Skip to content

Commit ca25d85

Browse files
wurstbrotwurstbrot
authored
🤖 fmt
1 parent 09b3e8a commit ca25d85

File tree

2 files changed

+214
-3
lines changed

2 files changed

+214
-3
lines changed

‎CHANGELOG.md

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,10 @@
1+
# [1.13.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.12.0...v1.13.0) (2024-10-15)
2+
3+
4+
### Features
5+
6+
* add office hours, vuln management tools, epss ([09b3e8a](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/commit/09b3e8a69936aec7b10dbdb293cbe41fc864edfe))
7+
18
# [1.12.0](https://github.com/devsecopsmaturitymodel/DevSecOps-MaturityModel-data/compare/v1.11.1...v1.12.0) (2024-09-23)
29

310

‎src/assets/YAML/generated/generated.yaml

Lines changed: 207 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -943,6 +943,14 @@ Build and Deployment:
943943
url: https://github.com/faloker/purify/
944944
description: |
945945
The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
946+
SecObserve:
947+
uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3
948+
name: SecObserve
949+
tags:
950+
- vulnerability management system
951+
url: https://github.com/MaibornWolff/SecObserve
952+
description: |
953+
The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools.
946954
see-other-actions-e:
947955
uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8
948956
name: See other actions, e.g. "Treatment of defects with severity high".
@@ -1528,6 +1536,21 @@ Build and Deployment:
15281536
sprints, and managing software releases. It offers features for creating
15291537
and managing tasks, assigning them to team members, and monitoring progress
15301538
through customizable workflows and dashboards.
1539+
epss:
1540+
uuid: e39afc58-8195-4600-92c6-11922e3a141b
1541+
name: Exploit Prediction Scoring System
1542+
tags:
1543+
- vulnerability
1544+
url: https://www.first.org/epss/
1545+
description: Estimates the likelihood that a software vulnerability will
1546+
be exploited.
1547+
cisa-kev:
1548+
uuid: aa507341-9531-42cd-95cf-d7b51af47086
1549+
name: Known Exploited Vulnerabilities
1550+
tags:
1551+
- vulnerability
1552+
url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
1553+
description: A catalog of vulnerabilities that have been exploited.
15311554
references:
15321555
samm2:
15331556
- I-SD-1-B
@@ -2807,7 +2830,6 @@ Culture and Organization:
28072830
openCRE:
28082831
- https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education
28092832
and Guidance/12c90cc6-3d58-4d9b-82ff-d469d2a0c298
2810-
comments: ""
28112833
tags:
28122834
- none
28132835
teamsImplemented:
@@ -3052,6 +3074,35 @@ Culture and Organization:
30523074
Default: false
30533075
B: false
30543076
C: false
3077+
Office Hours:
3078+
uuid: 185d5a74-19dc-4422-be07-44ea35226783
3079+
risk: Developers and Operations are not in contact with the security team and
3080+
therefore do not ask prior implementation of (known or unknown) threats-
3081+
measure: As a security team, be open for questions and hints during defined
3082+
office hours. x x d
3083+
difficultyOfImplementation:
3084+
knowledge: 1
3085+
time: 1
3086+
resources: 1
3087+
usefulness: 3
3088+
level: 3
3089+
implementation: ~
3090+
references:
3091+
samm2:
3092+
- G-EG-1-A
3093+
iso27001-2017:
3094+
- 7.2.2
3095+
iso27001-2022:
3096+
- 6.3
3097+
openCRE:
3098+
- https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Education
3099+
and Guidance/185d5a74-19dc-4422-be07-44ea35226783
3100+
tags:
3101+
- none
3102+
teamsImplemented:
3103+
Default: false
3104+
B: false
3105+
C: false
30553106
Regular security training for all:
30563107
uuid: 9768f154-357a-4c06-af6f-d66570677c9b
30573108
risk: Understanding security is hard.
@@ -7195,14 +7246,23 @@ Test and Verification:
71957246
risk: Maintenance of false positives in each tool enforces a high workload.
71967247
In addition a correlation of the same finding from different tools is not
71977248
possible.
7198-
measure: Aggregation of vulnerabilities in one tool reduce the workload to mark
7199-
false positives.
7249+
measure: Aggregation of vulnerabilities in one tool reduce the workload to handle
7250+
them, e.g. mark as false positives.
72007251
difficultyOfImplementation:
72017252
knowledge: 3
72027253
time: 3
72037254
resources: 2
72047255
usefulness: 2
7256+
dependsOn:
7257+
- f2f0f274-c1a0-4501-92fe-7fc4452bc8ad
7258+
- 6217fe11-5ed7-4cf4-9de4-555bcfa6fe87
7259+
- 185d5a74-19dc-4422-be07-44ea35226783
72057260
level: 3
7261+
description: "For known vulnerabilities a processes to estimate the exploit
7262+
ability of a vulnerability is recommended.\n\nTo implement a security culture
7263+
including training, office hours and security champions can help integrating
7264+
\nsecurity scanning at scale. Such activities help to understand why a vulnerability
