You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
RUN curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/master/src/assets/YAML/meta.yaml -o /var/www/html/src/assets/YAML/meta.yaml
14
14
RUN cd /var/www/html && php yaml-generation/generateDimensions.php
15
+
RUN curl https://raw.githubusercontent.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/refs/heads/master/src/assets/YAML/meta.yaml -o /var/www/html/src/assets/YAML/meta.yaml
Copy file name to clipboardExpand all lines: src/assets/YAML/default/Implementation/ApplicationHardening.yaml
+64-9Lines changed: 64 additions & 9 deletions
Original file line number
Diff line number
Diff line change
@@ -49,23 +49,79 @@ Implementation:
49
49
iso27001-2022:
50
50
- Hardening is not explicitly covered by ISO 27001 - too specific
51
51
- 8.22
52
-
isImplemented: false
53
52
comments: ""
54
-
Contextualized Encoding:
53
+
Context-aware output encoding:
55
54
uuid: e1f37abb-d848-4a3a-b3df-65e91a89dcb7
55
+
description: |
56
+
**Input validation** stops malicious data from entering your system. \
57
+
**Output encoding** neutralizes malicious data before rendering to user, or the next system.
58
+
59
+
Input validation and output encoding work together. Apply both.
60
+
61
+
**Context-aware output encoding** encodes data differently, depending on its context. In the sample below the `{{bad_data}}` must be encoded differently, depending on its context, to render safe HTML.
62
+
63
+
```html
64
+
<div>{{bad_data}}</div>
65
+
<a href="{{bad_data}}">Click me</a>
66
+
<script>var x = '{{bad_data}}';</script>
67
+
<script>/** Comment {{bad_data}} */</script>
68
+
```
56
69
risk:
57
-
The generation of interpreter directives from user-provided data poses difficulties and can introduce vulnerabilities to injection attacks.
70
+
If an attacker manages to slip though your input validation, the attacker may gain control over the user session or execute arbitrary actions.
58
71
measure: |
59
-
Implementing contextualized encoding, such as employing object-relational mapping tools or utilizing prepared statements, nearly removes the threat of injection vulnerabilities.
72
+
* Use modern secure frameworks such as React/Angular/Vue/Svelte. The default method here renders data in a safe way.
73
+
* Use established and well-maintained encoding libraries such as OWASP’s Java Encoder and Microsoft’s AntiXSS.
74
+
* Implement content security policies (CSP) to restrict the types of content that can be loaded and executed.
- Hardening is not explicitly covered by ISO 27001 - too specific
89
+
- 13.1.3
90
+
iso27001-2022:
91
+
- Hardening is not explicitly covered by ISO 27001 - too specific
92
+
- 8.22
93
+
comments: ""
94
+
Parametrization:
95
+
uuid: 00e91a8a-3972-4692-8679-674ab8547486
66
96
description: |
67
-
Bear in mind that utilizing frameworks is a recommended approach; however, they can develop known security weaknesses over time. Diligent and regular patching is crucial.
68
-
implementation: []
97
+
By concatenating strings from user input to build SQL queries, an attacker can manipulate the query to do other unintentional SQL commands as well.
98
+
99
+
This is called *SQL injection* but the principle applies to NoSql, and anywhere that your code is building commands that will be executed.
100
+
101
+
Pay attention to these two lines of code. They seem similar, but behave very differently.
102
+
103
+
* `sql.execute("SELECT * FROM table WHERE ID = " + id);`
104
+
* `sql.execute("SELECT * FROM table WHERE ID = ?", id);`
105
+
The second line is parameterized. The same principle applies to other types, such as command line execution, etc.
106
+
risk: |
107
+
Systems vulnerable to injections may lead to data breaches, loss of data,
108
+
unauthorized alteration of data, or complete database compromise or downtime.
109
+
110
+
This applies to SQL, NoSql, LDAP, XPath, email headers OS commands, etc.
111
+
measure: |
112
+
* Identify which of the types your application is using. Check that you use:
113
+
* Use _parametrized queries_ (or _prepared statements_)
114
+
* For database queries, you may also use:
115
+
* Use _stored procedures_ ()
116
+
* Use ORM (Object-Relational Mapping) tools that automatically handle input sanitization
Copy file name to clipboardExpand all lines: src/assets/YAML/default/Implementation/InfrastructureHardening.yaml
+6-4Lines changed: 6 additions & 4 deletions
Original file line number
Diff line number
Diff line change
@@ -510,10 +510,12 @@ Implementation:
510
510
uuid: ad23be9c-5661-4f1f-81a3-5a5dc7061629
511
511
risk:
512
512
Evil actors might be able to perform a man in the middle attack and sniff
513
-
confidential information (e.g. authentication factors like passwords)
514
-
measure:
513
+
confidential information (e.g. authentication factors like passwords).
