Skip to content

Commit 149ccdf

Browse files
0x41head0x41head
authored
Merge pull request #150 from 0x41head/angular-ui
Added Features
2 parents f5f19f4 + 91ddb5d commit 149ccdf

13 files changed

+190
-73
lines changed

‎Development.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# DSOMM
2+
3+
This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 13.3.6.
4+
5+
## Development server
6+
7+
Run `ng serve` for a dev server. Navigate to `http://localhost:4200/`. The application will automatically reload if you change any of the source files.
8+
9+
## Code scaffolding
10+
11+
Run `ng generate component component-name` to generate a new component. You can also use `ng generate directive|pipe|service|class|guard|interface|enum|module`.
12+
13+
## Build
14+
15+
Run `ng build` to build the project. The build artifacts will be stored in the `dist/` directory.
16+
17+
## Running unit tests
18+
19+
Run `ng test` to execute the unit tests via [Karma](https://karma-runner.github.io).
20+
21+
## Running end-to-end tests
22+
23+
Run `ng e2e` to execute the end-to-end tests via a platform of your choice. To use this command, you need to first add a package that implements end-to-end testing capabilities.
24+
25+
## Further help
26+
27+
To get more help on the Angular CLI use `ng help` or go check out the [Angular CLI Overview and Command Reference](https://angular.io/cli) page.

‎README.md‎

Lines changed: 148 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,161 @@
1-
# DSOMM
1+
# Introduction
22

3-
This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 13.3.6.
3+
From a startup to a multinational corporation the software development industry is currently dominated by agile frameworks and product teams and as part of it DevOps strategies. It has been observed that during the implementation, security aspects are usually neglected or are at least not sufficient taken account of. It is often the case that standard safety requirements of the production environment are not utilized or applied to the build pipeline in the continuous integration environment with containerization or concrete docker. Therefore, the docker registry is often not secured which might result in the theft of the entire company’s source code.
44

5-
## Development server
5+
The OWASP DevSecOps Maturity Model provides opportunities to harden DevOps strategies and shows how these can be prioritized.
66

7-
Run `ng serve` for a dev server. Navigate to `http://localhost:4200/`. The application will automatically reload if you change any of the source files.
7+
With the help of DevOps strategies security can also be enhanced. For example, each component such as application libraries and operating system libraries in docker images can be tested for known vulnerabilities.
88

9-
## Code scaffolding
9+
Attackers are intelligent and creative, equipped with new technologies and purpose. Under the guidance of the forward-looking DevSecOps Maturity Model, appropriate principles and measures are at hand implemented which counteract the attacks.
1010

11-
Run `ng generate component component-name` to generate a new component. You can also use `ng generate directive|pipe|service|class|guard|interface|enum|module`.
11+
# Usage
1212

13-
## Build
13+
Go to https://dsomm.timo-pagel.de or clone [this repository](https://github.com/wurstbrot/DevSecOps-MaturityModel/) and run `startDocker.bash`.
1414

15-
Run `ng build` to build the project. The build artifacts will be stored in the `dist/` directory.
15+
* _matrix_ shows the dimensions, subdimensions and activities are described.
16+
* _Implementation Levels_ can be used to measure the current implementation level by clicking on the specific activities which have been performed.
17+
* _Ease and Value of Implementation_ is used for the maturity model development to see the ease and value of each activity to be able to compare it with activities within the subdimension and activities from other subdimensions.
18+
* _Dependenies_ shows the dependencies between activities
19+
* _Useage_ describes the dimensions
20+
* _Full Report_ prints all activities to be able to print it
1621

17-
## Running unit tests
22+
In this [video](https://www.youtube.com/watch?v=tX9RHZ_O5NU) Timo Pagel describes different strategic approaches for your secure DevOps strategy. The use OWASP DSOMM in combination with [OWASP SAMM](https//owaspsamm.org) is explained.
1823

19-
Run `ng test` to execute the unit tests via [Karma](https://karma-runner.github.io).
24+
In case you have evidence or review questions to gather evidence, you can add the attribute "evidence" to an activity which will be attached to an activity to provide it to your CISO or your customer's CISO.
25+
You can switch on to show open TODO's for evidence by changing IS_SHOW_EVIDENCE_TODO to true 'bib.php' `define(IS_SHOW_EVIDENCE_TODO, true);`
2026