7265+
is potentially critical and needs handling."
72067266
implementation:
72077267
- uuid: 227d786c-dd76-4b81-b0b2-62389ab8f0fb
72087268
name: OWASP DefectDojo
@@ -7219,6 +7279,13 @@ Test and Verification:
72197279
url: https://github.com/faloker/purify/
72207280
description: |
72217281
The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
7282+
- uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3
7283+
name: SecObserve
7284+
tags:
7285+
- vulnerability management system
7286+
url: https://github.com/MaibornWolff/SecObserve
7287+
description: |
7288+
The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools.
72227289
references:
72237290
samm2:
72247291
- I-DM-1-B
@@ -8009,6 +8076,14 @@ Test and Verification:
80098076
url: https://github.com/faloker/purify/
80108077
description: |
80118078
The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
8079+
SecObserve:
8080+
uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3
8081+
name: SecObserve
8082+
tags:
8083+
- vulnerability management system
8084+
url: https://github.com/MaibornWolff/SecObserve
8085+
description: |
8086+
The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools.
80128087
see-other-actions-e:
80138088
uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8
80148089
name: See other actions, e.g. "Treatment of defects with severity high".
@@ -8594,6 +8669,21 @@ Test and Verification:
85948669
sprints, and managing software releases. It offers features for creating
85958670
and managing tasks, assigning them to team members, and monitoring progress
85968671
through customizable workflows and dashboards.
8672+
epss:
8673+
uuid: e39afc58-8195-4600-92c6-11922e3a141b
8674+
name: Exploit Prediction Scoring System
8675+
tags:
8676+
- vulnerability
8677+
url: https://www.first.org/epss/
8678+
description: Estimates the likelihood that a software vulnerability will
8679+
be exploited.
8680+
cisa-kev:
8681+
uuid: aa507341-9531-42cd-95cf-d7b51af47086
8682+
name: Known Exploited Vulnerabilities
8683+
tags:
8684+
- vulnerability
8685+
url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
8686+
description: A catalog of vulnerabilities that have been exploited.
85978687
- argocd:
85988688
uuid: fdb0e7cc-d3dd-4a2b-9f45-7d403001294f
85998689
name: argoCD
@@ -9120,6 +9210,14 @@ Test and Verification:
91209210
url: https://github.com/faloker/purify/
91219211
description: |
91229212
The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
9213+
SecObserve:
9214+
uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3
9215+
name: SecObserve
9216+
tags:
9217+
- vulnerability management system
9218+
url: https://github.com/MaibornWolff/SecObserve
9219+
description: |
9220+
The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools.
91239221
see-other-actions-e:
91249222
uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8
91259223
name: See other actions, e.g. "Treatment of defects with severity high".
@@ -9705,6 +9803,21 @@ Test and Verification:
97059803
sprints, and managing software releases. It offers features for creating
97069804
and managing tasks, assigning them to team members, and monitoring progress
97079805
through customizable workflows and dashboards.
9806+
epss:
9807+
uuid: e39afc58-8195-4600-92c6-11922e3a141b
9808+
name: Exploit Prediction Scoring System
9809+
tags:
9810+
- vulnerability
9811+
url: https://www.first.org/epss/
9812+
description: Estimates the likelihood that a software vulnerability will
9813+
be exploited.
9814+
cisa-kev:
9815+
uuid: aa507341-9531-42cd-95cf-d7b51af47086
9816+
name: Known Exploited Vulnerabilities
9817+
tags:
9818+
- vulnerability
9819+
url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
9820+
description: A catalog of vulnerabilities that have been exploited.
97089821
comments: ""
97099822
tags:
97109823
- none
@@ -10264,6 +10377,50 @@ Test and Verification:
1026410377
Default: false
1026510378
B: false
1026610379
C: false
10380+
Exploit likelihood estimation:
10381+
uuid: f2f0f274-c1a0-4501-92fe-7fc4452bc8ad
10382+
risk: Without proper prioritization, organizations may waste time and effort
10383+
on low-risk vulnerabilities while neglecting critical ones.
10384+
measure: Estimate the likelihood of exploitation by using data (CISA KEV) from
10385+
the past or prediction models (EPSS).
10386+
difficultyOfImplementation:
10387+
knowledge: 2
10388+
time: 2
10389+
resources: 2
10390+
usefulness: 4
10391+
level: 3
10392+
dependsOn:
10393+
- d918cd44-a972-43e9-a974-eff3f4a5dcfe
10394+
implementation:
10395+
- uuid: aa507341-9531-42cd-95cf-d7b51af47086
10396+
name: Known Exploited Vulnerabilities
10397+
tags:
10398+
- vulnerability
10399+
url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
10400+
