Skip to content

Commit fcc7d01

Browse files
eddie-knightTheFoxAtWorkpuercoSecurityCRob
authored
Revising Vuln Management controls based on feedback (#205)
* Updated SCA and SAST checks Signed-off-by: Eddie Knight <knight@linux.com> * improved SCA requirement text Signed-off-by: Eddie Knight <knight@linux.com> * Adjusted to have a separate requirement for VEX Signed-off-by: Eddie Knight <knight@linux.com> * Update baseline/OSPS-VM.yaml Co-authored-by: Emily Fox <33327273+TheFoxAtWork@users.noreply.github.com> Signed-off-by: Eddie Knight <knight@linux.com> * Update baseline/OSPS-VM.yaml Co-authored-by: Puerco <puerco@users.noreply.github.com> Signed-off-by: Eddie Knight <knight@linux.com> * Update baseline/OSPS-VM.yaml Co-authored-by: Puerco <puerco@users.noreply.github.com> Signed-off-by: Eddie Knight <knight@linux.com> --------- Signed-off-by: Eddie Knight <knight@linux.com> Co-authored-by: Emily Fox <33327273+TheFoxAtWork@users.noreply.github.com> Co-authored-by: Puerco <puerco@users.noreply.github.com> Co-authored-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
1 parent 9790980 commit fcc7d01

