + involve-security-sme: + uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + damn-vulnerable-web: + uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + example-all-docker: + uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + owasp-asvs: + uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + owasp-masvs: + uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + cis-kubernetes-bench: + uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + cis-docker-bench-for: + uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + for-example-for-cont: + uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, + ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + attack-matrix-cloud: + uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + attack-matrix-contai: + uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for containers + attack-matrix-kubern: + uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + istio: + uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + bridges: + uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + firewalls: + uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + open-policy-agent: + uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + gitops: + uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + ansible: + uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + chef: + uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + puppet: + uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + jenkinsfile: + uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + seccomp: + uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + strace: + uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + remove-direct-access: + uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + directory-service: + uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + plugins: + uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + smartcard: + uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 + name: Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + yubikey: + uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + sms: + uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + totp: + uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + http-basic-authentic: + uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + vpn: + uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + for-applications-ch: + uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + managing-secrets: + uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + crypto: + uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + authentication: + uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + rsyslog: + uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + logstash: + uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + fluentd: + uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + bash: + uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + owasp-logging-cheats: + uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + elk-stack: + uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + https-ht-transpare: + uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + prometheus: + uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + collected: + uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + httpunit: + uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 + name: HttpUnit + tags: [] + url: http://httpunit.sourceforge.net/ + junit: + uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + karma: + uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + owasp-defectdojo: + uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + purify: + uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + see-other-actions-e: + uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 + name: See other actions, e.g. "Treatment of defects with severity high". + tags: [] + sast: + uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side + / client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + dast: + uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + owasp-defect-dojo: + uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c + name: OWASP Defect Dojo + tags: [] + url: https://github.com/DefectDojo/django-DefectDojo + owasp-dependency-che: + uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + logparser-jenkins-pl: + uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + owasp-code-pulse: + uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + ajax-spider: + uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + curl: + uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + openapi: + uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + owasp-zap: + uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + arachni: + uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + zest: + uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + owasp-securecodebox: + uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + kube-hunter: + uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + openvas: + uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + htc-hydra: + uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + netassert: + uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + nmap: + uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + owasp-amass: + uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + k8spurger: + uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + pmd: + uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + eslint: + uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + findsecuritybugs: + uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + jsprime: + uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + bdd-mobile-security: + uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + retire-js: + uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + npm-audit: + uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + sigmahq: + uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + dive-to-inspect-a-co: + uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + clusterscanner: + url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + dockerfile-with-hado: + uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + deployment-with-kube: + uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + kubesec: + uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + anchore-io: + uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + clair: + uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + openscap: + uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + vuls: + uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + kube-bench: + uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + trufflehog: + uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + go-pillage-registrie: + uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + https-github-com-a: + uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + registries-like-quay: + uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + dockerfilelint: + uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile + and looks for common traps, mistakes and helps enforce best practices. + threat-matrix-for-storage: + uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + defend-the-core-kubernetes: + uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + business-friendly-vulnerability-metrics: + uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + kubescape: + uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + azuredevops: + uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + github-policies: + uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + sonarqube: + uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + stylecop: + uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + fortify-vscode-extension: + uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + appscan-vscode-extension: + uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + checkmarx-vscode-extension: + uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + pre-commit-microsoft: + uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + pre-commit-synopsis: + uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + dependencyTrack: + uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach + by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + juice-shop: + uuid: c021aa72-c71c-43e4-9573-717b74d6c19d + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + dvwa: + uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + loggingCheatSheet: + uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + zap: + uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + secureCodeBox: + uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + K8sPurger: + uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + hashicorp-vault: + uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. + stoplight-spectral: + uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + api-oas-checker: + uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + coveragepy: + uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + github-dependabot: + uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + github-super-linter: + uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + schemathesis: + uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + martin-feature-toggles: + uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + defectdojo-client: + uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + falco: + uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + sammancoaching: + uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + terraform: + uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + packj: + uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + apiMyth: + uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + references: + samm2: + - I-SD-1-B + iso27001-2017: + - 9.4.5 + - 14.2.6 + iso27001-2022: + - 8.4 + - 8.31 + d3f: + - ApplicationConfigurationHardening + isImplemented: false + evidence: "" + comments: "" + Evaluation of the trust of used components: + uuid: 0de465a6-55a7-4343-af79-948bb5ff10ba + risk: Application and system components like Open Source libraries or images + can have implementation flaws or deployment flaws. Developers or operations + might start random images in the production cluster which have malicious code + or known vulnerabilities. + measure: Each components source is evaluated to be trusted. For example the + source, number of developers included, email configuration used by maintainers + to prevent maintainer account theft, typo-squatting, ... Create image assessment + criteria, perform an evaluation of images and create a whitelist of artifacts/container + images/virtual machine images. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + - uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Handover of confidential parameters: + uuid: 94a96f79-8bd6-4904-97c0-994ff88f176a + risk: Parameters are often used to set credentials, for example by starting + containers or applications; these parameters can often be seen by any one + listing running processes on the target system. + measure: Encryption ensures confidentiality of credentials e.g. from unauthorized + access on the file system. Also, the usage of a credential management system + can help protect credentials. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: "" + dependsOn: + - Environment depending configuration parameters (secrets) + references: + samm2: + - I-SD-2-B + iso27001-2017: + - 14.1.3 + - 13.1.3 + - 9.4.3 + - 9.4.1 + - 10.1.2 + iso27001-2022: + - 8.33 + - 8.22 + - 5.17 + - 8.3 + - 8.24 + d3f: + - ApplicationConfigurationHardening + isImplemented: false + evidence: "" + comments: "" + Inventory of dependencies: + uuid: 13e9757e-58e2-4277-bc0f-eadc674891e6 + risk: In case a vulnerability of severity high or critical is known by the organization, + it needs to be known where an artifacts with that vulnerability is deployed + with which dependencies. + measure: A documented inventory of dependencies used in images and containers + exists. + dependsOn: + - Defined deployment process + - SBOM of components + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 3 + implementation: + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + references: + samm2: + - I-SD-2-A + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + isImplemented: false + evidence: "" + comments: "" + Inventory of running artifacts: + uuid: 83057028-0b77-4d2e-8135-40969768ae88 + risk: In case a vulnerability of severity high or critical exists, it needs + to be known where an artifacts (e.g. container image) with that vulnerability + is deployed. + measure: A documented inventory or a possibility to gather the needed information. + dependsOn: + - Defined deployment process + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - I-SD-2-A + iso27001-2017: + - 8.1 + - 8.2 + iso27001-2022: + - 5.9 + - 5.12 + isImplemented: false + evidence: "" + comments: "" + Rolling update on deployment: + uuid: 85d52588-f542-4225-a338-20dc22a5508d + risk: While a deployment is performed, the application can not be reached. + measure: A deployment without downtime is performed*. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 3 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + - uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + - uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + dependsOn: + - Defined deployment process + references: + samm2: + - I-SD-1-A + iso27001-2017: + - 12.5.1 + - 14.2.2 + - 17.2.1 + iso27001-2022: + - 8.19 + - 8.32 + - 8.14 + isImplemented: false + evidence: "" + comments: "" + Same artifact for environments: + uuid: a854b48d-83bd-4f8d-8621-a0bdd470837f + risk: Building of an artifact for different environments means that an untested + artifact might reach the production environment. + measure: Building an artifact once and deploying it to different environments + means that only tested artifacts are allowed to reach the production environment + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 4 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + dependsOn: + - Defined build process + references: + samm2: + - I-SD-2-A + iso27001-2017: + - 14.3.1 + - 14.2.8 + - 12.1.4 + iso27001-2022: + - 8.33 + - 8.29 + - 8.31 + isImplemented: false + evidence: "" + comments: "" + Usage of feature toggles: + uuid: a511799b-045e-4b96-9843-7d63d8c1e2ad + risk: Using environment variables to enable or disable features can lead to + a situation where a feature is accidentally enabled in the production environment. + measure: Usage of environment independent configuration parameter, called static + feature toggles, mitigates the risk of accidentally enabling insecure features + in production. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 2 + level: 4 + implementation: + - uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + - uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + dependsOn: + - Same artifact for environments + references: + samm2: [] + iso27001-2017: + - 14.3.1 + - 14.2.8 + - 14.2.9 + - 12.1.4 + iso27001-2022: + - 8.33 + - 8.29 + - 8.31 + d3f: + - ApplicationConfigurationHardening + isImplemented: false + evidence: "" + comments: "" + Patch Management: + A patch policy is defined: + uuid: 99415139-6b50-441b-89e1-0aa59accd43d + risk: Vulnerabilities in running containers stay for long and might get exploited. + measure: A patch policy for all artifacts (e.g. in images) is defined. How often + is an image rebuilt? + difficultyOfImplementation: + knowledge: 3 + time: 1 + resources: 2 + usefulness: 4 + level: 1 + implementation: [] + references: + samm2: + - O-EM-1-B + iso27001-2017: + - 12.6.1 + - 12.5.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.19 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Automated PRs for patches: + uuid: 8ae0b92c-10e0-4602-ba22-7524d6aed488 + risk: Components with known (or unknown) vulnerabilities might stay for long + and get exploited, even when a patch is available. + measure: Fast patching of third party component is needed. The DevOps way is + to have an automated pull request for new components. This includes * Applications + * Virtualized operating system components (e.g. container images) * Operating + Systems * Infrastructure as Code/GitOps (e.g. argocd based on a git repository + or terraform) + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 5 + level: 1 + implementation: + - uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: [] + url: https://dependabot.com/ + - uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + - uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + references: + samm2: + - O-EM-1-B + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Nightly build of images (base images): + uuid: 34869eaf-f2e1-4926-b0bd-28c43402f057 + description: |- + A base image is a pre-built image that serves as a starting point for building + new images or containers. These base images usually include an operating system, + necessary dependencies, libraries, and other components that are required to run + a specific application or service. Nightly builds of custom base images refer to + an automated process that occurs daily or on a scheduled basis, usually during + nighttime or off-peak hours, to create updated versions of custom base images. + risk: Vulnerabilities in running containers stay for too long and might get + exploited. + measure: Custom base images are getting build at least nightly. In case the + packages in the base image e.g. centos has changed, the build server + triggers the build of depending images. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-1-B + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Reduction of the attack surface: + uuid: 16e39c8f-5336-4001-88ed-a552d2447531 + description: |- + Distroless images are minimal, stripped-down base images that contain only the + essential components required to run your application. They do not include package + managers, shells, or any other tools that are commonly found in standard Linux + distributions. Using distroless images can help reduce the attack surface and + overall size of your container images. + risk: Components, dependencies, files or file access rights might have vulnerabilities, + but the they are not needed. + measure: Removal of unneeded components, dependencies, files or file access + rights. For container images the usage of distroless images is recommended. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + - uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + - uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + references: + samm2: + - I-SB-2 + iso27001-2017: + - hardening is missing in ISO 27001 + - 14.2.1 + iso27001-2022: + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Usage of a maximum lifetime for images: + uuid: 485a3383-7f2e-4dba-bb84-479377070904 + description: |- + The maximum lifetime for a Docker container refers to the duration a container + should be allowed to run before it is considered outdated, stale, or insecure. + There is not a fixed, universally applicable maximum lifetime for a Docker + container, as it varies depending on the specific use case, application + requirements, and security needs. As a best practice, it is essential to define + a reasonable maximum lifetime for containers to ensure that you consistently + deploy the most recent, patched, and secure versions of both your custom base + images and third-party images. + risk: Vulnerabilities in images of running containers stay for too long and + might get exploited. Long running containers have potential memory leaks. + A compromised container might get killed by restarting the container (e.g. + in case the attacker has not reached the persistence layer). + measure: A short maximum lifetime for images is defined, e.g. 30 days. The project + images, based on the nightly builded images, are deployed at leased once within + the defined lifetime. Third Party images are deployed at leased once within + the defined lifetime. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-1-B + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Usage of a short maximum lifetime for images: + uuid: 6b96e5a0-ce34-4ea4-a88f-469d3b84546e + description: |- + The maximum lifetime for a Docker container refers to the duration a container + should be allowed to run before it is considered outdated, stale, or insecure. + There is not a fixed, universally applicable maximum lifetime for a Docker + container, as it varies depending on the specific use case, application + requirements, and security needs. As a best practice, it is essential to define + a reasonable maximum lifetime for containers to ensure that you consistently + deploy the most recent, patched, and secure versions of both your custom base + images and third-party images. + risk: Vulnerabilities in running containers stay for too long and might get + exploited. + measure: | + A good practice is to perform the build and deployment daily or even just-in-time, when a new component (e.g. package) for the image is available. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service outage + will occur to the end users. \n(2) twice a day a rebuild of images is done. + The rebuilds are put into a automated testing pipeline. If the testing has + no blocking issues the new images will be released for deployment during + the next \"restart\" of a container. What has to be done, is to ensure the + new containers are deployed in some canary deployment manner, this will + ensure that if (and only if) something buggy has been introduced which breaks + functionality the canary deployment will make sure the \"older version\" + is being used and not the buggy newer one." + references: + samm2: + - O-EM-2-B + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" +Culture and Organization: + Design: + Conduction of advanced threat modeling: + uuid: ae22dafd-bcd6-41ee-ba01-8b7fe6fc1ad9 + risk: Inadequate identification of business and technical risks. + measure: Threat modeling is performed by using reviewing user stories and producing + security driven data flow diagrams. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 3 + level: 4 + dependsOn: + - Conduction of simple threat modeling on technical level + - Creation of threat modeling processes and standards + description: | + **Example High Maturity Scenario:** + + Based on a detailed threat model defined and updated through code, the team decides the following: + + * Local encrypted caches need to expire and auto-purged. + * Communication channels encrypted and authenticated. + * All secrets persisted in shared secrets store. + * Frontend designed with permissions model integration. + * Permissions matrix defined. + * Input is escaped output is encoded appropriately using well established libraries. + + Source: OWASP Project Integration Project + implementation: + - uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + - uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + - uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + references: + samm2: + - D-TA-2-B + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Conduction of simple threat modeling on business level: + uuid: 48f97f31-931c-46eb-9b3e-e2fec0cd0426 + risk: Business related threats are discovered too late in the development and + deployment process. + measure: Threat modeling of business functionality is performed during the product + backlog creation to facilitate early detection of security defects. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - D-TA-2-B + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Conduction of simple threat modeling on technical level: + uuid: 47419324-e263-415b-815d-e7161b6b905e + risk: Technical related threats are discovered too late in the development and + deployment process. + measure: Threat modeling of technical features is performed during the product + sprint planning. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + - uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + - uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + - uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + description: | + # OWASP SAMM Description + Threat modeling is a structured activity for identifying, evaluating, and managing system threats, architectural design flaws, and recommended security mitigations. It is typically done as part of the design phase or as part of a security assessment. + + Threat modeling is a team exercise, including product owners, architects, security champions, and security testers. At this maturity level, expose teams and stakeholders to threat modeling to increase security awareness and to create a shared vision on the security of the system. + + At maturity level 1, you perform threat modeling ad-hoc for high-risk applications and use simple threat checklists, such as STRIDE. Avoid lengthy workshops and overly detailed lists of low-relevant threats. Perform threat modeling iteratively to align to more iterative development paradigms. If you add new functionality to an existing application, look only into the newly added functions instead of trying to cover the entire scope. A good starting point is the existing diagrams that you annotate during discussion workshops. Always make sure to persist the outcome of a threat modeling discussion for later use. + + Your most important tool to start threat modeling is a whiteboard, smartboard, or a piece of paper. Aim for security awareness, a simple process, and actionable outcomes that you agree upon with your team. Once requirements are gathered and analysis is performed, implementation specifics need to be defined. The outcome of this stage is usually a diagram outlining data flows and a general system architecture. This presents an opportunity for both threat modeling and attaching security considerations to every ticket and epic that is the outcome of this stage. + + Source: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + # OWASP Project Integration Description + There is some great advice on threat modeling out there *e.g.* [this](https://arstechnica.com/information-technology/2017/07/how-i-learned-to-stop-worrying-mostly-and-love-my-threat-model/) article or [this](https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling) one. + + A bite sized primer by Adam Shostack himself can be found [here](https://adam.shostack.org/blog/2018/03/threat-modeling-panel-at-appsec-cali-2018/). + + OWASP includes a short [article](https://wiki.owasp.org/index.php/Category:Threat_Modeling) on Threat Modeling along with a relevant [Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Threat_Modeling_Cheat_Sheet.html). Moreover, if you're following OWASP SAMM, it has a short section on [Threat Assessment](https://owaspsamm.org/model/design/threat-assessment/). + + There's a few projects that can help with creating Threat Models at this stage, [PyTM](https://github.com/izar/pytm) is one, [ThreatSpec](https://github.com/threatspec/threatspec) is another. + + > Note: _A threat model can be as simple as a data flow diagram with attack vectors on every flow and asset and equivalent remediations. An example can be found below._ + + ![Threat Model](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/threat_model.png "Threat Model") + + Last, if the organizations maps Features to Epics, the Security Knowledge Framework (SKF) can be used to facilitate this process by leveraging it's questionnaire function. + + ![SKF](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/skf_qs.png "SKF") + + This practice has the side effect that it trains non-security specialists to think like attackers. + + The outcomes of this stage should help lay the foundation of secure design and considerations. + + **Example Low Maturity Scenario:** + + Following vague feature requirements the design includes caching data to a local unencrypted database with a hardcoded password. + + Remote data store access secrets are hardcoded in the configuration files. All communication between backend systems is plaintext. + + Frontend serves data over GraphQL as a thin layer between caching system and end user. + + GraphQL queries are dynamically translated to SQL, Elasticsearch and NoSQL queries. Access to data is protected with basic auth set to _1234:1234_ for development purposes. + + Source: OWASP Project Integration Project + references: + samm2: + - D-TA-2-B + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Creation of advanced abuse stories: + uuid: 0a929c3e-ab9a-4206-8761-adf84b74622e + risk: Simple user stories are not going deep enough. Relevant security considerations + are performed. Security flaws are discovered too late in the development and + deployment process + measure: Advanced abuse stories are created as part of threat modeling activities. + difficultyOfImplementation: + knowledge: 4 + time: 2 + resources: 1 + usefulness: 4 + level: 5 + dependsOn: + - Creation of simple abuse stories + implementation: + - uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: '[Don''t Forget EVIL U' + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + references: + samm2: + - D-TA-2-B + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 6.1.5 + - May be part of risk assessment + - 8.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 5.8 + - May be part of risk assessment + - 5.9 + isImplemented: false + evidence: "" + comments: "" + Creation of simple abuse stories: + uuid: bacf85b6-5bc0-405d-b5ba-a5d971467cc1 + risk: User stories mostly don't consider security implications. Security flaws + are discovered too late in the development and deployment process. + measure: Abuse stories are created during the creation of user stories. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: '[Don''t Forget EVIL U' + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + dependsOn: + - Conduction of simple threat modeling on technical level + - Creation of threat modeling processes and standards + references: + samm2: + - D-TA-2-B + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 6.1.5 + - May be part of risk assessment + - 8.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of project management + - 5.8 + - May be part of risk assessment + - 5.9 + isImplemented: false + evidence: "" + comments: "" + Creation of threat modeling processes and standards: + uuid: dd5ed7c1-bdbf-400f-b75f-6d3953a1a04e + risk: Inadequate identification of business and technical risks. + measure: Creation of threat modeling processes and standards through the organization + helps to enhance the security culture and provide more structure to the threat + model exercises. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 3 + level: 3 + description: "" + implementation: + - uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + - uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + dependsOn: + - Conduction of simple threat modeling on technical level + references: + samm2: + - D-TA-3-B + iso27001-2017: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 8.2.1 + - 14.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 + - May be part of risk assessment + - 5.12 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Information security targets are communicated: + uuid: 1b9281b9-48e2-4c01-9ac6-9db9931c4885 + risk: Employees don't known their organizations security targets. Therefore + security is not considered during development and administration as much as + it should be. + measure: Transparent and timely communication of the security targets by senior + management is essential to ensure teams' buy-in and support. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: [] + iso27001-2017: + - 5.1.1 + - 7.2.1 + iso27001-2022: + - 5.1 + - 5.4 + isImplemented: false + evidence: "" + comments: "" + Education and Guidance: + Ad-Hoc Security trainings for software developers: + uuid: 12c90cc6-3d58-4d9b-82ff-d469d2a0c298 + risk: Understanding security is hard and personnel needs to be trained on it. + Otherwise, flaws like an SQL Injection might be introduced into the software + which might get exploited. + measure: Provide security awareness training for all personnel involved in software + development Ad-Hoc. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-1-A + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + isImplemented: false + evidence: "" + comments: "" + Aligning security in teams: + uuid: f994a55d-71bb-45a4-a887-0a213d72c504 + risk: The concept of Security Champions might suggest that only he/she is responsible + for security. However, everyone in the project team should be responsible + for security. + measure: By aligning security Subject Matter Experts with project teams, a higher + security standard can be achieved. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 1 + usefulness: 5 + implementation: + - uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + level: 4 + references: + samm2: + - G-EG-3-B + iso27001-2017: + - 7.1.1 + iso27001-2022: + - 6.1 + isImplemented: false + evidence: "" + comments: "" + Conduction of build-it, break-it, fix-it contests: + uuid: bfdb576e-a416-4ec6-96fe-a078d58b2ff8 + risk: Understanding security is hard, even for security champions and the conduction + of security training often focuses on breaking a component instead of building + a component secure. + measure: The build-it, break-it, fix-it contest allows to train people with + security related roles like security champions the build, break and fix part + of a secure application. This increases the learning of building secure components. + difficultyOfImplementation: + knowledge: 5 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + references: + samm2: + - G-EG-2-A + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + isImplemented: false + evidence: "" + comments: "" + Conduction of collaborative security checks with developers and system administrators: + risk: Security checks by external companies do not increase the understanding + of an application/system for internal employees. + measure: Periodically security reviews of source code (SCA), in which security + SME, developers and operations are involved, are effective at increasing the + robustness of software and the security knowledge of the teams involved. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 5 + implementation: [] + references: + samm2: + - G-EG-2-A + iso27001-2017: + - Mutual review of source code is not explicitly required in ISO 27001 may + be + - 7.2.2 + - 12.6.1 + - 12.7.1 + iso27001-2022: + - Mutual review of source code is not explicitly required in ISO 27001 may + be + - 6.3 + - 8.8 + - 8.34 + isImplemented: false + evidence: "" + comments: "" + Conduction of collaborative team security checks: + uuid: 35446784-7610-40d9-af9e-d43f3173bf8c + risk: Development teams limited insight over security practices. + measure: Mutual security testing the security of other teams project enhances + security awareness and knowledge. + difficultyOfImplementation: + resources: 2 + knowledge: 4 + time: 4 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - G-EG-1-A + - G-EG-2-A + iso27001-2017: + - Mutual security testing is not explicitly required in ISO 27001 may be + - 7.2.2 + iso27001-2022: + - Mutual security testing is not explicitly required in ISO 27001 may be + - 6.3 + isImplemented: false + evidence: "" + comments: "" + Conduction of war games: + uuid: 534f60bf-0995-4314-bb9c-f0f2bf204694 + risk: Understanding incident response plans during an incident is hard and ineffective. + measure: War Games like activities help train for incidents. Security SMEs create + attack scenarios in a testing environment enabling the trainees to learn how + to react in case of an incident. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 4 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - G-EG-2-A + iso27001-2017: + - War games are not explicitly required in ISO 27001 may be + - 7.2.2 + - 16.1 + - 16.1.5 + iso27001-2022: + - War games are not explicitly required in ISO 27001 may be + - 6.3 + - 5.24 + - 5.26 + isImplemented: false + evidence: "" + comments: "" + Each team has a security champion: + uuid: 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87 + risk: No one feels directly responsible for security and the security champion + does not have enough time to allocate to each team. + measure: Each team defines an individual to be responsible for security. These + individuals are often referred to as 'security champions' + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + description: "Implement a program where each software development team has a + member considered a \u201CSecurity Champion\u201D who is the liaison between + Information Security and developers. Depending on the size and structure of + the team the \u201CSecurity Champion\u201D may be a software developer, tester, + or a product manager. The \u201CSecurity Champion\u201D has a set number of + hours per week for Information Security related activities. They participate + in periodic briefings to increase awareness and expertise in different security + disciplines. \u201CSecurity Champions\u201D have additional training to help + develop these roles as Software Security subject-matter experts. You may need + to customize the way you create and support \u201CSecurity Champions\u201D + for cultural reasons.\n\nThe goals of the position are to increase effectiveness + and efficiency of application security and compliance and to strengthen the + relationship between various teams and Information Security. To achieve these + objectives, \u201CSecurity Champions\u201D assist with researching, verifying, + and prioritizing security and compliance related software defects. They are + involved in all Risk Assessments, Threat Assessments, and Architectural Reviews + to help identify opportunities to remediate security defects by making the + architecture of the application more resilient and reducing the attack threat + surface.\nSource: [OWASP SAMM](https://owaspsamm.org/model/governance/education-and-guidance/stream-b/)\n" + implementation: + - uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + references: + samm2: + - G-EG-1-B + - G-EG-2-B + iso27001-2017: + - Security champions are missing in ISO 27001 most likely + - 7.2.1 + - 7.2.2 + iso27001-2022: + - Security champions are missing in ISO 27001 most likely + - 5.4 + - 6.3 + isImplemented: false + evidence: "" + comments: "" + Regular security training for all: + uuid: 9768f154-357a-4c06-af6f-d66570677c9b + risk: Understanding security is hard. + measure: Provide security awareness training for all internal personnel involved + in software development on a regular basis like twice in a year for 1-3 days. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 4 + level: 2 + description: | + Conduct security awareness training for all roles currently involved in the management, development, testing, or auditing of the software. The goal is to increase the awareness of application security threats and risks, security best practices, and secure software design principles. Develop training internally or procure it externally. Ideally, deliver training in person so participants can have discussions as a team, but Computer-Based Training (CBT) is also an option. + + Course content should include a range of topics relevant to application security and privacy, while remaining accessible to a non-technical audience. Suitable concepts are secure design principles including Least Privilege, Defense-in-Depth, Fail Secure (Safe), Complete Mediation, Session Management, Open Design, and Psychological Acceptability. Additionally, the training should include references to any organization-wide standards, policies, and procedures defined to improve application security. The OWASP Top 10 vulnerabilities should be covered at a high level. + + Training is mandatory for all employees and contractors involved with software development and includes an auditable sign-off to demonstrate compliance. Consider incorporating innovative ways of delivery (such as gamification) to maximize its effectiveness and combat desensitization. + + [Source: OWASP SAMM 2](https://owaspsamm.org/model/governance/education-and-guidance/stream-a/) + implementation: + - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 + name: OWASP JuiceShop + tags: [] + url: https://github.com/bkimminich/juice-shop + description: |- + In case you do not have the budget to hire an external security expert, an option + is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-1-A + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + isImplemented: false + evidence: "" + comments: "" + Regular security training for externals: + uuid: 31833d56-35af-4ef3-9300-f23d27646ce7 + risk: Understanding security is hard. + measure: Provide security awareness training for all personnel including externals + involved in software development on a regular basis. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 + usefulness: 4 + level: 4 + implementation: + - uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 + name: OWASP JuiceShop + tags: [] + url: https://github.com/bkimminich/juice-shop + description: |- + In case you do not have the budget to hire an external security expert, an option + is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + - uuid: 99080ac7-60cd-46af-93a1-a53a33597cba + name: https://cheatsheetseries.owasp.org/ + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-3-A + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + isImplemented: false + evidence: "" + comments: "" + Regular security training of security champions: + uuid: f88d1b17-3d7d-4c3d-8139-ad44fc4942d4 + risk: Understanding security is hard, even for security champions. + measure: Regular security training of security champions. + assessment: | + - Process Documentation: TODO + - Training Content: TOODO + difficultyOfImplementation: + knowledge: 4 + time: 2 + resources: 2 + usefulness: 5 + level: 2 + implementation: + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + dependsOn: + - Each team has a security champion + references: + samm2: + - D-TA-2-B + - G-EG-1-A + iso27001-2017: + - Security champions are missing in ISO 27001 + - 7.2.2 + iso27001-2022: + - Security champions are missing in ISO 27001 + - 6.3 + isImplemented: false + evidence: "" + comments: "" + Reward of good communication: + uuid: 91b6f75b-9f4a-4d77-95a2-af7ad3222c7c + risk: Employees are not getting excited about security. + measure: Good communication and transparency encourages cross-organizational + support. Gamification of security is also known to help, examples include + T-Shirts, mugs, cups, gift cards and 'High-Fives'. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + - uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + references: + samm2: + - G-EG-1-B + iso27001-2017: + - not required by ISO 27001 + - interestingly enough A7.2.3 is requiring a process to handle misconduct + but nothing to promote good behavior. + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Security Coaching: + uuid: f7b215dc-73a4-4c61-9e49-b3a3af1c9ac3 + risk: Training does not change behaviour. Therefore, even if security practices + are understood, it's likely that they are not performed. + measure: By coaching teams on security topics using for example the samman coaching + method, teams internalize security practices as new habits in their development + process. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + implementation: + - uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + level: 3 + references: + samm2: + - G-EG-3-B + iso27001-2017: + - 7.1.1 + iso27001-2022: + - 6.1 + isImplemented: false + evidence: "" + comments: "" + Security code review: + uuid: 7121b0c7-6ace-4d6b-95d0-94535dbccb57 + risk: Understanding security is hard. + measure: | + The following areas of code tend to have a high-risk of containing security vulnerabilities: + - Crypto implementations / usage + - Parser, unparser + - System configuration + - Authentication, authorization + - Session management + - Request throttling + - :unicorn: (self-developed code, only used in that one software) + description: | + ### Benefits + - New vulnerabilities may be found before reaching production. + - Old vulnerabilities are found and fixed. + assessment: | + - Present the performed reviews (including participants, findings, consequences) and assess whether it is reasonable. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + credits: | + AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + references: + samm2: + - V-ST-1-B + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Security consulting on request: + uuid: 0b28367b-75a0-4bae-a926-3725c1bf9bb0 + risk: Not asking a security expert when questions regarding security appear + might lead to flaws. + measure: Security consulting to teams is given on request. The security consultants + can be internal or external. + difficultyOfImplementation: + knowledge: 3 + time: 1 + resources: 1 + usefulness: 3 + level: 1 + implementation: + - uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + references: + samm2: + - G-EG-1-A + iso27001-2017: + - security consulting is missing in ISO 27001 may be + - 6.1.1 + - 6.1.4 + - 6.1.5 + iso27001-2022: + - Security consulting is missing in ISO 27001 may be + - 5.2 + - 5.6 + - 5.8 + isImplemented: false + evidence: "" + comments: "" + Security-Lessoned-Learned: + uuid: 58c46807-fee9-448b-b6dd-8050c464ab52 + risk: After an incident, a similar incident might reoccur. + measure: Running a 'lessons learned' session after an incident helps drive continuous + improvement. Regular meetings with security champions are a good place to + share and discuss lessons learned. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: + - O-IM-3-B + iso27001-2017: + - 16.1.6 + iso27001-2022: + - 5.27 + isImplemented: false + evidence: "" + comments: "" + Simple mob hacking: + uuid: 535f301a-e8e8-4eda-ad77-a08b035c92de + risk: Understanding security is hard. + measure: | + Participate with your whole team in a simple mob hacking session organized by the Security Champion Guild. + In the session the guild presents a vulnerable application and together you look at possible exploits. + Just like in mob programming there is one driver and several navigators. + description: | + ### Guidelines for your simple mob hacking session + - All exploits happen via the user interface. + - No need for security/hacking tools. + - No need for deep technical or security knowledge. + - Use an insecure training app, e.g., [DVWA](https://dvwa.co.uk/) or [OWASP Juice Shop](https://owasp.org/www-project-juice-shop/). + - Encourage active participation, e.g., use small groups. + - Allow enough time for everyone to run at least one exploit. + + ### Benefits + - The team gets an idea of how exploits can look like and how easy applications can be attacked. + - The team understands functional correct working software can be highly insecure and easy to exploit. + difficultyOfImplementation: + knowledge: 5 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + credits: | + AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/) + implementation: + - uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + - uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + references: + samm2: + - G-EG-1-A + iso27001-2017: + - 7.2.2 + iso27001-2022: + - 6.3 + isImplemented: false + evidence: "" + comments: "" + Process: + Approval by reviewing any new version: + uuid: 3f63bdbc-c75f-4780-a941-e6ad42e894e1 + risk: An individual might forget to implement security measures to protect source + code or infrastructure components. + measure: On each new version (e.g. Pull Request) of source code or infrastructure + components a security peer review of the changes is performed (two eyes principle) + and approval given by the reviewer. