From 8fae39576af450bb2425b01f9eeacc8b61cc8a90 Mon Sep 17 00:00:00 2001 From: gearnode Date: Wed, 15 Jan 2025 13:15:58 +0100 Subject: [PATCH] Add control index links Signed-off-by: gearnode --- controls/core/data/README.md | 7 +++++++ controls/core/infra/README.md | 9 +++++++++ ...tration_test.md => COR.NET.003_penetration_test.md} | 0 controls/core/network/README.md | 6 ++++++ controls/core/src/README.md | 7 +++++++ controls/operations/incidents/README.md | 5 +++++ controls/operations/monitoring/README.md | 6 ++++++ controls/personnel/access/README.md | 8 ++++++++ controls/personnel/comms/README.md | 7 +++++++ controls/personnel/lifecycle/README.md | 10 ++++++++++ controls/physical/facilities/README.md | 7 +++++++ controls/physical/hardware/README.md | 6 ++++++ 12 files changed, 78 insertions(+) rename controls/core/network/{COR.NET.002_penetration_test.md => COR.NET.003_penetration_test.md} (100%) diff --git a/controls/core/data/README.md b/controls/core/data/README.md index 0f498da4c..f2bf20c0d 100644 --- a/controls/core/data/README.md +++ b/controls/core/data/README.md @@ -12,3 +12,10 @@ client information. Implement measures to protect data from unauthorized access and set up processes to regularly secure and monitor its location. + +## Mitigations + +- [Automated backup](COR.DAT.001_automated_backup.md) +- [Help the auditor with a data-flow diagram](COR.DAT.002_data_flow_diagram.md) +- [Encrypt your data storage](COR.DAT.003_data_at_rest.md) +- [Encrypt your data in transit](COR.DAT.004_tls.md) diff --git a/controls/core/infra/README.md b/controls/core/infra/README.md index 12791460b..e299489ad 100644 --- a/controls/core/infra/README.md +++ b/controls/core/infra/README.md @@ -14,3 +14,12 @@ To secure your infrastructure, you will need to: 2. Regulate access 3. Log changes 4. Fix known vulnerabilities + +## Mitigations + +- [List of your assets](COR.INF.001_list_your_assets.md) +- [Scan for security updates](COR.INF.002_scan_security_updates.md) +- [IAM for database authentication](COR.INF.003_iam_authentication_for_database.md) +- [Plug GCP & Github](COR.INF.004_short_live_auth_ci.md) +- [Manage your service accounts](COR.INF.005_manage_service_account.md) +- [Keep an history of all your changes](COR.INF.006_keep_an_history_of_all_your_changes.md) diff --git a/controls/core/network/COR.NET.002_penetration_test.md b/controls/core/network/COR.NET.003_penetration_test.md similarity index 100% rename from controls/core/network/COR.NET.002_penetration_test.md rename to controls/core/network/COR.NET.003_penetration_test.md diff --git a/controls/core/network/README.md b/controls/core/network/README.md index 65776a50a..a0c4ea15c 100644 --- a/controls/core/network/README.md +++ b/controls/core/network/README.md @@ -15,3 +15,9 @@ Strengthening network security in a targeted, efficient way is essential. By restricting access to infrastructure, implementing protective layers like Cloudflare, and conducting regular security assessments, you can effectively safeguard your systems against unauthorized access and potential attacks. + +## Mitigations + +- [Restrict public access on your infrastructure](COR.NET.001_restrict_public_access_on_your_infrastructure.md) +- [Set-up a WAF](COR.NET.002_web_application_firewall.md) +- [Run a penetration test](COR.NET.003_penetration_test.md) diff --git a/controls/core/src/README.md b/controls/core/src/README.md index ef7483936..ed345dade 100644 --- a/controls/core/src/README.md +++ b/controls/core/src/README.md @@ -16,3 +16,10 @@ helps you scale your engineering team. - **Implement structured processes:** Define a development lifecycle for software, adopt Infrastructure-as-Code (IaC), and deploy configuration management systems to maintain consistency and security. + +## Mitigations + +- [Code Review](COR.SRC.001.patch_review.md) +- [Configure Code Scanning](COR.SRC.002.enable_code_scanning.md) +- [Configure Dependancy Vulnerability Alerts](COR.SRC.003.dependancy_vulnerability_alerts.md) +- [Document your Development Lifecycle](COR.SRC.004.systems_development_life_cycle.md) diff --git a/controls/operations/incidents/README.md b/controls/operations/incidents/README.md index 272aa84d9..19ead6b5b 100644 --- a/controls/operations/incidents/README.md +++ b/controls/operations/incidents/README.md @@ -9,3 +9,8 @@ impacts. ## How can I proceed? Create a procedure to restore services and test it + +## Mitigations + +- [Build an incident response process](OPS.INC.001_incident_response_process.md) +- [Disaster Recovery Plan](OPS.INC.002_drp.md) diff --git a/controls/operations/monitoring/README.md b/controls/operations/monitoring/README.md index af45eb1c9..13a285a96 100644 --- a/controls/operations/monitoring/README.md +++ b/controls/operations/monitoring/README.md @@ -12,3 +12,9 @@ access in real-time. ## How can I proceed? Log critical event and implement alerts to be notified if everything goes wrong. + +## Mitigations + +- [Configure logs and implement real-time monitoring](OPS.MON.001_log_and_implement_real_time_monitoring.md) +- [Keep your logs](OPS.MON.002_keep_your_logs.md) +- [Be automatically notified of issues](OPS.MON.003_automatically_notified_of_issues.md) diff --git a/controls/personnel/access/README.md b/controls/personnel/access/README.md index c0e12e562..e047446eb 100644 --- a/controls/personnel/access/README.md +++ b/controls/personnel/access/README.md @@ -19,3 +19,11 @@ The main idea is to follow those principles: passwords/access 3. **Continuous update:** making sure the privileges are up to date and you use the latest best practices + +## Mitigations + +- [Enable MFA on critical services](PER.ACC.001_mfa_on_critical_services.md) +- [Access Request Process](PER.ACC.002_access_request_process.md) +- [Setup a password manager](PER.ACC.003_password_manager.md) +- [Setup Role Based Access Control](PER.ACC.004_role_based_access_control.md) +- [Enforce SSO when possible](PER.ACC.005_enforce_single_sign_on.md) diff --git a/controls/personnel/comms/README.md b/controls/personnel/comms/README.md index 1d5d4f4f9..354512621 100644 --- a/controls/personnel/comms/README.md +++ b/controls/personnel/comms/README.md @@ -15,3 +15,10 @@ To do so, we divided the work in two steps: - You secure the access to your offices. - You secure the internet connexion of remote employees + +## Mitigations + +- [Configure SPF for Email Authentication](PER.COM.001.sender_policy_framework.md) +- [Configure DKIM for Email Authentication](PER.COM.002.dkim_implementation.md) +- [Configure DMARC for Email Authentication](PER.COM.003.domain_based_message_authentication.md) +- [Configure Email Security Filters](PER.COM.004.email_filtering_and_warning_system.md) diff --git a/controls/personnel/lifecycle/README.md b/controls/personnel/lifecycle/README.md index 2fd798432..d576a2b63 100644 --- a/controls/personnel/lifecycle/README.md +++ b/controls/personnel/lifecycle/README.md @@ -15,3 +15,13 @@ You will focus on two things: prepared and you are sure not to forgot anything. - **Enabling**: empower your employees to take the best decision possible to maintain your security posture + +## Mitigations + +- [Integrate security checklist in your onboarding process](PER.LIF.001_onboarding.md) +- [Properly off-board your employees](PER.LIF.002_offboarding.md) +- [Know your recruits](PER.LIF.003_pre-employment-screening-process.md) +- [Implement confidential whistleblower process](PER.LIF.004_confidential_whistleblower_process.md) +- [Run performance reviews](PER.LIF.005_performance_reviews.md) +- [Specify security responsabilities](PER.LIF.006_security_roles_and_responsibilities.md) +- [Train your employees on security](PER.LIF.007_security_awareness_training.md) diff --git a/controls/physical/facilities/README.md b/controls/physical/facilities/README.md index 8808a3629..75fdbeca4 100644 --- a/controls/physical/facilities/README.md +++ b/controls/physical/facilities/README.md @@ -17,3 +17,10 @@ We break this into two main areas of focus: unauthorized entry. 2. **Internet Security:** Ensure that members of your teams or contractors that work remotely have a secure access to internet. + +## Mitigations + +- [Cloud datacenter physical security](PHY.FAC.001_cloud_datacenter_physical_security.md) +- [Implement Physical Access Control](PHY.FAC.002_physical_access_control.md) +- [Implement Visitor Access Policies](PHY.FAC.003_visitor_access_policy.md) +- [Use VPNs to Secure Access for Remote Devices](PHY.FAC.004_virtual_private_network.md) diff --git a/controls/physical/hardware/README.md b/controls/physical/hardware/README.md index ec5963d01..fde51eb6a 100644 --- a/controls/physical/hardware/README.md +++ b/controls/physical/hardware/README.md @@ -17,3 +17,9 @@ machine, you need: - Firewall is active - Anti-malware detection is active - Data is encrypted + +## Mitigations + +- [Configure Anti-malware Protection on Employee Devices](PHY.HW.001_endpoint_antimalware.md) +- [Configure Automatic Screen Lock on Employee Devices](PHY.HW.002_device_screen_lock.md) +- [Configure Disk Encryption and Firewall on Employee Devices](PHY.HW.003_device_encryption.md)