rohit/probo
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Add access controls

Browse Source 
Signed-off-by: gearnode <bryan@frimin.fr>
This commit is contained in:
gearnode
2025-01-14 11:57:21 +01:00
parent 15c6902c13
commit bf93f5afb7
10 changed files with 247 additions and 26 deletions
Download Patch File Download Diff File Expand all files Collapse all files

45
controls/personnel/access/PER.ACC.001_mfa_on_critical_services.md Normal file
View File

@@ -0,0 +1,45 @@
---
id: "PER.ACC.001"
category: "personnel/access"
revision-version: 1
revision-date: "2024-01-14"
estimate-time: "1h"
necessity: "mandatory"
frameworks:
- name: "soc2"
sections: ["CC6.1", "CC6.8"]
---
# Enable 2FA on critical services
## Purpose
In order to minimize the threat of someone getting access to something they
should not, we follow the **secure principle:** nobody can easily get access to
data/systems.
We need to ensure that if someone has access to your password, they still cannot
log into your account. Multi-Factor Authentication (MFA) adds extra layers of
security by requiring users to provide additional authentication factors beyond
their passwords. The most standard solution is 2FA: your password + something
else.
## Implementation
Enable 2FA across all your systems. If you don’t want to activate it everywhere,
prioritize:
- System containing sensitive data
- System related to your network, infrastructure or production.
At least, you need it for the following:
- Cloud provider (GCP, AWS etc.)
- Code hosting (Github, Gitlab etc.)
- Email/SSO (Google, Microsoft etc.)
## Evidence
- Screenshot of your 2FA settings in Cloud provider.
- Screenshot of your 2FA settings in Code hosting.
- Screenshot of your 2FA settings in Email/SSO.

40
controls/personnel/access/PER.ACC.002_access_request_process.md Normal file
View File

@@ -0,0 +1,40 @@
---
id: "PER.ACC.002"
category: "personnel/access"
revision-version: 1
revision-date: "2024-01-14"
estimate-time: "15m"
necessity: "mandatory"
frameworks:
- name: "soc2"
sections: ["CC6.2", "CC6.3"]
---
# Access Request Process
## Purpose
In order to minimize the threat of someone getting access to something they
should not, we follow the continuous update principle: making sure the
privileges are up to date. We need to setup a proper process to define how we
grant and revoke access to different systems.
## Implementation
We will formalize your access granting and revocation policy later, for that, we
need you to implement the fitting process for you.
1. Setup an easy process to update the access outside of onboarding and
offboarding:
1. Define who in your leadership team should be the person granting access.
It usually would be someone from HR or IT
2. Go to Slack and create an `access-request` channel
3. Ensure any access request goes through this slack channel so you can
provide screenshots of those requests.
> Pro tip: Setup an alias to @access-admin that pings the right person in charge
> to reduce notification noise
## Evidence
- Screenshot of the slack channel with some actions on it.

53
controls/personnel/access/PER.ACC.003_password_manager.md Normal file
View File

@@ -0,0 +1,53 @@
---
id: "PER.ACC.003"
category: "personnel/access"
revision-version: 1
revision-date: "2024-01-14"
estimate-time: "15m"
necessity: "mandatory"
frameworks:
- name: "soc2"
sections: ["CC6.1", "CC6.8"]
---
# Setup a password manager
## Purpose
In order to minimize the threat of someone getting access to something they
should not, we want to ensure a few things:
1. The password used in your company are complex enough
2. They are stored encrypted
3. They are shared safely when needed (not openly, on slack or by text)
4. They are not compromised
The easiest way to implement those is to use a password manager.
## Implementation
### Choose your provider
There are a few options on the market regarding password manager. We will guide
you through [1password](https://1password.com/) setup.
You can also use [Dashlane](https://www.dashlane.com/) or a free open source
solution such as https://github.com/passbolt/passbolt_api.
### Confirm the policy you want
The main thing you need to decide on is the complexity of password you require.
Below, you will find a suggestion of something you can implement in 1password.
<aside>
🔒
Employees secret must meet the following requirements:
a. min 12 characters in length b. A mix of uppercase and lowercase characters c.
At least one non-alphanumeric character d. At least one number
</aside>
> If you change from this suggestion, please edit the suggestion - this rule
> will be added to a policy later.

43
controls/personnel/access/PER.ACC.004_role_based_access_control.md Normal file
View File

@@ -0,0 +1,43 @@
---
id: "PER.ACC.004"
category: "personnel/access"
revision-version: 1
revision-date: "2024-01-14"
estimate-time: "30m"
necessity: "mandatory"
frameworks:
- name: "soc2"
sections: ["CC6.8", "CC7.2"]
---
# Setup Role Based Access Control (RBAC)
## Purpose
In order to minimize the threat of someone getting access to something they
should not, we follow the least privilege principle: access is limited to what's
necessary for job duties. We need to define which function should have access to
which tool in your company to serve as a reference when providing access to
people (password manager vaults etc.).
## Implementation
Define who should have access to what in a role-based matrix in the template
below:
1. Edit and add columns for the main tool categories you are using
2. Edit and add lines for the different functions / teams in your organization
3. Edit and add ticks `x` in the right box for access
4. In the last line, make sure to fill the right admin team
| **Role** | **Email** | **Google Workspace** | **Expense Tool** | **CRM** | **App** | **Infrastructure** | **Version Control** | **Build System** | **Vuln Scanner** |
| ------------- | --------- | -------------------- | ---------------- | ---------- | ------------ | ------------------ | ------------------- | ---------------- | ---------------- |
| **Everyone** | x | x | x | | x | | | | |
| **Engineers** | x | x | x | | x | x | x | x | x |
| **Sales** | x | x | x | x | x | | | | |
| | | | | | | | | | |
| **Admin** | HR | HR | Finance | Sales lead | Product lead | Eng lead | Eng lead | Eng lead | Eng lead |
## Evidence
- Provide the link to the matrix you implemented on your side

