Skip to content

Remove control statements from policies #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
chris-cmsoft merged 1 commit into from
Jul 9, 2025
Merged

Remove control statements from policies #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
38 changes: 0 additions & 38 deletions policies/gh_org_mfa_enabled.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,41 +7,3 @@ violation[{}] if {
title := "Two Factor Authentication is required at an organization level"
description := "Two factor authentication should be enabled and enforced for all users within the Github Organization to make it harder for malicious actors to gain access to the organizations settings and repositories & settings"
remarks := "More information from Github can be found here: https://docs.github.com/en/organizations/keeping-your-organization-secure/managing-two-factor-authentication-for-your-organization/requiring-two-factor-authentication-in-your-organization"

controls := [
# SAMA Cyber Security Framework v1.0
# https://rulebook.sama.gov.sa/en/cyber-security-framework-2
# Class: SAMA_CSF_1.0
#
# 3.3: Cyber Security Operations and Technology
# https://rulebook.sama.gov.sa/en/33-cyber-security-operations-and-technology-0
{
"class": "SAMA_CSF_1.0",
"control-id": "3.3.5", # Identity and Access Management https://rulebook.sama.gov.sa/en/335-identity-and-access-management-0
"statement-ids": [
"4.e",
"f.1.a",
]
},

# NIST SP 800-53 v5.1.1
# https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-53r5.pdf
# Class SP800-53-enhancement
# ia: Identification and Authentication
{
"class": "SP800-53-enhancement",
"control-id": "ia-2.1", # Multi-factor Authentication to Privileged Accounts
},
{
"class": "SP800-53-enhancement",
"control-id": "ia-2.2", # Multi-factor Authentication for Non-privileged Accounts
},
{
"class": "OWASP_DSOMM_3",
"control-id": "IM-3.10",
},
{
"class": "OWASP_DSOMM_3",
"control-id": "IM-3.11",
},
]
5 changes: 0 additions & 5 deletions policies/gh_org_public_repos.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -15,8 +15,3 @@ violation[{}] if {

title := "No Public Repos or Gists"
description := "The Organization should not have any public repositories or gists attached to it"

# No direct controls in the frameworks at the moment
# But will be useful when we are mapping ISO 27001, data privacy or custom
# IPR frameworks generated either as a standard or a custom catalog
controls := []
39 changes: 0 additions & 39 deletions policies/gh_org_secret_dependabot_alerts.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,42 +7,3 @@ violation[{}] if {
title := "Dependabot alerts enabled for new repositories"
description := "All new repositories should be set up to alert for any dependabot alerts that are coming from the repositories"
remarks := "Endpoint is closing down at some point and moving to code security configurations: See https://docs.github.com/rest/code-security/configurations"

controls := [
{
"class": "SP800-53-enhancement",
"control-id": "ra-5.4", # Discoverable Information
},
{
"class": "SP800-218",
"control-id": "RV-1.1",
},
{
"class": "SP800-218",
"control-id": "PW-1.3"
},
{
"class": "SP800-218",
"control-id": "PW-5.1"
},
{
"class": "SP800-218",
"control-id": "PW-8.2"
},
{
"class": "OWASP_DSOMM_3",
"control-id": "IG-3.3",
},
{
"class": "OWASP_DSOMM_3",
"control-id": "IG-3.4",
},
{
"class": "OWASP_DSOMM_3",
"control-id": "IG-2.5",
},
{
"class": "OWASP_DSOMM_3",
"control-id": "TV-6.3",
},
]
40 changes: 0 additions & 40 deletions policies/gh_org_secret_scanning_enabled.rego
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,43 +7,3 @@ violation[{}] if {
title := "Secret Scanning is enabled for new repositories in the organization"
description := "All new repositories should be set up for secret scanning as the default."
remarks := "Endpoint is closing down at some point and moving to code security configurations: See https://docs.github.com/rest/code-security/configurations"

controls := [
# OWASP DSOMM v3
# https://dsomm.owasp.org/
# Class: OWASP_DSOMM_3
#
# TV: Test and Verification
{
"class": "SAMA_CSF_1.0",
"control-id": "TV-6.8", # Test for stored secrets https://dsomm.owasp.org/activity-description?uuid=c6e3c812-56e2-41b0-ae01-b7afc41a004c&dimension=Test%20and%20Verification&subDimension=Static%20depth%20for%20infrastructure&level=1&activityName=Test%20for%20stored%20secrets

"statement-ids": [
"TV-6.8_statement"
]
},
{
"class": "SP800-218",
"control-id": "RV-1.1"
},
{
"class": "SP800-218",
"control-id": "PW-1.3"
},
{
"class": "SP800-218",
"control-id": "PW-5.1"
},
{
"class": "SP800-218",
"control-id": "PW-8.2"
},
{
"class": "OWASP_DSOMM_3",
"control-id": "IG-2.5",
},
{
"class": "OWASP_DSOMM_3",
"control-id": "TV-6.8",
},
]