21-
## Running end-to-end tests
27+
# Community
2228

23-
Run `ng e2e` to execute the end-to-end tests via a platform of your choice. To use this command, you need to first add a package that implements end-to-end testing capabilities.
29+
Code Freeze: Currently, with the Google Summer student Aryan Prasad we develop a new Angular frontend version, therefore, we do not accept any code changes right now.
2430

25-
## Further help
31+
Join #dsomm in [OWASP Slack](https://owasp.slack.com/join/shared_invite/zt-g398htpy-AZ40HOM1WUOZguJKbblqkw#/).
32+
Create issues or even better Pull Requests in [github](https://github.com/wurstbrot/DevSecOps-MaturityModel/).
2633

27-
To get more help on the Angular CLI use `ng help` or go check out the [Angular CLI Overview and Command Reference](https://angular.io/cli) page.
34+
# Slides and talks
35+
* [Video: OWASP (DevSecOps) Projects, 2021-04-28, OWASP Stammtisch Frankfurt](https://www.youtube.com/watch?v=8webiYnF56A)
36+
* [Video: DSOMM Enhancement Workshop at Open Security Summit, 2021-04-16](https://youtu.be/H2BA6gaeKBE)
37+
* [Video: Strategic Usage of the OWASP Software Assurance Maturity Model and the OWASP DevSecOps Maturity Model, OWASP Jakarta](https://m.youtube.com/watch?v=lLMLGIzl56M)
38+
* [Slides: DSOMM Overview](https://docs.google.com/presentation/d/1eQcE_AsR1g6uOVf3B2Ehh1g0cHvPknkdLY4BzMYatSw/edit?usp=sharing)
39+
* [Video: GitHub practical DSOMM snippet on twitch](https://www.twitch.tv/githubenterprise/clip/EsteemedTriumphantMinkFailFish)
40+
* [Blog: GitHub on DSOMM](https://github.blog/2020-08-06-achieving-devsecops-maturity-with-a-developer-first-community-driven-approach/) 2020
41+
* [Video: Benutzung vom OWASP DevSecOps Maturity Model (German)](https://vimeo.com/456523229)
42+
* [Online: OWASP DevSecOps Maturity Model - Culture (German)](https://www.meetup.com/de-DE/Breaking-Agile/) 2020-08-25
43+
* [Video: Usage of the OWASP DevSecOps Maturity Model](https://www.youtube.com/watch?v=tX9RHZ_O5NU), [OWASP Ottawa Chapter](https://www.meetup.com/de-DE/OWASP-Ottawa/events/272355636/), 2020-08-17
44+
* [Continuous Application Security Testing for Enterprise](https://docs.google.com/presentation/d/1dAewXIHgBEKHKwBPpM5N_G2eM6PRpduoGJrp6R6pNUI/edit?usp=sharing), DevOps Meetup Hamburg, 2019-09-26
45+
* [DevSecOps Maturity Model](https://docs.google.com/presentation/d/1zF7c_0cPYBO7LHcLNtEApQBB_qJugXgRQUyiwBKKtKk/edit?usp=sharing), Open Security Summit, near London, 2018
46+
* [Security in DevOps-Strategies](https://www.youtube.com/watch?v=gWjGWebWahE&t=448s), 28.09.2017, Hamburg, Germany
47+
* [DevSecOps Maturity Model](https://docs.google.com/presentation/d/1rrbyXqxy3LXAJNPFrVH99mj_BNaJKymMsXZItYArWEM/edit?usp=sharing), 2017
48+
49+
# Assessment
50+
51+
In case you would like to perform a DevSecOps assessment, the following tools are available:
52+
53+
* Usage of the applicaton in a `container`.
54+
* Development of an export to [OWASP Maturity Models](https://github.com/OWASP/Maturity-Models) (recommended for assessments with a lot of teams)
55+
* Creation of your excel sheet (not recommended, you want to use DevOps, don't even try!)
56+
57+
## Container
58+
59+
1. Install [Docker](https://www.docker.com)
60+
2. Run `docker run --rm -p 8080:80 wurstbrot/dsomm:latest
61+
3. Browse to <http://localhost:8080> (on macOS and Windows browse to <http://192.168.99.100:8080> if you are using docker-machine instead
62+
of the native docker installation)
63+
64+
In case you would like to have perform an assessment for multiple teams, iterate from port 8080 to 8XXX, depending of the size of your team.
