From d831b7d02a77fe48bfc98cdec7bbfa236d7f7a8e Mon Sep 17 00:00:00 2001 From: Mike Long Date: Tue, 17 Oct 2023 04:34:33 -0700 Subject: [PATCH 01/40] Update site title in config.toml --- config.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config.toml b/config.toml index fa60ecb..a78677e 100644 --- a/config.toml +++ b/config.toml @@ -1,6 +1,6 @@ baseURL = "https://devopsctl.com/" languageCode = "en-us" -title = "DevOps Control Framework" +title = "Kosli's Software Development Lifecycle" [taxonomies] risk = 'risks' @@ -21,4 +21,4 @@ title = "DevOps Control Framework" [markup.tableOfContents] startLevel = 2 - endLevel = 3 \ No newline at end of file + endLevel = 3 From c967a29b93c928fd7723a4cd85e7ac7680b4fd30 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 14:31:56 +0200 Subject: [PATCH 02/40] Set company name to Kosli --- config.toml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/config.toml b/config.toml index a78677e..a699824 100644 --- a/config.toml +++ b/config.toml @@ -7,8 +7,8 @@ title = "Kosli's Software Development Lifecycle" level = 'levels' [params] - company = 'AcmePay' - csor = 'a compliance system of record' + company = 'Kosli' + csor = 'Kosli' vcs = 'git' vcsHost = 'github' forkLink = 'https://github.com/kosli-dev/devopsctl/fork' From 2d71d79f75b45915643f630b437f25c9a4ffc561 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 14:52:57 +0200 Subject: [PATCH 03/40] Added Infra and config process --- config.toml | 1 + .../infrastructure_and_config_management.md | 19 +++++++++++++++++++ 2 files changed, 20 insertions(+) create mode 100644 content/process/ssdlc/runtime/infrastructure_and_config_management.md diff --git a/config.toml b/config.toml index a699824..78115af 100644 --- a/config.toml +++ b/config.toml @@ -10,6 +10,7 @@ title = "Kosli's Software Development Lifecycle" company = 'Kosli' csor = 'Kosli' vcs = 'git' + gitProvider = 'github' vcsHost = 'github' forkLink = 'https://github.com/kosli-dev/devopsctl/fork' logo = 'svg/logo.svg' diff --git a/content/process/ssdlc/runtime/infrastructure_and_config_management.md b/content/process/ssdlc/runtime/infrastructure_and_config_management.md new file mode 100644 index 0000000..65f00da --- /dev/null +++ b/content/process/ssdlc/runtime/infrastructure_and_config_management.md @@ -0,0 +1,19 @@ +--- +title: Infrastructure and Configuration Management +level: 1 +weight: 50 +tldr: Infrastructure and Configurations are defined "as code" and applied through automation +rationale: Software defined cloud infrastructure allows auditability, reproducibility and drift detection +--- + +# {{% param "title" %}} +{{< area_head >}} + +## Background +Infrastructure setup, configuration and evolution must be auditable, secure and reproducible. To ensure this we define our cloud environments as code and use automation tools to automatically roll out changes. + +## How we implement this control + +* To ensure this we define all our production and test infrastructure using code. Changes are rolled out via CI pipelines in {{% param "gitProvider" %}} +* We use the appropriate for the type and level of the change (e.g. Terraform for infrastructure, Docker for application Runtimes) +* All documentation around our infrastructure, security approaches and automation is maintained and up-to-date in our [Knowledge Base](https://github.com/kosli-dev/knowledge-base) \ No newline at end of file From cbc45edfdd970a92682b4120eba0bb0d93d59b8e Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 15:04:50 +0200 Subject: [PATCH 04/40] Update landing page --- content/_index.md | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/content/_index.md b/content/_index.md index 5ee51e6..d43cea4 100644 --- a/content/_index.md +++ b/content/_index.md @@ -5,13 +5,13 @@ bookToC: true --- {{< figure src="/images/hero-home.svg" alt="Devops Control Framework">}} -# The DevOps Control Framework +# Kosli's Software Delivery Lifecycle {{< columns >}} {{< figure src="/images/devops-values.svg" alt="DevOps Values" >}} ## DevOps Values -The DevOps Control Framework is a defined secure software development process +This is a defined secure software development process with **DevOps Culture** at it's heart. <---> @@ -27,8 +27,8 @@ institutions to deliver **compliant, secure, and audit-ready software**. ## Overview -The purpose of a Secure Software Development Lifecycle (SSDLC) is to provide a -defined, repeatable way of working that manages IT risks associated with +The purpose of this Secure Software Development Lifecycle (SSDLC) is to provide a +defined, repeatable way of working that manages Kosli's risks associated with software development. It is a governance framework which forms a _definition_ of how things should be done, which should be adhered to in _implementation_, which produces _proof_ of conformance. @@ -37,7 +37,7 @@ which produces _proof_ of conformance. ## Scope -The scope of this framework is to secure the entire value stream of software +The scope of this framework is to secure the entire value stream of our software development. {{< figure src="/images/governance-scope.svg" alt="Secure Value Stream" >}} From 524547438cfb2411dda02f277e779711b6a69303 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 15:10:31 +0200 Subject: [PATCH 05/40] Update logo --- themes/hugo-book/static/svg/logo-dcf.svg | 69 ++++++++ themes/hugo-book/static/svg/logo-short.svg | 70 ++++++++ themes/hugo-book/static/svg/logo.svg | 195 ++++++++++++++------- 3 files changed, 274 insertions(+), 60 deletions(-) create mode 100644 themes/hugo-book/static/svg/logo-dcf.svg create mode 100644 themes/hugo-book/static/svg/logo-short.svg diff --git a/themes/hugo-book/static/svg/logo-dcf.svg b/themes/hugo-book/static/svg/logo-dcf.svg new file mode 100644 index 0000000..9f5cd29 --- /dev/null +++ b/themes/hugo-book/static/svg/logo-dcf.svg @@ -0,0 +1,69 @@ + + + + + + + + + + + + + + + + + + + diff --git a/themes/hugo-book/static/svg/logo-short.svg b/themes/hugo-book/static/svg/logo-short.svg new file mode 100644 index 0000000..6041dd3 --- /dev/null +++ b/themes/hugo-book/static/svg/logo-short.svg @@ -0,0 +1,70 @@ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/themes/hugo-book/static/svg/logo.svg b/themes/hugo-book/static/svg/logo.svg index 9f5cd29..783891b 100644 --- a/themes/hugo-book/static/svg/logo.svg +++ b/themes/hugo-book/static/svg/logo.svg @@ -1,69 +1,144 @@ - + + viewBox="0 0 2557.7 164.9" style="enable-background:new 0 0 2557.7 164.9;" xml:space="preserve"> - - - - - - - - - - - - + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + From 2028e96490076267c48ae925c7b7763a40b2df3b Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 15:18:34 +0200 Subject: [PATCH 06/40] More customizations for Kosli --- content/background/why.md | 2 +- layouts/partials/docs/inject/footer.html | 2 +- layouts/partials/docs/inject/menu-before.html | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/content/background/why.md b/content/background/why.md index 212905b..249c0ef 100644 --- a/content/background/why.md +++ b/content/background/why.md @@ -1,6 +1,6 @@ --- weight: 10 -title: Why do you need a process? +title: Why do we need a process? --- # Why does {{% param "company" %}} need a software process? diff --git a/layouts/partials/docs/inject/footer.html b/layouts/partials/docs/inject/footer.html index 7e0490d..e186b1e 100644 --- a/layouts/partials/docs/inject/footer.html +++ b/layouts/partials/docs/inject/footer.html @@ -1,6 +1,6 @@
- The DevOpsCTL framework is maintained by + This SDLC is maintained by
    diff --git a/layouts/partials/docs/inject/menu-before.html b/layouts/partials/docs/inject/menu-before.html index 3cce3e0..92d57e0 100644 --- a/layouts/partials/docs/inject/menu-before.html +++ b/layouts/partials/docs/inject/menu-before.html @@ -1,3 +1,3 @@ - The DevOpsCTL Framework + Home \ No newline at end of file From 877bbe7948c47f6cf1f4bae8c576db68a84a8a8b Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 15:35:42 +0200 Subject: [PATCH 07/40] Binary provenance --- content/process/ssdlc/build/binary_provenance.md | 10 +++++++--- content/process/ssdlc/runtime/service_ownership.md | 2 +- 2 files changed, 8 insertions(+), 4 deletions(-) diff --git a/content/process/ssdlc/build/binary_provenance.md b/content/process/ssdlc/build/binary_provenance.md index a31eb1b..c75ecb6 100644 --- a/content/process/ssdlc/build/binary_provenance.md +++ b/content/process/ssdlc/build/binary_provenance.md @@ -1,7 +1,7 @@ --- title: Artifact Binary Provenance weight: 1 -tldr: Every software running production has known provenance +tldr: Every software running in a production system has known provenance rationale: High security environment require a tamper-proof identity scheme. The use of Content Addressable Storage mechanisms ensures that if software changes it will have a different identity. risks: - supply-chain @@ -15,7 +15,7 @@ level: 1 ## Background To define software identity, you use the cryptographic hash of the software itself. We use the SHA256 digest of the sofware binary. -This means that if a single byte in the software changes it will have a different identity. +This means that if a single byte in the software changes it will have a different identity. This ensures we can't qualify one software artifact and deploy a different one. It also allows us to create a provable chain of custody from commit to build to production. {{< figure src="/images/binary-provenance.svg" alt="Binary Provenance" >}} @@ -35,4 +35,8 @@ It can be helpful to use human-friendly identites in CI displays, filenames, and These are very useful ways for humans to navigate identity through version control and CI systems. However, since they are fallible, they cannot be used to identify software in the security and compliance areas. -Use labels for humans and SHAs for machines. \ No newline at end of file +Use labels for humans and SHAs for machines. + +## How we implement this control + +We use Kosli to record every official build in our CI system. The audit trails for our binary provenance can be found here: https://app.kosli.com/kosli/flows/ \ No newline at end of file diff --git a/content/process/ssdlc/runtime/service_ownership.md b/content/process/ssdlc/runtime/service_ownership.md index b317dc6..627e249 100644 --- a/content/process/ssdlc/runtime/service_ownership.md +++ b/content/process/ssdlc/runtime/service_ownership.md @@ -16,6 +16,6 @@ landscapes: * **Knowlege**: Who knows how this is supposed to work? How can I get help with this system? * **Incident**: Alerts are firing for a service, who do I contact? What has changed lately? -* **Audit**: who is reponsible that the DevOpsCTL process is followed for this service? +* **Audit**: who is reponsible that the SDLC is followed for this service? {{< figure src="/images/secrets-management.svg" alt="Change Records" >}} \ No newline at end of file From 960e240b333d1d4244395bfa127513fc2c394bec Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 15:54:29 +0200 Subject: [PATCH 08/40] Dependencies --- content/process/ssdlc/build/dependencies.md | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/content/process/ssdlc/build/dependencies.md b/content/process/ssdlc/build/dependencies.md index a11a9f6..070e881 100644 --- a/content/process/ssdlc/build/dependencies.md +++ b/content/process/ssdlc/build/dependencies.md @@ -11,8 +11,6 @@ level: 1 ## Background - - Key points: * You must have control over what dependencies are packaged in your software @@ -29,3 +27,12 @@ During build, these inputs to the build package can be recorded as the software bill-of-materials while recording [binary provenance]({{< relref "/process/ssdlc/build/binary_provenance" >}}) +## How we implement this control + +We define these dependencies in the source code, at the application level and if relevent, at the Docker image level. + +| Application | Dependencies | +| ----------- | ------------ | +| CLI | [Golang Dependencies](https://github.com/kosli-dev/cli/blob/main/go.mod) | +| Server | [Python Dependencies](https://github.com/kosli-dev/server/blob/master/src/requirements.txt)
    [Docker Dependencies](https://github.com/kosli-dev/server/blob/master/Dockerfile) | +| Slack Application | [Python Dependencies](https://github.com/kosli-dev/slack-auth-app/blob/main/src/requirements.txt)
