Skip to content

Commit 96d589d

Browse files
wurstbrotwurstbrot
authored
Merge pull request #91 from james-ahearn/feat/devAndsource-control
Feat/dev andsource control
2 parents 8b2ee0b + 7d10c52 commit 96d589d

3 files changed

Lines changed: 106 additions & 17 deletions

File tree

‎data/dimensions-subdimensions-activities/CultureAndOrganization/Process.yaml‎

Lines changed: 0 additions & 17 deletions
Original file line numberDiff line numberDiff line change
@@ -1,22 +1,5 @@
11
Culture and Organization:
22
Process:
3-
Source Control Protection:
4-
risk: Unaproved code in important branches like master.
5-
measure: Enabled protections on the source code management system preventing commited directly to an important branch.
6-
difficultyOfImplementation:
7-
knowledge: 2
8-
time: 1
9-
resources: 2
10-
usefulness: 4
11-
level: 1
12-
iso27001-2017:
13-
- peer review - four eyes principle is not explicitly required by ISO 27001
14-
- 6.1.2
15-
- 14.2.1
16-
implementation:
17-
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/azuredevops
18-
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/github-policies
19-
samm2: O-EM-1-C
203
Definition of simple BCDR practices for critical components:
214
risk:
225
- In case of an emergency, like a power outage, DR actions to perform are not

‎data/dimensions-subdimensions-activities/Implementation/DevelopmentAndSourceControl‎

Lines changed: 78 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,78 @@
1+
Implementation:
2+
Development & Source Control:
3+
Local development linting & style checks performed:
4+
risk:
5+
- Creating and developing code that contains code smells and quality issues.
6+
measure: |
7+
Integration of quality and linting plugins with interactive development environment (IDEs).
8+
difficultyOfImplementation:
9+
knowledge: 1
10+
time: 1
11+
resources: 1
12+
usefulness: 2
13+
level: 1
14+
md-description: |
15+
16+
implementation:
17+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/stylecop
18+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/sonarqube
19+
samm2: V-ST-A-1-1
20+
iso27001-2017:
21+
22+
Local development security checks performed:
23+
risk:
24+
- Creating and developing code contains code smells and quality issues.
25+
measure: |
26+
Integration of quality and linting plugins with interactive development environment (IDEs).
27+
difficultyOfImplementation:
28+
knowledge: 2
29+
time: 1
30+
resources: 1
31+
usefulness: 4
32+
level: 2
33+
md-description: |
34+
35+
implementation:
36+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/fortify-vscode-extension
37+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/checkmarx-vscode-extension
38+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/appscan-vscode-extension
39+
samm2: V-ST-A-1-1
40+
iso27001-2017:
41+
- hardening is not explicitly covered by ISO 27001 - too specific
42+
- 13.1.3
43+
44+
Source Control Protection:
45+
risk: Unapproved code in important branches like master.
46+
measure: Enabled protections on the source code management system preventing committed directly to an important branch.
47+
difficultyOfImplementation:
48+
knowledge: 2
49+
time: 1
50+
resources: 2
51+
usefulness: 4
52+
level: 1
53+
iso27001-2017:
54+
- peer review - four eyes principle is not explicitly required by ISO 27001
55+
- 6.1.2
56+
- 14.2.1
57+
implementation:
58+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/azuredevops
59+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/github-policies
60+
samm2: O-EM-1-C
61+
Pre-Commit checks & validations:
62+
risk:
63+
- Using an insecure application might lead to a compromised application. This
64+
might lead to total data theft or data modification.
65+
measure: |
66+
Implement pre-commit validations to prevent secrets & other security issues being commit to source code.
67+
difficultyOfImplementation:
68+
knowledge: 4
69+
time: 4
70+
resources: 2
71+
usefulness: 4
72+
level: 2
73+
implementation:
74+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/pre-commit-microsoft
75+
- $ref: data/dimensions-subdimensions-activities/implementations.yaml#/implementations/pre-commit-synopsis
76+
samm2: V-ST-A-1-1
77+
iso27001-2017:
78+

‎data/dimensions-subdimensions-activities/implementations.yaml‎

Lines changed: 28 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -518,3 +518,31 @@ implementations:
518518
name: About protected branches
519519
url: https://docs.github.com/en/repositories/configuring-branches-and-merges-in-your-repository/defining-the-mergeability-of-pull-requests/about-protected-branches
520520
tags: [source-code-protection, scm]
521+
sonarqube:
522+
name: In-Depth Linting of Your TypeScript While Coding
523+
url: https://blog.sonarsource.com/in-depth-linting-of-your-typescript-while-coding
524+
tags: [ide, linting]
525+
stylecop:
526+
name: How to enforce a consistent coding style in your projects
527+
url: https://www.meziantou.net/how-to-enforce-a-consistent-coding-style-in-your-projects.htm
528+
tags: [ide, linting]
529+
fortify-vscode-extension:
530+
name: Fortify Extension for Visual Studio Code
531+
url: https://marketplace.visualstudio.com/items?itemName=fortifyvsts.fortify-extension-for-vs-code
532+
tags: [ide, sast]
533+
appscan-vscode-extension:
534+
name: HCL AppScan CodeSweep
535+
url: https://marketplace.visualstudio.com/items?itemName=HCLTechnologies.hclappscancodesweep
536+
tags: [ide, sast]
537+
checkmarx-vscode-extension:
538+
name: Setting Up the Visual Studio Code Extension Plugin
539+
url: https://checkmarx.atlassian.net/wiki/spaces/SD/pages/1759216424/Setting+Up+the+Visual+Studio+Code+Extension+Plugin
540+
tags: [ide, sast]
541+
pre-commit-microsoft:
542+
name: DevSecOps control Pre-commit
543+
url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop
544+
tags: [pre-commit]
545+
pre-commit-synopsis:
546+
name: Building your DevSecOps pipeline 5 essential activities
547+
url: https://www.synopsys.com/blogs/software-security/devsecops-pipeline-checklist/
548+
tags: [pre-commit]

0 commit comments

Comments
 (0)