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: [] + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Definition of a change management process: + uuid: b4193d32-3948-47e2-a326-3748c48019a1 + risk: The impact of a change is not controlled because these are not recorded + or documented. + measure: Each change of a system is automatically recorded and adequately logged. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: [] + references: + samm2: [] + iso27001-2017: + - 14.2.2 + - 12.1.2 + - 12.4.1 + iso27001-2022: + - 8.32 + - 8.15 + isImplemented: false + evidence: "" + comments: "" + Definition of simple BCDR practices for critical components: + uuid: c72da779-86cc-45b1-a339-190ce5093171 + risk: In case of an emergency, like a power outage, DR actions to perform are + not clear. This leads to reaction and remediation delays. + measure: By understanding and documenting a business continuity and disaster + recovery (BCDR) plan, the overall availability of systems and applications + is increased. Success factors like responsibilities, Service Level Agreements, + Recovery Point Objectives, Recovery Time Objectives or Failover must be fully + documented and understood. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 4 + level: 1 + implementation: [] + references: + samm2: [] + iso27001-2017: + - 17.1.1 + iso27001-2022: + - 5.29 + isImplemented: false + evidence: "" + comments: "" +Implementation: + Application Hardening: + App. Hardening Level 1: + uuid: cf819225-30cb-4702-8e32-60225eedc33d + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 1 + * OWASP Mobile Application Security Verification Standard + + in all applications provides a good baseline. Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + dependsOn: + - App. Hardening Level 1 (50%) + description: | + To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jump-start the development process, but also do so securely. + + [...] + + ### Planning aka Requirements Gathering & Analysis + The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. + + ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) + + Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. + + These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. + + In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. + + Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + - uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + references: + samm2: + - D-SR-1-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + comments: "" + App. Hardening Level 1 (50%): + uuid: b597928e-54d6-48a5-a806-8003dcd56aab + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 1 + * OWASP Mobile Application Security Verification Standard + + in all applications provides a good baseline. Implement 50% of the recommendations. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + description: | + To tackle the security of code developed in-house, OWASP offers an extensive collection of [Cheatsheets](https://cheatsheetseries.owasp.org/) demonstrating how to implement features securely. Moreover, the Security Knowledge Framework[1] offers an extensive library of code patterns spanning several programming languages. These patterns can be used to not only jumpstart the development process, but also do so securely. + + [...] + + ### Planning aka Requirements Gathering & Analysis + The Requirements gathering process tries to answer the question: _"What is the system going to do?"_ At this stage, the [SAMM project](https://owaspsamm.org/model/) offers 3 distinct maturity levels covering both [in-house](https://owaspsamm.org/model/design/security-requirements/stream-a/) software development and [third party](https://owaspsamm.org/model/design/security-requirements/stream-b/) supplier security. + + ![SAMM Requirements](https://github.com/OWASP/www-project-integration-standards/raw/master/writeups/owasp_in_sdlc/images/OWASP-in0.png) + + Organizations can use these to add solid security considerations at the start of the Software Development or Procurement process. + + These general security considerations can be audited by using a subsection of the ASVS controls in section V1 as a questionnaire. This process attempts to ensure that every feature has concrete security considerations. + + In case of internal development and if the organization maps Features to Epics, the [Security Knowledge Framework](https://securityknowledgeframework.org/) can be used to facilitate this process by leveraging its questionnaire function, shown below. + + Source: [OWASP Project Integration](https://raw.githubusercontent.com/OWASP/www-project-integration-standards/master/writeups/owasp_in_sdlc/index.md) + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + - uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + references: + samm2: + - D-SR-1-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + comments: "" + App. Hardening Level 2: + uuid: ffe86caf-2fec-4630-b514-2db83983984d + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 2 + * OWASP Mobile Application Security Verification Standard Level 2 + + Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 4 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-2-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + dependsOn: + - App. Hardening Level 2 (75%) + App. Hardening Level 2 (75%): + uuid: 03643ca2-03c2-472b-8e19-956bf02fe9b7 + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 2 + * OWASP Mobile Application Security Verification Standard Level 2 + + Implement 75% of the recommendations. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-2-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + dependsOn: + - App. Hardening Level 1 + App. Hardening Level 3: + uuid: 4cae98c2-4163-44ed-bb88-3c67c569533a + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + Following frameworks like the + * OWASP Application Security Verification Standard Level 3 + * OWASP Mobile Application Security Verification Standard + + Implement 95%-100% of the recommendations. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 + usefulness: 4 + level: 5 + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + references: + samm2: + - D-SR-3-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + dependsOn: + - App. Hardening Level 2 + Contextualized Encoding: + identifier: e1f37abb-d848-4a3a-b3df-65e91a89dcb7 + hazard: The generation of interpreter directives from user-provided data poses + difficulties and can introduce vulnerabilities to injection attacks. + remediation: | + Implementing contextualized encoding, such as employing object-relational mapping tools or utilizing prepared statements, nearly removes the threat of injection vulnerabilities. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 1 + description: | + Bear in mind that utilizing frameworks is a recommended approach; however, they can develop known security weaknesses over time. Diligent and regular patching is crucial. + implementation: + - uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + - uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + - uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + references: + samm2: + - D-SR-1-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + Usage of a Web Application Firewall: + uuid: 3e6253ab-89e5-4dea-aca0-3e770b78d39e + risk: Using an insecure application might lead to a compromised application. + This might lead to total data theft or data modification. + measure: | + The usage of an API Gateway / Web Application Firewall might mitigate it. There are debates on how useful a WAF is for APIs. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 4 + usefulness: 2 + level: 5 + implementation: + - uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + references: + samm2: + - D-SR-3-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + dependsOn: + - App. Hardening Level 2 + Development and Source Control: + API design validation: + uuid: 948a4d51-ceb5-4ebd-bdc7-d74ea25e171c + risk: Creation of insecure or non-compliant API. + measure: | + Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP + and validate the specification using specific tools. + Checks should be integrated in IDEs and CI/CD pipelines. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 3 + implementation: + - uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.25 + - 8.27 + - 8.28 + isImplemented: false + evidence: "" + comments: "" + Local development linting & style checks performed: + uuid: 517b0957-4981-4ac0-b4c7-0d8d1934c474 + risk: Insecure or unmaintainable code base. + measure: Integrate static code analysis tools in IDEs. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 5 + description: "" + implementation: + - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + - uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + references: + samm2: + - V-ST-1-A + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Source Control Protection: + uuid: e7598ac4-b082-4e56-b7df-e2c6b426a5e2 + risk: Intentional or accidental alterations in critical branches like master. + measure: Define source code management system policies (e.g. branch protection + rules, mandatory code reviews, ...) to ensure that changes to critical branches + are only possible under defined conditions. These policies can be implemented + at repository level or organization level, depending on the source code management + system. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 2 + implementation: + - uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + - uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + - uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - Peer review - four eyes principle is not explicitly required by ISO 27001 + - 5.3 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Versioning: + uuid: 066084c6-1135-4635-9cc5-9e75c7c5459f + risk: Deployment of untracked artifacts. + measure: Version artifacts in order to identify deployed features and issues. + This includes application and infrastructure code, jenkins configuration, + container and virtual machine images. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 1 + dependsOn: + - Defined deployment process + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + - 14.2.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + isImplemented: false + evidence: "" + comments: "" + Infrastructure Hardening: + Applications are running in virtualized environments: + uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 + risk: Through a vulnerability in one service on a server, the attacker gains + access to other services running on the same server. + measure: Applications are running in a dedicated and isolated virtualized environments. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 3 + level: 2 + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + Backup: + uuid: 5c61fd6b-8106-4c68-ac28-a8a42f1c67dc + risk: If errors are experienced during the deployment process you want to deploy + an old release. However, due to changes in the database this is often unfeasible. + measure: Performing automated periodical backups are used. Backup before deployment + can help facilitate deployments whilst testing the backup restore processes. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + - uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + dependsOn: + - Defined deployment process + references: + samm2: + - TODO + iso27001-2017: + - 12.3 + - 14.2.6 + iso27001-2022: + - 8.13 + - 8.31 + isImplemented: false + evidence: "" + comments: "" + Baseline Hardening of the environment: + uuid: 5992c38c-8597-4035-89db-d15820d81c3a + risk: Using default configurations for a cluster environment leads to potential + risks. + measure: Harden environments according to best practices. Level 1 and partially + level 2 from hardening practices like 'CIS Kubernetes Bench for Security' + should be considered. + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 2 + usefulness: 4 + level: 2 + implementation: + - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + - uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for containers + - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + references: + samm2: + - O-EM-1-A + iso27001-2017: + - system hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Filter outgoing traffic: + uuid: 6df508ef-86fc-4c22-bd9f-646c3127ce7d + risk: A compromised infrastructure component might try to send out stolen data. + measure: Having a whitelist and explicitly allowing egress traffic provides + the ability to stop unauthorized data leakage. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 2 + level: 3 + dependsOn: [] + implementation: + - uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + Hardening of the Environment: + uuid: dcf9601b-b4f2-4e25-9143-e39af75f7c33 + risk: Using default configurations for a cluster environment leads to potential + risks. + measure: Harden environments according to best practices. Level 2 and partially + level 3 from hardening practices like 'CIS Kubernetes Bench for Security' + should be considered. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 2 + usefulness: 3 + level: 4 + implementation: + - uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + - uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + - uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + - uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + - uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for containers + - uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + - uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + Immutable infrastructure: + uuid: 48e92bb1-fdba-40e8-b6c2-35de0d431833 + risk: The availability of IT systems might be disturbed due to components failures + measure: Redundancies in the IT systems + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + dependsOn: + - Infrastructure as Code + implementation: + - uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 17.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.14 + isImplemented: false + evidence: "" + comments: "" + Infrastructure as Code: + uuid: 8b994601-575e-4ea5-b228-accb18c8e514 + risk: No tracking of changes in systems might lead to errors in the configuration. + In additions, it might lead to unauthorized changes. An examples is jenkins. + measure: Systems are setup by code. A full environment can be provisioned. In + addition, software like Jenkins 2 can be setup and configured in in code too. + The code should be stored in a version control system. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 4 + usefulness: 4 + level: 3 + implementation: + - uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + - uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + - uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + - uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + - uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.1 + - 12.1.2 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.37 + - 8.32 + isImplemented: false + evidence: "" + comments: "" + Isolated networks for virtual environments: + uuid: 4ce24abd-8ba6-494c-828d-4d193e28e4a1 + risk: Virtual environments in default settings are able to access other virtual + environments on the network stack. By using virtual machines, it is often + possible to connect to other virtual machines. By using docker, one bridge + is used by default so that all containers on one host can communicate with + each other. + measure: The communication between virtual environments is controlled and regulated. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 2 + dependsOn: [] + implementation: + - uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + - uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + - uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + Limitation of system events: + uuid: e5386abf-9154-4752-a1a8-c3a8900f732d + risk: System events (system calls) can lead to privilege escalation. + measure: System calls are limited. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 5 + level: 3 + dependsOn: + - Audit of system events + implementation: + - uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + - uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + references: + samm2: + - O-EM-1-A + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + MFA: + uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de + risk: One factor authentication is more vulnerable to brute force attacks and + is considered less secure. + measure: Two ore more factor authentication for all accounts on all (important) + systems and applications + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 2 + dependsOn: + - MFA for admins + implementation: + - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 + name: Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + references: + samm2: + - O-EM-1-A + iso27001-2017: + - 9.2.4 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.17 + - 5.3 + - 8.25 + d3f: + - Multi-factorAuthentication + isImplemented: false + evidence: "" + comments: "" + MFA for admins: + uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 + risk: One factor authentication is more vulnerable to brute force attacks and + is considered less secure. + measure: Two ore more factor authentication for all privileged accounts on systems + and applications + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 4 + level: 1 + implementation: + - uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 + name: Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + - uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + - uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + references: + samm2: + - O-EM-1-A + iso27001-2017: + - 9.2.4 + - 6.1.2 + - 14.2.1 + iso27001-2022: + - 5.17 + - 5.3 + - 8.25 + d3f: + - Multi-factorAuthentication + isImplemented: false + evidence: "" + comments: "" + Microservice-architecture: + uuid: 118b869b-3850-456e-98d9-1abdb85cbc5a + risk: Monolithic applications are hard to test. + measure: A microservice-architecture helps to have small components, which are + more easy to test. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 5 + usefulness: 1 + level: 5 + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Production near environments are used by developers: + uuid: e14de741-94b3-447c-8b07-eea947d82e61 + risk: In case an errors occurs in production, the developer need to be able + to create a production near environment on a local development environment. + measure: Usage of infrastructure as code helps to create a production near environment. + The developer needs to be trained in order to setup a local development environment. + In addition, it should be possible to create production like test data. Often + personal identifiable information is anonymized in order to comply with data + protection laws. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 4 + level: 4 + dependsOn: + - Defined deployment process + - Infrastructure as Code + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - 12.1.4 + - 17.2.1 + iso27001-2022: + - 8.31 + - 8.14 + isImplemented: false + evidence: "" + comments: "" + Role based authentication and authorization: + uuid: 070bb14b-e04a-4f3d-896a-a08eba7a35f9 + risk: Everyone is able to get unauthorized access to information on systems + or to modify information unauthorized on systems. + measure: The usage of a (role based) access control helps to restrict system + access to authorized users. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + - uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + dependsOn: + - Defined deployment process + - Defined build process + references: + samm2: + - O-EM-1-A + iso27001-2017: + - 9.4.1 + iso27001-2022: + - 8.3 + isImplemented: false + evidence: "" + comments: "" + Simple access control for systems: + uuid: 82e499d1-f463-4a4b-be90-68812a874af6 + risk: Attackers a gaining access to internal systems and application interfaces + measure: All internal systems are using simple authentication + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 5 + level: 1 + dependsOn: + - Defined deployment process + implementation: + - uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + - uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + references: + samm2: + - O-EM-1-A + iso27001-2017: + - 9.4.1 + iso27001-2022: + - 8.3 + isImplemented: false + evidence: "" + comments: "" + Usage of a chaos monkey: + uuid: f8e80f18-2503-4e3e-b3bc-7f67bb28defe + risk: Due to manual changes on a system, they are not replaceable anymore. In + case of a crash it might happen that a planned redundant system is unavailable. + In addition, it is hard to replay manual changes. + measure: A randomized periodically shutdown of systems makes sure, that nobody + will perform manual changes to a system. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 5 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 17.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.29 + isImplemented: false + evidence: "" + comments: "" + Usage of an security account: + uuid: 746025a6-dbfb-4087-a000-e46acab64ee1 + risk: Having security auditing in the same account as infrastructure and applications + at the cloud provide might cause evil administrators (or threat actors taking + over an account of an administrator) to alter evidence like audit logs. + measure: Usage of a separate account dedicated for security activities. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 3 + usefulness: 4 + level: 2 + implementation: "" + references: + samm2: + - I-SD-2-B + iso27001-2017: + - 10.1 + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Usage of edge encryption at transit: + uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629 + risk: Evil actors might be able to perform a man in the middle attack and sniff + confidential information (e.g. authentication factors like passwords) + measure: By using encryption at the edge of traffic in transit, it is impossible + or at least harder to sniff credentials being outside of the organization. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + implementation: "" + references: + samm2: + - I-SD-2-B + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + isImplemented: false + evidence: "" + comments: "" + Usage of encryption at rest: + uuid: 0ff45fb8-7eef-46ed-9b3a-84c955cd7060 + risk: Evil actors might be able to access data and read information, e.g. from + physical hard disks. + measure: By using encryption at rest, it is impossible or at least harder to + to read information. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: "" + references: + samm2: + - I-SD-2-B + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + isImplemented: false + evidence: "" + comments: "" + Usage of internal encryption at transit: + uuid: ecb0184c-6bc9-45da-bbbb-a983797ffc93 + risk: Evil actors within the organization of traffic in transit might be able + to perform a man in the middle attack and sniff confidential information (e.g. + authentication factors like passwords) + measure: By using encryption internally, e.g. inside of a cluster, it is impossible + or at least harder to sniff credentials. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 3 + usefulness: 4 + level: 3 + implementation: "" + references: + samm2: + - I-SD-2-B + iso27001-2017: + - 10.1 + iso27001-2022: + - 8.24 + isImplemented: false + evidence: "" + comments: "" + Usage of security by default for components: + uuid: 11b3848e-e931-4146-a35d-35409ada24ee + risk: Components (images, libraries, applications) are not hardened. + measure: Hardening of components is important, specially for image on which + other teams base on. Hardening should be performed on the operation system + and on the services inside (e.g. Nginx or a Java-Application). + difficultyOfImplementation: + knowledge: 4 + time: 3 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + - uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + - uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + - uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + dependsOn: + - Defined build process + references: + samm2: + - O-EM-1-A + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Usage of test and production environments: + uuid: bfdacb52-1e3f-431d-ae72-d844a5e86415 + risk: Security tests are not running regularly because test environments are + missing + measure: A test and a production like environment is used + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 4 + level: 2 + dependsOn: + - Defined deployment process + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.4 + - 17.2.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.31 + - 8.14 + isImplemented: false + evidence: "" + comments: "" + Virtual environments are limited: + uuid: 760f1056-b0ee-4f22-a35b-f65446f944ca + risk: Denial of service (internally by an attacker or unintentionally by a bug) + on one service effects other services + measure: All virtual environments are using resource limits on hard disks, memory + and CPU + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 3 + usefulness: 3 + level: 2 + dependsOn: + - Applications are running in virtualized environments + implementation: [] + references: + samm2: + - O-EM-1-A + iso27001-2017: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 12.1.3 + - 13.1.3 + - 17.2.1 + iso27001-2022: + - Virtual environments are not explicitly covered by ISO 27001 - too specific + - 8.6 + - 8.22 + - 8.14 + isImplemented: false + evidence: "" + comments: "" + WAF Advanced: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b-advanced + risk: The presence of sophisticated threats necessitates a robust defense strategy + where application inputs are meticulously scrutinized for security breaches, + including advanced persistent threats and zero-day vulnerabilities. + measure: An advanced WAF protection level includes rigorous input validation, + rejecting any parameters not explicitly required, and custom rule sets that + are dynamically updated in response to emerging threats. + description: | + The advanced WAF setup is designed to ensure all data is in the correct format and any superfluous input parameters are automatically rejected. It includes machine learning algorithms to detect anomalies, custom-developed rules for real-time traffic analysis, and seamless integration with existing security infrastructures to adapt to the ever-changing threat landscape. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 5 + usefulness: 4 + level: 5 + dependsOn: + - WAF medium + implementation: [] + references: + samm2: + - TODO: Develop an advanced threat management framework that includes rigorous + input validation strategies. + iso27001-2022: + - TODO: Incorporate advanced WAF input validation processes into the organization's + ISMS. + comments: ~ + WAF baseline: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b + risk: Vulnerable input, such as exploits, can infiltrate the application via + numerous entry points, posing a significant security threat. + measure: Implementing a web application firewall (WAF) is a critical security + control. At a baseline level, the objective is to finely balance the reduction + of false positives, maintaining user experience, against a potential increase + in the less noticeable false negatives. + description: | + Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 3 + usefulness: 3 + level: 3 + dependsOn: + - Contextualized encoding + implementation: [] + references: + samm2: + - TODO: Identify and implement SAMM security practices relevant to WAF configuration. + iso27001-2022: + - TODO: Integrate WAF deployment with ISO 27001 controls for system hardening. + comments: ~ + WAF medium: + uuid: f0e01814-3b88-4bd0-a3a9-f91db001d20b + risk: The threat from malicious inputs remains high, with exploits seeking to + exploit any vulnerabilities present at the various points of entry to the + application. + measure: A WAF deployed with a medium level of protection strengthens the security + posture by striking a more advanced balance between the detection of genuine + threats and the minimization of false alarms. + description: | + Maintain the WAF in alert mode initially to ensure a comprehensive understanding of potential threats. With a medium-level configuration, the WAF settings are refined for greater precision in threat detection, with a stronger emphasis on security without significantly impacting legitimate traffic. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 4 + usefulness: 3 + level: 4 + dependsOn: + - WAF baseline + implementation: [] + references: + samm2: + - TODO: Establish advanced SAMM security practices for WAF management. + iso27001-2022: + - TODO: Ensure WAF processes are integrated into the overall security management + in accordance with ISO 27001 standards. + comments: ~ +Information Gathering: + Logging: + Centralized application logging: + uuid: fe875e17-ae4a-45f8-a359-244aa4fcbc04 + risk: Local stored logs can be unauthorized manipulated by attackers with system + access or might be corrupt after an incident. In addition, it is hard to perform + an correlation of logs. This leads attacks, which can be performed silently. + measure: A centralized logging system is used and applications logs (including + application exceptions) are shipped to it. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 5 + level: 3 + dependsOn: + - Visualized logging + - Alerting + implementation: [] + references: + samm2: + - O-IM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + isImplemented: false + evidence: "" + comments: "" + Centralized system logging: + uuid: 4eced38a-7904-4c45-adb0-50b663065540 + risk: Local stored system logs can be unauthorized manipulated by attackers + or might be corrupt after an incident. In addition, it is hard to perform + a aggregation of logs. + measure: By using centralized logging logs are protected against unauthorized + modification. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 1 + implementation: + - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + references: + samm2: + - O-IM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + isImplemented: false + evidence: "" + comments: "" + Correlation of security events: + uuid: ccf4561d-253f-4762-adcb-bc4622fd6fc5 + risk: Detection of security related events with hints on different systems/tools/metrics + is not possible. + measure: Events are correlated on one system. For example the correlation and + visualization of failed login attempts combined with successful login attempts. + difficultyOfImplementation: + knowledge: 4 + time: 4 + resources: 4 + usefulness: 3 + level: 5 + dependsOn: + - Visualized logging + - Alerting + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + isImplemented: false + evidence: "" + comments: "" + Logging of security events: + uuid: ccfdd0a8-991e-4269-ad77-c0a54ca655cb + description: | + Implement logging of security relevant events. The following events tend to be security relevant: + - successful/failed login/logout + - creation, change, and deletion of users + - errors during input validation and output creation + - exceptions and errors with security in their name + - transactions of value (e.g., financial transactions, costly operations) + - :unicorn: (special things of your application) + measure: Security-relevant events like login/logout or creation, change, deletion + of users should be logged. + assessment: | + - Show which events are logged. + - Show a test for one event logging. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 2 + credits: | + [AppSecure-nrw](https://github.com/AppSecure-nrw/security-belts/blob/master/orange/logging-of-security-events.md) + implementation: + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + - uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + references: + samm2: + - O-IM-1-A + iso27001-2017: + - 12.4.1 + iso27001-2022: + - 8.15 + risk: |- + * No track of security-relevant events makes it harder to analyze an incident. + * Security incident analysis takes significantly less time with proper security events, such that an attack can be stopped before the attacker reaches his goal. + isImplemented: false + evidence: "" + comments: "" + PII logging concept: + uuid: 613a73dc-4f60-49db-a6ce-4fb7bf8519f9 + risk: Personal identifiable information (PII) is logged and the privacy law + (e.g. General Data Protection Regulation) is not followed. + measure: A concept how to log PII is documented and applied. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + - uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + - uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + - uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + references: + samm2: + - O-IM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + - 18.1.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + - 5.31 + isImplemented: false + evidence: "" + comments: "" + Visualized logging: + uuid: 7c735089-6a83-419f-8b27-c1e676cedea1 + risk: System and application protocols are not visualized properly which leads + to no or very limited logging assessment. Specially developers might have + difficulty to read applications logs with unusually tools like the Linux tool + 'cat' + measure: Protocols are visualized in a simple to use real time monitoring system. + The GUI gives the ability to search for special attributes in the protocol. + difficultyOfImplementation: + knowledge: 1 + time: 3 + resources: 3 + usefulness: 4 + level: 2 + dependsOn: + - Centralized system logging + - Centralized application logging + implementation: + - uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + references: + samm2: + - O-IM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.4.1 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.15 + isImplemented: false + evidence: "" + comments: "" + Monitoring: + Advanced app. metrics: + uuid: d03bc410-74a7-4e92-82cb-d01a020cb6bf + risk: People are not looking into tests results. Vulnerabilities not recolonized, + even they are detected by tools. + measure: All defects from the dimension Test- and Verification are instrumented. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - Simple application metrics + - Visualized metrics + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Advanced availability and stability metrics: + uuid: ed715b38-c34b-40cd-83fd-ce807f306fc1 + risk: Trends and advanced attacks are not detected. + measure: Advanced metrics are gathered in relation to availability and stability. + For example unplanned downtime's per year. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Simple application metrics + - Visualized metrics + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + isImplemented: false + evidence: "" + comments: "" + Alerting: + uuid: 8a442d8e-0eb1-4793-a513-571aef982edd + risk: Incidents are discovered after they happened. + measure: | + Thresholds for metrics are set. In case the thresholds are reached, alarms are send out. Which should get attention due to the critically. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 2 + dependsOn: + - Visualized metrics + implementation: [] + references: + samm2: + - I-DM-A 3 + iso27001-2017: + - 16.1.2 + - 16.1.4 + - 12.1.4 + iso27001-2022: + - 6.8 + - 5.25 + - 8.31 + isImplemented: false + evidence: "" + comments: "" + Audit of system events: + uuid: 1cd5e4b8-be36-4726-adc7-d8f843f47ac8 + risk: System events (system calls) trends and attacks are not detected. + measure: Gathering of system calls. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 3 + dependsOn: + - Visualized metrics + implementation: + - uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + references: + samm2: + - O-IM-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Coverage and control metrics: + uuid: d0d681e7-d6de-4829-ac64-a9eb2546aa0d + risk: The effectiveness of configuration, patch and vulnerability management + is unknown. + measure: "Usage of Coverage- and control-metrics to show the effectiveness of + the security program. Coverage is the degree in \n which a specific + security control for a specific target group is applied with all resources.\n + \ The control degree shows the actual application of security standards + and security-guidelines. Examples are gathering information on anti-virus, + anti-rootkits, patch management, server configuration and vulnerability management." + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - Visualized metrics + implementation: + - uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + references: + samm2: + - O-IM-2-A + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Deactivation of unused metrics: + uuid: 7f36b9ba-bc05-4fd6-9a2a-73344c249722 + risk: High resources are used while gathering unused metrics. + measure: Deactivation of unused metrics helps to free resources. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 3 + dependsOn: + - Visualized metrics + implementation: [] + references: + samm2: + - O-IM-1-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.6 + isImplemented: false + evidence: "" + comments: "" + Defense metrics: + uuid: e808028c-351c-42f1-bcd9-fba738d1fc55 + risk: IDS/IPS systems like packet- or application-firewalls detect and prevent + attacks. It is not known how many attacks has been detected and blocked. + measure: | + Gathering of defense metrics like TCP/UDP sources enables to assume the geographic location of the request. + Assuming a Kubernetes cluster with an egress-traffic filter (e.g. IP/domain based), an alert might be send out in case of every violation. For ingress-traffic, alerting might not even be considered. + difficultyOfImplementation: + knowledge: 3 + time: 5 + resources: 2 + usefulness: 4 + level: 4 + dependsOn: + - Visualized metrics + - Filter outgoing traffic + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - 12.4.1 + - 13.1.1 + iso27001-2022: + - 8.15 + - 8.2 + isImplemented: false + evidence: "" + comments: "" + Grouping of metrics: + uuid: 42170a71-d4c8-47af-bd71-bf36875fd05b + risk: The analysis of metrics takes long. + measure: Meaningful grouping of metrics helps to speed up analysis. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 + usefulness: 2 + level: 3 + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 12.1.3 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.6 + isImplemented: false + evidence: "" + comments: "" + Metrics are combined with tests: + uuid: 71699daf-b2a4-466b-a0b2-89f7dbb18506 + risk: Changes might cause high load due to programming errors. + measure: Metrics during tests helps to identify programming errors. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 2 + usefulness: 5 + level: 5 + dependsOn: + - Grouping of metrics + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - not explicitly covered by ISO 27001 + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Monitoring of costs: + uuid: 10e23a8c-22ff-4487-a706-87ccc9d0798e + risk: Not monitoring costs might lead to unexpected high resource consumption + and a high invoice. + measure: Implement cost budgets. Setting of an alert threshold and sending out + errors when it is reached. In the best case, a second threshold with a limit + is set so that the cost can not go higher. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Simple application metrics + - Simple system metrics + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + isImplemented: false + evidence: "" + comments: "" + Screens with metric visualization: + uuid: 8746647c-638c-473f-8e17-82c068e4c311 + risk: Security related information is discovered too late during an incident. + measure: By having an internal accessible screen with a security related dashboards + helps to visualize incidents. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 5 + level: 4 + dependsOn: + - Grouping of metrics + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.26 + isImplemented: false + evidence: "" + comments: "" + Simple application metrics: + uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1 + risk: Attacks on an application are not recognized. + measure: Gathering of application metrics helps to identify incidents like brute + force attacks, login/logout. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 5 + level: 1 + implementation: + - uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + references: + samm2: + - O-IM-1-A + iso27001-2017: + - 12.4.1 + iso27001-2022: + - 8.15 + isImplemented: false + evidence: "" + comments: "" + Simple budget metrics: + uuid: f08a3219-6941-43ec-8762-4aff739f4664 + risk: Not getting notified about reaching the end of the budget (e.g. due to + a denial of service) creates unexpected costs. + measure: Cloud providers often provide insight into budgets. A threshold and + alarming for the budget is set. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 5 + level: 1 + implementation: + - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + references: + samm2: + - O-IM-1-A + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + isImplemented: false + evidence: "" + comments: "" + Simple system metrics: + uuid: 3d1f4c3b-f713-46d9-933a-54a014a26c03 + risk: Without simple metrics analysis of incidents are hard. In case an application + uses a lot of CPU from time to time, it is hard for a developer to find out + the source with Linux commands. + measure: Gathering of system metrics helps to identify incidents and specially + bottlenecks like in CPU usage, memory usage and hard disk usage. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 5 + assessment: | + Are system metrics gathered? + level: 1 + implementation: + - uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + references: + samm2: + - O-IM-1-A + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + isImplemented: false + evidence: "" + comments: "" + Targeted alerting: + uuid: d6f06ae8-401a-4f44-85df-1079247fa030 + risk: People are bored (ignorant) of incident alarm messages, as they are not + responsible to react. + measure: By the definition of target groups for incidents people are only getting + alarms for incidents they are in charge for. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 5 + usefulness: 5 + level: 3 + dependsOn: + - Alerting + implementation: [] + references: + samm2: + - I-DM-A 3 + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.26 + isImplemented: false + evidence: "" + comments: "" + Visualized metrics: + uuid: ded39bcf-4eaa-4c5f-9c94-09acde0a4734 + risk: Not visualized metrics lead to restricted usage of metrics. + measure: Metrics are visualized in real time in a user friendly way. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 2 + usefulness: 3 + level: 2 + dependsOn: + - Simple application metrics + - Simple system metrics + implementation: [] + references: + samm2: + - O-IM-2-A + iso27001-2017: + - 12.1.3 + iso27001-2022: + - 8.6 + isImplemented: false + evidence: "" + comments: "" +Test and Verification: + Application tests: + High coverage of security related module and integration tests: + uuid: 67667c97-c33e-4306-a4e5-e7b1d8e10c5a + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment in not important components. + measure: Implementation of security related tests via unit tests and integration + tests. Including the test of libraries, in case the are not tested already. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 3 + usefulness: 3 + level: 5 + implementation: [] + references: + samm2: + - V-ST-3-B + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Security integration tests for important components: + uuid: f57d55f2-dc05-4b34-9d1f-f8ce5bfb0715 + risk: Vulnerabilities are rising due to code changes in a complex microservice + environment. + measure: Implementation of essential security related integration tests. For + example for authentication and authorization. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 2 + level: 3 + references: + samm2: + - V-ST-3-B + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Security unit tests for important components: + uuid: eb2c7f9d-d0bd-4253-a2ba-cff2ace4a075 + risk: Vulnerabilities are rising due to code changes. + measure: Usage of unit tests to test important security related features like + authentication and authorization. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 2 + usefulness: 3 + level: 2 + comments: | + The integration of module tests takes place during development instead, it highlights vulnerabilities in sub-routines, functions, modules, libraries etc. checked. + A sample implementation of unit tests are explained in the video [Shift-Left-Security with the Security Test Pyramid - Andreas Falk](https://www.youtube.com/watch?v=TzFZy3f7d8E) starting with minute 9. + implementation: + - uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + - uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + references: + samm2: + - V-ST-3-B + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + Smoke Test: + uuid: 73aaae0b-5d68-4953-9fa4-fd25bf665f2a + risk: During a deployment an error might happen which leads to non-availability + of the system, a part of the system or a feature. + measure: Integration tests are performed against the production environment + after each deployment. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 2 + level: 4 + implementation: [] + dependsOn: + - Defined deployment process + references: + samm2: + - V-ST-3-B + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Consolidation: + Advanced visualization of defects: + uuid: 7a82020c-94d1-471c-bbd3-5f7fe7df4876 + risk: Correlation of the vulnerabilities of different tools to have an overview + of the the overall security level per component/project/team is not given. + measure: Findings are visualized per component/project/team. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 1 + usefulness: 2 + level: 4 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + isImplemented: false + evidence: "" + comments: "" + Generation of Patch Management Statistics: + uuid: 785e34ef-40c6-487a-984c-3e7706c9bc1f + risk: Delays in patch response lead to an increased attack surface through longer + exposure of known vulnerabilities. + measure: Average time to patch is visualized per component/project/team. