Skip to content

Commit 2298a0c

Browse files
author
Timo Pagel
committed
feat: Reorganize VersionCOntrol
1 parent 96d589d commit 2298a0c

8 files changed

Lines changed: 555 additions & 23 deletions

File tree

‎data/custom/README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1 +1,2 @@
11
This folder contains custom .yaml files to extend the existing ones
2+
You might inspect and copy the file `../sample-organization.yaml` to this directory to get a demonstration.

‎data/dimensions-subdimensions-activities/BuildAndDeployment/Build.yaml‎

Lines changed: 150 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,150 @@
1+
Build and Deployment:
2+
Build:
3+
Continuous integration:
4+
risk: Quality is not visible to everyone, quality checks are distributed or manually and not deterministic.
5+
measure: Use continuous automated building and testing of the software.
6+
md-description: |
7+
## Benefits:
8+
Quality is visible to everyone
9+
There is a single instance deciding whether the code meets its quality (single ground of truth).
10+
Deterministic and reproducible builds
11+
assessment: |
12+
- Show your build pipeline and an exemplary job (build + test).
13+
- Show that every team member has access.
14+
- Show that failed jobs are fixed.
15+
difficultyOfImplementation:
16+
knowledge: 2
17+
time: 2
18+
resources: 2
19+
usefulness: 2
20+
level: 1
21+
implementation:
22+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/ci-cd-tools
23+
references:
24+
samm2:
25+
- I-SB-1-A
26+
iso27001-2017:
27+
- iso27001-2017:14.2.6
28+
credits: |
29+
AppSecure-nrw [Security Belts](https://github.com/AppSecure-nrw/security-belts/)
30+
Building and testing of artifacts in virtual environments:
31+
description: |-
32+
While building and testing artifacts, third party systems, application frameworks
33+
and 3rd party libraries are used. These might be malicious as a result of
34+
vulnerable libraries or because they are altered during the delivery phase.
35+
risk:
36+
- |-
37+
While building and testing artifacts, third party systems, application frameworks
38+
and 3rd party libraries are used. These might be malicious as a result of
39+
vulnerable libraries or because they are altered during the delivery phase.
40+
measure: Each step during within the build and testing phase is performed in
41+
a separate virtual environments, which is destroyed afterward.
42+
meta:
43+
implementationGuide: Depending on your environment, usage of virtual machines
44+
or container technology is a good way. After the build, the filesystem should
45+
not be used again in other builds.
46+
difficultyOfImplementation:
47+
knowledge: 2
48+
time: 2
49+
resources: 2
50+
usefulness: 2
51+
level: 2
52+
implementation:
53+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/ci-cd-tools
54+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/container-technologi
55+
references:
56+
samm2:
57+
- I-SB-2-A
58+
iso27001-2017:
59+
- iso27001-2017:14.2.6
60+
Defined build process:
61+
risk:
62+
- Performing builds without a defined process is error prone; for example, as
63+
a result of incorrect security related configuration.
64+
measure: A well defined build process lowers the possibility of errors during
65+
the build process.
66+
description-md: |
67+
Sample evidence as an attribute in the yaml: The build process is defined in <a href="REPLACE-ME">REPLACE-ME Pipeline</a>
68+
in the folder <i>vars</>. Projects are using a <i>Jenkinsfile</i> to use the
69+
defined process.
70+
difficultyOfImplementation:
71+
knowledge: 2
72+
time: 3
73+
resources: 2
74+
usefulness: 4
75+
level: 1
76+
dependsOn:
77+
- Continuous Integration
78+
implementation:
79+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/ci-cd-tools
80+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/container-technologi
81+
references:
82+
samm2:
83+
- I-SB-1-A
84+
iso27001-2017:
85+
- 12.1.1
86+
- 14.2.2
87+
Signing of code:
88+
risk:
89+
- Unauthorized manipulation of source code might be difficult to spot.
90+
measure: Digitally signing commits helps to prevent unauthorized manipulation
91+
of source code.
92+
difficultyOfImplementation:
93+
knowledge: 2
94+
time: 2
95+
resources: 2
96+
usefulness: 3
97+
level: 3
98+
implementation: []
99+
dependsOn:
100+
- Defined build process
101+
references:
102+
samm2: I-SB-2-A
103+
iso27001-2017:
104+
- 14.2.6
105+
Pinning of artifacts:
106+
risk:
107+
- Unauthorized manipulation of artifacts might be difficult to spot. For example,
108+
this may result in using images with malicious code.
109+
Also, intendend major changes, which are automatically used in an image used might break the functionality.
110+
measure: Pinning of artifacts ensure that changes are performed only when intended.
111+
comment: The usage of pinning requires a good processes for patching. Therefore, choose this activity wisly.
112+
difficultyOfImplementation:
113+
knowledge: 2
114+
time: 2
115+
resources: 2
116+
usefulness: 3
117+
level: 2
118+
implementation:
119+
- Container technology automatically creates a hash for images, which can be used.
120+
- Immutable images are an other way, e.g. by using a registry, which doesn't allow overriding of images.
121+
dependsOn:
122+
- Defined build process
123+
references:
124+
samm2:
125+
- I-SB-1-A
126+
iso27001-2017:
127+
- 14.2.6
128+
Signing of artifacts:
129+
risk:
130+
- Unauthorized manipulation of artifacts might be difficult to spot. For example,
131+
this may result in images with malicious code in the Docker registry.
132+
measure: Digitally signing artifacts for all steps during the build and especially
133+
docker images, helps to ensure their integrity.
134+
difficultyOfImplementation:
135+
knowledge: 2
136+
time: 2
137+
resources: 2
138+
usefulness: 4
139+
level: 3
140+
implementation:
141+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/docker-content-trust
142+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/in-toto
143+
dependsOn:
144+
- Defined build process
145+
- Pinning of artifacts
146+
references:
147+
samm2:
148+
- I-SB-1-A
149+
iso27001-2017:
150+
- 14.2.6

