From 99d32ca49d9f2629d4fd2535f033716c85995508 Mon Sep 17 00:00:00 2001 From: gearnode Date: Wed, 8 Jan 2025 11:13:58 +0100 Subject: [PATCH] Style Signed-off-by: Bryan Frimin --- controls/code/COD.001.patch_review.md | 19 ++++++++------- controls/code/COD.002.enable_code_scanning.md | 14 +++++------ ...COD.003.dependancy_vulnerability_alerts.md | 21 +++++++++-------- .../COD.004.systems_development_life_cycle.md | 15 ++++++------ .../PLT.EMAIL.001.sender_policy_framework.md | 17 +++++++------- .../PLT.EMAIL.002.dkim_implementation.md | 16 +++++++------ ...003.domain_based_message_authentication.md | 13 +++++++---- ....004.email_filtering_and_warning_system.md | 23 +++++++++---------- 8 files changed, 70 insertions(+), 68 deletions(-) diff --git a/controls/code/COD.001.patch_review.md b/controls/code/COD.001.patch_review.md index 2525fb64f..84c5129bb 100644 --- a/controls/code/COD.001.patch_review.md +++ b/controls/code/COD.001.patch_review.md @@ -5,17 +5,17 @@ revision-version: 1 revision-date: "2024-01-07" estimate-time: "15m" frameworks: - - name: "soc2" - sections: ["CC1.4", "CC5.2", "CC8.1"] + - name: "soc2" + sections: ["CC1.4", "CC5.2", "CC8.1"] --- ## Purpose -Requiring pull requests and code reviews ensures higher code quality -and security by allowing multiple team members to catch bugs, -inefficiencies, and potential vulnerabilities before code is -merged. It also promotes collaboration, knowledge sharing, and -accountability within the team. This process helps prevent issues in -production and maintains adherence to coding standards. + +Requiring pull requests and code reviews ensures higher code quality and +security by allowing multiple team members to catch bugs, inefficiencies, and +potential vulnerabilities before code is merged. It also promotes collaboration, +knowledge sharing, and accountability within the team. This process helps +prevent issues in production and maintains adherence to coding standards. ## Implementation @@ -23,8 +23,7 @@ production and maintains adherence to coding standards. 1. Open your GitHub repository and go to settings. 2. In "Branche"s, click "Add Rule". -3. Enter the branch name (e.g. "main") in the branch name pattern - field. +3. Enter the branch name (e.g. "main") in the branch name pattern field. 4. Enable: "Require a pull request before merging" 5. Click Create or Save to apply the rule diff --git a/controls/code/COD.002.enable_code_scanning.md b/controls/code/COD.002.enable_code_scanning.md index dc22412b1..c42d74a39 100644 --- a/controls/code/COD.002.enable_code_scanning.md +++ b/controls/code/COD.002.enable_code_scanning.md @@ -5,14 +5,14 @@ revision-version: 1 revision-date: "2024-01-07" estimate-time: "15m" frameworks: - - name: "soc2" - sections: ["CC4.1", "CC8.1"] + - name: "soc2" + sections: ["CC4.1", "CC8.1"] --- ## Purpose -It ensures that potential security flaws are detected early. This -proactive approach strengthens your security posture and helps -maintain high code quality. + +It ensures that potential security flaws are detected early. This proactive +approach strengthens your security posture and helps maintain high code quality. ## Implementation @@ -23,8 +23,8 @@ maintain high code quality. 3. Select "Set up this workflow" under "CodeQL Analysis". 4. Review the YAML file and commit it to your repository. -Code scanning will now run every time code is pushed to the -repository, and results will appear in the Security tab. +Code scanning will now run every time code is pushed to the repository, and +results will appear in the Security tab. ## Evidence diff --git a/controls/code/COD.003.dependancy_vulnerability_alerts.md b/controls/code/COD.003.dependancy_vulnerability_alerts.md index 09a69f993..c60781489 100644 --- a/controls/code/COD.003.dependancy_vulnerability_alerts.md +++ b/controls/code/COD.003.dependancy_vulnerability_alerts.md @@ -5,14 +5,15 @@ revision-version: 1 revision-date: "2024-01-07" estimate-time: "15m" frameworks: - - name: "soc2" - sections: ["CC4.1", "CC8.1"] + - name: "soc2" + sections: ["CC4.1", "CC8.1"] --- ## Purpose -It ensures your project stays secure and up-to-date without manual -tracking of dependencies. It also reduces the risk of using outdated -or insecure libraries in your codebase. + +It ensures your project stays secure and up-to-date without manual tracking of +dependencies. It also reduces the risk of using outdated or insecure libraries +in your codebase. ## Implementation @@ -21,13 +22,13 @@ or insecure libraries in your codebase. 