forked from usnistgov/oscal-content
-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathbasic-catalog.yaml
199 lines (191 loc) · 13 KB
/
basic-catalog.yaml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
catalog:
uuid: 74c8ba1e-5cd4-4ad1-bbfd-d888e2f6c724
metadata:
title: Sample Security Catalog *for Demonstration* and Testing
published: "2023-10-12T00:00:00.000000-04:00"
last-modified: "2024-02-01T13:57:28.355446-04:00"
version: "1.1"
oscal-version: 1.1.2
remarks: The following is a short excerpt from [ISO/IEC 27002:2013](https://www.iso.org/standard/54533.html), *Information technology — Security techniques — Code of practice for information security controls*. This work is provided here under copyright "fair use" for non-profit, educational purposes only. Copyrights for this work are held by the publisher, the International Organization for Standardization (ISO).
groups:
- id: s1
title: Organization of Information Security
props:
- name: label
value: "1"
groups:
- id: s1.1
title: Internal Organization
controls:
- id: s1.1.1
title: Information security roles and responsibilities
params:
- id: s1.1.1-prm1
label: a choice from a selection
select:
how-many: one-or-more
choice:
- 'initiating a device lock after {{ insert: param, s1.1.1-prm_2 }} of inactivity'
- requiring the user to initiate a device lock before leaving the system unattended
- id: s1.1.1-prm_2
label: a duration
props:
- name: label
value: 1.1.1
parts:
- id: s1.1_smt
name: overview
prose: To establish a management framework to initiate and control the implementation and operation of information security within the organization.
- id: s1.1.1_stm
name: statement
prose: |-
All information security responsibilities should be defined and allocated.
A value has been assigned to {{ insert: param, s1.1.1-prm1 }}.
A cross link has been established with a choppy syntax: [(choppy)](#s1.2).
- id: s1.1.1_gdn
name: guidance
parts:
- id: s1.1.1_gdn.1
name: objective
prose: Allocation of information security responsibilities should be done in accordance with the information security policies. Responsibilities for the protection of individual assets and for carrying out specific information security processes should be identified. Responsibilities for information security risk management activities and in particular for acceptance of residual risks should be defined. These responsibilities should be supplemented, where necessary, with more detailed guidance for specific sites and information processing facilities. Local responsibilities for the protection of assets and for carrying out specific security processes should be defined.
- id: s1.1.1_gdn.2
name: objective
prose: Individuals with allocated information security responsibilities may delegate security tasks to others. Nevertheless they remain accountable and should determine that any delegated tasks have been correctly performed.
- id: s1.1.1_gdn.3
name: objective
prose: |
Areas for which individuals are responsible should be stated. In particular the following should take place:
1. the assets and information security processes should be identified and defined;
1. the entity responsible for each asset or information security process should be assigned and the details of this responsibility should be documented;
1. authorization levels should be defined and documented;
1. to be able to fulfil responsibilities in the information security area the appointed individuals should be competent in the area and be given opportunities to keep up to date with developments;
1. coordination and oversight of information security aspects of supplier relationships should be identified and documented.
- id: s1.1.1_inf
name: overview
props:
- name: label
value: Other information
prose: |-
Many organizations appoint an information security manager to take overall responsibility for the development and implementation of information security and to support the identification of controls.
However, responsibility for resourcing and implementing the controls will often remain with individual managers. One common practice is to appoint an owner for each asset who then becomes responsible for its day-to-day protection.
- id: s1.1.2
title: Segregation of duties
props:
- name: label
value: 1.1.2
parts:
- id: s1.1.2_stm
name: statement
prose: Conflicting duties and areas of responsibility should be segregated to reduce opportunities for unauthorized or unintentional modification or misuse of the organization’s assets.
- id: s1.1.2_gdn
name: guidance
parts:
- id: s1.1.2_gdn.1
name: objective
prose: Care should be taken that no single person can access, modify or use assets without authorization or detection. The initiation of an event should be separated from its authorization. The possibility of collusion should be considered in designing the controls.