‎data/dimensions-subdimensions-activities/BuildAndDeployment/Deployment.yaml‎

Lines changed: 204 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,204 @@
1+
Build and Deployment:
2+
Deployment:
3+
Blue/Green Deployment:
4+
risk:
5+
- A new artifacts version can have unknown defects.
6+
measure: By having multiple production environments, a deployment can be performant
7+
on the first environment to spot possible defects before it is deployment
8+
in the production environment(s)
9+
difficultyOfImplementation:
10+
knowledge: 1
11+
time: 2
12+
resources: 1
13+
usefulness: 2
14+
level: 4
15+
implementation:
16+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/blue-green-deploymen
17+
dependsOn:
18+
- Smoke Test
19+
references:
20+
samm2:
21+
- TODO
22+
iso27001-2017:
23+
- 17.2.1
24+
- 12.1.1
25+
- 12.1.2
26+
- 12.1.4
27+
- 12.5.1
28+
- 14.2.9
29+
Defined deployment process:
30+
risk:
31+
- Deployments without a defined process are error prone thus allowing old or
32+
untested artifact to be deployed.
33+
measure: A defined deployment process significantly lowers the likelihood of
34+
errors during the deployment phase.
35+
difficultyOfImplementation:
36+
knowledge: 2
37+
time: 2
38+
resources: 1
39+
usefulness: 4
40+
level: 1
41+
dependsOn:
42+
- Continuous Integration
43+
implementation:
44+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/ci-cd-tools
45+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/docker
46+
references:
47+
samm2: I-SD-1-A
48+
iso27001-2017:
49+
- 12.1.1
50+
- 14.2.2
51+
Environment depending configuration parameters (secrets):
52+
risk:
53+
- Attackers who compromise a system can see confidential access information
54+
like database credentials.
55+
- Parameters are often used to set credentials, for example by starting containers
56+
or applications; these parameters can often be seen by any one listing running
57+
processes on the target system.
58+
measure: |
59+
Configuration parameters are set for each environment not in the source code.
60+
By using encryption, it is harder to read credentials , e.g. from the file system. Also, the usage of a credential management system can help protect credentials.
61+
difficultyOfImplementation:
62+
knowledge: 2
63+
time: 2
64+
resources: 1
65+
usefulness: 4
66+
level: 2
67+
implementation: []
68+
references:
69+
samm2:
70+
- I-SD-1-B
71+
iso27001-2017:
72+
- 9.4.5
73+
- 14.2.6
74+
Rolling update on deployment:
75+
risk:
76+
- While a deployment is performed, the application can not be reached.
77+
measure: A deployment without downtime is performed*.
78+
difficultyOfImplementation:
79+
knowledge: 2
80+
time: 2
81+
resources: 2
82+
usefulness: 2
83+
level: 3
84+
implementation:
85+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/docker
86+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/webserver
87+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/rolling-update
88+
dependsOn:
89+
- Defined deployment process
90+
samm2: I-SD-1-A
91+
iso27001-2017:
92+
- 12.5.1
93+
- 14.2.2
94+
- 17.2.1
95+
Same artifact for environments:
96+
risk:
97+
- Building of an artifact for different environments means that an untested
98+
artifact might reach the production environment.
99+
measure: Building an artifact once and deploying it to different environments
100+
means that only tested artifacts are allowed to reach the production environment