45
controls/personnel/access/PER.ACC.005_enforce_single_sign_on.md Normal file
View File

@@ -0,0 +1,45 @@
---
id: "PER.ACC.005"
category: "personnel/access"
revision-version: 1
revision-date: "2024-01-14"
estimate-time: "30m"
necessity: "mandatory"
frameworks:
- name: "soc2"
sections: ["CC6.8", "CC7.2"]
---
# Enforce SSO when possible
## Purpose
To minimize the risk of unauthorized access, it's important to centralize and
secure authentication across your organization. Single Sign-On (SSO) enhances
security by enabling better control over account access, enforcing consistent
security policies (e.g., 2FA), and making it easier to revoke access when
someone leaves the organization.
## Implementation
## Google Workspace
1. Log in to the [Google Admin Console](https://admin.google.com/) with an admin
account.
2. Go to **Apps** > **Web and Mobile Apps** > **Add App** > **Add Custom SAML
App**.
3. Name the app and upload a logo (optional).
4. **Generate SSO details**:
- Google provides the **SSO URL**, **Entity ID**, and **Certificate** for the
app.
5. **Configure the Third-Party App**:
- In the app’s admin console, input the **SSO URL**, **Entity ID**, and
upload the **Certificate**.
6. Return to Google Admin Console and configure attribute mapping (e.g., email,
first name).
7. Test the connection, enable the app, and assign it to users or groups.
## Evidence
- Screenshot of SSO activation for Google Workplace + your cloud
provider + code hosting tool

2
controls/personnel/comms/PER.COM.004.email_filtering_and_warning_system.md
View File

@@ -10,7 +10,7 @@ frameworks:
sections: ["CC6.8", "CC7.2"]
---
# Configure Email Security Filters
# Configure Email Security Filters
## Purpose

7
controls/physical/facilities/PHY.FAC.002_physical_access_control.md
View File

@@ -20,10 +20,9 @@ secured (we will focus on the digital access later).
## Implementation
If you are working from a co-working space or subleasing offices, you
don’t have much do to. Provide a link to their access policy and the
dashboard they probably provide to manage the list of authorized
personnel.
If you are working from a co-working space or subleasing offices, you don’t have
much do to. Provide a link to their access policy and the dashboard they
probably provide to manage the list of authorized personnel.
If you have your own office space, you need to provide:

7
controls/physical/facilities/PHY.FAC.003_visitor_access_policy.md
View File

@@ -14,10 +14,9 @@ frameworks:
## Purpose
Even if you do most of your business online, you still have offices,
computers or even printed document: you need to make sure those assets
are physically secured (we will focus on the digital access later)
regarding visitors.
Even if you do most of your business online, you still have offices, computers
or even printed document: you need to make sure those assets are physically
secured (we will focus on the digital access later) regarding visitors.
## Implementation

25
controls/physical/facilities/PHY.FAC.004_virtual_private_network.md
View File

@@ -15,24 +15,21 @@ frameworks:
## Purpose
In short, implementing a VPN will encrypt your data and ensure a safe
transmission between your employees devices and your internal network
(even when using untrusted networks like a public wifi) ⇒ it offers a
layer of security for your data.
transmission between your employees devices and your internal network (even when
using untrusted networks like a public wifi) ⇒ it offers a layer of security for
your data.
## Implementation
> If you have doubt whether you should do it or not, ping us on
> Discord.
<br/>
> If everything is on Google Suite/Notion/Slack with MFA and you don’t
> have your own network => no needed.
If you think you need one, you should consider deploying one and make
it mandatory when working remote => You can follow the [Wireguard
installation guide there](https://www.wireguard.com/install/).
> If you have doubt whether you should do it or not, ping us on Discord. <br/>
> If everything is on Google Suite/Notion/Slack with MFA and you don’t have your
> own network => no needed.
If you think you need one, you should consider deploying one and make it
mandatory when working remote => You can follow the
[Wireguard installation guide there](https://www.wireguard.com/install/).
## Evidence
- Screenshot of VPN settings page (to show active use) or log of VPN
connection from employees device.
- Screenshot of VPN settings page (to show active use) or log of VPN connection
from employees device.

6
controls/physical/hardware/PHY.HW.003_device_encryption.md
View File

@@ -14,9 +14,9 @@ frameworks:
## Purpose
Ensure all employee devices have disk encryption and firewall
protection enabled to secure data at rest and protect network
communications from unauthorized access.
Ensure all employee devices have disk encryption and firewall protection enabled
to secure data at rest and protect network communications from unauthorized
access.
## Implementation