    [Docker Dependencies](https://github.com/kosli-dev/slack-auth-app/blob/main/Dockerfile) | \ No newline at end of file From 5e1c891cfa86696cf44dff80a80f8aa72ea228e8 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 15:58:49 +0200 Subject: [PATCH 09/40] Update toolchain info --- content/process/ssdlc/build/toolchain.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/content/process/ssdlc/build/toolchain.md b/content/process/ssdlc/build/toolchain.md index 1702697..5100f6d 100644 --- a/content/process/ssdlc/build/toolchain.md +++ b/content/process/ssdlc/build/toolchain.md @@ -21,3 +21,8 @@ version control. You can learn more about build security levels defined in the [slsa specification](https://slsa.dev/spec/v0.1/requirements#scripted-build). {{< /hint >}} +## How we implement this control + +* Our officical builds occur in Github pipelines defined as code +* Each step runs in an immutable container +* Each build fingerprint is stored using [Binary Provenance]({{< ref "binary_provenance.md" >}}) \ No newline at end of file From f12e3085b3268b6e365263e2d0b2f200a2952c94 Mon Sep 17 00:00:00 2001 From: Tore Martin Hagen Date: Wed, 18 Oct 2023 15:59:04 +0200 Subject: [PATCH 10/40] Added training section --- config.toml | 1 + content/process/training.md | 12 ++++++++++++ 2 files changed, 13 insertions(+) create mode 100644 content/process/training.md diff --git a/config.toml b/config.toml index 78115af..d5429ae 100644 --- a/config.toml +++ b/config.toml @@ -1,6 +1,7 @@ baseURL = "https://devopsctl.com/" languageCode = "en-us" title = "Kosli's Software Development Lifecycle" +theme = "hugo-book" [taxonomies] risk = 'risks' diff --git a/content/process/training.md b/content/process/training.md new file mode 100644 index 0000000..48e2cba --- /dev/null +++ b/content/process/training.md @@ -0,0 +1,12 @@ +--- +weight: 10 +bookFlatSection: false +title: "Training" +--- + +# Training + +The team will annualy go through the [OWASP top 10 security risks](https://owasp.org/www-project-top-ten/) +and discuss them. Activity and paritsipants will be logged in Kosli. +For new employees the OWASP top 10 will be done together with +one of the other team members. From bdbbc7b74de8c0a5f0866fbf75df9b4dba02634a Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 17:36:16 +0200 Subject: [PATCH 11/40] QA process --- content/process/ssdlc/build/versioncontrol.md | 1 + .../process/ssdlc/process/deployment_approvals.md | 5 ++++- content/process/ssdlc/process/quality.md | 14 ++++++++++++++ 3 files changed, 19 insertions(+), 1 deletion(-) diff --git a/content/process/ssdlc/build/versioncontrol.md b/content/process/ssdlc/build/versioncontrol.md index 392efe9..f1068ca 100644 --- a/content/process/ssdlc/build/versioncontrol.md +++ b/content/process/ssdlc/build/versioncontrol.md @@ -11,6 +11,7 @@ rationale: Version control allows us to track and manage changes to our software ## Background We use {{< param "vcs" >}} to manage versioning for software development source code. For repository hosting and user management we use {{< param "vcsHost" >}}. +## How we implement this control ## Branching Strategies diff --git a/content/process/ssdlc/process/deployment_approvals.md b/content/process/ssdlc/process/deployment_approvals.md index a98c86e..f0ebdaf 100644 --- a/content/process/ssdlc/process/deployment_approvals.md +++ b/content/process/ssdlc/process/deployment_approvals.md @@ -24,4 +24,7 @@ Deployment approval controls form a key role in the secure software development lifecycle. Its purpose is to ensure that risks around change are managed and that change is an active decisions. -In highly sensitive software systems, more than one approver may be required. \ No newline at end of file +In highly sensitive software systems, more than one approver may be required. + +## How we implement this control + diff --git a/content/process/ssdlc/process/quality.md b/content/process/ssdlc/process/quality.md index 5fcae9d..03c555a 100644 --- a/content/process/ssdlc/process/quality.md +++ b/content/process/ssdlc/process/quality.md @@ -23,3 +23,17 @@ The benefits of automated approaches to regression testing include: * Automated test results documentation {{< /hint >}} + +## How we implement this control + +For any software delivered to customers, or with potential to impact customer data, we will test all software prior to deployment/release. Our main testing method will favor automated tests, both on the unit and integration level. (As of this time, our server software has over 95% branch coverage). + +* We perform automated testing as part of our CI/CD pipelines +* We record the automated test results against the code and artifacts in our [Kosli Flows](https://app.kosli.com/kosli/flows/) +* We control that tests are passing and test results are stored prior to deployment + +In addition, we can perform these controls which are optional but good practice: + +* We have a test coverage ratchet that fails if a coverage goal is not met +* This ratchet fails the pipeline +* A manual intervention is required to lower the coverage goal \ No newline at end of file From 356d350e51a4b0e1bc8b04b769e49f21a9f27225 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 17:43:41 +0200 Subject: [PATCH 12/40] Add link to our repositories --- content/process/ssdlc/build/versioncontrol.md | 2 ++ 1 file changed, 2 insertions(+) diff --git a/content/process/ssdlc/build/versioncontrol.md b/content/process/ssdlc/build/versioncontrol.md index f1068ca..18f7d37 100644 --- a/content/process/ssdlc/build/versioncontrol.md +++ b/content/process/ssdlc/build/versioncontrol.md @@ -13,6 +13,8 @@ We use {{< param "vcs" >}} to manage versioning for software development source ## How we implement this control +Our git repositories can be found here: https://github.com/kosli-dev + ## Branching Strategies Every service will follow one of the following branching strategies: From e2ce52a6e363502206872a8e0b881ae5c5224287 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 17:44:08 +0200 Subject: [PATCH 13/40] Add more info on code review --- content/process/ssdlc/process/code_review.md | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/content/process/ssdlc/process/code_review.md b/content/process/ssdlc/process/code_review.md index 9cb8071..59c904f 100644 --- a/content/process/ssdlc/process/code_review.md +++ b/content/process/ssdlc/process/code_review.md @@ -31,3 +31,10 @@ To avoid this, we recommend pair- or ensemble-programming: a practice where more Note: the reviewer should not be the person who pushes the last commit on the branch. {{< /hint >}} + + +## How we implement this control + +* We prefer real time reviews with pair or ensemble programming +* We use pull requests to document reviews in github +* We protect the `main` branch in each repository From 4f5ad67b53f65673482b2ea84108eb1aef04fdf0 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 17:54:37 +0200 Subject: [PATCH 14/40] Security --- content/process/ssdlc/process/security.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/content/process/ssdlc/process/security.md b/content/process/ssdlc/process/security.md index 91e2010..a54f38a 100644 --- a/content/process/ssdlc/process/security.md +++ b/content/process/ssdlc/process/security.md @@ -26,3 +26,12 @@ remedial actions. * Implement security scanning in the pipeline * Act in a timely manner to security issues * Consider security concerns in code reviews and software design + +## How we implement this control + +* We use [snyk](https://snyk.io/) to scan code and dependencies in our CI/CD pipelines +* We record snyk scans in Kosli and control/monitor that no artifact with missing and/or failed snyk scans run in production + +While not mandatory for our process, we additionally: + +* Run continuous nightly snky scans on containers in production in case new vulnerabilities are found in running assets \ No newline at end of file From 01775915b345f3559ba2f2f1c8af6cf09e135f6e Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 17:56:49 +0200 Subject: [PATCH 15/40] PR attestations --- content/process/ssdlc/process/code_review.md | 1 + 1 file changed, 1 insertion(+) diff --git a/content/process/ssdlc/process/code_review.md b/content/process/ssdlc/process/code_review.md index 59c904f..cb37774 100644 --- a/content/process/ssdlc/process/code_review.md +++ b/content/process/ssdlc/process/code_review.md @@ -38,3 +38,4 @@ Note: the reviewer should not be the person who pushes the last commit on the br * We prefer real time reviews with pair or ensemble programming * We use pull requests to document reviews in github * We protect the `main` branch in each repository +* We record the pull requests in Kosli and control/monitor that no runtime workload is missing PR attestations From cdda000a8fe8fa95e12ff95f3614660790e30b28 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 18:14:01 +0200 Subject: [PATCH 16/40] Edits on process --- content/process/ssdlc/process/deployment_approvals.md | 4 ++++ content/process/ssdlc/process/security.md | 2 +- 2 files changed, 5 insertions(+), 1 deletion(-) diff --git a/content/process/ssdlc/process/deployment_approvals.md b/content/process/ssdlc/process/deployment_approvals.md index f0ebdaf..d40cbea 100644 --- a/content/process/ssdlc/process/deployment_approvals.md +++ b/content/process/ssdlc/process/deployment_approvals.md @@ -28,3 +28,7 @@ In highly sensitive software systems, more than one approver may be required. ## How we implement this control +Deployment approvals are + +* We use git tags to trigger and record deployment approvals +* CI/CD pipelines generate attestations for approvals \ No newline at end of file diff --git a/content/process/ssdlc/process/security.md b/content/process/ssdlc/process/security.md index a54f38a..7346e69 100644 --- a/content/process/ssdlc/process/security.md +++ b/content/process/ssdlc/process/security.md @@ -34,4 +34,4 @@ remedial actions. While not mandatory for our process, we additionally: -* Run continuous nightly snky scans on containers in production in case new vulnerabilities are found in running assets \ No newline at end of file +* Run continuous nightly snyk scans on containers in production in case new vulnerabilities are found in running assets \ No newline at end of file From 7fd0d13e18c58b5039438d67134c56f43d57ffac Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 18:19:01 +0200 Subject: [PATCH 17/40] Change records --- content/process/ssdlc/runtime/change_records.md | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/content/process/ssdlc/runtime/change_records.md b/content/process/ssdlc/runtime/change_records.md index 927800a..63bedb0 100644 --- a/content/process/ssdlc/runtime/change_records.md +++ b/content/process/ssdlc/runtime/change_records.md @@ -13,4 +13,9 @@ rationale: To meet our change management requirements, all changes to production The deployment steps in our pipelines automatically log all deployments, and we can also control that we only deploy software that is approved in the {{% param "csor" %}} audit trail. -{{< figure src="/images/change-records.svg" alt="Change records" >}} \ No newline at end of file +{{< figure src="/images/change-records.svg" alt="Change records" >}} + +## How we implement this control + +* We monitor production systems and automatically record a forensic history of all changes in Kosli using [environment monitoring](https://docs.kosli.com/getting_started/environments/) + * Environment records can be found here: https://app.kosli.com/kosli/environments/ From a5dcf835fa5aec529e0f3e68ab3cbb4fd56bddb1 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Wed, 18 Oct 2023 18:30:00 +0200 Subject: [PATCH 18/40] Deployment controls & approvals --- content/process/ssdlc/process/deployment_approvals.md | 4 ++-- content/process/ssdlc/runtime/deployment_controls.md | 7 ++++++- 2 files changed, 8 insertions(+), 3 deletions(-) diff --git a/content/process/ssdlc/process/deployment_approvals.md b/content/process/ssdlc/process/deployment_approvals.md index d40cbea..e0db2f2 100644 --- a/content/process/ssdlc/process/deployment_approvals.md +++ b/content/process/ssdlc/process/deployment_approvals.md @@ -11,7 +11,7 @@ rationale: To meet segregation of duties requirements, all deploymnents to produ ## Background -Segregations of duties is a common requirement in regulated or high security +Segregation of duties is a common requirement in regulated or high security development environment. Put plainly, it means that a developer cannot deploy their own changes without approval from someone who both: @@ -31,4 +31,4 @@ In highly sensitive software systems, more than one approver may be required. Deployment approvals are * We use git tags to trigger and record deployment approvals -* CI/CD pipelines generate attestations for approvals \ No newline at end of file +* CI/CD pipelines generate attestations for [Kosli approvals](https://docs.kosli.com/getting_started/approvals/) \ No newline at end of file diff --git a/content/process/ssdlc/runtime/deployment_controls.md b/content/process/ssdlc/runtime/deployment_controls.md index abdb7c4..56fe68e 100644 --- a/content/process/ssdlc/runtime/deployment_controls.md +++ b/content/process/ssdlc/runtime/deployment_controls.md @@ -12,7 +12,12 @@ rationale: Ensuring only compliant, approved software deployments are made to pr We use deployment controls to automatically ensure we only deploy software that has gone through our Software Development Lifecycle. This can be implemented as -a gate in the pipeline, or as an admission control in the environment (ideally +a gate in the pipeline, or as an admission controller in the environment (ideally both). {{< figure src="/images/deployment-controls.svg" alt="Deployment Controls" >}} + +## How we implement this control + +* We use [Kosli's assert artifact command](https://docs.kosli.com/client_reference/kosli_assert_artifact/) prior to deployment +* We use [Kosli's environment monitoring]({{< ref "workload_monitoring.md" >}}) to alert on non-compliant workloads \ No newline at end of file From 6eaa8df37778bd25aa27c471d24fbfc4789f2bd7 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Thu, 19 Oct 2023 07:24:05 +0200 Subject: [PATCH 19/40] Workload monitoring --- .../process/ssdlc/runtime/workload_monitoring.md | 14 ++++++++++---- 1 file changed, 10 insertions(+), 4 deletions(-) diff --git a/content/process/ssdlc/runtime/workload_monitoring.md b/content/process/ssdlc/runtime/workload_monitoring.md index 9fc59ab..f666e2d 100644 --- a/content/process/ssdlc/runtime/workload_monitoring.md +++ b/content/process/ssdlc/runtime/workload_monitoring.md @@ -1,8 +1,8 @@ --- -title: Workload Monitoring +title: Runtime Workload Monitoring level: 1 weight: 50 -tldr: Workloads are monitored to alert if any system is incompliant +tldr: Workloads are monitored to alert if any non-compliant or unauthorized change is discovered rationale: Real-time closed-loop compliance monitoring is a constant vigil against threats --- @@ -13,7 +13,13 @@ rationale: Real-time closed-loop compliance monitoring is a constant vigil again Ensuring that risks are controlled in the value stream is the first level of software process compliance. Beyond this, it is important to have a monitoring -process in place to ensure that unknown or incompliant workloads are identified +process in place to ensure that unknown or non-compliant workloads are identified in production. -{{< figure src="/images/workload-monitoring.svg" alt="Workload Monitoring" >}} \ No newline at end of file +{{< figure src="/images/workload-monitoring.svg" alt="Workload Monitoring" >}} + +## How we implement this control + +* A full forensic history of all container runtimes, lambda functions and s3 buckets are recorded using [Kosli environments](https://www.kosli.com/blog/kosli-a-flight-data-recorder-for-your-runtime-environments/) and can be found here: https://app.kosli.com/kosli/environments/ +* Unauthorized or non-compliant workloads are recorded and create alerts in our slack channels + From dc86a58186f8d1b4c17d81f84e01799eca9b4f9d Mon Sep 17 00:00:00 2001 From: Mike Long Date: Thu, 19 Oct 2023 07:30:00 +0200 Subject: [PATCH 20/40] Secrets --- content/process/ssdlc/runtime/secrets_managment.md | 8 +++++++- content/process/ssdlc/runtime/service_ownership.md | 7 ++++++- 2 files changed, 13 insertions(+), 2 deletions(-) diff --git a/content/process/ssdlc/runtime/secrets_managment.md b/content/process/ssdlc/runtime/secrets_managment.md index 6b591b7..72e93e6 100644 --- a/content/process/ssdlc/runtime/secrets_managment.md +++ b/content/process/ssdlc/runtime/secrets_managment.md @@ -14,4 +14,10 @@ rationale: Leaked secrets such as api keys, cryptography keys, identity tokens Secrets must be stored in a secure way, and a documented in a central place. [Cryptographic failures are the second highest risk in the OWASP top ten](https://owasp.org/Top10/A02_2021-Cryptographic_Failures/) so rigor and process is essential. -{{< figure src="/images/secrets-management.svg" alt="Change Records" >}} \ No newline at end of file +{{< figure src="/images/secrets-management.svg" alt="Change Records" >}} + +## How we implement this control + +* We use AWS secrets manager to store infrastructure secrets +* Secrets are provisioned in our terraform model ([instructions here](https://github.com/kosli-dev/knowledge-base/blob/master/add_secrets.md)) +* Secrets are entered via the AWS cloud console by the authorized team members \ No newline at end of file diff --git a/content/process/ssdlc/runtime/service_ownership.md b/content/process/ssdlc/runtime/service_ownership.md index 627e249..4c29e40 100644 --- a/content/process/ssdlc/runtime/service_ownership.md +++ b/content/process/ssdlc/runtime/service_ownership.md @@ -18,4 +18,9 @@ landscapes: * **Incident**: Alerts are firing for a service, who do I contact? What has changed lately? * **Audit**: who is reponsible that the SDLC is followed for this service? -{{< figure src="/images/secrets-management.svg" alt="Change Records" >}} \ No newline at end of file +{{< figure src="/images/secrets-management.svg" alt="Change Records" >}} + +## How we implement this control + +At this stage, as we have a relatively simple system and a single tech team, simply recording the services in [Kosli's environment monitoring]({{< ref "workload_monitoring.md" >}}) meets this need. + From 8eea480fe06a76c8bcfaec16b56ff50362b59380 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Thu, 19 Oct 2023 07:34:51 +0200 Subject: [PATCH 21/40] Training --- content/process/training.md | 11 +++++++---- 1 file changed, 7 insertions(+), 4 deletions(-) diff --git a/content/process/training.md b/content/process/training.md index 48e2cba..9843706 100644 --- a/content/process/training.md +++ b/content/process/training.md @@ -6,7 +6,10 @@ title: "Training" # Training -The team will annualy go through the [OWASP top 10 security risks](https://owasp.org/www-project-top-ten/) -and discuss them. Activity and paritsipants will be logged in Kosli. -For new employees the OWASP top 10 will be done together with -one of the other team members. +The team study the [OWASP top 10 security risks](https://owasp.org/www-project-top-ten/) +and discuss their implications for our software development and operations, at least annually. New employees and members of the tech team require this as part of our onboarding process. + +## How we implement this control + +* The activity and paritsipants will be logged in a Kosli audit trail. +* For new employees the OWASP top 10 will be done together with one of the other team members. From 102a88b28d2e2815221616be5c578ae7d7c10d81 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Thu, 19 Oct 2023 07:49:47 +0200 Subject: [PATCH 22/40] Improve risk register --- data/exceptions/example.yaml | 8 ++++---- data/risks/env_breach.yaml | 3 ++- data/risks/insider_threat.yaml | 9 ++++++--- layouts/partials/risk.html | 2 +- 4 files changed, 13 insertions(+), 9 deletions(-) diff --git a/data/exceptions/example.yaml b/data/exceptions/example.yaml index e28dabb..0fd7c7c 100644 --- a/data/exceptions/example.yaml +++ b/data/exceptions/example.yaml @@ -1,5 +1,5 @@ exception: - service: build-logrotate - owner: platform team - description: Does not use code reviews - rationale: This code is never ran in production systems + service: example-service + owner: Tech team + description: This is an example exemption + rationale: "Example rationale: this code is never ran in production systems" diff --git a/data/risks/env_breach.yaml b/data/risks/env_breach.yaml index 14ad345..72280a2 100644 --- a/data/risks/env_breach.yaml +++ b/data/risks/env_breach.yaml @@ -3,4 +3,5 @@ risk: display_name: Environment Breach description: External attacker running workloads in our system mitigations: - - workload_monitoring + - hreflink: "http://localhost:1313/process/ssdlc/runtime/workload_monitoring/" + hreftext: "Kosli’s environment monitoring" diff --git a/data/risks/insider_threat.yaml b/data/risks/insider_threat.yaml index 553e0b9..74f09e9 100644 --- a/data/risks/insider_threat.yaml +++ b/data/risks/insider_threat.yaml @@ -3,6 +3,9 @@ risk: display_name: Insider Threat description: Someone inside the company acts against the best intests mitigations: - - code_review - - deployment_approvals - - workload_monitoring + - hreflink: "/process/ssdlc/process/code_review/" + hreftext: "Code Review" + - hreflink: "/process/ssdlc/process/deployment_approvals/" + hreftext: "Deployment Approvals" + - hreflink: "/process/ssdlc/process/workload_monitoring/" + hreftext: "Workload Monitoring" diff --git a/layouts/partials/risk.html b/layouts/partials/risk.html index 7e379a3..c611475 100644 --- a/layouts/partials/risk.html +++ b/layouts/partials/risk.html @@ -5,7 +5,7 @@
      {{ range .root.risk.mitigations }}
    • - {{ . }}: + {{ .hreftext }}
      • {{ end }} From 827e9a5166cf795485dccc2909a357c356682d7f Mon Sep 17 00:00:00 2001 From: Mike Long Date: Thu, 19 Oct 2023 07:51:12 +0200 Subject: [PATCH 23/40] Fix paths --- data/risks/env_breach.yaml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/data/risks/env_breach.yaml b/data/risks/env_breach.yaml index 72280a2..6b7a4dc 100644 --- a/data/risks/env_breach.yaml +++ b/data/risks/env_breach.yaml @@ -3,5 +3,5 @@ risk: display_name: Environment Breach description: External attacker running workloads in our system mitigations: - - hreflink: "http://localhost:1313/process/ssdlc/runtime/workload_monitoring/" - hreftext: "Kosli’s environment monitoring" + - hreflink: "/process/ssdlc/runtime/workload_monitoring/" + hreftext: "Workload monitoring" From 5c89f55e8332b295a3c0aea3a8e37172b48ab564 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Thu, 19 Oct 2023 07:54:08 +0200 Subject: [PATCH 24/40] Fix paths --- data/risks/insider_threat.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/data/risks/insider_threat.yaml b/data/risks/insider_threat.yaml index 74f09e9..7f26227 100644 --- a/data/risks/insider_threat.yaml +++ b/data/risks/insider_threat.yaml @@ -7,5 +7,5 @@ risk: hreftext: "Code Review" - hreflink: "/process/ssdlc/process/deployment_approvals/" hreftext: "Deployment Approvals" - - hreflink: "/process/ssdlc/process/workload_monitoring/" + - hreflink: "/process/ssdlc/runtime/workload_monitoring/" hreftext: "Workload Monitoring" From cc22774451cb83b50a36322a26870c2047c49fb7 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Thu, 19 Oct 2023 09:12:07 +0200 Subject: [PATCH 25/40] Add ordering to pages --- content/process/exception_register.md | 2 +- content/process/training.md | 2 +- layouts/partials/risk.html | 10 +++++----- 3 files changed, 7 insertions(+), 7 deletions(-) diff --git a/content/process/exception_register.md b/content/process/exception_register.md index 7155495..248b485 100644 --- a/content/process/exception_register.md +++ b/content/process/exception_register.md @@ -1,5 +1,5 @@ --- -weight: 10 +weight: 15 bookFlatSection: false title: "Exception Register" --- diff --git a/content/process/training.md b/content/process/training.md index 9843706..132c208 100644 --- a/content/process/training.md +++ b/content/process/training.md @@ -1,5 +1,5 @@ --- -weight: 10 +weight: 5 bookFlatSection: false title: "Training" --- diff --git a/layouts/partials/risk.html b/layouts/partials/risk.html index c611475..6c8f559 100644 --- a/layouts/partials/risk.html +++ b/layouts/partials/risk.html @@ -1,13 +1,13 @@ +

