Review of level 1 activities #46
Conversation
There was a problem hiding this comment.
Looks good in general.
For the assessment attribute: It was written in a way that users understand what they have to provide in order to get it marked as implemented. I do not enforce that you re-write it, but for you know.
E.g.
The organization has a process for triaging and documenting false positives and accepted risks
could be
Provide a maximum one year old sample of a false positive or accepted finding including the date, description and date and expire date
src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml
Outdated
Show resolved
Hide resolved
vbakke
left a comment
vbakke
left a comment
There was a problem hiding this comment.
Thank you for a thorough review.
Looks like I skipped Implementation and Test and Verification. I can try to add them soon.
However, could you please elaborate some on Default settings for intensity? The current text is very short, and I struggle to understand the boundaries for the activity.
src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml
Outdated
Show resolved
Hide resolved
| A defined deployment process is a documented and automated set of steps for releasing software into production. It ensures that deployments are consistent, secure, and auditable, reducing the risk of errors and unauthorized changes. This process should include validation, approval, and rollback mechanisms. | ||
| risk: >- | ||
| Deployment of insecure or malfunctioning artifacts. | ||
| Deployment based human routines are error prone, and of insecure or malfunctioning artifacts. |
There was a problem hiding this comment.
yes, readme is well definied.
Building and testing of artifacts in virtual environments is there to not run all build jobs on the same server without isolation.
src/assets/YAML/default/CultureAndOrganization/EducationAndGuidance.yaml
Outdated
Show resolved
Hide resolved
| risk: Attackers a gaining access to internal systems and application interfaces | ||
| measure: All internal systems are using simple authentication | ||
| assessment: | | ||
| - Demonstrate that every team member has appropriate access (least privilege). |
There was a problem hiding this comment.
From my point of view, it is the opposite:
- Demonstrate that every team member has least access as possible.
…b.com/vbakke/DevSecOps-MaturityModel-data into feat/v4-review-level-1-implementation
Feat/v4 review level 1 implementation
Split 'Defined deployment process' into 'Automated deployment process'
Updated external URLs
Added tags (scannig, sca, ...)
2 participants
Added missing descriptions and assessments, on level 1 activities.
Feel free to comment and adjust. I reckon we should aim to avoid repeating the same message in multiple attributes of the same activity. But I might still be doing that. Nice with more sets of eyes to improve...