1. Go to your repository on GitHub. 2. Click on the "Settings" tab. 3. On the left sidebar, click "Security & analysis". -4. Under "Dependabot alerts", ensure "Dependency graph" and - "Dependabot security updates" are enabled. -5. GitHub will now alert you to any vulnerable dependencies and - automatically open pull requests to fix them. +4. Under "Dependabot alerts", ensure "Dependency graph" and "Dependabot security + updates" are enabled. +5. GitHub will now alert you to any vulnerable dependencies and automatically + open pull requests to fix them. ## Evidence + - Screenshot of Dependabot configuration screen - Sample of dependency update PRs - Vulnerability alert history - diff --git a/controls/code/COD.004.systems_development_life_cycle.md b/controls/code/COD.004.systems_development_life_cycle.md index e66ffb452..d804961b4 100644 --- a/controls/code/COD.004.systems_development_life_cycle.md +++ b/controls/code/COD.004.systems_development_life_cycle.md @@ -5,21 +5,20 @@ revision-version: 1 revision-date: "2024-01-08" estimate-time: "1h" frameworks: - - name: "soc2" - sections: ["CC1.4", "CC5.2", "CC8.1"] + - name: "soc2" + sections: ["CC1.4", "CC5.2", "CC8.1"] --- ## Purpose -Formalizing a proper development lifecycle helps your engineer in -their jobs and helps you to scale your team. It reduces the chances of -human error. +Formalizing a proper development lifecycle helps your engineer in their jobs and +helps you to scale your team. It reduces the chances of human error. ## Implementation -Write a document with your development lifecycle. It should include: -planning, analysis, design, coding, testing, and maintenance. Don’t -forget secure coding practices (eg code review) and quality. +Write a document with your development lifecycle. It should include: planning, +analysis, design, coding, testing, and maintenance. Don’t forget secure coding +practices (eg code review) and quality. ## Evidence diff --git a/controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md b/controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md index 29cd3afcb..4a42a2f72 100644 --- a/controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md +++ b/controls/platform/email-security/PLT.EMAIL.001.sender_policy_framework.md @@ -5,16 +5,16 @@ revision-version: 1 revision-date: "2024-01-07" estimate-time: "30m" frameworks: - - name: "soc2" - sections: ["CC6.1", "CC6.8"] + - name: "soc2" + sections: ["CC6.1", "CC6.8"] --- ## Purpose -SPF (Sender Policy Framework) prevents email spoofing by defining -which mail servers are authorized to send emails on behalf of your -domain. It helps receiving mail servers verify that incoming email -from a domain comes from a host authorized by that domain's -administrators. + +SPF (Sender Policy Framework) prevents email spoofing by defining which mail +servers are authorized to send emails on behalf of your domain. It helps +receiving mail servers verify that incoming email from a domain comes from a +host authorized by that domain's administrators. ## Implementation @@ -35,10 +35,9 @@ administrators. - Create TXT record at domain root - Publish SPF record in DNS - Wait for DNS propagation - + ## Evidence - Screenshot of published SPF DNS record - Email header samples showing SPF pass - Documentation of authorized senders - diff --git a/controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md b/controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md index 2d638829b..59903a243 100644 --- a/controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md +++ b/controls/platform/email-security/PLT.EMAIL.002.dkim_implementation.md @@ -5,15 +5,16 @@ revision-version: 1 revision-date: "2024-01-07" estimate-time: "30m" frameworks: - - name: "soc2" - sections: ["CC6.1", "CC6.8"] + - name: "soc2" + sections: ["CC6.1", "CC6.8"] --- ## Purpose -DKIM (DomainKeys Identified Mail) helps prevent email spoofing by -adding a digital signature to outgoing messages, allowing receiving -mail systems to verify that emails genuinely came from your domain and -weren't modified in transit. + +DKIM (DomainKeys Identified Mail) helps prevent email spoofing by adding a +digital signature to outgoing messages, allowing receiving mail systems to +verify that emails genuinely came from your domain and weren't modified in +transit. ## Implementation @@ -24,7 +25,8 @@ weren't modified in transit. 3. Select your domain and click "Generate new record". 4. Copy the DKIM TXT record provided by Google. 5. Add this TXT record to your DNS. -6. After DNS propagation, return to Admin console and click "Start authentication". +6. After DNS propagation, return to Admin console and click "Start + authentication". ## Evidence diff --git a/controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md b/controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md index 3690a6716..18124c6b9 100644 --- a/controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md +++ b/controls/platform/email-security/PLT.EMAIL.003.domain_based_message_authentication.md @@ -15,16 +15,18 @@ frameworks: --- ## Purpose -DMARC (Domain-based Message Authentication, Reporting, and -Conformance) is a policy framework that builds upon SPF and DKIM. It -tells receiving servers what to do when emails fail SPF or DKIM -checks, and provides reporting on authentication results. + +DMARC (Domain-based Message Authentication, Reporting, and Conformance) is a +policy framework that builds upon SPF and DKIM. It tells receiving servers what +to do when emails fail SPF or DKIM checks, and provides reporting on +authentication results. ## Implementation ### Google Workspace -1. Create a Google Group named `dmarc-report@example.com` which is assecible from external users. +1. Create a Google Group named `dmarc-report@example.com` which is assecible + from external users. 2. Create DMARC record in monitoring mode: ``` Record: _dmarc.example.com @@ -38,5 +40,6 @@ checks, and provides reporting on authentication results. authentication of emails. ## Evidence + - Screenshot of DMARC DNS record - Sample aggregate reports diff --git a/controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md b/controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md index 8243f7297..06ba70533 100644 --- a/controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md +++ b/controls/platform/email-security/PLT.EMAIL.004.email_filtering_and_warning_system.md @@ -5,16 +5,15 @@ revision-version: 1 revision-date: "2024-01-07" estimate-time: "15m" frameworks: - - name: "soc2" - sections: ["CC6.8", "CC7.2"] + - name: "soc2" + sections: ["CC6.8", "CC7.2"] --- ## Purpose -Implement email filtering and warning systems to reduce phishing risks -and protect employees from malicious emails. This reduces mental load -on employees and decreases company risk exposure through email-based -attacks. +Implement email filtering and warning systems to reduce phishing risks and +protect employees from malicious emails. This reduces mental load on employees +and decreases company risk exposure through email-based attacks. ## Implementation @@ -27,13 +26,13 @@ attacks. ``` 3. Configure "Safety" settings: - Attachments Protection - - Scan for anomalous attachment types - - Block attachments with scripts - - Block encrypted attachments from untrusted senders + - Scan for anomalous attachment types + - Block attachments with scripts + - Block encrypted attachments from untrusted senders - Links and External Images: - - Enable scanning of linked images - - Identify shortened URLs - - Display warning prompts for untrusted domains + - Enable scanning of linked images + - Identify shortened URLs + - Display warning prompts for untrusted domains ## Evidence