description: A catalog of vulnerabilities that have been exploited.
10401+
- uuid: e39afc58-8195-4600-92c6-11922e3a141b
10402+
name: Exploit Prediction Scoring System
10403+
tags:
10404+
- vulnerability
10405+
url: https://www.first.org/epss/
10406+
description: Estimates the likelihood that a software vulnerability will be
10407+
exploited.
10408+
references:
10409+
samm2:
10410+
- V-ST-2-A
10411+
iso27001-2017:
10412+
- 12.6.1
10413+
iso27001-2022:
10414+
- 8.8
10415+
openCRE:
10416+
- https://www.opencre.org/rest/v1/standard/DevSecOps+Maturity+Model+(DSOMM)/Static
10417+
depth for applications/f2f0f274-c1a0-4501-92fe-7fc4452bc8ad
10418+
tags:
10419+
- none
10420+
teamsImplemented:
10421+
Default: false
10422+
B: false
10423+
C: false
1026710424
Local development security checks performed:
1026810425
uuid: 6e180abc-7c98-4265-b4e9-852cb91b067b
1026910426
risk: Creating and developing code contains code smells and quality issues.
@@ -10821,6 +10978,14 @@ Test and Verification:
1082110978
url: https://github.com/faloker/purify/
1082210979
description: |
1082310980
The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
10981+
SecObserve:
10982+
uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3
10983+
name: SecObserve
10984+
tags:
10985+
- vulnerability management system
10986+
url: https://github.com/MaibornWolff/SecObserve
10987+
description: |
10988+
The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools.
1082410989
see-other-actions-e:
1082510990
uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8
1082610991
name: See other actions, e.g. "Treatment of defects with severity high".
@@ -11406,6 +11571,21 @@ Test and Verification:
1140611571
sprints, and managing software releases. It offers features for creating
1140711572
and managing tasks, assigning them to team members, and monitoring progress
1140811573
through customizable workflows and dashboards.
11574+
epss:
11575+
uuid: e39afc58-8195-4600-92c6-11922e3a141b
11576+
name: Exploit Prediction Scoring System
11577+
tags:
11578+
- vulnerability
11579+
url: https://www.first.org/epss/
11580+
description: Estimates the likelihood that a software vulnerability will
11581+
be exploited.
11582+
cisa-kev:
11583+
uuid: aa507341-9531-42cd-95cf-d7b51af47086
11584+
name: Known Exploited Vulnerabilities
11585+
tags:
11586+
- vulnerability
11587+
url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
11588+
description: A catalog of vulnerabilities that have been exploited.
1140911589
- uuid: 58ac9dea-b6c7-4698-904e-df89a9451c82
1141011590
name: DevSecOps control Pre-commit
1141111591
url: https://docs.microsoft.com/en-us/azure/cloud-adoption-framework/secure/devsecops-controls#plan-and-develop
@@ -11449,6 +11629,7 @@ Test and Verification:
1144911629
dependsOn:
1145011630
- Defined build process
1145111631
- 2a44b708-734f-4463-b0cb-86dc46344b2f
11632+
- f2f0f274-c1a0-4501-92fe-7fc4452bc8ad
1145211633
implementation:
1145311634
- uuid: aa54a82c-d628-4d42-9bc8-1aa269cd91c7
1145411635
name: retire.js
@@ -12078,6 +12259,14 @@ Test and Verification:
1207812259
url: https://github.com/faloker/purify/
1207912260
description: |
1208012261
The goal of Purify to be an easy-in-use and efficient tool to simplify a workflow of managing vulnerabilities delivered from various (even custom) tools.
12262+
SecObserve:
12263+
uuid: d899488c-5799-4df1-a14c-3bb92fec3ac3
12264+
name: SecObserve
12265+
tags:
12266+
- vulnerability management system
12267+
url: https://github.com/MaibornWolff/SecObserve
12268+
description: |
12269+
The aim of SecObserve is to make vulnerability scanning and vulnerability management as easy as possible for software development projects using open source tools.
1208112270
see-other-actions-e:
1208212271
uuid: 44c08670-78dc-47ee-a4c1-2503ca6b6cf8
1208312272
name: See other actions, e.g. "Treatment of defects with severity high".
@@ -12663,6 +12852,21 @@ Test and Verification:
1266312852
sprints, and managing software releases. It offers features for creating
1266412853
and managing tasks, assigning them to team members, and monitoring progress
1266512854
through customizable workflows and dashboards.
12855+
epss:
12856+
uuid: e39afc58-8195-4600-92c6-11922e3a141b
12857+
name: Exploit Prediction Scoring System
12858+
tags:
12859+
- vulnerability
12860+
url: https://www.first.org/epss/
12861+
description: Estimates the likelihood that a software vulnerability will
12862+
be exploited.
12863+
cisa-kev:
12864+
uuid: aa507341-9531-42cd-95cf-d7b51af47086
12865+
name: Known Exploited Vulnerabilities
12866+
tags:
12867+
- vulnerability
12868+
url: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
12869+
description: A catalog of vulnerabilities that have been exploited.
1266612870
references:
1266712871
samm2:
1266812872
- V-ST-2-A

0 commit comments

Comments
 (0)