Skip to content

Commit 473b2ac

Browse files
wurstbrotwurstbrot
committed
add AI
1 parent ca6e517 commit 473b2ac

37 files changed

Lines changed: 11808 additions & 303 deletions

‎AI/Isolation.yaml‎

Lines changed: 228 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,228 @@
1+
# yaml-language-server: $schema=../../schemas/dsomm-schema-build-and-deployment.json
2+
---
3+
AI:
4+
Isolation:
5+
Usage of container-based isolation:
6+
uuid: a340f46b-6360-4cb8-847b-a0d3483d09d3
7+
description: |-
8+
While building and testing artifacts, third party systems, application frameworks
9+
and 3rd party libraries are used. These might be malicious as a result of
10+
vulnerable libraries or because they are altered during the delivery phase.
11+
risk: |-
12+
While building and testing artifacts, third party systems, application frameworks
13+
and 3rd party libraries are used. These might be malicious as a result of
14+
vulnerable libraries or because they are altered during the delivery phase.
15+
measure:
16+
Each step during within the build and testing phase is performed in
17+
a separate virtual environments, which is destroyed afterward.
18+
meta:
19+
implementationGuide:
20+
Depending on your environment, usage of virtual machines
21+
or container technology is a good way. After the build, the filesystem should
22+
not be used again in other builds.
23+
difficultyOfImplementation:
24+
knowledge: 2
25+
time: 2
26+
resources: 2
27+
usefulness: 2
28+
level: 2
29+
implementation:
30+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools
31+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology
32+
references:
33+
samm2:
34+
- I-SB-A-2
35+
iso27001-2017:
36+
- 14.2.6
37+
iso27001-2022:
38+
- 8.31
39+
isImplemented: false
40+
evidence: ""
41+
comments: ""
42+
Defined build process:
43+
uuid: f6f7737f-25a9-4317-8de2-09bf59f29b5b
44+
description: |
45+
A *build process* includes more than just compiling your source code. It also covers:
46+
- Managing (third party) dependencies
47+
- Environment configuration
48+
- Running unit and integration tests
49+
- Security scanning and compliance checks
50+
- Artifact creation and storage
51+
- Deployment preparation
52+
53+
Basing the build process on human memory may lead to inconsistencies and security misconfigurations.
54+
55+
A *defined build process* can automate these steps to ensure consistency, avoiding accidental omissions or misconfigurations. Use tools such as Jenkins, GitHub Actions, GitLab CI, or Maven to codify the process.
56+
57+
A simplified, but still a *defined build process*, may be a checklist of the steps to be performed.
58+
risk:
59+
Without a defined and automated build process the risk increase for accidental mistakes, forgetting test activities, and insecure misconfigurations.
60+
measure:
61+
Find a tool that suits your environment. Add your manual build steps, include steps for running tests, scanning and preparation for deployment.
62+
assessment: |
63+
- Show your build pipeline configuration (e.g., Jenkinsfile, GitHub Actions workflow) and an exemplary job (build + test + security scan).
64+
level: 1
65+
difficultyOfImplementation:
66+
knowledge: 2
67+
time: 3
68+
resources: 2
69+
usefulness: 4
70+
implementation:
71+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/jenkins
72+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/maven
73+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/ci-cd-tools
74+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/container-technology
75+
references:
76+
samm2:
77+
- I-SB-A-1
78+
iso27001-2017:
79+
- 12.1.1
80+
- 14.2.2
81+
iso27001-2022:
82+
- 5.37
83+
- 8.32
84+
isImplemented: false
85+
evidence: ""
86+
comments: ""
87+
Pinning of artifacts:
88+
uuid: f3c4971e-9f4d-4e59-8ed0-f0bdb6262477
89+
risk:
90+
Unauthorized manipulation of artifacts might be difficult to spot. For
91+
example, this may result in using images with malicious code. Also, intended
92+
major changes, which are automatically used in an image used might break the
93+
functionality.
94+
measure: Pinning of artifacts ensure that changes are performed only when intended.
95+
comment:
96+
The usage of pinning requires a good processes for patching. Therefore,
97+
choose this activity wisely.
98+
meta:
99+
implementationGuide:
100+
Pinning artifacts in Dockerfile refers to the practice of using specific,
101+
immutable versions of base images and dependencies in your build process. Instead of using the
102+
latest tag for your base image, select a specific version or digest. For example, replace FROM node:latest,
103+
to FROM node@sha256:abcdef12.
104+
difficultyOfImplementation:
105+
knowledge: 2
106+
time: 2
107+