      {{ .root.risk.display_name }}

        -
      • {{ .root.risk.display_name }}
        • -
      • Description: {{ .root.risk.description }}
        • -
      • Mitigations:
        • -
          +
        • Description: {{ .root.risk.description }}
          • +
        • Mitigations:
          • + +
      \ No newline at end of file From 6fba79a5ff0cb654dd5c3691f81c1e95cdc0c48b Mon Sep 17 00:00:00 2001 From: Mike Long Date: Thu, 19 Oct 2023 09:58:18 +0200 Subject: [PATCH 26/40] System access --- .../process/ssdlc/runtime/system_access.md | 26 +++++++++++++++++++ 1 file changed, 26 insertions(+) create mode 100644 content/process/ssdlc/runtime/system_access.md diff --git a/content/process/ssdlc/runtime/system_access.md b/content/process/ssdlc/runtime/system_access.md new file mode 100644 index 0000000..90d083d --- /dev/null +++ b/content/process/ssdlc/runtime/system_access.md @@ -0,0 +1,26 @@ +--- +title: System Access Controls +level: 1 +weight: 50 +tldr: All access to runtime environments requires authentication and audit trails +rationale: To meet our system access control policy, all access must be approved and auditable +--- + +# {{% param "title" %}} +{{< area_head >}} + +## Background + +As part of normal software development, it can be necessary to gain remote access to runtime environments. This can be for many reasons: + +* Debugging the runtime environment +* Running migration scripts +* Inspecting the behaviour of running systems + +This must be limited to authorized personnel and all activities performed should have full audit trails. + +## How we implement this control + +* Any remote shell session require SSO authentication and full adit trails are logged in Kosli here: https://app.kosli.com/kosli/audit-trails +* This forms part of our [System Access Control Policy](https://app.drata.com/policy-builder/18) +* All access audit trails are reviewed \ No newline at end of file From 36ad8a81a4aab727f97006c466a9175b1ce6fc2c Mon Sep 17 00:00:00 2001 From: Tore Martin Hagen Date: Mon, 13 Nov 2023 07:51:10 +0100 Subject: [PATCH 27/40] Updated Code review to spesify changes to production. SW that does not go to production does not need to be reviewed --- content/process/ssdlc/process/code_review.md | 18 ++++++++++++------ 1 file changed, 12 insertions(+), 6 deletions(-) diff --git a/content/process/ssdlc/process/code_review.md b/content/process/ssdlc/process/code_review.md index cb37774..75db70b 100644 --- a/content/process/ssdlc/process/code_review.md +++ b/content/process/ssdlc/process/code_review.md @@ -2,8 +2,8 @@ title: Code Review weight: 10 level: 1 -tldr: Code review is performed on all software changes -rationale: Peer review is an essential mitigation against insider threats, as well as a means of improving knowledege sharing and quality. +tldr: Code review is performed on all software changes to production +rationale: Peer review is an essential mitigation against insider threats, as well as a means of improving knowledge sharing and quality. risks: insider_threat --- @@ -11,22 +11,28 @@ risks: insider_threat {{< area_head >}} ## Background -We use pull requests to document code reviews. The pull request description should contain key information of the change, as well as any relevant information. At a minimum, code reviews should be performed by someone capable of understanding the change and it’s associated risks. +We use pull requests to document code reviews. The pull request description should contain key information of +the change, as well as any relevant information. At a minimum, code reviews should be performed by someone +capable of understanding the change, and it’s associated risks. Important considerations we make before approving a Pull Request: - Security concerns: is this change secure? - Quality: is this maintainable? -- Verification: Does this require manual testing? Has is been performed? +- Verification: Does this require manual testing? Has it been performed? {{< figure src="/images/feature-branch-pr.svg" alt="Feature Branch Strategy" >}} {{< hint warning >}} ### Code Review Anti-patterns -A common anti-pattern when using pull requests is waiting for review. In an ideal situation, the lead time for review should approach 0. If there is any delay on integration, it can lead to people batching larger and larger changes. This causes larger pull requests, more delays, poorer code reviews, and ultimately more risks. +A common anti-pattern when using pull requests is waiting for review. In an ideal situation, the lead time for +review should approach 0. If there is any delay on integration, it can lead to people batching larger and +larger changes. This causes larger pull requests, more delays, poorer code reviews, and ultimately more risks. -To avoid this, we recommend pair- or ensemble-programming: a practice where more than one person works together to complete tasks. This way, as soon as one developer creates the pull request, another person can sign off immediately. +To avoid this, we recommend pair- or ensemble-programming: a practice where more than one person works together +to complete tasks. This way, as soon as one developer creates the pull request, another person can sign +off immediately. Note: the reviewer should not be the person who pushes the last commit on the branch. From 095f37cf6e90f223cbc092ab9ed64f5bc8299650 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Sun, 15 Sep 2024 10:41:38 -0700 Subject: [PATCH 28/40] Save point --- config.toml | 2 +- content/build/_index.md | 5 + content/catalog.md | 8 ++ content/map.md | 8 ++ content/process/exception_register.md | 2 +- content/process/levels.html | 2 - content/process/risk_register.md | 2 +- .../process/ssdlc/build/binary_provenance.md | 2 + content/process/ssdlc/build/dependencies.md | 2 + .../infrastructure_and_config_management.md | 2 + content/process/ssdlc/build/toolchain.md | 2 + content/process/ssdlc/build/versioncontrol.md | 2 + content/process/ssdlc/process/code_review.md | 2 + .../ssdlc/process/deployment_approvals.md | 2 + content/process/ssdlc/process/quality.md | 2 + content/process/ssdlc/process/security.md | 2 + .../{runtime => process}/service_ownership.md | 2 + .../process/ssdlc/runtime/change_records.md | 2 + .../ssdlc/runtime/deployment_controls.md | 2 + .../ssdlc/runtime/secrets_managment.md | 2 + .../process/ssdlc/runtime/system_access.md | 2 + .../ssdlc/runtime/workload_monitoring.md | 2 + content/process/training.md | 2 +- layouts/partials/area.html | 5 + layouts/shortcodes/areas.html | 39 ++++++ layouts/shortcodes/map.html | 55 +++++++++ themes/hugo-book/assets/_custom.scss | 113 ++++++++++++++++++ 27 files changed, 267 insertions(+), 6 deletions(-) create mode 100644 content/build/_index.md create mode 100644 content/catalog.md create mode 100644 content/map.md delete mode 100644 content/process/levels.html rename content/process/ssdlc/{runtime => build}/infrastructure_and_config_management.md (98%) rename content/process/ssdlc/{runtime => process}/service_ownership.md (98%) create mode 100644 layouts/partials/area.html create mode 100644 layouts/shortcodes/areas.html create mode 100644 layouts/shortcodes/map.html diff --git a/config.toml b/config.toml index d5429ae..e5bfb46 100644 --- a/config.toml +++ b/config.toml @@ -5,7 +5,7 @@ theme = "hugo-book" [taxonomies] risk = 'risks' - level = 'levels' + area = 'areas' [params] company = 'Kosli' diff --git a/content/build/_index.md b/content/build/_index.md new file mode 100644 index 0000000..79ff0cc --- /dev/null +++ b/content/build/_index.md @@ -0,0 +1,5 @@ +--- +title: Build +wikipedia: https://en.wikipedia.org/wiki/Bruce_Willis +weight: 100 +--- \ No newline at end of file diff --git a/content/catalog.md b/content/catalog.md new file mode 100644 index 0000000..e813b3c --- /dev/null +++ b/content/catalog.md @@ -0,0 +1,8 @@ +--- +weight: 20 +title: Catalog +bookToC: true +--- + + +{{< areas >}} \ No newline at end of file diff --git a/content/map.md b/content/map.md new file mode 100644 index 0000000..50b5214 --- /dev/null +++ b/content/map.md @@ -0,0 +1,8 @@ +--- +weight: 20 +title: Map +bookToC: true +--- + + +{{< map >}} \ No newline at end of file diff --git a/content/process/exception_register.md b/content/process/exception_register.md index 248b485..7508410 100644 --- a/content/process/exception_register.md +++ b/content/process/exception_register.md @@ -1,5 +1,5 @@ --- -weight: 15 +weight: 40 bookFlatSection: false title: "Exception Register" --- diff --git a/content/process/levels.html b/content/process/levels.html deleted file mode 100644 index 139597f..0000000 --- a/content/process/levels.html +++ /dev/null @@ -1,2 +0,0 @@ - - diff --git a/content/process/risk_register.md b/content/process/risk_register.md index e7f263f..7aca5bb 100644 --- a/content/process/risk_register.md +++ b/content/process/risk_register.md @@ -1,5 +1,5 @@ --- -weight: 10 +weight: 20 bookFlatSection: false title: "Risk Register" --- diff --git a/content/process/ssdlc/build/binary_provenance.md b/content/process/ssdlc/build/binary_provenance.md index c75ecb6..b189904 100644 --- a/content/process/ssdlc/build/binary_provenance.md +++ b/content/process/ssdlc/build/binary_provenance.md @@ -1,6 +1,8 @@ --- title: Artifact Binary Provenance weight: 1 +areas: + - build tldr: Every software running in a production system has known provenance rationale: High security environment require a tamper-proof identity scheme. The use of Content Addressable Storage mechanisms ensures that if software changes it will have a different identity. risks: diff --git a/content/process/ssdlc/build/dependencies.md b/content/process/ssdlc/build/dependencies.md index 070e881..c3431b1 100644 --- a/content/process/ssdlc/build/dependencies.md +++ b/content/process/ssdlc/build/dependencies.md @@ -1,6 +1,8 @@ --- title: Dependency Management weight: 20 +areas: + - build tldr: Every dependency is defined securely, managed, and auditable rationale: Inputs to the build process can introduce security and quality issues, and as such must be defined, controlled, and transparent as part of the software development lifecycle. level: 1 diff --git a/content/process/ssdlc/runtime/infrastructure_and_config_management.md b/content/process/ssdlc/build/infrastructure_and_config_management.md similarity index 98% rename from content/process/ssdlc/runtime/infrastructure_and_config_management.md rename to content/process/ssdlc/build/infrastructure_and_config_management.md index 65f00da..48dd48a 100644 --- a/content/process/ssdlc/runtime/infrastructure_and_config_management.md +++ b/content/process/ssdlc/build/infrastructure_and_config_management.md @@ -4,6 +4,8 @@ level: 1 weight: 50 tldr: Infrastructure and Configurations are defined "as code" and applied through automation rationale: Software defined cloud infrastructure allows auditability, reproducibility and drift detection +areas: + - build --- # {{% param "title" %}} diff --git a/content/process/ssdlc/build/toolchain.md b/content/process/ssdlc/build/toolchain.md index 5100f6d..f2e8a8b 100644 --- a/content/process/ssdlc/build/toolchain.md +++ b/content/process/ssdlc/build/toolchain.md @@ -2,6 +2,8 @@ title: Defined Toolchain level: 3 weight: 20 +areas: + - build tldr: Build environments must be defined securely and auditable rationale: A secure build environment is the foundation for a mitigating software supply chain attacks. Build environments defined as code protect against interference that can happen in the build and distribution processes. --- diff --git a/content/process/ssdlc/build/versioncontrol.md b/content/process/ssdlc/build/versioncontrol.md index 18f7d37..4a23f4a 100644 --- a/content/process/ssdlc/build/versioncontrol.md +++ b/content/process/ssdlc/build/versioncontrol.md @@ -2,6 +2,8 @@ title: Version Control weight: 1 level: 1 +areas: + - build tldr: Every change to the source is tracked in a version control system rationale: Version control allows us to track and manage changes to our software code. As a traceability system, it provides a means to understand how our software changes, who changes it, and why it was changed. --- diff --git a/content/process/ssdlc/process/code_review.md b/content/process/ssdlc/process/code_review.md index 75db70b..ffd5f9c 100644 --- a/content/process/ssdlc/process/code_review.md +++ b/content/process/ssdlc/process/code_review.md @@ -5,6 +5,8 @@ level: 1 tldr: Code review is performed on all software changes to production rationale: Peer review is an essential mitigation against insider threats, as well as a means of improving knowledge sharing and quality. risks: insider_threat +areas: + - process --- # {{% param "title" %}} diff --git a/content/process/ssdlc/process/deployment_approvals.md b/content/process/ssdlc/process/deployment_approvals.md index e0db2f2..0b38b09 100644 --- a/content/process/ssdlc/process/deployment_approvals.md +++ b/content/process/ssdlc/process/deployment_approvals.md @@ -4,6 +4,8 @@ level: 1 weight: 40 tldr: Deployments are approved rationale: To meet segregation of duties requirements, all deploymnents to production are approved by someone other than the person making the change +areas: + - process --- # {{% param "title" %}} diff --git a/content/process/ssdlc/process/quality.md b/content/process/ssdlc/process/quality.md index 03c555a..e4c2a1b 100644 --- a/content/process/ssdlc/process/quality.md +++ b/content/process/ssdlc/process/quality.md @@ -4,6 +4,8 @@ level: 1 weight: 20 tldr: Functionality of software is assured prior to production rationale: Every change has the potential to introduce regressions in functionality. By testing our software prior to deployment we manage the risk of production issues. +areas: + - process --- # {{% param "title" %}} diff --git a/content/process/ssdlc/process/security.md b/content/process/ssdlc/process/security.md index 7346e69..e8febce 100644 --- a/content/process/ssdlc/process/security.md +++ b/content/process/ssdlc/process/security.md @@ -4,6 +4,8 @@ level: 1 weight: 30 tldr: Software is scanned for security vulnerabilities prior to deployment rationale: Many common security vulnerabilities can be detected with automated tools. By implementing tools for dependency scanning, SAST, and DAST in the pipeline we can reduce the attack surface of our software +areas: + - process --- # {{% param "title" %}} diff --git a/content/process/ssdlc/runtime/service_ownership.md b/content/process/ssdlc/process/service_ownership.md similarity index 98% rename from content/process/ssdlc/runtime/service_ownership.md rename to content/process/ssdlc/process/service_ownership.md index 4c29e40..8f5d352 100644 --- a/content/process/ssdlc/runtime/service_ownership.md +++ b/content/process/ssdlc/process/service_ownership.md @@ -5,6 +5,8 @@ weight: 40 tldr: All services running in our environments have registered ownership rationale: In a diverse software landscape it is essential everyone knows who is responsible for maintaince and support +areas: + - process --- # {{% param "title" %}} {{< area_head >}} diff --git a/content/process/ssdlc/runtime/change_records.md b/content/process/ssdlc/runtime/change_records.md index 63bedb0..ebfb0b4 100644 --- a/content/process/ssdlc/runtime/change_records.md +++ b/content/process/ssdlc/runtime/change_records.md @@ -4,6 +4,8 @@ level: 1 weight: 10 tldr: All systems and services maintain a record of changes rationale: To meet our change management requirements, all changes to production systems are recorded permanently +areas: + - change --- # {{% param "title" %}} diff --git a/content/process/ssdlc/runtime/deployment_controls.md b/content/process/ssdlc/runtime/deployment_controls.md index 56fe68e..334c37b 100644 --- a/content/process/ssdlc/runtime/deployment_controls.md +++ b/content/process/ssdlc/runtime/deployment_controls.md @@ -4,6 +4,8 @@ level: 1 weight: 20 tldr: Deployments controls are enforced in the pipeline and environments rationale: Ensuring only compliant, approved software deployments are made to production +areas: + - change --- # {{% param "title" %}} {{< area_head >}} diff --git a/content/process/ssdlc/runtime/secrets_managment.md b/content/process/ssdlc/runtime/secrets_managment.md index 72e93e6..ad1ba01 100644 --- a/content/process/ssdlc/runtime/secrets_managment.md +++ b/content/process/ssdlc/runtime/secrets_managment.md @@ -5,6 +5,8 @@ weight: 30 tldr: Build and runtime secrets are stored securely and documented appropriately rationale: Leaked secrets such as api keys, cryptography keys, identity tokens are a common attack scenario. +areas: + - change --- # {{% param "title" %}} {{< area_head >}} diff --git a/content/process/ssdlc/runtime/system_access.md b/content/process/ssdlc/runtime/system_access.md index 90d083d..555822a 100644 --- a/content/process/ssdlc/runtime/system_access.md +++ b/content/process/ssdlc/runtime/system_access.md @@ -4,6 +4,8 @@ level: 1 weight: 50 tldr: All access to runtime environments requires authentication and audit trails rationale: To meet our system access control policy, all access must be approved and auditable +areas: + - change --- # {{% param "title" %}} diff --git a/content/process/ssdlc/runtime/workload_monitoring.md b/content/process/ssdlc/runtime/workload_monitoring.md index f666e2d..a6c66ae 100644 --- a/content/process/ssdlc/runtime/workload_monitoring.md +++ b/content/process/ssdlc/runtime/workload_monitoring.md @@ -4,6 +4,8 @@ level: 1 weight: 50 tldr: Workloads are monitored to alert if any non-compliant or unauthorized change is discovered rationale: Real-time closed-loop compliance monitoring is a constant vigil against threats +areas: + - change --- # {{% param "title" %}} diff --git a/content/process/training.md b/content/process/training.md index 132c208..a5f5fd4 100644 --- a/content/process/training.md +++ b/content/process/training.md @@ -1,5 +1,5 @@ --- -weight: 5 +weight: 30 bookFlatSection: false title: "Training" --- diff --git a/layouts/partials/area.html b/layouts/partials/area.html new file mode 100644 index 0000000..6581790 --- /dev/null +++ b/layouts/partials/area.html @@ -0,0 +1,5 @@ +{{- range site.Menus.main }} + + {{ .Name }} + +{{- end }} \ No newline at end of file diff --git a/layouts/shortcodes/areas.html b/layouts/shortcodes/areas.html new file mode 100644 index 0000000..8577d07 --- /dev/null +++ b/layouts/shortcodes/areas.html @@ -0,0 +1,39 @@ + +{{ with .Site.Taxonomies }} + {{ $numberOfTerms := 0 }} + {{ range $taxonomy, $terms := . }} + {{ if eq $taxonomy "areas" }} + {{ $numberOfTerms = len . | add $numberOfTerms }} + {{ end }} + {{ end }} + + {{ if gt $numberOfTerms 0 }} +
      + {{ range $taxonomy, $terms := . }} + {{ if eq $taxonomy "areas" }} + {{ with $terms }} + + {{ range $term, $weightedPages := . }} +
      + +