File tree

1 file changed

+148
-140
lines changed

1 file changed

+148
-140
lines changed

‎baseline/OSPS-VM.yaml‎

Lines changed: 148 additions & 140 deletions
Original file line numberDiff line numberDiff line change
@@ -8,139 +8,6 @@ description: |
88
security threats and vulnerabilities in the software.
99
controls:
1010
- id: OSPS-VM-01
11-
title: |
12-
Define a threshold for remediation of SCA findings related to
13-
vulnerabilities and licenses
14-
objective: |
15-
Ensure that the project clearly communicates the threshold for remediation of
16-
SCA findings, including vulnerabilities and license issues in software
17-
dependencies.
18-
family: Vulnerability Management
19-
mappings:
20-
- reference-id: BPB
21-
identifiers:
22-
- Q-B-12
23-
- Q-S-9
24-
- S-B-14
25-
- S-B-15
26-
- A-B-3
27-
- A-B-8
28-
- reference-id: CRA
29-
identifiers:
30-
- 1.2a
31-
- 1.2b
32-
- 1.2c
33-
- 2.1
34-
- 2.2
35-
- 2.3
36-
- reference-id: SSDF
37-
identifiers:
38-
- PO.4
39-
- PW1.2
40-
- PW8.1
41-
- RV2.1
42-
- RV 2.2
43-
- reference-id: CSF
44-
identifiers:
45-
- GV.RM-05
46-
- GV.RM-06
47-
- GV.PO-01
48-
- GV.PO-02
49-
- ID.RA-01
50-
- ID.RA-08
51-
- ID.IM-02
52-
- reference-id: OC
53-
identifiers:
54-
- 4.1.5
55-
- 4.2.1
56-
- 4.3.2
57-
- reference-id: OCRE
58-
identifiers:
59-
- 124-564
60-
- 832-555
61-
- 611-158
62-
- 207-435
63-
- 088-377
64-
assessment-requirements:
65-
- id: OSPS-VM-01.01
66-
text: |
67-
The project documentation MUST include a policy that defines a threshold
68-
for remediation of SCA findings related to vulnerabilities and licenses.
69-
applicability:
70-
- Maturity Level 3
71-
recommendation: |
72-
Document a policy in the project that defines a threshold for
73-
remediation of SCA findings related to vulnerabilities and licenses.
74-
Include the process for identifying, prioritizing, and remediating
75-
these findings.
76-
77-
- id: OSPS-VM-02
78-
title: |
79-
Address SCA violations prior to merge and release
80-
objective: |
81-
Ensure that violations of your SCA policy are addressed before software
82-
is merged as well as before it releases, reducing the risk of compromised
83-
delivery mechanisms or released software assets that are vulnerable or
84-
malicious.
85-
family: Vulnerability Management
86-
mappings:
87-
- reference-id: BPB
88-
identifiers:
89-
- S-B-14
90-
- S-B-15
91-
- A-B-3
92-
- A-B-8
93-
- reference-id: CRA
94-
identifiers:
95-
- 1.2a
96-
- 1.2c
97-
- 2.2
98-
- 2.3
99-
- reference-id: SSDF
100-
identifiers:
101-
- PW8.1
102-
- reference-id: CSF
103-
identifiers:
104-
- GV.PO-01
105-
- GV.PO-02
106-
- ID.RA-01
107-
- ID.RA-08
108-
- reference-id: OC
109-
identifiers:
110-
- 4.1.5
111-
- reference-id: OCRE
112-
identifiers:
113-
- 486-813
114-
- 833-442
115-
- 611-158
116-
- 207-435
117-
- 088-377
118-
assessment-requirements:
119-
- id: OSPS-VM-02.01
120-
text: |
121-
The project documentation MUST include a policy to address SCA
122-
violations prior to any release.
123-
applicability:
124-
- Maturity Level 3
125-
recommendation: |
126-
Document a policy in the project to address applicable Software
127-
Composition Analysis results before any release, and add status checks
128-
that verify compliance with that policy prior to release.
129-
- id: OSPS-VM-02.02
130-
text: |
131-
All proposed changes to the project's codebase must be automatically
132-
evaluated against a documented policy for known vulnerabilities and
133-
blocked in the event of violations except when declared and suppressed
134-
as non-exploitable.
135-
applicability:
136-
- Maturity Level 3
137-
recommendation: |
138-
Create a status check in the project's version control system that
139-
runs a Static Application Security Testing (SAST) tool on all changes
140-
to the codebase. Require that the status check passes before changes
141-
can be merged.
142-
143-
- id: OSPS-VM-03
14411
title: |
14512
Define a policy for coordinated vulnerability reporting
14613
objective: |
@@ -181,7 +48,7 @@ controls:
18148
identifiers:
18249
- 887-750
18350
assessment-requirements:
184-
- id: OSPS-VM-03.01
51+
- id: OSPS-VM-01.01
18552
text: |
18653
The project documentation MUST include a policy for coordinated
18754
vulnerability reporting, with a clear timeframe for response.
@@ -194,7 +61,7 @@ controls:
19461
method for reporting vulnerabilities. Set expectations for the how the
19562
project will respond and address reported issues.
19663
197-
- id: OSPS-VM-04
64+
- id: OSPS-VM-02
19865
title: |
19966
Publish contacts and process for reporting vulnerabilities
20067
objective: |
@@ -228,7 +95,7 @@ controls:
22895
identifiers:
22996
- 464-513
23097
assessment-requirements:
231-
- id: OSPS-VM-04.01
98+
- id: OSPS-VM-02.01
23299
text: |
233100
The project MUST publish contacts and process for reporting vulnerabilities.
234101
applicability:
@@ -238,7 +105,7 @@ controls:
238105
contacts for the project and provide project's process for handling
239106
vulnerabilities in the project or dependencies.
240107
241-
- id: OSPS-VM-05
108+
- id: OSPS-VM-03
242109
title: |
243110
Provide a means for reporting security vulnerabilities privately
244111
objective: |
@@ -258,7 +125,7 @@ controls:
258125
identifiers:
259126
- 308-514
260127
assessment-requirements:
261-
- id: OSPS-VM-05.01
128+
- id: OSPS-VM-03.01
262129
text: |
263130
The project MUST provide a means for reporting security
264131
vulnerabilities privately to the security contacts within the project.
@@ -268,7 +135,7 @@ controls:
268135
recommendation: |
269136