- id: s1.1.2_gdn.2
name: objective
prose: Small organizations may find segregation of duties difficult to achieve, but the principle should be applied as far as is possible and practicable. Whenever it is difficult to segregate, other controls such as monitoring of activities, audit trails and management supervision should be considered.
- id: s1.1.2_inf
name: overview
prose: Segregation of duties is a method for reducing the risk of accidental or deliberate misuse of an organization’s assets.
- id: s2
title: Access control
props:
- name: label
value: "2"
groups:
- id: s2.1
title: Business requirements of access control
props:
- name: label
value: "2.1"
parts:
- id: s2.1_smt
name: overview
prose: To limit access to information and information processing facilities.
controls:
- id: s2.1.1
title: Access control policy
props:
- name: label
value: 2.1.1
parts:
- id: s2.1.1_stm
name: statement
prose: An access control policy should be established, documented and reviewed based on business and information security requirements.
- id: s2.1.1_gdn
name: guidance
parts:
- id: s2.1.1_gdn.1
name: objective
prose: Asset owners should determine appropriate access control rules, access rights and restrictions for specific user roles towards their assets, with the amount of detail and the strictness of the controls reflecting the associated information security risks.
- id: s2.1.1_gdn.2
name: objective
prose: Access controls are both logical and physical and these should be considered together.
- id: s2.1.1_gdn.3
name: objective
prose: Users and service providers should be given a clear statement of the business requirements to be met by access controls.
- id: s2.1.1_gdn.4
name: objective
prose: |
The policy should take account of the following:
1. security requirements of business applications;
1. policies for information dissemination and authorization, e.g. the need-to-know principle and information security levels and classification of information;
1. consistency between the access rights and information classification policies of systems and networks;
1. relevant legislation and any contractual obligations regarding limitation of access to data or services;
1. management of access rights in a distributed and networked environment which recognizes all types of connections available;
1. segregation of access control roles, e.g. access request, access authorization, access administration;
1. requirements for formal authorization of access requests;
1. requirements for periodic review of access rights;
1. removal of access rights;
1. archiving of records of all significant events concerning the use and management of user identities and secret authentication information;,
1. roles with privileged access.
- id: s2.1.1_info
name: overview
parts:
- id: s2.1.1_info.1
name: objective
prose: |
Care should be taken when specifying access control rules to consider:
1. establishing rules based on the premise “Everything is generally forbidden unless expressly permitted” rather than the weaker rule “Everything is generally permitted unless expressly forbidden”;
1. changes in information labels that are initiated automatically by information processing facilities and those initiated at the discretion of a user;
1. changes in user permissions that are initiated automatically by the information system and those initiated by an administrator;
1. rules which require specific approval before enactment and those which do not.
- id: s2.1.1_info.2
name: objective
prose: Access control rules should be supported by formal procedures and defined responsibilities.
- id: s2.1.1_stm.3
name: objective
prose: Role based access control is an approach used successfully by many organizations to link access rights with business roles.
- id: s2.1.1_stm.4
name: objective
prose: |
Two of the frequent principles directing the access control policy are:
1. Need-to-know: you are only granted access to the information you need to perform your tasks (different tasks/roles mean different need-to-know and hence different access profile);
1. Need-to-use: you are only granted access to the information processing facilities (IT equipment, applications, procedures, rooms) you need to perform your task/job/role.
- id: s2.1.2
title: Access to networks and network services
props:
- name: label
value: 2.1.2
parts:
- id: s2.1.2_stm
name: statement
prose: Users should only be provided with access to the network and network services that they have been specifically authorized to use.
- id: s2.1.2_gdn
name: guidance
parts:
- id: s2.1.2_gdn.1
name: objective
prose: |
A policy should be formulated concerning the use of networks and network services. This policy should cover:
1. the networks and network services which are allowed to be accessed;
1. authorization procedures for determining who is allowed to access which networks and networked services;
1. management controls and procedures to protect access to network connections and network services;
1. the means used to access networks and network services (e.g. use of VPN or wireless network);
1. user authentication requirements for accessing various network services;
1. monitoring of the use of network service
- id: s2.1.2_gdn.2
name: objective
prose: The policy on the use of network services should be consistent with the organization’s access control policy