      + {{ .Page.LinkTitle }} +

      + + +
      + {{ end }} + + + {{ end }} + {{ end }} + {{ end }} +
      + {{ end }} +{{ end }} \ No newline at end of file diff --git a/layouts/shortcodes/map.html b/layouts/shortcodes/map.html new file mode 100644 index 0000000..dddb4b7 --- /dev/null +++ b/layouts/shortcodes/map.html @@ -0,0 +1,55 @@ + +{{ range .Site.Taxonomies }} + {{ . }} +{{ end}}
      + +{{ with .Site.Taxonomies }} + {{ $numberOfTerms := 0 }} + {{ range $taxonomy, $terms := . }} + {{ if eq $taxonomy "areas" }} + {{ $numberOfTerms = len . | add $numberOfTerms }} + {{ end }} + {{ end }} + + + + {{ if gt $numberOfTerms 0 }} + {{ range $taxonomy, $terms := . }} + {{ if eq $taxonomy "areas" }} + {{ with $terms }} + + {{ . }}
      + + {{ range $term, $weightedPages := . }} +

      + {{ .Page.LinkTitle }} +

      +
      + + {{ range $index, $page := $weightedPages }} + +
      + {{ .LinkTitle }} +
      +       + {{ end }} + +
      + {{ end }} + {{ end }} + {{ end }} + {{ end }} + + {{ end }} +{{ end }} + + +
      + +{{ define "main" }} +

      {{ .Title }}

      + {{ .Content }} + {{ range .Data.Terms.Alphabetical }} +

      {{ .Page.LinkTitle }} ({{ .Count }})