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 2 + level: 3 + dependsOn: + - A patch policy is defined + - Automated PRs for patches + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + references: + samm2: + - I-DM-3-B + iso27001-2017: + - 16.1.4 + iso27001-2022: + - 5.25 + isImplemented: false + evidence: "" + comments: "" + Generation of Response Statistics: + uuid: c922981b-65ed-40f3-a947-96fee9a0125f + risk: No or delayed reaction to findings leads to potential exploitation of + findings. + measure: Creation and response statistics of findings. This is also referred + to as _Mean Time to Resolve_. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + dependsOn: + - Usage of a vulnerability management system + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + - uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + - uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + references: + samm2: + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.1 + isImplemented: false + evidence: "" + comments: The [DefectDojo-Client](https://github.com/SDA-SE/defectdojo-client/tree/master/statistic-client) + generates statistics from OWASP DefectDojo and places the results in a [Github + repository](https://github.com/pagel-pro/cluster-image-scanner-all-results). + Integration of vulnerability issues into the development process: + uuid: ce970c9b-da94-41cf-bd78-8c15357b7e8e + risk: To read console output of the build server to search for vulnerabilities + might be difficult. Also, to check a vulnerability management system might + not be a daily task for a developer. + measure: Vulnerabilities are tracked in the teams issue system (e.g. jira). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 2 + level: 3 + implementation: + - uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side / + client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + - uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + references: + samm2: + - I-DM-2-B + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.4 + - 16.1.5 + - 16.1.6 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.25 + - 5.26 + - 5.27 + isImplemented: false + evidence: "" + comments: "" + Reproducible defect tickets: + uuid: 27337442-e4b1-4e87-8dc9-ce86fbb79a39 + risk: Vulnerability descriptions are hard to understand by staff from operations + and development. + measure: Vulnerabilities include the test procedure to give the staff from operations + and development the ability to reproduce vulnerabilities. This enhances the + understanding of vulnerabilities and therefore the fix have a higher quality. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 2 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + isImplemented: false + evidence: "" + comments: "" + Simple false positive treatment: + uuid: c1acc8af-312e-4503-a817-a26220c993a0 + risk: As false positive occur during each test, all vulnerabilities might be + ignored. + measure: False positives are suppressed so they will not show up on the next + tests again. Most security tools have the possibility to suppress false positives. + A Vulnerability Management System might be used. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 4 + level: 1 + implementation: + - uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c + name: OWASP Defect Dojo + tags: [] + url: https://github.com/DefectDojo/django-DefectDojo + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + references: + samm2: + - I-DM-2-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 16.1.6 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 5.27 + isImplemented: false + evidence: "" + comments: "" + Simple visualization of defects: + uuid: 55f4c916-3a34-474d-ad96-9a9f7a4f6a83 + risk: The security level of a component is not visible. Therefore, the motivation + to enhance the security is not give. + measure: Vulnerabilities are simple visualized. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + - uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + references: + samm2: + - I-DM-1-B + iso27001-2017: + - 16.1.4 + - 8.2.1 + - 8.2.2 + - 8.2.3 + iso27001-2022: + - 5.25 + - 5.12 + - 5.13 + - 5.1 + isImplemented: false + evidence: "" + comments: "" + Treatment of all defects: + uuid: b2f77606-3e6c-41e9-b72d-7c0b1d3d581d + risk: Vulnerabilities with severity low are not visible. + measure: All vulnerabilities are added to the quality gate. + difficultyOfImplementation: + knowledge: 3 + time: 4 + resources: 1 + usefulness: 2 + level: 5 + implementation: [] + references: + samm2: + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + isImplemented: false + evidence: "" + comments: "" + Treatment of defects with severity high or higher: + uuid: 44f2c8a9-4aaa-4c72-942d-63f78b89f385 + risk: Vulnerabilities with severity high or higher are not visible. + measure: Vulnerabilities with severity high or higher are added to the quality + gate. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 1 + comments: False positive analysis, specially for static analysis, is time consuming. + references: + samm2: + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + implementation: [] + isImplemented: false + evidence: "" + Treatment of defects with severity middle: + uuid: 9cac3341-fe83-4079-bef2-bfc4279eb594 + risk: Vulnerabilities with severity middle are not visible. + measure: Vulnerabilities with severity middle are added to the quality gate. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + comments: False positive analysis, specially for static analysis, is time consuming. + references: + samm2: + - I-DM-2-B + iso27001-2017: + - 16.1.4 + - 12.6.1 + iso27001-2022: + - 8.8 + - 5.25 + implementation: [] + isImplemented: false + evidence: "" + Usage of a vulnerability management system: + uuid: 85ba5623-84be-4219-8892-808837be582d + risk: Maintenance of false positives in each tool enforces a high workload. + In addition a correlation of the same finding from different tools is not + possible. + measure: Aggregation of vulnerabilities in one tool reduce the workload to mark + false positives. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 2 + usefulness: 2 + level: 3 + implementation: + - uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + - uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + references: + samm2: + - I-DM-1-B + iso27001-2017: + - 12.6.1 + - 16.1.3 + - 16.1.4 + - 16.1.5 + - 16.1.6 + iso27001-2022: + - 8.8 + - 6.8 + - 5.25 + - 5.26 + - 5.27 + isImplemented: false + evidence: "" + comments: "" + Dynamic depth for applications: + Coverage analysis: + uuid: d0ba0be5-c573-405f-b905-b7a8f87a9cc7 + risk: Parts of the service are not still covered by tests. + measure: Check that there are no missing paths in the application with coverage-tools. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 3 + usefulness: 4 + level: 5 + implementation: + - uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + - uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + references: + samm2: + - V-ST-2-A + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + - part of periodic review, PDCA + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Coverage of client side dynamic components: + uuid: 9711f871-f79d-4573-8d4f-d2c98fd0d18e + risk: Parts of the service are not covered during the scan, because JavaScript + is not getting executed. Therefore, the co + measure: Usage of a spider which executes dynamic content like JavaScript, e.g. + via Selenium. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 4 + level: 2 + dependsOn: + - Usage of different roles + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + implementation: + - uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + isImplemented: false + evidence: "" + comments: "" + Coverage of hidden endpoints: + uuid: 6a9cb303-0f98-48a8-bdcd-56d41c0012b8 + risk: Hidden endpoints of the service are not getting tracked. + measure: Hidden endpoints are getting detected and included in the vulnerability + scan. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 1 + usefulness: 5 + level: 3 + implementation: + - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + - uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + dependsOn: + - Usage of different roles + references: + samm2: + - V-ST-2-A + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Coverage of more input vectors: + uuid: 5e0ff85b-ec89-4ef0-96b1-5695fa0025dc + risk: Parts of the service are not covered. For example specially formatted + or coded parameters are not getting detected as parameter (e.g. parameters + in REST-like URLs, parameters in JSON-Format or base64-coded parameters). + measure: Special parameter and special encodings are defined, so that they get + fuzzed by the used vulnerability scanners. + difficultyOfImplementation: + knowledge: 5 + time: 5 + resources: 1 + usefulness: 4 + level: 3 + dependsOn: + - Usage of different roles + references: + samm2: + - V-ST-2-A + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + iso27001-2022: + - ISO 27001:2022 mapping is missing + implementation: + - uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + isImplemented: false + evidence: "" + comments: "" + Coverage of sequential operations: + uuid: 845f06ec-148c-4c67-9755-7041911dcca5 + risk: Sequential operations like workflows (e.g. login -> put products in the + basket + measure: Sequential operations are defined and checked by the vulnerability + scanner in the defined order. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 5 + level: 3 + implementation: + - uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + dependsOn: + - Usage of different roles + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 14.2.8 + - 14.2.3 + iso27001-2022: + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Coverage of service to service communication: + uuid: 22aab0ef-76ce-4b8c-979c-3699784330db + risk: Service to service communication is not covered. + measure: Service to service communication is dumped and checked. + difficultyOfImplementation: + knowledge: 4 + time: 5 + resources: 2 + usefulness: 3 + level: 5 + dependsOn: + - Simple Scan + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + implementation: + - signing-of-commits-protection: + uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + signing-of-commits: + uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + ci-cd-tools: + uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + apimaturity: + uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + container-technologi: + uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + cwe25: + uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + docker-content-trust: + uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + in-toto: + uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + a-complete-backup-of: + uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + a-point-in-time-reco: + uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + blue-green-deploymen: + uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + docker: + uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + webserver: + uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + rolling-update: + uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + kubernetes-admission: + uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + dependabot: + uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: [] + url: https://dependabot.com/ + jenkins: + uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + sample-concept-1: + uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service + outage will occur to the end users. \n(2) twice a day a rebuild of images + is done. The rebuilds are put into a automated testing pipeline. If the + testing has no blocking issues the new images will be released for deployment + during the next \"restart\" of a container. What has to be done, is to + ensure the new containers are deployed in some canary deployment manner, + this will ensure that if (and only if) something buggy has been introduced + which breaks functionality the canary deployment will make sure the \"older + version\" is being used and not the buggy newer one." + distroless: + uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + fedora-coreos: + uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + distroless-usage: + uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + threat-modeling-play: + uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + owasp-samm: + uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + whiteboard: + uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + miro-or-any-other-c: + uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + draw-io: + uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + threagile: + uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + don-t-forget-evil-u: + uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: '[Don''t Forget EVIL U' + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + owasp-juice-shop: + uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + owasp-cheatsheet-ser: + uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-juiceshop: + uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 + name: OWASP JuiceShop + tags: [] + url: https://github.com/bkimminich/juice-shop + description: |- + In case you do not have the budget to hire an external security expert, an option + is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + https-cheatsheetse: + uuid: 99080ac7-60cd-46af-93a1-a53a33597cba + name: https://cheatsheetseries.owasp.org/ + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-security-champ: + uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + build-it-break-it-fi: + uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + motivate-people: + uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + owasp-top-10-maturit: + uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + involve-security-sme: + uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + damn-vulnerable-web: + uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + example-all-docker: + uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + owasp-asvs: + uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + owasp-masvs: + uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + cis-kubernetes-bench: + uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + cis-docker-bench-for: + uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + for-example-for-cont: + uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, + ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + attack-matrix-cloud: + uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + attack-matrix-contai: + uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for containers + attack-matrix-kubern: + uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + istio: + uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + bridges: + uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + firewalls: + uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + open-policy-agent: + uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + gitops: + uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + ansible: + uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + chef: + uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + puppet: + uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + jenkinsfile: + uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + seccomp: + uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + strace: + uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + remove-direct-access: + uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + directory-service: + uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + plugins: + uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + smartcard: + uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 + name: Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + yubikey: + uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + sms: + uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + totp: + uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + http-basic-authentic: + uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + vpn: + uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + for-applications-ch: + uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + managing-secrets: + uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + crypto: + uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + authentication: + uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + rsyslog: + uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + logstash: + uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + fluentd: + uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + bash: + uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + owasp-logging-cheats: + uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + elk-stack: + uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + https-ht-transpare: + uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + prometheus: + uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + collected: + uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + httpunit: + uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 + name: HttpUnit + tags: [] + url: http://httpunit.sourceforge.net/ + junit: + uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + karma: + uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + owasp-defectdojo: + uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + purify: + uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + see-other-actions-e: + uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 + name: See other actions, e.g. "Treatment of defects with severity high". + tags: [] + sast: + uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side + / client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + dast: + uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + owasp-defect-dojo: + uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c + name: OWASP Defect Dojo + tags: [] + url: https://github.com/DefectDojo/django-DefectDojo + owasp-dependency-che: + uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + logparser-jenkins-pl: + uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + owasp-code-pulse: + uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + ajax-spider: + uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + curl: + uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + openapi: + uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + owasp-zap: + uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + arachni: + uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + zest: + uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + owasp-securecodebox: + uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + kube-hunter: + uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + openvas: + uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + htc-hydra: + uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + netassert: + uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + nmap: + uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + owasp-amass: + uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + k8spurger: + uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + pmd: + uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + eslint: + uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + findsecuritybugs: + uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + jsprime: + uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + bdd-mobile-security: + uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + retire-js: + uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + npm-audit: + uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + sigmahq: + uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + dive-to-inspect-a-co: + uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + clusterscanner: + url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + dockerfile-with-hado: + uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + deployment-with-kube: + uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + kubesec: + uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + anchore-io: + uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + clair: + uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + openscap: + uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + vuls: + uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + kube-bench: + uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + trufflehog: + uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + go-pillage-registrie: + uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + https-github-com-a: + uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + registries-like-quay: + uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + dockerfilelint: + uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile + and looks for common traps, mistakes and helps enforce best practices. + threat-matrix-for-storage: + uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + defend-the-core-kubernetes: + uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + business-friendly-vulnerability-metrics: + uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + kubescape: + uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + azuredevops: + uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + github-policies: + uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + sonarqube: + uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + stylecop: + uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + fortify-vscode-extension: + uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + appscan-vscode-extension: + uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + checkmarx-vscode-extension: + uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + pre-commit-microsoft: + uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + pre-commit-synopsis: + uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + dependencyTrack: + uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach + by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + juice-shop: + uuid: c021aa72-c71c-43e4-9573-717b74d6c19d + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + dvwa: + uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + loggingCheatSheet: + uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + zap: + uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + secureCodeBox: + uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + K8sPurger: + uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + hashicorp-vault: + uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. + stoplight-spectral: + uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + api-oas-checker: + uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + coveragepy: + uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + github-dependabot: + uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + github-super-linter: + uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + schemathesis: + uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + martin-feature-toggles: + uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + defectdojo-client: + uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + falco: + uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + sammancoaching: + uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + terraform: + uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + packj: + uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + apiMyth: + uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + - signing-of-commits-protection: + uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + signing-of-commits: + uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + ci-cd-tools: + uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + apimaturity: + uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + container-technologi: + uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + cwe25: + uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + docker-content-trust: + uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + in-toto: + uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + a-complete-backup-of: + uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + a-point-in-time-reco: + uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + blue-green-deploymen: + uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + docker: + uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + webserver: + uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + rolling-update: + uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + kubernetes-admission: + uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + dependabot: + uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: [] + url: https://dependabot.com/ + jenkins: + uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + sample-concept-1: + uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service + outage will occur to the end users. \n(2) twice a day a rebuild of images + is done. The rebuilds are put into a automated testing pipeline. If the + testing has no blocking issues the new images will be released for deployment + during the next \"restart\" of a container. What has to be done, is to + ensure the new containers are deployed in some canary deployment manner, + this will ensure that if (and only if) something buggy has been introduced + which breaks functionality the canary deployment will make sure the \"older + version\" is being used and not the buggy newer one." + distroless: + uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + fedora-coreos: + uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + distroless-usage: + uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + threat-modeling-play: + uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + owasp-samm: + uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + whiteboard: + uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + miro-or-any-other-c: + uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + draw-io: + uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + threagile: + uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + don-t-forget-evil-u: + uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: '[Don''t Forget EVIL U' + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + owasp-juice-shop: + uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + owasp-cheatsheet-ser: + uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-juiceshop: + uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 + name: OWASP JuiceShop + tags: [] + url: https://github.com/bkimminich/juice-shop + description: |- + In case you do not have the budget to hire an external security expert, an option + is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + https-cheatsheetse: + uuid: 99080ac7-60cd-46af-93a1-a53a33597cba + name: https://cheatsheetseries.owasp.org/ + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-security-champ: + uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + build-it-break-it-fi: + uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + motivate-people: + uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + owasp-top-10-maturit: + uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + involve-security-sme: + uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + damn-vulnerable-web: + uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + example-all-docker: + uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + owasp-asvs: + uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + owasp-masvs: + uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + cis-kubernetes-bench: + uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + cis-docker-bench-for: + uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + for-example-for-cont: + uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, + ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + attack-matrix-cloud: + uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + attack-matrix-contai: + uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for containers + attack-matrix-kubern: + uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + istio: + uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + bridges: + uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + firewalls: + uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + open-policy-agent: + uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + gitops: + uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + ansible: + uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + chef: + uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + puppet: + uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + jenkinsfile: + uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + seccomp: + uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + strace: + uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + remove-direct-access: + uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + directory-service: + uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + plugins: + uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + smartcard: + uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 + name: Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + yubikey: + uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + sms: + uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + totp: + uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + http-basic-authentic: + uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + vpn: + uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + for-applications-ch: + uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + managing-secrets: + uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + crypto: + uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + authentication: + uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + rsyslog: + uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + logstash: + uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + fluentd: + uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + bash: + uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + owasp-logging-cheats: + uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + elk-stack: + uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + https-ht-transpare: + uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + prometheus: + uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + collected: + uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + httpunit: + uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 + name: HttpUnit + tags: [] + url: http://httpunit.sourceforge.net/ + junit: + uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + karma: + uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + owasp-defectdojo: + uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + purify: + uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + see-other-actions-e: + uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 + name: See other actions, e.g. "Treatment of defects with severity high". + tags: [] + sast: + uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side + / client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + dast: + uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + owasp-defect-dojo: + uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c + name: OWASP Defect Dojo + tags: [] + url: https://github.com/DefectDojo/django-DefectDojo + owasp-dependency-che: + uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + logparser-jenkins-pl: + uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + owasp-code-pulse: + uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + ajax-spider: + uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + curl: + uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + openapi: + uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + owasp-zap: + uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + arachni: + uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + zest: + uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + owasp-securecodebox: + uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + kube-hunter: + uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + openvas: + uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + htc-hydra: + uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + netassert: + uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + nmap: + uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + owasp-amass: + uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + k8spurger: + uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + pmd: + uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + eslint: + uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + findsecuritybugs: + uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + jsprime: + uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + bdd-mobile-security: + uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + retire-js: + uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + npm-audit: + uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + sigmahq: + uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + dive-to-inspect-a-co: + uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + clusterscanner: + url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + dockerfile-with-hado: + uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + deployment-with-kube: + uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + kubesec: + uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + anchore-io: + uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + clair: + uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + openscap: + uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + vuls: + uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + kube-bench: + uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + trufflehog: + uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + go-pillage-registrie: + uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + https-github-com-a: + uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + registries-like-quay: + uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + dockerfilelint: + uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile + and looks for common traps, mistakes and helps enforce best practices. + threat-matrix-for-storage: + uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + defend-the-core-kubernetes: + uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + business-friendly-vulnerability-metrics: + uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + kubescape: + uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + azuredevops: + uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + github-policies: + uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + sonarqube: + uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + stylecop: + uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + fortify-vscode-extension: + uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + appscan-vscode-extension: + uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + checkmarx-vscode-extension: + uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + pre-commit-microsoft: + uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + pre-commit-synopsis: + uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + dependencyTrack: + uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach + by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + juice-shop: + uuid: c021aa72-c71c-43e4-9573-717b74d6c19d + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + dvwa: + uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + loggingCheatSheet: + uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + zap: + uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + secureCodeBox: + uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + K8sPurger: + uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + hashicorp-vault: + uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. + stoplight-spectral: + uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + api-oas-checker: + uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + coveragepy: + uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + github-dependabot: + uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + github-super-linter: + uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + schemathesis: + uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + martin-feature-toggles: + uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + defectdojo-client: + uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + falco: + uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + sammancoaching: + uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + terraform: + uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + packj: + uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + apiMyth: + uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + isImplemented: false + evidence: "" + comments: "" + Simple Scan: + uuid: 07796811-37f9-467c-9ff2-48f346e77ff3 + risk: Deficient security tests are performed. Simple vulnerabilities are not + detected and missing security configurations (e.g. headers) are not set. Fast + feedback is not given. + measure: A simple scan is performed to get a security baseline. In case the + test is done in under 10 minutes, it should be part of the build and deployment + process. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 1 + level: 2 + dependsOn: + - Defined build process + implementation: + - uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + - uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Usage of different roles: + uuid: 65a2d7d9-5441-46bf-a4e3-f76919857750 + risk: Parts of the service are not covered during the scan, because a login + is not performed. + measure: Integration of authentication with all roles used in the service. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 2 + level: 2 + dependsOn: + - Simple Scan + references: + samm2: + - V-ST-2-A + iso27001-2017: + - not explicitly covered by ISO 27001 - too specific + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.32 + - 8.29 + implementation: + - uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + isImplemented: false + assessment: For REST APIs, multiple OAuth2 scopes are used. + evidence: "" + comments: "" + Usage of multiple scanners: + uuid: 5b5a1eb2-113f-41fb-a3d6-06af4fdc9cea + risk: Each vulnerability scanner has different opportunities. By using just + one scanner, some vulnerabilities might not be found. + measure: Usage of multiple spiders and scanner enhance the coverage and the + vulnerabilities. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 1 + level: 4 + dependsOn: + - Usage of different roles + implementation: + - uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Dynamic depth for infrastructure: + Load tests: + uuid: ab5725aa-4d53-47b9-96df-c14b3fa93bcd + risk: As it is unknown how many requests the systems and applications can serve, + due to an unexpected load the availability is disturbed. + measure: Load test against the production system or a production near system + is performed. + difficultyOfImplementation: + knowledge: 3 + time: 2 + resources: 5 + usefulness: 3 + level: 4 + implementation: [] + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 12.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.6 + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Test for exposed services: + uuid: a6c4cefb-a0b7-4787-8cc7-a0f96b4b00d8 + risk: Standard network segmentation and firewalling has not been performed, + leading to world open cluster management ports. + measure: With the help of tools the network configuration of unintentional exposed + cluster(s) are tested. To identify clusters, all subdomains might need to + be identified with a tool like OWASP Amass to perform port scans based o the + result. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 2 + dependsOn: + - Isolated networks for virtual environments + usefulness: 2 + level: 2 + implementation: + - uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + - uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Test for unauthorized installation: + uuid: dccf1949-b9a8-4ce8-b992-6a4a7f3a623a + risk: Unapproved components are used. + measure: Components must be whitelisted. Regular scans on the docker infrastructure + (e.g. cluster) need to be performed, to verify that only standardized base + images are used. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + comments: By preventing teams from trying out new components, innovation might + be hampered + references: + samm2: [] + iso27001-2017: + - 12.5.1 + - 12.6.1 + iso27001-2022: + - 8.19 + - 8.8 + isImplemented: false + evidence: "" + dependsOn: + - Evaluation of the trust of used components + Test for unused Resources: + uuid: 6532c1fe-9d23-4228-8722-558ddabca7d4 + risk: Unused resources, specially secrets, might be still valid, but are exposing + information. As an attacker, I compromise a system, gather credentials and + try to use them. + measure: Test for unused resources helps to identify unused resources. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 5 + implementation: + - uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Test network segmentation: + uuid: 6d2c3ac6-8afc-4af6-a5e9-6188341aca01 + risk: Wrong or no network segmentation of pods makes it easier for an attacker + to access a database and extract or modify data. + measure: Cluster internal test needs to be performed. Integration of fine granulated + network segmentation (also between pods in the same namespace). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 2 + implementation: + - uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + dependsOn: + - Segmented networks for virtual environments + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 13.1.3 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - 8.22 + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Test of the configuration of cloud environments: + uuid: 7bb70764-9392-4462-935d-e55b2e148199 + risk: Standard hardening practices for cloud environments are not performed + leading to vulnerabilities. + measure: With the help of tools the configuration of virtual environments are + tested. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + - uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + - uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + references: + samm2: [] + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Weak password test: + uuid: 61e10f9c-e126-4ffa-af12-fdbe0d0a831f + risk: Weak passwords in components like applications or systems, specially for + privileged accounts, lead to take over of that account. + measure: Automatic brute force attacks are performed. Specially the usage of + standard accounts like 'admin' and employee user-ids is recommended. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 1 + level: 3 + implementation: + - uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 9.4.3 + iso27001-2022: + - 5.17 + isImplemented: false + evidence: "" + comments: "" + Static depth for applications: + API design validation: + uuid: 017d9e26-42b5-49a4-b945-9f59b308fb99 + risk: Creation of insecure or non-compliant API. + measure: | + Design contract-first APIs using an interface description language such as OpenAPI, AsyncAPI or SOAP + and validate the specification using specific tools. + Checks should be integrated in IDEs and CI/CD pipelines. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 4 + level: 2 + implementation: + - uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + - uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.25 + - 8.27 + - 8.28 + isImplemented: false + evidence: "" + comments: "" + Dead code elimination: + uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + risk: Dead code increases the attack surface (use of hard coded credentials + and variables, sensitive information) + measure: Collection of unused code and then manual removal of unused code. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - Defined build process + references: + samm2: + - V-ST-2-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Exclusion of source code duplicates: + uuid: d17dbff0-1f10-492a-b4c7-17bb59a0a711 + risk: Duplicates in source code might influence the stability of the application. + measure: Automatic Detection and manual removal of duplicates in source code. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + dependsOn: + - Defined build process + references: + samm2: + - V-ST-2-A + iso27001-2017: + - Not explicitly covered by ISO 27001 - too specific + - 14.2.1 + - 14.2.5 + iso27001-2022: + - Not explicitly covered by ISO 27001 - too specific + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Local development security checks performed: + uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b + risk: Creating and developing code contains code smells and quality issues. + measure: | + Integration of quality and linting plugins with interactive development environment (IDEs). + Implement pre-commit checks to prevent secrets & other security issues being commit to source code. