Add UKSSCOP reference-ids and claims to OSPS-BR.yaml #428
Conversation
SecurityCRob
requested review from
eddie-knight,
evankanderson,
funnelfiasco and
puerco
SecurityCRob
changed the title
| - reference-id: CM-7 | ||
| - reference-id: SI-7 | ||
| - reference-id: UKSSCOP | ||
| entries: |
There was a problem hiding this comment.
This feels a little tenuous, especially 2.1.2. I can certainly see an argument though, so I'll just leave this comment for now and see if anyone else weighs in. If not, I think we proceed as-is.
There was a problem hiding this comment.
Claim 2.1.2 "Users of the build environment are required to authenticate on a regular basis." Is Partial coverage at best. A means of ensuring that actors & inputs are trusted to to periodically authenticate them.
There was a problem hiding this comment.
I think this may be a distinction between commercial and OSS software -- in OSS, we expect that attackers can do a lot more in the build system than you would expect for commercial software. So this hardening is roughly because OSS doesn't enforce 2.1.6 "Users with access to the build environment are regularly reviewed to ensure they still have a legitimate need".
| entries: | ||
| - reference-id: Claim 1.1.4 | ||
| - reference-id: Claim 2.2.3 | ||
| - reference-id: Claim 3.1.1 |
There was a problem hiding this comment.
I don't see the connection here. I read 3.1.1 as being about cryptographic hash validation.
| - reference-id: SI-7(14) | ||
| - reference-id: UKSSCOP | ||
| entries: | ||
| - reference-id: Claim 1.2.2 |
There was a problem hiding this comment.
This control is more about output than input. 1.2.2 is about input, and 3.1.1 is output, so we should drop 1.2.2 here imo.
Added UKSSCOP reference IDs and claims to multiple sections. Dependent upon merge of #426 BR mapping sot UKSSCOP framework Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
trumant
force-pushed
the
SecurityCRob-patch-4
branch
from
838a9cb to
a46e661
Compare
Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
Co-authored-by: Ben Cotton <ben@kusari.dev> Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
Signed-off-by: CRob <69357996+SecurityCRob@users.noreply.github.com>
Added UKSSCOP reference IDs and claims to multiple sections.
Dependent upon merge of #426
BR mappings to UKSSCOP framework