      + {{ end }} +{{ end }} \ No newline at end of file diff --git a/themes/hugo-book/assets/_custom.scss b/themes/hugo-book/assets/_custom.scss index 8e053a0..c54bfd9 100644 --- a/themes/hugo-book/assets/_custom.scss +++ b/themes/hugo-book/assets/_custom.scss @@ -156,4 +156,117 @@ ul.hlist { h2 { font-size: 1.8rem; } +} + +ul.control-list { + padding-left: 0; +} + +.control-list, .control-list li { + list-style-type: none; + padding:0px; + margin:0px; +} + +.control-card { + width: 110px; + height: 110px; + border: 1px solid black; + padding: 10px; + margin: 10px; + font-size: 12px; + color: var(--neutral-100); + font-weight: 600; +} + +.card-row { + display: flex; + flex-wrap: wrap; +} + +h2.area-header{ + margin-bottom: 0px; + margin-top: 1em; +} + +.control-card.card-index-0 { + margin-left: 0px; +} + +.control-card.area-build.card-index-0 { + + background-color: var(--green-300); + border-color: var(--green-400); +} + +.control-card.area-build.card-index-1 { + background-color: var(--green-200); + border-color: var(--green-300); +} + +.control-card.area-build.card-index-2 { + background-color: var(--green-100); + border-color: var(--green-200); +} + +.control-card.area-build.card-index-3 { + background-color: var(--green-100); + border-color: var(--green-100); +} + +.control-card.area-build.card-index-4 { + background-color: var(--green-100); + border-color: var(--green-100); +} + + +.control-card.area-process.card-index-0 { + background-color: var(--blue-300); + border-color: var(--blue-400); +} + +.control-card.area-process.card-index-1 { + background-color: var(--blue-200); + border-color: var(--blue-300); +} + +.control-card.area-process.card-index-2 { + background-color: var(--blue-100); + border-color: var(--blue-200); +} + +.control-card.area-process.card-index-3 { + background-color: var(--blue-100); + border-color: var(--blue-100); +} + +.control-card.area-process.card-index-4 { + background-color: var(--blue-100); + border-color: var(--blue-100); +} + + +.control-card.area-change.card-index-0 { + background-color: var(--red-300); + border-color: var(--red-400); +} + +.control-card.area-change.card-index-1 { + background-color: var(--red-200); + border-color: var(--red-300); +} + +.control-card.area-change.card-index-2 { + background-color: var(--red-100); + border-color: var(--red-200); +} + +.control-card.area-change.card-index-3 { + background-color: var(--red-100); + border-color: var(--red-100); +} + +.control-card.area-change.card-index-4 { + background-color: var(--red-100); + border-color: var(--red-100); } \ No newline at end of file From f6308189bee35ec8b3d238618c946ed2345171aa Mon Sep 17 00:00:00 2001 From: Mike Long Date: Sun, 15 Sep 2024 12:21:07 -0700 Subject: [PATCH 29/40] Add weights for taxonomies and order in map --- content/{ => areas}/build/_index.md | 0 content/areas/change/_index.md | 5 ++ content/areas/process/_index.md | 5 ++ layouts/shortcodes/map.html | 84 ++++++++++++----------------- 4 files changed, 45 insertions(+), 49 deletions(-) rename content/{ => areas}/build/_index.md (100%) create mode 100644 content/areas/change/_index.md create mode 100644 content/areas/process/_index.md diff --git a/content/build/_index.md b/content/areas/build/_index.md similarity index 100% rename from content/build/_index.md rename to content/areas/build/_index.md diff --git a/content/areas/change/_index.md b/content/areas/change/_index.md new file mode 100644 index 0000000..63425da --- /dev/null +++ b/content/areas/change/_index.md @@ -0,0 +1,5 @@ +--- +title: Change +wikipedia: https://en.wikipedia.org/wiki/Bruce_Willis +weight: 300 +--- \ No newline at end of file diff --git a/content/areas/process/_index.md b/content/areas/process/_index.md new file mode 100644 index 0000000..a65c32d --- /dev/null +++ b/content/areas/process/_index.md @@ -0,0 +1,5 @@ +--- +title: Process +wikipedia: https://en.wikipedia.org/wiki/Bruce_Willis +weight: 200 +--- \ No newline at end of file diff --git a/layouts/shortcodes/map.html b/layouts/shortcodes/map.html index dddb4b7..2fc4683 100644 --- a/layouts/shortcodes/map.html +++ b/layouts/shortcodes/map.html @@ -1,55 +1,41 @@ -{{ range .Site.Taxonomies }} - {{ . }} -{{ end}}
      -{{ with .Site.Taxonomies }} - {{ $numberOfTerms := 0 }} - {{ range $taxonomy, $terms := . }} - {{ if eq $taxonomy "areas" }} - {{ $numberOfTerms = len . | add $numberOfTerms }} - {{ end }} - {{ end }} - - - - {{ if gt $numberOfTerms 0 }} - {{ range $taxonomy, $terms := . }} - {{ if eq $taxonomy "areas" }} - {{ with $terms }} - - {{ . }}
      - - {{ range $term, $weightedPages := . }} -

      - {{ .Page.LinkTitle }} -

      -
      - - {{ range $index, $page := $weightedPages }} - -
      - {{ .LinkTitle }} -
      -       +{{ range $taxonomy_name, $taxonomy := .Site.Taxonomies }} + {{ if (eq $taxonomy_name "areas") }} + + {{ with ($.Site.GetPage (printf "/%s" $taxonomy_name)) }} + {{ range $index, $weightedArea:= .Pages.ByWeight }} + + +

      + {{ .Page.LinkTitle }} +

      + + + {{ $term := .Page.Data.Term }} + + + {{ with .Site.Taxonomies.areas }} + {{ range $area, $cards := . }} + {{ if eq $area $term }} +
      + {{ range $index, $card := $cards }} + +
      + {{ .LinkTitle }} +
      +       + {{ end }} +
      {{ end }} + {{ end }} + {{ end}} + +
      +
      + {{ end }} + {{ end }} -
      - {{ end }} - {{ end }} - {{ end }} - {{ end }} + {{ end }} - {{ end }} {{ end }} - - -
      - -{{ define "main" }} -

      {{ .Title }}

      - {{ .Content }} - {{ range .Data.Terms.Alphabetical }} -

      {{ .Page.LinkTitle }} ({{ .Count }})

      - {{ end }} -{{ end }} \ No newline at end of file From 915451f83bc9e55a984d748f26d6d6137f117098 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Sun, 15 Sep 2024 21:49:33 -0700 Subject: [PATCH 30/40] Hover background --- themes/hugo-book/assets/_custom.scss | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/themes/hugo-book/assets/_custom.scss b/themes/hugo-book/assets/_custom.scss index c54bfd9..ceccc2a 100644 --- a/themes/hugo-book/assets/_custom.scss +++ b/themes/hugo-book/assets/_custom.scss @@ -189,6 +189,8 @@ h2.area-header{ margin-top: 1em; } + + .control-card.card-index-0 { margin-left: 0px; } @@ -269,4 +271,10 @@ h2.area-header{ .control-card.area-change.card-index-4 { background-color: var(--red-100); border-color: var(--red-100); -} \ No newline at end of file +} + + +div.control-card:hover { + background-color: var(--blue-500) !important; + border-color: var(--blue-500) !important; +} From 7cc9db7bff425ec8b179d7d928bb949a4a84f440 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Mon, 16 Sep 2024 09:34:03 -0700 Subject: [PATCH 31/40] Add bolder colors to palette --- themes/hugo-book/assets/_custom.scss | 6 +++--- themes/hugo-book/assets/_variables.scss | 4 ++++ 2 files changed, 7 insertions(+), 3 deletions(-) diff --git a/themes/hugo-book/assets/_custom.scss b/themes/hugo-book/assets/_custom.scss index ceccc2a..d552918 100644 --- a/themes/hugo-book/assets/_custom.scss +++ b/themes/hugo-book/assets/_custom.scss @@ -217,7 +217,7 @@ h2.area-header{ } .control-card.area-build.card-index-4 { - background-color: var(--green-100); + background-color: var(--green-050); border-color: var(--green-100); } @@ -243,7 +243,7 @@ h2.area-header{ } .control-card.area-process.card-index-4 { - background-color: var(--blue-100); + background-color: var(--blue-050); border-color: var(--blue-100); } @@ -269,7 +269,7 @@ h2.area-header{ } .control-card.area-change.card-index-4 { - background-color: var(--red-100); + background-color: var(--red-050); border-color: var(--red-100); } diff --git a/themes/hugo-book/assets/_variables.scss b/themes/hugo-book/assets/_variables.scss index dfe1e90..b39ab40 100644 --- a/themes/hugo-book/assets/_variables.scss +++ b/themes/hugo-book/assets/_variables.scss @@ -2,21 +2,25 @@ // @import "plugins/dark"; :root { + --blue-050: #0942C5; --blue-100: #2459D1; --blue-200: #4B75D9; --blue-300: #7293E1; --blue-400: #D0D6E8; --blue-500: #000D40; + --green-050: #06A163; --green-100: #29B57D; --green-200: #4FB98C; --green-300: #86CFB0; --green-400: #CBEADD; --green-500: #001D16; + --red-050: #D7122B; --red-100: #ED475C; --red-200: #F06173; --red-300: #F38593; --red-400: #FBD5DA; --red-500: #1F0808; + --yellow-050: #EEB002; --yellow-100: #F7C22E; --yellow-200: #F8CD54; --yellow-300: #F9D776; From 03a4e592da5b56edef847629e8db378cdfeb1c63 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Mon, 16 Sep 2024 09:42:14 -0700 Subject: [PATCH 32/40] Move content around --- content/_index.md | 41 ++-------------------------- content/background/_index.md | 39 ++++++++++++++++++++++++++ content/catalog.md | 8 ------ content/map.md | 8 ------ content/process/ssdlc/_index.md | 2 ++ themes/hugo-book/assets/_custom.scss | 1 + 6 files changed, 44 insertions(+), 55 deletions(-) delete mode 100644 content/catalog.md delete mode 100644 content/map.md diff --git a/content/_index.md b/content/_index.md index d43cea4..a6eafa4 100644 --- a/content/_index.md +++ b/content/_index.md @@ -1,45 +1,8 @@ --- weight: 1 title: Introduction -bookToC: true +bookToC: false --- -{{< figure src="/images/hero-home.svg" alt="Devops Control Framework">}} -# Kosli's Software Delivery Lifecycle - -{{< columns >}} -{{< figure src="/images/devops-values.svg" alt="DevOps Values" >}} -## DevOps Values - -This is a defined secure software development process -with **DevOps Culture** at it's heart. - -<---> -{{< figure src="/images/continuous-compliance.svg" alt="Continuous Compliance" >}} -## Continuous Compliance - -This is the distillation of the real processes in use by leading regulated -institutions to deliver **compliant, secure, and audit-ready software**. - -{{< /columns >}} - - - -## Overview - -The purpose of this Secure Software Development Lifecycle (SSDLC) is to provide a -defined, repeatable way of working that manages Kosli's risks associated with -software development. It is a governance framework which forms a _definition_ -of how things should be done, which should be adhered to in _implementation_, -which produces _proof_ of conformance. - -{{< figure src="/images/governance.svg" alt="Governance Framework" >}} - -## Scope - -The scope of this framework is to secure the entire value stream of our software -development. -{{< figure src="/images/governance-scope.svg" alt="Secure Value Stream" >}} - - +{{< map >}} diff --git a/content/background/_index.md b/content/background/_index.md index abeebf9..f82e02a 100644 --- a/content/background/_index.md +++ b/content/background/_index.md @@ -4,3 +4,42 @@ bookCollapseSection: true weight: 5 title: Background --- +{{< figure src="/images/hero-home.svg" alt="Devops Control Framework">}} +# Kosli's Software Delivery Lifecycle + +{{< columns >}} +{{< figure src="/images/devops-values.svg" alt="DevOps Values" >}} +## DevOps Values + +This is a defined secure software development process +with **DevOps Culture** at it's heart. + +<---> +{{< figure src="/images/continuous-compliance.svg" alt="Continuous Compliance" >}} +## Continuous Compliance + +This is the distillation of the real processes in use by leading regulated +institutions to deliver **compliant, secure, and audit-ready software**. + +{{< /columns >}} + + + +## Overview + +The purpose of this Secure Software Development Lifecycle (SSDLC) is to provide a +defined, repeatable way of working that manages Kosli's risks associated with +software development. It is a governance framework which forms a _definition_ +of how things should be done, which should be adhered to in _implementation_, +which produces _proof_ of conformance. + +{{< figure src="/images/governance.svg" alt="Governance Framework" >}} + +## Scope + +The scope of this framework is to secure the entire value stream of our software +development. +{{< figure src="/images/governance-scope.svg" alt="Secure Value Stream" >}} + + + diff --git a/content/catalog.md b/content/catalog.md deleted file mode 100644 index e813b3c..0000000 --- a/content/catalog.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -weight: 20 -title: Catalog -bookToC: true ---- - - -{{< areas >}} \ No newline at end of file diff --git a/content/map.md b/content/map.md deleted file mode 100644 index 50b5214..0000000 --- a/content/map.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -weight: 20 -title: Map -bookToC: true ---- - - -{{< map >}} \ No newline at end of file diff --git a/content/process/ssdlc/_index.md b/content/process/ssdlc/_index.md index 7a94e22..3cfe485 100644 --- a/content/process/ssdlc/_index.md +++ b/content/process/ssdlc/_index.md @@ -4,3 +4,5 @@ bookFlatSection: false bookCollapseSection: true title: "Requirements" --- + +{{< areas >}} \ No newline at end of file diff --git a/themes/hugo-book/assets/_custom.scss b/themes/hugo-book/assets/_custom.scss index d552918..9af8640 100644 --- a/themes/hugo-book/assets/_custom.scss +++ b/themes/hugo-book/assets/_custom.scss @@ -277,4 +277,5 @@ h2.area-header{ div.control-card:hover { background-color: var(--blue-500) !important; border-color: var(--blue-500) !important; + text-decoration: none; } From 0b52f84a4bb388a3519d82d80c060d836f6b1d90 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Mon, 16 Sep 2024 10:12:41 -0700 Subject: [PATCH 33/40] Normalize naming --- content/process/ssdlc/build/_index.md | 2 +- content/process/ssdlc/{runtime => change}/_index.md | 2 +- content/process/ssdlc/{runtime => change}/change_records.md | 0 .../process/ssdlc/{runtime => change}/deployment_controls.md | 0 content/process/ssdlc/{runtime => change}/secrets_managment.md | 0 content/process/ssdlc/{runtime => change}/system_access.md | 0 .../process/ssdlc/{runtime => change}/workload_monitoring.md | 0 content/process/ssdlc/process/_index.md | 2 +- 8 files changed, 3 insertions(+), 3 deletions(-) rename content/process/ssdlc/{runtime => change}/_index.md (75%) rename content/process/ssdlc/{runtime => change}/change_records.md (100%) rename content/process/ssdlc/{runtime => change}/deployment_controls.md (100%) rename content/process/ssdlc/{runtime => change}/secrets_managment.md (100%) rename content/process/ssdlc/{runtime => change}/system_access.md (100%) rename content/process/ssdlc/{runtime => change}/workload_monitoring.md (100%) diff --git a/content/process/ssdlc/build/_index.md b/content/process/ssdlc/build/_index.md index fc5de10..4c677cc 100644 --- a/content/process/ssdlc/build/_index.md +++ b/content/process/ssdlc/build/_index.md @@ -1,6 +1,6 @@ --- weight: 10 -title: Secure Build +title: Secure Builds bookCollapseSection: false bookFlatSection: true --- diff --git a/content/process/ssdlc/runtime/_index.md b/content/process/ssdlc/change/_index.md similarity index 75% rename from content/process/ssdlc/runtime/_index.md rename to content/process/ssdlc/change/_index.md index 2dc2ee6..753c0cb 100644 --- a/content/process/ssdlc/runtime/_index.md +++ b/content/process/ssdlc/change/_index.md @@ -1,6 +1,6 @@ --- weight: 30 -title: Secure Runtime +title: Secure Changes bookCollapseSection: false bookFlatSection: true --- \ No newline at end of file diff --git a/content/process/ssdlc/runtime/change_records.md b/content/process/ssdlc/change/change_records.md similarity index 100% rename from content/process/ssdlc/runtime/change_records.md rename to content/process/ssdlc/change/change_records.md diff --git a/content/process/ssdlc/runtime/deployment_controls.md b/content/process/ssdlc/change/deployment_controls.md similarity index 100% rename from content/process/ssdlc/runtime/deployment_controls.md rename to content/process/ssdlc/change/deployment_controls.md diff --git a/content/process/ssdlc/runtime/secrets_managment.md b/content/process/ssdlc/change/secrets_managment.md similarity index 100% rename from content/process/ssdlc/runtime/secrets_managment.md rename to content/process/ssdlc/change/secrets_managment.md diff --git a/content/process/ssdlc/runtime/system_access.md b/content/process/ssdlc/change/system_access.md similarity index 100% rename from content/process/ssdlc/runtime/system_access.md rename to content/process/ssdlc/change/system_access.md diff --git a/content/process/ssdlc/runtime/workload_monitoring.md b/content/process/ssdlc/change/workload_monitoring.md similarity index 100% rename from content/process/ssdlc/runtime/workload_monitoring.md rename to content/process/ssdlc/change/workload_monitoring.md diff --git a/content/process/ssdlc/process/_index.md b/content/process/ssdlc/process/_index.md index 2957cf3..0744b6a 100644 --- a/content/process/ssdlc/process/_index.md +++ b/content/process/ssdlc/process/_index.md @@ -1,6 +1,6 @@ --- weight: 20 -title: Secure Process +title: Secure Processes bookCollapseSection: false bookFlatSection: true --- From 0ecd8dac57ada15a8202c34a1bb4b3dab49369f3 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Tue, 24 Sep 2024 13:52:02 -0700 Subject: [PATCH 34/40] Add style for headers --- layouts/shortcodes/map.html | 8 +++++--- themes/hugo-book/assets/_custom.scss | 4 ++++ 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/layouts/shortcodes/map.html b/layouts/shortcodes/map.html index 2fc4683..4676472 100644 --- a/layouts/shortcodes/map.html +++ b/layouts/shortcodes/map.html @@ -7,9 +7,11 @@ {{ range $index, $weightedArea:= .Pages.ByWeight }} -