101+
difficultyOfImplementation:
102+
knowledge: 2
103+
time: 2
104+
resources: 1
105+
usefulness: 4
106+
level: 3
107+
implementation:
108+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/docker
109+
dependsOn:
110+
- Defined build process
111+
samm2: I-SD-2-A
112+
iso27001-2017:
113+
- 14.3.1
114+
- 14.2.8
115+
- 12.1.4
116+
Handover of confidential parameters:
117+
risk:
118+
- Attackers who compromise a system can see confidential access information
119+
like database credentials.
120+
- Parameters are often used to set credentials, for example by starting containers
121+
or applications; these parameters can often be seen by any one listing running
122+
processes on the target system.
123+
measure: By using encryption, it is harder to read credentials , e.g. from the
124+
file system. Also, the usage of a credential management system can help protect
125+
credentials.
126+
difficultyOfImplementation:
127+
knowledge: 2
128+
time: 2
129+
resources: 1
130+
usefulness: 4
131+
level: 3
132+
implementation: ''
133+
dependsOn:
134+
- Environment depending configuration parameters (secrets)
135+
references:
136+
samm2: I-SD-2-B
137+
iso27001-2017:
138+
- 14.1.3
139+
- 13.1.3
140+
- 9.4.3
141+
- 9.4.1
142+
- 10.1.2
143+
Usage of feature toggles:
144+
risk:
145+
- By using environment dependent configuration, some parameters will not be
146+
tested correctly. i.e. <pre>if (host == 'production') {} else {}</pre>
147+
measure: Usage of environment independent configuration parameter, called feature
148+
toggles, helps to enhance the test coverage. Only what has been tested, goes
149+
to production.
150+
difficultyOfImplementation:
151+
knowledge: 2
152+
time: 1
153+
resources: 1
154+
usefulness: 2
155+
level: 3
156+
implementation:
157+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/docker
158+
dependsOn:
159+
- Same artifact for environments
160+
iso27001-2017:
161+
- 14.3.1
162+
- 14.2.8
163+
- 14.2.9
164+
- 12.1.4
165+
Usage of trusted images:
166+
risk:
167+
- Developers or operations might start random images in the production cluster
168+
which have malicious code or known vulnerabilities.
169+
measure: Create image assessment criteria, perform an evaluation of images and
170+
create a whitelist of artifacts/container images/virtual machine images.
171+
implementation:
172+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/kubernetes-admission
173+
difficultyOfImplementation:
174+
knowledge: 1
175+
time: 1
176+
resources: 1
177+
usefulness: 3
178+
level: 2
179+
samm2: I-SD-2-A
180+
iso27001-2017:
181+
- 15.1.1
182+
- 15.1.2
183+
- 15.1.3
184+
- 14.1.3
185+
Inventory of running artifacts:
186+
risk:
187+
- In case a vulnerability of severity high or critical exists, it needs to be
188+
known where an artifacts with that vulnerability is deployed with which dependencies.
189+
measure: A documented inventory or a possibility to gather the needed information
190+
(e.g. the documentation of which script needs to be run by whom) must be in
191+
place.
192+
dependsOn:
193+
- Defined deployment process
194+
difficultyOfImplementation:
195+
knowledge: 2
196+
time: 2
197+
resources: 3
198+
usefulness: 3
199+
level: 3
200+
samm2: o-incident-management|TODO
201+
iso27001-2017:
202+
- '8.1'
203+
- '8.2'
204+
implementation: []

0 commit comments

Comments
 (0)