resources: 2
108+
usefulness: 3
109+
level: 2
110+
tags:
111+
- inventory
112+
implementation:
113+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/signing-of-containers
114+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/immutable-images
115+
dependsOn:
116+
- Defined build process
117+
references:
118+
samm2:
119+
- I-SB-B-1
120+
iso27001-2017:
121+
- 14.2.6
122+
iso27001-2022:
123+
- 8.31
124+
isImplemented: false
125+
evidence: ""
126+
comments: ""
127+
SBOM of components:
128+
uuid: 2858ac12-0179-40d9-9acf-1b839c030473
129+
description: |-
130+
SBOM (Software Bill of Materials) is a document that lists all components, libraries,
131+
and dependencies used in a software application or container image. Creating an SBOM
132+
during the build process can help ensure transparency, security, and license compliance
133+
for your application.
134+
risk:
135+
In case a vulnerability of severity high or critical exists, it needs
136+
to be known where an artifacts with that vulnerability is deployed with which
137+
dependencies.
138+
measure:
139+
Creation of an SBOM of components (e.g. application and container image
140+
content) during build.
141+
dependsOn:
142+
- Defined build process
143+
difficultyOfImplementation:
144+
knowledge: 2
145+
time: 2
146+
resources: 3
147+
usefulness: 3
148+
level: 2
149+
implementation:
150+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/trivy
151+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/syft
152+
references:
153+
samm2:
154+
- I-SB-B-1
155+
- D-TA-A-1
156+
iso27001-2017:
157+
- 8.1
158+
- 8.2
159+
iso27001-2022:
160+
- 5.9
161+
- 5.12
162+
isImplemented: false
163+
tags: ["inventory", "scanning", "sca"]
164+
evidence: ""
165+
comments: ""
166+
Signing of artifacts:
167+
uuid: 5786959d-0c6f-46a6-8e1c-a32ff1a50222
168+
risk: &execution-maliciuous Execution or usage of malicious code or data e.g. via executables, libraries or container images.
169+
measure:
170+
Digitally signing artifacts for all steps during the build and especially
171+
docker images, helps to ensure their integrity and authenticity.
172+
description: |-
173+
To perform a push to a GitHub repository, you must be authenticated. It's important to note that GitHub does not verify if the authenticated user's email address matches the one in the commit.
174+
To clearly identify the author of a commit for reviewers, commit signing is recommended.
175+
176+
GitHub actions such as [semantic-release-action](https://github.com/cycjimmy/semantic-release-action) do not automatically sign commits and may encounter issues as a result.
177+
178+
To address this, you can refer to a working configuration example in the [workflow folder](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel/blob/master/.github/workflows/main.yml) of DSOMM, which demonstrates how to use semantic release action in conjunction with [planetscale/ghcommit-action](https://github.com/planetscale/ghcommit-action).
179+
For added security, consider using [Fine-grained personal access tokens](https://github.blog/2022-10-18-introducing-fine-grained-personal-access-tokens-for-github/) provided by your organization for a specific repository. Store the Personal Access Token (PAT) as a secret in your project.
180+
difficultyOfImplementation:
181+
knowledge: 2
182+
time: 2
183+
resources: 2
184+
usefulness: 4
185+
level: 5
186+
implementation:
187+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/docker-content-trust
188+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/in-toto
189+
dependsOn:
190+
- Defined build process
191+
- Pinning of artifacts
192+
references:
193+
samm2:
194+
- I-SB-A-1
195+
iso27001-2017:
196+
- 14.2.6
197+
iso27001-2022:
198+
- 8.31
199+
isImplemented: false
200+
evidence: ""
201+
comments: ""
202+
Signing of code:
203+
uuid: 9f107927-61e9-4574-85ad-3f2b4bca8665
204+
risk: *execution-maliciuous
205+
measure:
206+
Digitally signing commits helps to prevent unauthorized manipulation
207+
of source code.
208+
difficultyOfImplementation:
209+
knowledge: 2
210+
time: 2
211+
resources: 2
212+
usefulness: 3
213+
level: 3
214+
implementation:
215+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/signing-of-commits
216+
- $ref: src/assets/YAML/default/implementations.yaml#/implementations/signing-of-commits-protection
217+
dependsOn:
218+
- Defined build process
219+
references:
220+
samm2:
221+
- I-SB-A-2
222+
iso27001-2017:
223+
- 14.2.6
224+
iso27001-2022:
225+
- 8.31
226+
isImplemented: false
227+
evidence: ""
228+
comments: ""

‎AI/_meta.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
_meta:
2+
label: AI
3+
icon:
4+
description: |-
5+
AI related

0 commit comments

Comments
 (0)