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 4 + level: 3 + implementation: + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + - signing-of-commits-protection: + uuid: 86c6bdba-73c0-4c99-bbda-81b85c9fe2a4 + name: Enforcement of commit signing + tags: + - signing + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/managing-a-branch-protection-rule + description: Usage of branch protection rules + signing-of-commits: + uuid: d6d755d3-b9f1-4942-a084-e62b266541df + name: Signing of commits + tags: + - signing + url: https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work + description: Signing of commits in git + ci-cd-tools: + uuid: b4bfead3-5fb6-4dd0-ba44-5da713bd22e4 + name: CI/CD tools + tags: + - ci-cd + url: https://martinfowler.com/articles/continuousIntegration.html + description: CI/CD tools such as jenkins, gitlab-ci or github-actions + apimaturity: + uuid: 596cb528-8981-4723-bcc3-22c261f26114 + name: API Security Maturity Model for Authorization + tags: + - api + url: https://curity.io/resources/learn/the-api-security-maturity-model/ + container-technologi: + uuid: ed6b6340-6c7f-4e13-8937-f560d3f5db11 + name: Container technologies and orchestration like Docker, Kubernetes + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:ContainerOrchestrationSoftware/ + cwe25: + uuid: c77f7ecd-76de-4611-bd6d-5b249f910c39 + name: CWE Top 25 Most Dangerous Software Weaknesses + tags: + - documentation + - threat + url: https://cwe.mitre.org/top25/archive/2020/2020_cwe_top25.html + docker-content-trust: + uuid: ee81f93f-8230-4cfb-a132-ae4ec61cb8e6 + name: Docker Content Trust + tags: [] + url: https://docs.docker.com/engine/security/trust/ + in-toto: + uuid: 6e9d8c14-ba3b-4698-afc3-365b4ab6fb1f + name: in-toto + tags: [] + url: https://in-toto.github.io/ + a-complete-backup-of: + uuid: ba7348e5-1abf-4c7d-8fbc-49f99460930b + name: A complete backup of persisted data might be performed*. + tags: [] + a-point-in-time-reco: + uuid: 9af7624e-0729-4eeb-b257-ebaf65f70355 + name: A Point in Time Recovery for databases should be implemented. + tags: [] + blue-green-deploymen: + uuid: 4fb3d95c-07c0-4cbb-b396-5054aba751c2 + name: Blue/Green Deployments + tags: [] + url: https://martinfowler.com/bliki/BlueGreenDeployment.html + docker: + uuid: cc47b2e3-6ee5-4926-af3a-d418ef91c8ba + name: Docker + url: https://github.com/moby/moby + tags: [] + webserver: + uuid: a71ce8f8-fd4a-4240-8b46-64a6cdb5dfdb + name: Webserver + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebServer/ + rolling-update: + uuid: ee2eb94b-7204-40d8-97da-43c7b1296e2e + name: rolling update + tags: [] + kubernetes-admission: + uuid: 2a76300f-6b1f-4a51-b925-134c36b723af + name: Kubernetes Admission Controller can whitelist registries and/or whitelist + a signing key. + tags: [] + url: https://medium.com/slalom-technology/build-a-kubernetes-dynamic-admission-controller-for-container-registry-whitelisting-b46fe020e22d + dependabot: + uuid: d6292c7d-aab7-43d3-a7c6-1e443b5c1aa4 + name: dependabot + tags: [] + url: https://dependabot.com/ + jenkins: + uuid: 42ddb49f-48f2-4a3a-b76a-e73104ac6971 + name: Jenkins + tags: [] + url: https://www.jenkins.io/ + sample-concept-1: + uuid: 1a463242-b480-46f6-a912-b51ec1c1558d + name: "Sample concept: \n(1" + tags: [] + description: "Sample concept: \n(1) each container has a set lifetime and + is killed / replaced with a new container multiple times a day where you + have some form of a graceful replacement to ensure no (short) service + outage will occur to the end users. \n(2) twice a day a rebuild of images + is done. The rebuilds are put into a automated testing pipeline. If the + testing has no blocking issues the new images will be released for deployment + during the next \"restart\" of a container. What has to be done, is to + ensure the new containers are deployed in some canary deployment manner, + this will ensure that if (and only if) something buggy has been introduced + which breaks functionality the canary deployment will make sure the \"older + version\" is being used and not the buggy newer one." + distroless: + uuid: ef647044-b675-47d3-9720-3ebc144ef37b + name: Distroless + tags: [] + url: https://github.com/GoogleContainerTools/distroless + fedora-coreos: + uuid: be757cb3-63d6-4a63-9c4e-e10b746fd47a + name: Fedora CoreOS + tags: [] + url: https://getfedora.org/coreos + distroless-usage: + uuid: a92c4f8f-a918-406a-b1e5-70acfc0477bd + name: Distroless or Alpine + tags: [] + url: https://itnext.io/which-container-images-to-use-distroless-or-alpine-96e3dab43a22 + threat-modeling-play: + uuid: fd0f282b-a065-4464-beed-770c604a5f52 + name: Threat Modeling Playbook + tags: + - owasp + - defender + - threat-modeling + - whiteboard + url: https://github.com/Toreon/threat-model-playbook + owasp-samm: + uuid: b5eaf710-e05f-49e5-a649-13afde9aeb52 + name: OWASP SAMM + tags: + - threat-modeling + - owasp + - defender + url: https://owaspsamm.org/model/design/threat-assessment/stream-b/ + whiteboard: + uuid: c0533602-11b7-4838-93cc-a40556398163 + name: Whiteboard + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://en.wikipedia.org/wiki/Whiteboard + miro-or-any-other-c: + uuid: 965c3814-b6df-4ead-a096-1ed78ce1c7c1 + name: Miro (or any other collaborative board) + tags: + - defender + - threat-modeling + - collaboration + - whiteboard + url: https://miro.com/ + draw-io: + uuid: 088794c4-3424-40d4-9084-4151587fc84d + name: Draw.io + tags: + - defender + - threat-modeling + - whiteboard + url: https://github.com/jgraph/drawio-desktop + threagile: + uuid: e8332407-5149-459e-a2fe-c5c78c7ec55c + name: Threagile + tags: + - threat-modeling + url: https://github.com/Threagile/threagile + don-t-forget-evil-u: + uuid: bb5b8988-021b-452a-a914-bd36887b6860 + name: '[Don''t Forget EVIL U' + tags: [] + url: https://www.owasp.org/index.php/Agile_Software_Development + description: '[Do not Forget EVIL User Stories](https://www.owasp.org/index.php/Agile_Software_Development:_Don%27t_Forget_EVIL_User_Stories) + and [Practical Security Stories and Security Tasks for Agile Development + Environments](http://safecode.org/publication/SAFECode_Agile_Dev_Security0712.pdf)' + owasp-juice-shop: + uuid: 1fff917f-205e-4eab-ae0e-1fab8c04bf3a + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + owasp-cheatsheet-ser: + uuid: 1c3f2f7a-5031-4687-9d69-76c5178c74e1 + name: OWASP Cheatsheet Series + tags: + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-juiceshop: + uuid: 81476121-67dd-4ba9-a67b-e78a23050c28 + name: OWASP JuiceShop + tags: [] + url: https://github.com/bkimminich/juice-shop + description: |- + In case you do not have the budget to hire an external security expert, an option + is to use the [OWASP JuiceShop](https://github.com/bkimminich/juice-shop) on a "hacking Friday" + https-cheatsheetse: + uuid: 99080ac7-60cd-46af-93a1-a53a33597cba + name: https://cheatsheetseries.owasp.org/ + tags: + - training + - secure coding + url: https://cheatsheetseries.owasp.org/ + owasp-security-champ: + uuid: c191a515-3c10-4903-a889-70c8021f2ea1 + name: OWASP Security Champions Playbook + tags: + - security champions + url: https://github.com/c0rdis/security-champions-playbook + build-it-break-it-fi: + uuid: 8d4c1849-f310-4c42-8148-2810b382bc6f + name: Build it Break it Fix it Contest + tags: [] + url: https://builditbreakit.org/ + motivate-people: + uuid: 8e1b4a8a-c53b-4b1e-90f6-c60b7e225098 + name: Motivate people + tags: + - security champions + - gamification + - nudging + url: https://github.com/wurstbrot/security-pins + description: |- + Enhance motivation can be performed with the distribution of pins + as a reward, see [OWASP Security Pins Project](https://github.com/wurstbrot/security-pins) + owasp-top-10-maturit: + uuid: 22b63bdb-2003-4ac0-969d-b1e5268c2510 + name: OWASP Top 10 Maturity Categories for Security Champions + tags: + - security champions + url: https://owaspsamm.org/presentations/OWASP_Top_10_Maturity_Categories_for_Security_Champions.pptx + involve-security-sme: + uuid: 8a044b74-17f2-4ffa-9dee-6b3bb6e4baf3 + name: Involve Security SME + tags: [] + description: Security SME are involved in discussion for requirements analysis, + software design and sprint planning to provide guidance and suggestions. + damn-vulnerable-web: + uuid: a8cd9acb-ad22-44d6-b177-1154c65a8529 + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + example-all-docker: + uuid: 349cf64c-abea-40bb-bd07-9c98ce648fa4 + name: 'Example: All docker images used by teams need to be based on standard + images.' + tags: [] + owasp-asvs: + uuid: 88767cde-1610-402e-98ec-bc3575377183 + name: OWASP ASVS + tags: [] + url: https://owasp.org/www-project-application-security-verification-standard/ + owasp-masvs: + uuid: 7bf90650-a53a-4581-a214-1afd5de3a059 + name: OWASP MASVS + tags: [] + url: https://github.com/OWASP/owasp-masvs + cis-kubernetes-bench: + uuid: edaec98d-dac7-4dfd-8ab3-42c471d5b9ff + name: CIS Kubernetes Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + cis-docker-bench-for: + uuid: 4dd23c4a-5a7e-4917-82cf-d00e0f04482f + name: CIS Docker Bench for Security + tags: [] + url: https://www.cisecurity.org/cis-benchmarks/ + for-example-for-cont: + uuid: f4d7c796-8574-4a88-ab00-98d245a115ef + name: For example for Cont + tags: [] + description: 'For example for Containers: Deny running containers as root, + deny using advanced privileges, deny mounting of the hole filesystem, + ...' + url: https://d3fend.mitre.org/technique/d3f:ExecutionIsolation/ + attack-matrix-cloud: + uuid: 3b7df373-2ad9-456e-9abe-439cdc9d4d8b + name: Attack Matrix Cloud + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for cloud + attack-matrix-contai: + uuid: 59881520-4c69-4922-a44e-99044a77de2b + name: Attack Matrix Containers + tags: + - mitre + url: https://attack.mitre.org/matrices/enterprise/cloud/ + description: Attack matrix for containers + attack-matrix-kubern: + uuid: 9fbc47ad-82bc-46d1-bba9-66815ab79935 + name: Attack Matrix Kubernetes + tags: + - mitre + url: https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/ + description: Attack matrix for kubernetes + istio: + uuid: 9429d52c-203d-49ae-814f-1401210887cd + name: istio + tags: [] + url: https://istio.io/ + bridges: + uuid: fc0eda30-2bf7-466f-948e-e17584db9f30 + name: bridges + tags: [] + firewalls: + uuid: e3c6fb92-3f7d-471f-9308-c62359f4f1b7 + name: firewalls + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Firewall/ + open-policy-agent: + uuid: 4a024319-4510-4a53-a8b6-8f35b6c01867 + name: Open Policy Agent + tags: [] + url: https://www.openpolicyagent.org/ + gitops: + uuid: b0931397-2402-44f1-814b-63292ab4a339 + name: GitOps + tags: [] + url: https://www.redhat.com/en/topics/devops/what-is-gitops + ansible: + uuid: 73747d35-2185-4f22-94a0-723288fa283c + name: Ansible + tags: [] + url: https://github.com/ansible/ansible + chef: + uuid: 691c443f-b6e2-498d-94dc-778d8d51cfce + name: Chef + tags: [] + url: https://github.com/chef/chef + puppet: + uuid: eb7f76a8-87e5-4394-af4c-c09487c85982 + name: Puppet + tags: [] + url: https://github.com/puppetlabs/puppet + jenkinsfile: + uuid: 321dcfe4-d2fc-4dd2-85bf-aac563958458 + name: Jenkinsfile + tags: [] + url: https://www.jenkins.io/doc/book/pipeline/jenkinsfile/ + seccomp: + uuid: 0cc7e68b-f7d9-4e66-8065-47d076129ffd + name: seccomp + tags: [] + url: https://man7.org/linux/man-pages/man2/seccomp.2.html + strace: + uuid: 73ab2e3d-11a7-459d-8b57-9337662bd1ff + name: strace + tags: [] + url: https://man7.org/linux/man-pages/man1/strace.1.html + remove-direct-access: + uuid: b206481f-9c66-45e2-843c-37c5730580cd + name: Remove direct access to infrastructure + tags: [] + directory-service: + uuid: 04edc63e-d389-48dd-b365-552aaf4ea004 + name: Directory Service + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:DirectoryService/ + plugins: + uuid: cc55cba1-ea0a-466e-99c5-337c9da2b00e + name: Plugins + tags: [] + smartcard: + uuid: e76a395a-8d6a-4e25-a175-6cf25409b755 + name: Smartcard + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + yubikey: + uuid: d5981117-9bc2-45ed-b4a4-383135dc13d8 + name: YubiKey + tags: [] + url: https://d3fend.mitre.org/technique/d3f:Multi-factorAuthentication/ + sms: + uuid: 6151cfb3-c894-421e-83da-cac0b2bfaec8 + name: SMS + tags: [] + totp: + uuid: f69f5d03-691f-4e14-8fbc-ad66e2e5a12d + name: TOTP + tags: [] + url: https://d3fend.mitre.org/technique/d3f:One-timePassword/ + http-basic-authentic: + uuid: 41fda224-2980-443c-bfd4-0a1d4b520cb9 + name: HTTP-Basic Authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:WebAuthentication/ + vpn: + uuid: e506f60b-747b-44b1-8fe8-f67ccd8f290e + name: VPN + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:VPN/ + for-applications-ch: + uuid: d7fb1f5a-05e3-49f7-ae67-00bfb8f8410c + name: 'For applications: Check default encoding' + tags: [] + managing-secrets: + uuid: 7e744f11-976e-46b6-88d4-f39b2965dfaf + name: managing secrets + tags: [] + url: https://d3fend.mitre.org/technique/d3f:CredentialHardening/ + crypto: + uuid: 520517ef-2911-4efc-8e1b-dcc9389aca45 + name: crypto + tags: [] + authentication: + uuid: ba6bd46c-2069-4f4d-b26c-7334a7553339 + name: authentication + tags: [] + url: https://d3fend.mitre.org/dao/artifact/d3f:Authentication/ + rsyslog: + uuid: 79f88310-d63e-471d-8e63-8c77f2281b66 + name: rsyslog + url: https://www.rsyslog.com/ + tags: + - tool + - logging + logstash: + uuid: 7a8fad2e-d642-4972-8501-74591b23feab + name: logstash + url: https://www.elastic.co/guide/en/logstash/current/getting-started-with-logstash.html + tags: + - tool + - logging + fluentd: + uuid: f5da3a20-ab64-4ecf-b4e1-660c80036e45 + name: fluentd + tags: + - tool + url: https://www.fluentd.org/ + bash: + uuid: 6226f8bc-2f6e-45c2-9232-98d2027e4531 + name: bash + tags: + - tool + url: https://www.gnu.org/software/bash/ + owasp-logging-cheats: + uuid: 5a5c7d99-41e8-454a-86ae-a638c9787d8c + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + elk-stack: + uuid: 38fe9d00-df8b-44b6-910d-ca0f02b5c5d3 + name: ELK-Stack + tags: [] + url: https://www.elastic.co/elk-stack + https-ht-transpare: + uuid: 84ef86ea-ada4-4e10-ae4f-a5bb77dcae5d + name: https://ht.transpare + tags: [] + url: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD + description: https://ht.transparencytoolkit.org/FileServer/FileServer/OLD%20Fileserver/books/SICUREZZA/Addison.Wesley.Security.Metrics.Mar.2007.pdf + prometheus: + uuid: ddf221df-3517-42e4-b23d-c1d9a162744c + name: Prometheus + tags: [] + url: https://prometheus.io/ + collected: + uuid: 73f6a52c-4fc2-45dc-991b-d5911b6c1ef8 + name: collected + tags: [] + httpunit: + uuid: 3bd40005-f180-4b95-907d-ec5b58ac1f20 + name: HttpUnit + tags: [] + url: http://httpunit.sourceforge.net/ + junit: + uuid: cc2eec82-f3a7-4ae5-9ccb-3d75352b2e4d + name: JUnit + tags: + - unittest + url: https://junit.org/junit5/ + karma: + uuid: fd56720a-ad4b-487c-b4c3-897a688672c4 + name: Karma + tags: [] + url: https://karma-runner.github.io + owasp-defectdojo: + uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb + name: OWASP DefectDojo + tags: + - vulnerability management system + - owasp + url: https://github.com/DefectDojo/django-DefectDojo + description: | + DefectDojo is a security program and vulnerability management tool. DefectDojo allows you to manage your application security program, maintain product and application information, triage vulnerabilities and push findings into defect trackers. Consolidate your findings into one source of truth with DefectDojo. + purify: + uuid: d2eb592d-c9b5-4c39-bff7-bb313a58e3a9 + name: Purify + tags: + - vulnerability management system + url: https://github.com/faloker/purify/ + description: | + The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools. + see-other-actions-e: + uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8 + name: See other actions, e.g. "Treatment of defects with severity high". + tags: [] + sast: + uuid: aaad322e-806e-4c51-b78d-6551f7dc376a + name: SAST + tags: [] + description: 'At SAST (Static Application Security Testing): Server-side + / client-side teams can easily be recorded. With microservice architecture + individual microservices can be used usually Teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:StaticAnalysisTool/ + dast: + uuid: 9d4bd377-11ec-4054-9c9e-9bfb99ac9609 + name: DAST + tags: [] + description: 'At DAST (Dynamic Application Security Testing): vulnerabilities + are classified and can be assigned to server-side and client-side teams.' + url: https://d3fend.mitre.org/dao/artifact/d3f:DynamicAnalysisTool/ + owasp-defect-dojo: + uuid: bb9d0f2d-f8bc-46b5-bbc7-7dbcf927191c + name: OWASP Defect Dojo + tags: [] + url: https://github.com/DefectDojo/django-DefectDojo + owasp-dependency-che: + uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + logparser-jenkins-pl: + uuid: ef80cd34-d3ba-4406-a4fa-4cf6f30c2e81 + name: LogParser Jenkins Plugins + tags: [] + owasp-code-pulse: + uuid: 7063cf8c-cd98-480f-8ef7-11cf241d2366 + name: OWASP Code Pulse + tags: [] + url: https://www.owasp.org/index.php/OWASP_Code_Pulse + ajax-spider: + uuid: 6583fd5f-4314-4b39-9265-de72f861c8cb + name: Ajax Spider + tags: [] + url: https://www.zaproxy.org/docs/desktop/addons/ajax-spider/ + curl: + uuid: f2a5f642-43b3-4b2c-97d5-b14d5964981b + name: cURL + tags: [] + url: https://curl.se/ + openapi: + uuid: 7ce77258-bf65-4e7a-9627-daf765ee1d77 + name: OpenAPI Specifications + tags: [] + url: https://spec.openapis.org/ + owasp-zap: + uuid: 42a87524-ec35-4de2-a30c-1a7c7d045801 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + arachni: + uuid: 83ae1e92-5eb9-4467-b3d3-fd2f96e6ab63 + name: Arachni + url: https://github.com/Arachni/arachni + zest: + uuid: 7eb37566-02d5-4fff-8dcf-8fcd1c8197f3 + name: Zest + url: https://www.zaproxy.org/docs/desktop/addons/zest/ + tags: + - zap + description: | + Zest is an experimental specialized scripting language (also known as a domain-specific language) originally developed by the Mozilla security team and is intended to be used in web oriented security tools. + owasp-securecodebox: + uuid: f220b299-0917-4750-96c5-d81cd402b4df + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + kube-hunter: + uuid: 2af7204c-a25c-4625-9775-889978386407 + name: kube-hunter + tags: [] + url: https://github.com/aquasecurity/kube-hunter + openvas: + uuid: d45fba7d-f176-4f06-a33c-434b17ec8a8f + name: openVAS + tags: [] + url: https://www.openvas.org/ + htc-hydra: + uuid: b99c9d52-dd1a-4aef-8699-65173cf978ce + name: HTC Hydra + tags: + - password + url: https://www.htc-cs.com/en/products/htc-hydra/ + netassert: + uuid: fffa6fb9-1fae-4852-88dc-c7086961330c + name: netassert + tags: [] + url: https://github.com/controlplaneio/netassert + nmap: + uuid: 08111dc3-bdc4-47d8-8f2e-10bb50a86882 + name: nmap + tags: [] + url: https://nmap.org/ + owasp-amass: + uuid: f085295e-46a3-4c8d-bbc3-1ac6b9dfcf2a + name: OWASP Amass + tags: [] + url: https://github.com/OWASP/Amass + k8spurger: + uuid: 8fea20ad-e332-4aa8-b1f1-aa9deb635dc1 + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + pmd: + uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + eslint: + uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + findsecuritybugs: + uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + jsprime: + uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + bdd-mobile-security: + uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + retire-js: + uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + npm-audit: + uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + sigmahq: + uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + dive-to-inspect-a-co: + uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + clusterscanner: + url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + dockerfile-with-hado: + uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + deployment-with-kube: + uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + kubesec: + uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + anchore-io: + uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + clair: + uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + openscap: + uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + vuls: + uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + kube-bench: + uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + trufflehog: + uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + go-pillage-registrie: + uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + https-github-com-a: + uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + registries-like-quay: + uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + dockerfilelint: + uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile + and looks for common traps, mistakes and helps enforce best practices. + threat-matrix-for-storage: + uuid: 1c56dbea-e067-44e2-8d3b-0a1205a70617 + name: Threat Matrix for Storage + url: https://www.microsoft.com/security/blog/2021/04/08/threat-matrix-for-storage/ + tags: + - documentation + - storage + - cluster + - kubernetes + defend-the-core-kubernetes: + uuid: b7a92886-aec9-4bf4-94c4-07cc191a97af + name: Defend the core kubernetes security at every layer + url: https://thenewstack.io/defend-the-core-kubernetes-security-at-every-layer/ + tags: + - documentation + - cluster + - kubernetes + business-friendly-vulnerability-metrics: + uuid: 3b99799c-e875-4cc2-aad7-5ce4564a1cde + name: Business friendly vulnerability management metrics + url: https://medium.com/uber-security-privacy/business-friendly-vulnerability-management-metrics-cfd702fd7705 + tags: + - documentation + - vulnerability + - vulnerability management system + kubescape: + uuid: 893d9f37-2142-4490-996c-e43b55064d3d + name: kubescape + url: https://github.com/armosec/kubescape + tags: + - kubernetes + - vulnerability + - misconfiguration + description: _Testing if Kubernetes is deployed securely as defined in Kubernetes + Hardening Guidance by to NSA and CISA_ + azuredevops: + uuid: b1b88bc5-5a22-4888-a27b-acce3d9fe29a + name: Improve code quality with branch policies + url: https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops + tags: + - source-code-protection + - scm + github-policies: + uuid: 99211481-de9c-4358-880e-628366416a27 + name: About protected branches + url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches + tags: + - source-code-protection + - scm + sonarqube: + uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + stylecop: + uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + fortify-vscode-extension: + uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + appscan-vscode-extension: + uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + checkmarx-vscode-extension: + uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + pre-commit-microsoft: + uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + pre-commit-synopsis: + uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + dependencyTrack: + uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach + by leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + juice-shop: + uuid: c021aa72-c71c-43e4-9573-717b74d6c19d + name: OWASP Juice Shop + tags: + - training + url: https://github.com/bkimminich/juice-shop + description: In case you do not have the budget to hire an external security + expert, an option is to use the OWASP JuiceShop on a "hacking Friday" + dvwa: + uuid: e1282ab3-7ffd-4ee5-a564-8e9af070979d + name: Damn Vulnerable Web Application + tags: + - training + description: Simple Application with intended vulnerabilities. HTML based. + loggingCheatSheet: + uuid: 032ca7cc-67dc-46bc-9702-3580a3c9d1a9 + name: OWASP Logging CheatSheet + url: https://cheatsheetseries.owasp.org/cheatsheets/Logging_Cheat_Sheet.html + tags: + - logging + - documentation + zap: + uuid: 84a2a907-a6fb-4ceb-8e21-f65c0d633445 + name: OWASP Zap + tags: + - vulnerability + - scanner + url: https://github.com/zaproxy/zaproxy + description: | + The OWASP Zed Attack Proxy (ZAP) is one of the world's most popular free security tools and is actively maintained by a dedicated international team of ... + secureCodeBox: + uuid: dc0995a5-ff13-4cfc-b95f-07bf8a30b6ab + name: OWASP secureCodeBox + tags: + - vulnerability + - scanner-orchestration + url: https://github.com/secureCodeBox/secureCodeBox + description: | + secureCodeBox is a kubernetes based, modularized toolchain for continuous security scans of your software project. Its goal is to orchestrate and easily automate a bunch of security-testing tools out of the box. + K8sPurger: + uuid: 7a019f5e-a77d-4f4a-89a6-d5107054a2cb + name: K8sPurger + tags: + - vulnerability + - scanner + - dast + - infrastructure + url: https://github.com/yogeshkk/K8sPurger + description: | + Hunt Unused Resources In Kubernetes. + hashicorp-vault: + uuid: e3a2ffc8-313f-437e-9663-b24591568209 + name: Hashicorp Vault + tags: + - authentication + - authorization + - secrets + - infrastructure + url: https://github.com/hashicorp/vault + description: | + A tool for secrets management, encryption as a service, and privileged access management. + stoplight-spectral: + uuid: 261f243e-f89c-4169-b076-b22a03ec00be + name: Spectral + tags: + - linting + - api + - documentation + url: https://github.com/stoplightio/spectral + description: | + Spectral is a