Enable private bug reporting through VCS or other infrastructure.
270137
271-
- id: OSPS-VM-06
138+
- id: OSPS-VM-04
272139
title: |
273140
Publicly publish data about any vulnerabilities discovered
274141
objective: |
@@ -284,7 +151,7 @@ controls:
284151
- 2.4
285152
- 2.6
286153
assessment-requirements:
287-
- id: OSPS-VM-06.01
154+
- id: OSPS-VM-04.01
288155
text: |
289156
The project MUST publicly publish data about discovered
290157
vulnerabilities.
@@ -297,3 +164,144 @@ controls:
297164
To the degree possible, this information should include affected
298165
version(s), how a consumer can determine if they are vulnerable, and
299166
instructions for mitigation or remediation.
167+
- id: OSPS-VM-04.02
168+
text: |
169+
Any vulnerabilities in the software components not affecting the
170+
project MUST be accounted for in a VEX document, augmenting
171+
the vulnerability report with non-exploitability details.
172+
applicability:
173+
- Maturity Level 3
174+
recommendation: |
175+
Establish a VEX feed communicating the exploitability status of
176+
known vulnerabilities, including assessment details or any
177+
mitigations in place preventing vulnerable code from being
178+
executed.
179+
180+
- id: OSPS-VM-05
181+
title: |
182+
Define and enforce a threshold for remediation of SCA findings
183+
objective: |
184+
Ensure that the project clearly communicates the threshold for remediation
185+
of SCA findings, including vulnerabilities and license issues in software
186+
dependencies.
187+
Ensure that violations of your SCA policy are addressed before software
188+
is merged as well as before it releases, reducing the risk of compromised
189+
delivery mechanisms or released software assets that are vulnerable or
190+
malicious.
191+
family: Vulnerability Management
192+
mappings:
193+
- reference-id: BPB
194+
identifiers:
195+
- Q-B-12
196+
- Q-S-9
197+
- S-B-14
198+
- S-B-15
199+
- A-B-3
200+
- A-B-8
201+
- reference-id: CRA
202+
identifiers:
203+
- 1.2a
204+
- 1.2b
205+
- 1.2c
206+
- 2.1
207+
- 2.2
208+
- 2.3
209+
- reference-id: SSDF
210+
identifiers:
211+
- PO.4
212+
- PW1.2
213+
- PW8.1
214+
- RV2.1
215+
- RV 2.2
216+
- reference-id: CSF
217+
identifiers:
218+
- GV.RM-05
219+
- GV.RM-06
220+
- GV.PO-01
221+
- GV.PO-02
222+
- ID.RA-01
223+
- ID.RA-08
224+
- ID.IM-02
225+
- reference-id: OC
226+
identifiers:
227+
- 4.1.5
228+
- 4.2.1
229+
- 4.3.2
230+
- reference-id: OCRE
231+
identifiers:
232+
- 124-564
233+
- 832-555
234+
- 611-158
235+
- 207-435
236+
- 088-377
237+
assessment-requirements:
238+
- id: OSPS-VM-05.01
239+
text: |
240+
The project documentation MUST include a policy that defines a
241+
threshold for remediation of SCA findings related to vulnerabilities
242+
and licenses.
243+
applicability:
244+
- Maturity Level 3
245+
recommendation: |
246+
Document a policy in the project that defines a threshold for
247+
remediation of SCA findings related to vulnerabilities and licenses.
248+
Include the process for identifying, prioritizing, and remediating
249+
these findings.
250+
- id: OSPS-VM-05.02
251+
text: |
252+
The project documentation MUST include a policy to address SCA
253+
violations prior to any release.
254+
applicability:
255+
- Maturity Level 3
256+
recommendation: |
257+
Document a policy in the project to address applicable Software
258+
Composition Analysis results before any release, and add status checks
259+
that verify compliance with that policy prior to release.
260+
- id: OSPS-VM-05.03
261+
text: |
262+
All changes to the project's codebase MUST be automatically evaluated
263+
against a documented policy for malicious dependencies and
264+
known vulnerabilities in dependencies and blocked in the event of
265+
violations except when declared and suppressed as non-exploitable.
266+
applicability:
267+
- Maturity Level 3
268+
recommendation: |
269+
Create a status check in the project's version control system that
270+
runs a Software Composition Analysis tool on all changes
271+
to the codebase. Require that the status check passes before changes
272+
can be merged.
273+
274+
- id: OSPS-VM-06
275+
title: |
276+
Define and enforce a threshold for remediation of SAST findings
277+
objective: |
278+
Identify and address defects and security weaknesses in the project's
279+
codebase early in the development process, reducing the risk of shipping
280+
insecure software.
281+
family: Vulnerability Management
282+
mappings: []
283+
assessment-requirements:
284+
- id: OSPS-VM-06.01
285+
text: |
286+
The project documentation MUST include a policy that defines a
287+
threshold for remediation of SAST findings.
288+
applicability:
289+
- Maturity Level 3
290+
recommendation: |
291+
Document a policy in the project that defines a threshold for
292+
remediation of Static Application Security Testing (SAST) findings.
293+
Include the process for identifying, prioritizing, and remediating
294+
these findings.
295+
- id: OSPS-VM-06.02
296+
text: |
297+
All changes to the project's codebase MUST be automatically evaluated
298+
against a documented policy for security weaknesses and blocked in the
299+
event of violations except when declared and suppressed as
300+
non-exploitable.
301+
applicability:
302+
- Maturity Level 3
303+
recommendation: |
304+
Create a status check in the project's version control system that
305+
runs a Static Application Security Testing (SAST) tool on all changes
306+
to the codebase. Require that the status check passes before changes
307+
can be merged.

0 commit comments

Comments
 (0)