514
+
measure:|-
515
515
By using encryption at the edge of traffic in transit, it is impossible
516
-
or at least harder to sniff credentials being outside of the organization.
516
+
or at least harder to sniff credentials or information being outside of the organization.
517
+
518
+
Using standard secure protocols like HTTPS is recommended.
517
519
difficultyOfImplementation:
518
520
knowledge: 2
519
521
time: 2
@@ -699,7 +701,7 @@ Implementation:
699
701
description: |
700
702
Begin with the WAF in a monitoring state to understand the traffic and threats. Progressively enforce blocking actions based on intelligence gathered, ensuring minimal disruption to legitimate traffic.
Copy file name to clipboardExpand all lines: src/assets/YAML/default/InformationGathering/Monitoring.yaml
+13-7Lines changed: 13 additions & 7 deletions
Original file line number
Diff line number
Diff line change
@@ -291,15 +291,23 @@ Information Gathering:
291
291
iso27001-2022:
292
292
- Not explicitly covered by ISO 27001 - too specific
293
293
- 5.26
294
-
isImplemented: false
295
-
evidence: ""
296
294
comments: ""
297
295
Simple application metrics:
298
296
uuid: e9a6d403-a467-445e-b98a-74f0c29da0b1
299
297
risk: Attacks on an application are not recognized.
300
-
measure:
301
-
Gathering of application metrics helps to identify incidents like brute
302
-
force attacks, login/logout.
298
+
measure: |-
299
+
Gathering of application metrics helps to identify incidents like brute force attacks, login/logout patterns, and unusual spikes in activity. Key metrics to monitor include:
By monitoring these basic metrics, teams can quickly investigate abnormal patterns and determine if they represent security incidents requiring response.
Copy file name to clipboardExpand all lines: src/assets/YAML/default/TestAndVerification/Consolidation.yaml
+18-39Lines changed: 18 additions & 39 deletions
Original file line number
Diff line number
Diff line change
@@ -21,38 +21,9 @@ Test and Verification:
21
21
- The number of network hops required to reach the asset (recommended)
22
22
- Authentication requirements for access (recommended)
23
23
dependsOn:
24
-
- uuid:38d1bd10-7b5f-4ae1-868c-0ec813285425#Fix based on severity
24
+
- uuid:44f2c8a9-4aaa-4c72-942d-63f78b89f385#Treatment of defects with severity high or higher:
25
25
#- uuid:3260a15f-2df0-4173-8790-f11de2cb525a # Access applications accessibility TODO
26
-
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f #iventory of apps
27
-
implementation:
28
-
references:
29
-
samm2:
30
-
- I-DM-3-B
31
-
iso27001-2017:
32
-
- 16.1.4
33
-
- 8.2.1
34
-
- 8.2.2
35
-
- 8.2.3
36
-
iso27001-2022:
37
-
- 5.25
38
-
- 5.12
39
-
- 5.13
40
-
- 5.10
41
-
tags: ["vuln-action", "defect-management"]
42
-
Fix based on severity:
43
-
uuid: 38d1bd10-7b5f-4ae1-868c-0ec813285425
44
-
risk: |-
45
-
Overwhelming volume of security findings from automated testing tools. This might lead to ignorance of findings.
46
-
measure: |
47
-
Implement a very simple risk-based prioritization framework for vulnerability remediation based on the severity of the findings.
48
-
49
-
On level one, fix only critical findings.
50
-
difficultyOfImplementation:
51
-
knowledge: 2
52
-
time: 2
53
-
resources: 1
54
-
usefulness: 3
55
-
level: 1
26
+
- uuid:2a44b708-734f-4463-b0cb-86dc46344b2f # Inventory of production components
56
27
implementation:
57
28
references:
58
29
samm2:
@@ -168,11 +139,19 @@ Test and Verification:
168
139
uuid: c1acc8af-312e-4503-a817-a26220c993a0
169
140
risk:
170
141
As false positive occur during each test, all vulnerabilities might be
171
-
ignored.
172
-
measure:
173
-
False positives are suppressed so they will not show up on the next
174
-
tests again. Most security tools have the possibility to suppress false positives.
175
-
A Vulnerability Management System might be used.
142
+
ignored. Specially, if tests are automated an run daily.
143
+
measure: |-
144
+
Findings from security tests must be triaged and outcomes persisted/documented to:
145
+
- Prevent re-analysis of known issues in subsequent test runs
146
+
- Track accepted risks vs false positives
147
+
- Enable consistent decision-making across teams
148
+
149
+
At this maturity level, a simple tracking system suffices - tools need only distinguish between "triaged" and "untriaged" findings, without complex categorization. Some tools refer to this as "suppression" of findings.
0 commit comments