      - {{ .Page.LinkTitle }} -

      + +

      + {{ .Page.LinkTitle }} +

      +       {{ $term := .Page.Data.Term }} diff --git a/themes/hugo-book/assets/_custom.scss b/themes/hugo-book/assets/_custom.scss index 9af8640..eda9ff3 100644 --- a/themes/hugo-book/assets/_custom.scss +++ b/themes/hugo-book/assets/_custom.scss @@ -158,6 +158,10 @@ ul.hlist { } } +.area-header { + color: var(--body-font-color); +} + ul.control-list { padding-left: 0; } From 3e53fd61cb7dbceadf4cdd9a6ac58f7dc75f141f Mon Sep 17 00:00:00 2001 From: Mike Long Date: Tue, 24 Sep 2024 14:06:19 -0700 Subject: [PATCH 35/40] Make headings consistent and add new padlock --- content/areas/build/_index.md | 2 +- content/areas/change/_index.md | 2 +- content/areas/process/_index.md | 2 +- content/process/_index.md | 4 +++- static/images/padlock.svg | 12 ++++++------ 5 files changed, 12 insertions(+), 10 deletions(-) diff --git a/content/areas/build/_index.md b/content/areas/build/_index.md index 79ff0cc..cca1f5f 100644 --- a/content/areas/build/_index.md +++ b/content/areas/build/_index.md @@ -1,5 +1,5 @@ --- -title: Build +title: Secure Builds wikipedia: https://en.wikipedia.org/wiki/Bruce_Willis weight: 100 --- \ No newline at end of file diff --git a/content/areas/change/_index.md b/content/areas/change/_index.md index 63425da..fd90034 100644 --- a/content/areas/change/_index.md +++ b/content/areas/change/_index.md @@ -1,5 +1,5 @@ --- -title: Change +title: Secure Changes wikipedia: https://en.wikipedia.org/wiki/Bruce_Willis weight: 300 --- \ No newline at end of file diff --git a/content/areas/process/_index.md b/content/areas/process/_index.md index a65c32d..df8e615 100644 --- a/content/areas/process/_index.md +++ b/content/areas/process/_index.md @@ -1,5 +1,5 @@ --- -title: Process +title: Secure Processes wikipedia: https://en.wikipedia.org/wiki/Bruce_Willis weight: 200 --- \ No newline at end of file diff --git a/content/process/_index.md b/content/process/_index.md index 06fbdd4..3f59b76 100644 --- a/content/process/_index.md +++ b/content/process/_index.md @@ -19,4 +19,6 @@ The DevSecOps Framework provides: * A holistic view of managing insider threat * A clear roadmap for a security-based devops implementation -{{< /columns >}} \ No newline at end of file +{{< /columns >}} + +{{< areas >}} \ No newline at end of file diff --git a/static/images/padlock.svg b/static/images/padlock.svg index cafa739..5e763f0 100644 --- a/static/images/padlock.svg +++ b/static/images/padlock.svg @@ -1,18 +1,18 @@ - + - + - - - - + + + + From 9020d0287de45291f51a5d1a3eef93767f70e005 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Tue, 24 Sep 2024 14:09:35 -0700 Subject: [PATCH 36/40] Remove unnecessary directory layer --- content/process/{ssdlc => }/build/_index.md | 0 content/process/{ssdlc => }/build/binary_provenance.md | 0 content/process/{ssdlc => }/build/dependencies.md | 2 +- .../build/infrastructure_and_config_management.md | 0 content/process/{ssdlc => }/build/toolchain.md | 0 content/process/{ssdlc => }/build/versioncontrol.md | 2 +- content/process/{ssdlc => }/change/_index.md | 0 content/process/{ssdlc => }/change/change_records.md | 0 content/process/{ssdlc => }/change/deployment_controls.md | 0 content/process/{ssdlc => }/change/secrets_managment.md | 0 content/process/{ssdlc => }/change/system_access.md | 0 content/process/{ssdlc => }/change/workload_monitoring.md | 0 content/process/{ssdlc => }/process/_index.md | 0 content/process/{ssdlc => }/process/code_review.md | 0 .../process/{ssdlc => }/process/deployment_approvals.md | 0 content/process/{ssdlc => }/process/quality.md | 0 content/process/{ssdlc => }/process/security.md | 0 content/process/{ssdlc => }/process/service_ownership.md | 0 content/process/risk_register.md | 2 +- content/process/ssdlc/_index.md | 8 -------- 20 files changed, 3 insertions(+), 11 deletions(-) rename content/process/{ssdlc => }/build/_index.md (100%) rename content/process/{ssdlc => }/build/binary_provenance.md (100%) rename content/process/{ssdlc => }/build/dependencies.md (95%) rename content/process/{ssdlc => }/build/infrastructure_and_config_management.md (100%) rename content/process/{ssdlc => }/build/toolchain.md (100%) rename content/process/{ssdlc => }/build/versioncontrol.md (97%) rename content/process/{ssdlc => }/change/_index.md (100%) rename content/process/{ssdlc => }/change/change_records.md (100%) rename content/process/{ssdlc => }/change/deployment_controls.md (100%) rename content/process/{ssdlc => }/change/secrets_managment.md (100%) rename content/process/{ssdlc => }/change/system_access.md (100%) rename content/process/{ssdlc => }/change/workload_monitoring.md (100%) rename content/process/{ssdlc => }/process/_index.md (100%) rename content/process/{ssdlc => }/process/code_review.md (100%) rename content/process/{ssdlc => }/process/deployment_approvals.md (100%) rename content/process/{ssdlc => }/process/quality.md (100%) rename content/process/{ssdlc => }/process/security.md (100%) rename content/process/{ssdlc => }/process/service_ownership.md (100%) delete mode 100644 content/process/ssdlc/_index.md diff --git a/content/process/ssdlc/build/_index.md b/content/process/build/_index.md similarity index 100% rename from content/process/ssdlc/build/_index.md rename to content/process/build/_index.md diff --git a/content/process/ssdlc/build/binary_provenance.md b/content/process/build/binary_provenance.md similarity index 100% rename from content/process/ssdlc/build/binary_provenance.md rename to content/process/build/binary_provenance.md diff --git a/content/process/ssdlc/build/dependencies.md b/content/process/build/dependencies.md similarity index 95% rename from content/process/ssdlc/build/dependencies.md rename to content/process/build/dependencies.md index c3431b1..b5d5972 100644 --- a/content/process/ssdlc/build/dependencies.md +++ b/content/process/build/dependencies.md @@ -27,7 +27,7 @@ source code. During build, these inputs to the build package can be recorded as the software bill-of-materials while recording -[binary provenance]({{< relref "/process/ssdlc/build/binary_provenance" >}}) +[binary provenance]({{< relref "/process/build/binary_provenance" >}}) ## How we implement this control diff --git a/content/process/ssdlc/build/infrastructure_and_config_management.md b/content/process/build/infrastructure_and_config_management.md similarity index 100% rename from content/process/ssdlc/build/infrastructure_and_config_management.md rename to content/process/build/infrastructure_and_config_management.md diff --git a/content/process/ssdlc/build/toolchain.md b/content/process/build/toolchain.md similarity index 100% rename from content/process/ssdlc/build/toolchain.md rename to content/process/build/toolchain.md diff --git a/content/process/ssdlc/build/versioncontrol.md b/content/process/build/versioncontrol.md similarity index 97% rename from content/process/ssdlc/build/versioncontrol.md rename to content/process/build/versioncontrol.md index 4a23f4a..6d1f11c 100644 --- a/content/process/ssdlc/build/versioncontrol.md +++ b/content/process/build/versioncontrol.md @@ -34,7 +34,7 @@ This branching strategy uses a combination of feature branches with pull request * Main branch is protected * Pull requests must be approved before merge to the main branch. -* We use pull requests to enforce and document our code review process. You can read more about it here: [Code Review Process]({{< relref "/process/ssdlc/process/code_review" >}}) +* We use pull requests to enforce and document our code review process. You can read more about it here: [Code Review Process]({{< relref "/process/process/code_review" >}}) * Pull request merges should create merge or squash commits. (no fast-forward) diff --git a/content/process/ssdlc/change/_index.md b/content/process/change/_index.md similarity index 100% rename from content/process/ssdlc/change/_index.md rename to content/process/change/_index.md diff --git a/content/process/ssdlc/change/change_records.md b/content/process/change/change_records.md similarity index 100% rename from content/process/ssdlc/change/change_records.md rename to content/process/change/change_records.md diff --git a/content/process/ssdlc/change/deployment_controls.md b/content/process/change/deployment_controls.md similarity index 100% rename from content/process/ssdlc/change/deployment_controls.md rename to content/process/change/deployment_controls.md diff --git a/content/process/ssdlc/change/secrets_managment.md b/content/process/change/secrets_managment.md similarity index 100% rename from content/process/ssdlc/change/secrets_managment.md rename to content/process/change/secrets_managment.md diff --git a/content/process/ssdlc/change/system_access.md b/content/process/change/system_access.md similarity index 100% rename from content/process/ssdlc/change/system_access.md rename to content/process/change/system_access.md diff --git a/content/process/ssdlc/change/workload_monitoring.md b/content/process/change/workload_monitoring.md similarity index 100% rename from content/process/ssdlc/change/workload_monitoring.md rename to content/process/change/workload_monitoring.md diff --git a/content/process/ssdlc/process/_index.md b/content/process/process/_index.md similarity index 100% rename from content/process/ssdlc/process/_index.md rename to content/process/process/_index.md diff --git a/content/process/ssdlc/process/code_review.md b/content/process/process/code_review.md similarity index 100% rename from content/process/ssdlc/process/code_review.md rename to content/process/process/code_review.md diff --git a/content/process/ssdlc/process/deployment_approvals.md b/content/process/process/deployment_approvals.md similarity index 100% rename from content/process/ssdlc/process/deployment_approvals.md rename to content/process/process/deployment_approvals.md diff --git a/content/process/ssdlc/process/quality.md b/content/process/process/quality.md similarity index 100% rename from content/process/ssdlc/process/quality.md rename to content/process/process/quality.md diff --git a/content/process/ssdlc/process/security.md b/content/process/process/security.md similarity index 100% rename from content/process/ssdlc/process/security.md rename to content/process/process/security.md diff --git a/content/process/ssdlc/process/service_ownership.md b/content/process/process/service_ownership.md similarity index 100% rename from content/process/ssdlc/process/service_ownership.md rename to content/process/process/service_ownership.md diff --git a/content/process/risk_register.md b/content/process/risk_register.md index 7aca5bb..7e18901 100644 --- a/content/process/risk_register.md +++ b/content/process/risk_register.md @@ -1,5 +1,5 @@ --- -weight: 20 +weight: 200 bookFlatSection: false title: "Risk Register" --- diff --git a/content/process/ssdlc/_index.md b/content/process/ssdlc/_index.md deleted file mode 100644 index 3cfe485..0000000 --- a/content/process/ssdlc/_index.md +++ /dev/null @@ -1,8 +0,0 @@ ---- -weight: 20 -bookFlatSection: false -bookCollapseSection: true -title: "Requirements" ---- - -{{< areas >}} \ No newline at end of file From 1dd849573713ea48067de3ff61e8bd6ddb42f7f5 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Tue, 24 Sep 2024 14:24:12 -0700 Subject: [PATCH 37/40] Update padlock and change map color to yellow --- static/images/padlock.svg | 10 +++++----- themes/hugo-book/assets/_custom.scss | 20 ++++++++++---------- 2 files changed, 15 insertions(+), 15 deletions(-) diff --git a/static/images/padlock.svg b/static/images/padlock.svg index 5e763f0..fa01adc 100644 --- a/static/images/padlock.svg +++ b/static/images/padlock.svg @@ -1,18 +1,18 @@ - + - + - - + + - + diff --git a/themes/hugo-book/assets/_custom.scss b/themes/hugo-book/assets/_custom.scss index eda9ff3..1cd8db5 100644 --- a/themes/hugo-book/assets/_custom.scss +++ b/themes/hugo-book/assets/_custom.scss @@ -253,28 +253,28 @@ h2.area-header{ .control-card.area-change.card-index-0 { - background-color: var(--red-300); - border-color: var(--red-400); + background-color: var(--yellow-300); + border-color: var(--yellow-400); } .control-card.area-change.card-index-1 { - background-color: var(--red-200); - border-color: var(--red-300); + background-color: var(--yellow-200); + border-color: var(--yellow-300); } .control-card.area-change.card-index-2 { - background-color: var(--red-100); - border-color: var(--red-200); + background-color: var(--yellow-100); + border-color: var(--yellow-200); } .control-card.area-change.card-index-3 { - background-color: var(--red-100); - border-color: var(--red-100); + background-color: var(--yellow-100); + border-color: var(--yellow-100); } .control-card.area-change.card-index-4 { - background-color: var(--red-050); - border-color: var(--red-100); + background-color: var(--yellow-050); + border-color: var(--yellow-100); } From 2b5a5d0926f400dba4c91a1c6166ac019746af2e Mon Sep 17 00:00:00 2001 From: Mike Long Date: Tue, 24 Sep 2024 14:27:32 -0700 Subject: [PATCH 38/40] Change cta to view the repo on github --- config.toml | 2 +- themes/hugo-book/layouts/_default/baseof.html | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/config.toml b/config.toml index e5bfb46..b6ec83b 100644 --- a/config.toml +++ b/config.toml @@ -13,7 +13,7 @@ theme = "hugo-book" vcs = 'git' gitProvider = 'github' vcsHost = 'github' - forkLink = 'https://github.com/kosli-dev/devopsctl/fork' + repoLink = 'https://github.com/kosli-dev/kosli-sdlc' logo = 'svg/logo.svg' BookSection = '/' diff --git a/themes/hugo-book/layouts/_default/baseof.html b/themes/hugo-book/layouts/_default/baseof.html index cb52771..e46e375 100644 --- a/themes/hugo-book/layouts/_default/baseof.html +++ b/themes/hugo-book/layouts/_default/baseof.html @@ -16,8 +16,8 @@
From 888b07292ff55e3900f8367292769d21c6471a00 Mon Sep 17 00:00:00 2001 From: Mike Long Date: Tue, 24 Sep 2024 14:38:06 -0700 Subject: [PATCH 39/40] Remove unnecessary links --- content/process/_index.md | 1 - layouts/shortcodes/map.html | 9 ++++----- 2 files changed, 4 insertions(+), 6 deletions(-) diff --git a/content/process/_index.md b/content/process/_index.md index 3f59b76..edab97a 100644 --- a/content/process/_index.md +++ b/content/process/_index.md @@ -21,4 +21,3 @@ The DevSecOps Framework provides: {{< /columns >}} -{{< areas >}} \ No newline at end of file diff --git a/layouts/shortcodes/map.html b/layouts/shortcodes/map.html index 4676472..0a5d063 100644 --- a/layouts/shortcodes/map.html +++ b/layouts/shortcodes/map.html @@ -7,11 +7,10 @@ {{ range $index, $weightedArea:= .Pages.ByWeight }} - -

- {{ .Page.LinkTitle }} -

- +

+ {{ .Page.LinkTitle }} +

+ {{ $term := .Page.Data.Term }} From afa221e6e17d91af90f2488396353ccf52ef1b44 Mon Sep 17 00:00:00 2001 From: Simon Castagna Date: Wed, 25 Sep 2024 16:10:36 +0200 Subject: [PATCH 40/40] Small refactor to control-card css and markup --- layouts/shortcodes/map.html | 6 ++---- themes/hugo-book/assets/_custom.scss | 21 ++++++++++++--------- 2 files changed, 14 insertions(+), 13 deletions(-) diff --git a/layouts/shortcodes/map.html b/layouts/shortcodes/map.html index 0a5d063..b66cdca 100644 --- a/layouts/shortcodes/map.html +++ b/layouts/shortcodes/map.html @@ -21,10 +21,8 @@

{{ if eq $area $term }}
{{ range $index, $card := $cards }} - -
- {{ .LinkTitle }} -
+ + {{ .LinkTitle }} {{ end }}
diff --git a/themes/hugo-book/assets/_custom.scss b/themes/hugo-book/assets/_custom.scss index 1cd8db5..f13e988 100644 --- a/themes/hugo-book/assets/_custom.scss +++ b/themes/hugo-book/assets/_custom.scss @@ -172,20 +172,29 @@ ul.control-list { margin:0px; } -.control-card { +.markdown .control-card { + display: block; width: 110px; height: 110px; border: 1px solid black; padding: 10px; - margin: 10px; font-size: 12px; color: var(--neutral-100); font-weight: 600; -} + &:hover { + opacity: 0.7; + text-decoration: none; + } + &:visited { + color: var(--neutral-100); + } +} .card-row { display: flex; flex-wrap: wrap; + gap: 10px; + padding-top: 10px; } h2.area-header{ @@ -193,12 +202,6 @@ h2.area-header{ margin-top: 1em; } - - -.control-card.card-index-0 { - margin-left: 0px; -} - .control-card.area-build.card-index-0 { background-color: var(--green-300);