flexible JSON/YAML linter built with extensibility in mind. + It uses JSON/YAML path rules to describe the problems you want to find. + api-oas-checker: + uuid: d2c9403d-9da2-4518-b33f-8b74b9c5ca3f + name: API OAS Checker + tags: + - linting + - api + - documentation + url: https://github.com/italia/api-oas-checker + description: | + A tool to check OpenAPI specifications using a comprehensive ruleset based + on API best practices. + coveragepy: + uuid: f011de6e-ab7c-4ec7-af55-03427271ab32 + name: Coverage.py + tags: + - testing + - coverage + url: https://github.com/nedbat/coveragepy + description: | + Code coverage measurement for Python + github-dependabot: + uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + github-super-linter: + uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + schemathesis: + uuid: c9bbecf2-567b-4422-b29a-67b16385f32b + name: Schemathesis + tags: + - testing + - api + - documentation + url: https://github.com/schemathesis/schemathesis + description: | + Schemathesis is a tool for testing web applications and services by sending requests based on the Open API / Swagger schema. + martin-feature-toggles: + uuid: 83be6c60-6633-4c32-98de-7ae065c143c9 + name: Feature Toggles + tags: + - development + - architecture + url: https://martinfowler.com/articles/feature-toggles.html + description: | + Feature Toggles are a powerful technique, allowing teams to modify system behavior without changing code. (Pete Hodgson) + defectdojo-client: + uuid: 7ec30b0e-9681-427a-80ee-ab811d9e476f + name: DefectDojo Client + tags: + - Defectdojo + - statistics + url: https://github.com/SDA-SE/defectdojo-client + description: | + This projects contains the DefectDojo upload client and statistics client. It is for example used within the ClusterImageScanner. + falco: + uuid: 32b64e6e-5187-45e3-b4f3-f5f9a9739012 + name: Falco + tags: + - falco + - systemcall + - monitoring + url: https://github.com/falcosecurity/falco + description: | + Falco makes it easy to consume kernel events, and enrich those events with information from Kubernetes and the rest of the cloud native stack. + sammancoaching: + uuid: 9223be73-00da-400e-a910-3871734cff2f + name: sammancoaching + tags: + - documentation + - coaching + - education + url: https://sammancoaching.org/ + description: | + Security coaches work with software development teams to help them adopt better security practices. + terraform: + uuid: 0d63f907-37fe-4375-88a5-a5e252732618 + name: terraform + tags: + - IaC + url: https://www.terraform.io/ + description: | + Terraform enables infrastructure automation for provisioning, compliance, and management of any cloud, datacenter, and service. + packj: + uuid: 5d8b27ac-286e-47a5-b23f-769eb6d74e4a + name: packj + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://github.com/ossillate-inc/packj + description: | + Packj is a tool to detect software supply chain attacks. It can detect malicious, vulnerable, abandoned, typo-squatting, and other "risky" packages from popular open-source package registries, such as NPM, RubyGems, and PyPI. + apiMyth: + uuid: 6150533e-58ca-4b52-a9b2-6226545d9ea0 + name: Top 5 API Security Myths That Are Crushing Your Business + tags: + - documentation + - waf + url: https://thehackernews.com/2022/11/top-5-api-security-myths-that-are.html + description: | + There are several myths and misconceptions about API security. These myths about securing APIs are crushing your business + - uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82 + name: DevSecOps control Pre-commit + url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop + tags: + - pre-commit + - uuid: 8da8d115-0f4e-40f0-a3ce-484a49e845fb + name: Building your DevSecOps pipeline 5 essential activities + url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/ + tags: + - pre-commit + references: + samm2: + - V-ST-1-A + iso27001-2017: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 13.1.3 + iso27001-2022: + - Hardening is not explicitly covered by ISO 27001 - too specific + - 8.22 + isImplemented: false + evidence: "" + comments: "" + Software Composition Analysis (client side): + uuid: 07fe8c4f-ae33-4409-b1b2-cf64cfccea86 + risk: Client side components might have vulnerabilities. + measure: Tests for known vulnerabilities in components via Software Composition + Analysis of the frontend are performed. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 2 + level: 3 + dependsOn: + - Defined build process + implementation: + - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Software Composition Analysis (server side): + uuid: d918cd44-a972-43e9-a974-eff3f4a5dcfe + risk: Server side components might have vulnerabilities. + measure: Tests for known vulnerabilities in server side components (e.g. backend/middleware) + are performed. + difficultyOfImplementation: + knowledge: 1 + time: 2 + resources: 1 + usefulness: 5 + level: 1 + dependsOn: + - Defined build process + implementation: + - uuid: 06334caf-8be6-487a-96b1-d41c7ed5f207 + name: OWASP Dependency Check + tags: + - OpenSource + - Supply Chain + - vulnerability + url: https://owasp.org/www-project-dependency-check/ + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + - uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7 + name: retire.js + tags: [] + url: https://github.com/RetireJS/retire.js/ + - uuid: 7c26484a-763c-437d-b953-d482a4fd7cf3 + name: npm audit + tags: [] + url: https://docs.npmjs.com/cli/audit + - uuid: 5c0e817b-204e-4301-a315-2f7cc180c240 + name: Dependabot + tags: + - dependency + - dependency-management + - scm + url: https://github.com/dependabot/dependabot-core + description: | + Dependabot creates pull requests to keep your dependencies secure and up-to-date. + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Static analysis for all components/libraries: + uuid: f4ff841d-3b2a-45d9-853e-5ec7ecbcb054 + risk: Used components like libraries and legacy applications might have vulnerabilities + measure: Usage of a static analysis for all used components. + difficultyOfImplementation: + knowledge: 2 + time: 4 + resources: 2 + usefulness: 3 + level: 5 + dependsOn: + - Static analysis for important client side components + - Static analysis for important server side components + implementation: [] + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Static analysis for all self written components: + uuid: ee68331f-9b1d-4f61-844b-b2ea04753a84 + risk: Parts in the source code of the frontend or middleware have vulnerabilities. + measure: Usage of static analysis tools for all parts of the middleware and + frontend. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 4 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - Static analysis for important client side components + - Static analysis for important server side components + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Static analysis for important client side components: + uuid: e237176b-bec5-447d-a926-e37d6dd60e4b + risk: Important parts in the source code of the frontend have vulnerabilities. + measure: Usage of static analysis tools for important parts of the frontend + are used. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 3 + level: 3 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 3a8ba0ea-37dc-4124-983b-bbf9b4443d75 + name: '[bdd-mobile-security' + tags: [] + url: https://github.com/ing-bank/bdd-mobile-security-automation-framework + description: '[bdd-mobile-security-automation-framework](https://github.com/ing-bank/bdd-mobile-security-automation-framework)' + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - Defined build process + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Static analysis for important server side components: + uuid: 6c05c837-8c99-46e2-828b-7c903e27dba4 + risk: Important parts in the source code of the middleware have vulnerabilities. + measure: Usage of static analysis tools for important parts of the middleware + are used. Static analysis uses for example string matching algorithms and/or + dataflow analysis. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 6a0948a7-4781-4858-9766-f4303971b28b + name: eslint + tags: [] + url: https://eslint.org/ + - uuid: f911d2b4-3e0c-424c-acf9-3bd363ef5078 + name: FindSecurityBugs + tags: [] + - uuid: cccc2882-62ab-4175-afa1-58471017e8ed + name: jsprime + tags: [] + url: https://github.com/dpnishant/jsprime + - uuid: 5b52a841-c281-45fd-b68f-0a93aa6fa398 + name: Fortify Extension for Visual Studio Code + url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code + tags: + - ide + - sast + - uuid: cf1213fd-8bfa-4a97-bf8b-937c93f31005 + name: Setting Up the Visual Studio Code Extension Plugin + url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin + tags: + - ide + - sast + - uuid: 3f5a493d-12d0-4468-b9fa-c3e4eae89ffb + name: HCL AppScan CodeSweep + url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep + tags: + - ide + - sast + dependsOn: + - Defined build process + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Stylistic analysis: + uuid: efa52cc8-6c5c-4ba2-a3d2-7164b0402f34 + risk: Unclear or obfuscated code might have unexpected behavior. + measure: Analysis of compliance to style guides of the source code ensures that + source code formatting rules are met (e.g. indentation, loops, ...). + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 5 + implementation: + - uuid: 00702aca-04d9-49ca-90d0-c32c199b26cb + name: PMD + tags: [] + - uuid: 0b7ec352-0c36-4de1-8912-617fc6c608fe + name: How to enforce a consistent coding style in your projects + url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm + tags: + - ide + - linting + - uuid: aa5ded61-5380-4da6-9474-afc36a397682 + name: In-Depth Linting of Your TypeScript While Coding + url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding + tags: + - ide + - linting + - uuid: 94a7a85e-8064-46b4-929a-9e03fa292a9f + name: Super-Linter + tags: + - linting + - scm + url: https://github.com/github/super-linter + description: | + Lint code bases to catch common errors and enforce code style + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Usage of multiple analyzers: + uuid: 297be001-8d94-41ee-ab29-207020d423c0 + risk: Each vulnerability analyzer has different opportunities. By using just + one analyzer, some vulnerabilities might not be found. + measure: Usage of multiple static tools to find more vulnerabilities. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 1 + level: 4 + dependsOn: + - Software Composition Analysis (server side) + - Software Composition Analysis (client side) + - Static analysis for all self written components + implementation: [] + references: + samm2: + - V-ST-3-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Static depth for infrastructure: + Analyze logs: + uuid: b217c8bb-5d61-4b41-a675-1083993f83b1 + risk: Not aware of attacks happening. + measure: Check logs for keywords. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - uuid: 1adf1ac0-8572-407b-a358-3976d9a225e2 + name: SigmaHQ + tags: [] + url: https://github.com/SigmaHQ/sigma + references: + samm2: [] + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Correlate known vulnerabilities in infrastructure with new image versions: + uuid: 7de0ae33-6538-45cd-8222-a1475647ba58 + risk: TODO. + measure: TODO + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 4 + usefulness: 1 + level: 4 + dependsOn: + - Usage of a maximum lifetime for images + implementation: + - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + iso27001-2022: + - 8.8 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Test cluster deployment resources: + uuid: 621fb6a5-5c0a-4408-826a-068868bb031b + risk: The deployment configuration (e.g. kubernetes deployment resources) might + contain unsecured configurations. + measure: Test the deployment configuration for virtualized environments for + unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: 1e58f8d2-61e2-45bb-a17c-51516d0cc9ba + name: kubesec + tags: [] + url: https://kubesec.io + references: + samm2: + - V-ST-1-A + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Test for image lifetime: + uuid: ddfe7c3c-b7a4-4cba-9041-b044d4a34e5b + risk: Old container images in production indicate that patch management is not + performed and therefore vulnerabilities might exists. + measure: Check the image age of containers in production. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 2 + level: 2 + implementation: + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 12.6.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Test for known vulnerabilities: + uuid: 26e1c6d5-5632-4ec7-80d2-e564b98732ad + risk: Known vulnerabilities in infrastructure components like container images + might get exploited. + measure: Check for known vulnerabilities + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 1 + usefulness: 4 + level: 4 + description: Subscribing to Github projects and reading release notes might + help. Software Composition Analysis for infrastructure might help, but is + often too fine-granular. + implementation: + - uuid: 7f500e95-2110-44c4-a1f8-cd7ef5d9eb6b + name: https://github.com/aquasecurity/trivy + tags: [] + url: https://github.com/aquasecurity/trivy + - uuid: 8737c6c0-4e90-400a-bf9a-f8e399913b57 + name: Registries like quay + tags: [] + description: Registries like quay, dockerhub provide (commercial) offerings, + often not suitable for distroless images + - uuid: 500399bd-7dfc-47fd-99d8-b55cefb760a9 + name: Dependency-Track is an intelligent Component Analysis platform that + allows organizations to identify and reduce risk in the software supply + chain. Dependency-Track takes a unique and highly beneficial approach by + leveraging the capabilities of Software Bill of Materials (SBOM). + url: https://github.com/DependencyTrack/dependency-track + tags: + - sca + - inventory + - OpenSource + - Supply Chain + - vulnerability + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + iso27001-2022: + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Test for malware: + uuid: 837f8f90-adc2-4e6b-9ebb-60c2ee29494d + risk: Third party might include malware. Ether due to the maintainer (e.g. + typo squatting of an image name and using the wrong image) or by an attacker + on behalf of the maintainer with stolen credentials. + measure: Check for malware in components (e.g. container images, VM baseline + images, libraries). + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 2 + usefulness: 3 + level: 3 + implementation: + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.2.1 + iso27001-2022: + - 8.7 + isImplemented: false + evidence: "" + comments: "" + Test for new image version: + uuid: cb6321aa-0fbf-4996-9e08-05ab26ef4c1e + risk: When a new version of an image is available, it might fix security vulnerabilities. + measure: Check for new images of containers in production. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 1 + usefulness: 2 + level: 3 + implementation: [] + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + - 14.2.5 + - 12.2.1 + iso27001-2022: + - 8.8 + - 8.7 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Test for stored secrets: + uuid: c6e3c812-56e2-41b0-ae01-b7afc41a004c + risk: Stored secrets in git history, in container images or directly in code + shouldn't exists because they might be exposed to unauthorized parties. + measure: Test for secrets in code, container images and history + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 2 + level: 1 + implementation: + - uuid: d90fefc9-4e5d-420f-ac87-eeb165bf0ee6 + name: truffleHog + tags: [] + url: https://github.com/dxa4481/truffleHog + - uuid: 382873e2-8604-4410-ae5e-b0f5ccdee835 + name: go-pillage-registries + tags: [] + url: https://github.com/nccgroup/go-pillage-registries + references: + samm2: + - V-ST-1-A + iso27001-2017: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 9.4.3 + - 10.1.2 + iso27001-2022: + - vcs usage is not explicitly covered by ISO 27001 - too specific + - 5.17 + - 8.24 + isImplemented: false + evidence: "" + comments: "" + Test of infrastructure components for known vulnerabilities: + uuid: 13367d8f-e37f-4197-a610-9ffca4fde261 + risk: Infrastructure components might have vulnerabilities. + measure: Test for known vulnerabilities in infrastructure components. Often, + the only way to respond to known vulnerabilities in operating system packages + is to accept the risk and wait for a patch. As the patch needs to be applied + fast when it is available, this activity depends on 'Usage of a maximum life + for images'. + difficultyOfImplementation: + knowledge: 2 + time: 5 + resources: 2 + usefulness: 1 + level: 4 + dependsOn: + - Usage of a maximum lifetime for images + implementation: + - uuid: fab2765d-8d96-4fc6-af96-dc9304ca41dc + name: Anchore.io + tags: [] + url: https://anchore.com/ + - uuid: f10f5423-4dff-4bb7-99c8-9ce214645071 + name: Clair + tags: [] + url: https://github.com/quay/clair + - uuid: d0c6b3a0-b073-44d7-a187-c4ad8eaa6531 + name: OpenSCAP + tags: [] + url: https://www.open-scap.org/ + - uuid: 04261564-2fcf-4b73-8847-83b0d855e1c5 + name: Vuls + tags: [] + url: https://github.com/future-architect/vuls + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + iso27001-2022: + - 8.8 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Test of virtualized environments: + uuid: 58825d22-1ce6-4748-af81-0ec9956e4129 + risk: Virtualized environments (e.g. via Container Images) might contains + unsecure configurations. + measure: Test virtualized environments for unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + implementation: + - uuid: 73419fb5-b13d-4242-83ec-86f36c7d73d5 + name: Dive to inspect a container images + tags: [] + url: https://github.com/wagoodman/dive + - url: https://github.com/SDA-SE/clusterscanner + uuid: 3c9ac78c-0fd4-43f4-8211-c915f9ef685f + name: ClusterScanner + tags: + - docker + - image + - container + - vulnerability + - misconfiguration + - security-tools + - scanning + description: Discover vulnerabilities and container image misconfiguration + in production environments. + references: + samm2: + - V-ST-1-A + iso27001-2017: + - ISO 27001:2017 mapping is missing + iso27001-2022: + - ISO 27001:2022 mapping is missing + isImplemented: false + evidence: "" + comments: "" + Test the cloud configuration: + uuid: 46d6a2a8-f9dc-4c15-9fc8-1723cfecbddc + risk: Standard hardening practices for cloud environments are not performed + leading to vulnerabilities. + measure: With the help of tools, the configuration of virtual environments are + tested. + difficultyOfImplementation: + knowledge: 2 + time: 2 + resources: 1 + usefulness: 4 + level: 2 + implementation: + - uuid: 8aeefd29-6220-45bf-aead-83eba2e9d055 + name: kube-bench + tags: [] + url: https://github.com/aquasecurity/kube-bench + references: + samm2: + - V-ST-1-A + iso27001-2017: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + iso27001-2022: + - System hardening is not explicitly covered by ISO 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" + Test the definition of virtualized environments: + uuid: 8fc3de67-7b8d-420b-8d24-f35928cfed6e + risk: The definition of virtualized environments (e.g. via Dockerfile) + might contain unsecure configurations. + measure: Test the definition of virtualized environments for unsecured configurations. + difficultyOfImplementation: + knowledge: 2 + time: 1 + resources: 2 + usefulness: 3 + level: 2 + meta: + implementationGuide: For containier (images), test that the images are following + best practices like distroless or non-root. + implementation: + - uuid: 94d993ad-ef6e-4d9f-b7a8-27ea68dc3005 + name: Dockerfile with hadolint + tags: [] + url: https://github.com/hadolint/hadolint + - uuid: 95b717cd-5ad3-40b5-993b-13a63c382b1b + name: Deployment with kube-score + tags: [] + url: https://github.com/zegl/kube-score + - uuid: eba2685d-2d25-4961-8e4e-2957e7c07c30 + name: dockerfilelint + tags: + - sast + - docker + - dockerfile + url: https://github.com/replicatedhq/dockerfilelint + description: dockerfilelint is an node module that analyzes a Dockerfile and + looks for common traps, mistakes and helps enforce best practices. + references: + samm2: + - V-ST-1-A + iso27001-2017: + - System hardening, virtual environments are not explicitly covered by ISO + 27001 - too specific + - 12.6.1 + - 14.2.3 + - 14.2.8 + - 14.2.1 + iso27001-2022: + - System hardening, virtual environments are not explicitly covered by ISO + 27001 - too specific + - 8.8 + - 8.32 + - 8.29 + - 8.25 + isImplemented: false + evidence: "" + comments: "" + Test-Intensity: + Creation and application of a testing concept: + uuid: 79ef8103-e1ed-4055-8df8-fd2b2015bebe + risk: Scans might use a too small or too high test intensity. + measure: A testing concept considering the amount of time per scan/intensity + is created and applied. A dynamic analysis needs more time than a static analysis. + The dynamic scan, depending on the test intensity might be performed on every + commit, every night, every week or once in a month. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 3 + usefulness: 2 + level: 4 + implementation: [] + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 14.2.2 + - 14.2.3 + - 14.2.1 + - 14.2.5 + - 12.6.1 + iso27001-2022: + - 8.25 + - 8.32 + - 8.27 + - 8.8 + isImplemented: false + evidence: "" + comments: "" + Deactivating of unneeded tests: + uuid: 1bd78cdd-ef11-4bb5-9b58-5af2e25fe1c5 + risk: As tools cover a wide range of different vulnerability tests, they might + not match the used components. Therefore, they need more time and resources + as they need and the feedback loops takes too much time. + measure: Unneeded tests are deactivated. For example in case the service is + using a Mongo database and no mysql database, the dynamic scan doesn't need + to test for sql injections. + difficultyOfImplementation: + knowledge: 2 + time: 3 + resources: 1 + usefulness: 1 + level: 3 + implementation: [] + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Default settings for intensity: + uuid: ab0a4b51-3b18-43f1-a6fc-a98e4b28453d + risk: Time pressure and ignorance might lead to false predictions for the test + intensity. + measure: The intensity of the used tools are not modified to safe time. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 1 + level: 1 + implementation: [] + references: + samm2: + - V-ST-1-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + High test intensity: + uuid: 2ebfc421-8c76-415c-a3b0-fa518915bd10 + risk: A too small intensity or a too high confidence might lead to not visible + vulnerabilities. + measure: A deep scan with high test intensity and a low confidence threshold + is performed. + difficultyOfImplementation: + knowledge: 3 + time: 3 + resources: 5 + usefulness: 3 + level: 1 + implementation: [] + references: + samm2: + - V-ST-2-A + iso27001-2017: + - 12.6.1 + - 14.2.1 + - 14.2.5 + iso27001-2022: + - 8.8 + - 8.25 + - 8.27 + isImplemented: false + evidence: "" + comments: "" + Regular tests: + uuid: 598897a2-358e-441f-984c-e12ec4f6110a + risk: After pushing source code to the version control system, any delay in + receiving feedback on defects makes them harder for the developer to remediate. + measure: On each push and/or at given intervals automatic security tests are + performed. + difficultyOfImplementation: + knowledge: 1 + time: 1 + resources: 1 + usefulness: 2 + level: 2 + implementation: [] + references: + samm2: + - I-SB-3-A + iso27001-2017: + - 14.2.3 + - 14.2.8 + - 14.2.9 + iso27001-2022: + - 8.32 + - 8.29 + isImplemented: false + evidence: "" + comments: "" +...