From fd93199a2de0659a7c8d7c0f7d012743f74ec0cf Mon Sep 17 00:00:00 2001 From: Chris Date: Tue, 8 Jul 2025 14:03:19 +0100 Subject: [PATCH] Renive control statements from policies --- policies/gh_org_mfa_enabled.rego | 38 ------------------ policies/gh_org_public_repos.rego | 5 --- policies/gh_org_secret_dependabot_alerts.rego | 39 ------------------ policies/gh_org_secret_scanning_enabled.rego | 40 ------------------- 4 files changed, 122 deletions(-) diff --git a/policies/gh_org_mfa_enabled.rego b/policies/gh_org_mfa_enabled.rego index 84081b7..2ada568 100644 --- a/policies/gh_org_mfa_enabled.rego +++ b/policies/gh_org_mfa_enabled.rego @@ -7,41 +7,3 @@ violation[{}] if { title := "Two Factor Authentication is required at an organization level" description := "Two factor authentication should be enabled and enforced for all users within the Github Organization to make it harder for malicious actors to gain access to the organizations settings and repositories & settings" remarks := "More information from Github can be found here: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization" - -controls := [ - # SAMA Cyber Security Framework v1.0 - # https://rulebook.sama.gov.sa/en/cyber-security-framework-2 - # Class: SAMA_CSF_1.0 - # - # 3.3: Cyber Security Operations and Technology - # https://rulebook.sama.gov.sa/en/33-cyber-security-operations-and-technology-0 - { - "class": "SAMA_CSF_1.0", - "control-id": "3.3.5", # Identity and Access Management https://rulebook.sama.gov.sa/en/335-identity-and-access-management-0 - "statement-ids": [ - "4.e", - "f.1.a", - ] - }, - - # NIST SP 800-53 v5.1.1 - # https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf - # Class SP800-53-enhancement - # ia: Identification and Authentication - { - "class": "SP800-53-enhancement", - "control-id": "ia-2.1", # Multi-factor Authentication to Privileged Accounts - }, - { - "class": "SP800-53-enhancement", - "control-id": "ia-2.2", # Multi-factor Authentication for Non-privileged Accounts - }, - { - "class": "OWASP_DSOMM_3", - "control-id": "IM-3.10", - }, - { - "class": "OWASP_DSOMM_3", - "control-id": "IM-3.11", - }, -] \ No newline at end of file diff --git a/policies/gh_org_public_repos.rego b/policies/gh_org_public_repos.rego index ce2db50..d765d6a 100644 --- a/policies/gh_org_public_repos.rego +++ b/policies/gh_org_public_repos.rego @@ -15,8 +15,3 @@ violation[{}] if { title := "No Public Repos or Gists" description := "The Organization should not have any public repositories or gists attached to it" - -# No direct controls in the frameworks at the moment -# But will be useful when we are mapping ISO 27001, data privacy or custom -# IPR frameworks generated either as a standard or a custom catalog -controls := [] diff --git a/policies/gh_org_secret_dependabot_alerts.rego b/policies/gh_org_secret_dependabot_alerts.rego index dcb2609..89715d7 100644 --- a/policies/gh_org_secret_dependabot_alerts.rego +++ b/policies/gh_org_secret_dependabot_alerts.rego @@ -7,42 +7,3 @@ violation[{}] if { title := "Dependabot alerts enabled for new repositories" description := "All new repositories should be set up to alert for any dependabot alerts that are coming from the repositories" remarks := "Endpoint is closing down at some point and moving to code security configurations: See https://docs.github.com/rest/code-security/configurations" - -controls := [ - { - "class": "SP800-53-enhancement", - "control-id": "ra-5.4", # Discoverable Information - }, - { - "class": "SP800-218", - "control-id": "RV-1.1", - }, - { - "class": "SP800-218", - "control-id": "PW-1.3" - }, - { - "class": "SP800-218", - "control-id": "PW-5.1" - }, - { - "class": "SP800-218", - "control-id": "PW-8.2" - }, - { - "class": "OWASP_DSOMM_3", - "control-id": "IG-3.3", - }, - { - "class": "OWASP_DSOMM_3", - "control-id": "IG-3.4", - }, - { - "class": "OWASP_DSOMM_3", - "control-id": "IG-2.5", - }, - { - "class": "OWASP_DSOMM_3", - "control-id": "TV-6.3", - }, -] diff --git a/policies/gh_org_secret_scanning_enabled.rego b/policies/gh_org_secret_scanning_enabled.rego index 581cc0b..9da4793 100644 --- a/policies/gh_org_secret_scanning_enabled.rego +++ b/policies/gh_org_secret_scanning_enabled.rego @@ -7,43 +7,3 @@ violation[{}] if { title := "Secret Scanning is enabled for new repositories in the organization" description := "All new repositories should be set up for secret scanning as the default." remarks := "Endpoint is closing down at some point and moving to code security configurations: See https://docs.github.com/rest/code-security/configurations" - -controls := [ - # OWASP DSOMM v3 - # https://dsomm.owasp.org/ - # Class: OWASP_DSOMM_3 - # - # TV: Test and Verification - { - "class": "SAMA_CSF_1.0", - "control-id": "TV-6.8", # Test for stored secrets https://dsomm.owasp.org/activity-description?uuid=c6e3c812-56e2-41b0-ae01-b7afc41a004c&dimension=Test%20and%20Verification&subDimension=Static%20depth%20for%20infrastructure&level=1&activityName=Test%20for%20stored%20secrets - - "statement-ids": [ - "TV-6.8_statement" - ] - }, - { - "class": "SP800-218", - "control-id": "RV-1.1" - }, - { - "class": "SP800-218", - "control-id": "PW-1.3" - }, - { - "class": "SP800-218", - "control-id": "PW-5.1" - }, - { - "class": "SP800-218", - "control-id": "PW-8.2" - }, - { - "class": "OWASP_DSOMM_3", - "control-id": "IG-2.5", - }, - { - "class": "OWASP_DSOMM_3", - "control-id": "TV-6.8", - }, -] \ No newline at end of file