Actions

The systems and processes that are the foundations for effective security and governance.

Overview

Organizational Protections
SLSA
- API & OT (Operational Technology) Security
SLSA Levels
More on Security

PROTIP: To reduce arguments about priorities, pre-define this priority map (from red to orange, yellow, green, and gray) by focusing on the combination of impact and probability of each occurring:

The framework provides a way to rank the severity of each threat and to prioritize the actions to take to mitigate each threat.

PROTIP: Define the meaning of words for Impact Category Levels, such as this because values change over time (due to inflation, sales growth) and to provide a common vocabulary:

Organizational Protections

PROTIP: It’s cheaper and easier to install systems for coordinated teamwork early on that to disrupt the entire organization later on to achieve more agility through teamwork. Here are some systems needed to achieve standardization company-wide at the highest level of maturity.

Train and certify all employees to use …

A1. recognize phishing attacks in email and texts, which account for 80+% of how malicious penetrations begin. (Vendor: Knowbe4).

A2. use MFA (Multi-Factor Authentication) for all logins (vendor: Microsoft Entra ID P2).

A3. a local password manager to make it convenient to generate strong passwords and autofill websites so password reuse is not necessary.

A4. a common task tracking and project planning system responding to alerts (Vendor: Jira, Asana).

A5. a system to escalate tasks not resolved in a timely way (Vendor: PagerDuty, ServiceNow)

A6. a VPN (Virtual Private Network) to encrypt traffic between their device and the company network.

A7. manage action levels from trends in dashboards (Vendor: Grafana, Tableau, Qlik, etc.)

A8. ask customers and vendors to secure emails using SPF & DKIM in DNS (Vendor: Virtru).

VIDEO: Aqua’s Dynamic Threat Analysis

SLSA

SLSA provides this sequence of threats:

Actions defined to establish security controls for software artifacts, at each of 4 levels of maturity:

A. To limit the submission of unauthorized changes into GitHub repositories, enforce practices defined in my example CONTRIBUTING article:

pull requests

B. To limit compromise of GitHub accounts, enforce:

MFA

C. To limit build from modified source:

least privilege

D. To limit compromised dependencies:

SBOM

socket.dev

E. To limit use of compromised dependencies:

File integrity

Atomic OSSEC

Tripwire

F. To limit uploads of modified packages:

G. To limit compromise package repositories:

permission to backup

Segment

data backups

Verify recovery

H. To limit the use of compromised packages:

private repository

Reference packages based on its hash

CIS Benchmark

latest version

Automate installs

alerts to SIEM

Security Information and Event Management

alerts works

anomalies in network

API & OT (Operational Technology) Security

Standards for ICS (Industrial Control Systems) are defined by NIST (National Institute of Standards and Technology) as ISA/IEC-62443 or ISA-99 in the US and IEC (International Electrotechnical Commission) in Europe.

I1. Configure every node with certificates for two-way encryption using mTLS (Mutual TLS) between every node for all network connections.

I2. Have API servers verify JWT (JSON Web Tokens) signatures to block attempts at user impersonation. Sign JWT tokens with a private key, then verify the signature with a public key.

I3. Enforce a strict whitelist of permitted hosts for the jku header.

I4. Always set an expiration date for any tokens issued.

I5. Avoid sending tokens in URL parameter string, which end up in logs.

I6. Include the aud (audience) claim (or similar) to specify the intended recipient of the token. This prevents it from being used on different websites.

I7. Enable the issuing server to revoke tokens (on logout, for example).

I8. Setup secure video surveillance of remote hardware devices to provide a history of accesses.

I9. Use API management servers to assign API tokens so that the number of API calls per minute can be tracked and limited.

I10. Setup authentication and encryption for using SNMPv3 (Simple Network Management Protocol) to monitor devices. (Vendor: NetGuardian includes a RADIUS server which uses CBC-DES (Cipher Block Chaining Data Encryption Standard) as the default encryption algorithm, a part of the Universal Security Model (USM).)

SLSA Levels

The SLSA defines requirements to establish security controls for software artifacts, at each of 4 levels of maturity:

Level 0 - Unsigned provenance provides no guarantees of resilence against tampering.

Level 1 - A Scripted/automated build process generates provenance (metadata about how an artifact was built, including the build process, top-level source, and dependencies). This does not protect against tampering, but offers a basic level of code source identification and can aid in vulnerability management.

Level 2 - Version control in a host and a hosted build service (such as GitHub) that generates authenticated provenance, such as the use of hashes in a DAG (Directed Ascyclic Graph). This gives software consumers confidence in the origin of the software. At this level, the provenance prevents tampering to the extent that the build service is trusted.

Level 3 - The source and build platforms guarantee the auditability of the source and the integrity of the provenance to provide much stronger protections against tampering than earlier levels by threats such as cross-build contamination.

Level 4 - Two-person review of changes for catching mistakes and deterring bad behavior, such as procedures defined in this CONTRIBUTING doc. A hermetic, reproducible build process to guarantee that the SBOM dependencies is complete. Reproducible builds provide many auditability and reliability benefits. This gives the consumer a high degree of confidence that the software has not been tampered with.

More on Security

This is one of a series on Security and DevSecOps:

Wilson Mar