65+
In case the application should be visible, but the "Implementation Level" shouldn't be changeable, consider the following code:
66+
67+
```bash
68+
#!/bin/bash
69+
set -xe
70+
71+
IMAGE_NAME="<YOUR ORGANIZATION>/dsomm:latest"
72+
73+
rm -Rf DevSecOps-MaturityModel || true
74+
git clone git@github.com:wurstbrot/DevSecOps-MaturityModel.git
75+
cp data/* DevSecOps-MaturityModel/data
76+
cp -a selectedData.csv DevSecOps-MaturityModel/selectedData.csv
77+
78+
cd DevSecOps-MaturityModel
79+
docker build -t $IMAGE_NAME .
80+
docker push $IMAGE_NAME
81+
```
82+
83+
This approach also allows teams to perform self assessment with changes tracked in a repository.
84+
85+
86+
## Amazon EC2 Instance
87+
88+
1. In the _EC2_ sidenav select _Instances_ and click _Launch Instance_
89+
2. In _Step 1: Choose an Amazon Machine Image (AMI)_ choose an _Amazon
90+
Linux AMI_ or _Amazon Linux 2 AMI_
91+
3. In _Step 3: Configure Instance Details_ unfold _Advanced Details_ and
92+
copy the script below into _User Data_
93+
4. In _Step 6: Configure Security Group_ add a _Rule_ that opens port 80
94+
for HTTP
95+
5. Launch your instance
96+
6. Browse to your instance's public DNS
97+
98+
```bash
99+
#!/bin/bash
100+
yum update -y
101+
yum install -y docker
102+
service docker start
103+
docker run -d -p 80:80 wurstbrot/dsomm:latest
104+
```
105+
106+
## Tests
107+
108+
To run basic tests just
109+
110+
```bash
111+
docker-compose -f docker-compose.dev.yaml up test-php
112+
```
113+
114+
# Credits
115+
116+
* The dimension _Test and Verification_ is based on Christian Schneiders [Security DevOps Maturity Model (SDOMM)](https://www.christian-schneider.net/SecurityDevOpsMaturityModel.html). _Application tests_ and _Infrastructure tests_ are added by Timo Pagel. Also, the sub-dimension _Static depth_ has been evaluated by security experts at [OWASP Stammtisch Hamburg](https://www.owasp.org/index.php/OWASP_German_Chapter_Stammtisch_Initiative/Hamburg).
117+
* The sub-dimension <i>Process</i> has been added after a discussion with [Francois Raynaud](https://www.linkedin.com/in/francoisraynaud/) that reactive activities are missing.
118+
* Enhancement of my basic translation is performed by [Claud Camerino](https://github.com/clazba).
119+
* Adding ISO 27001:2017 mapping, [Andre Baumeier](https://github.com/AndreBaumeier).
120+
* Providing a documentation of how to use `docker` in the Juice Shop for simple copy&paste, [Björn Kimminich](https://github.com/bkimminich/).
121+
* [OWASP Project Integration Project Writeup](https://github.com/OWASP/www-project-integration-standards/blob/master/writeups/owasp_in_sdlc/index.md) for providing documentation on different DevSecOps practices which are copied&pasted/ (and adopted) (https://github.com/northdpole, https://github.com/ThunderSon)
122+
* The requirements from [level 0](https://github.com/AppSecure-nrw/security-belts/blob/master/white/) are based on/copied from [AppSecure NRW](https://appsecure.nrw/)
123+
124+
# Back link
125+
126+
- [OWASP DevSecOps maturity model page](https://dsomm.timo-pagel.de/)
127+
- [OWASP DevSecOps project page](https://owasp.org/www-project-devsecops-maturity-model/)
128+
- [OWASP](https://owasp.org)
129+
130+
# Your help is needed to perform
131+
132+
* Adding a manual on how to use DSOMM
133+
* Integration of Incident Response
134+
* DevSecOps Toolchain Categorization
135+
* App Sec Maturity Models Mapping
136+
* CAMS Categorization
137+
* Adding assessment questions
138+
139+
# Multilanguage support
140+
Multilanguage support is not given currently and not planned.
141+
142+
# Sponsors
143+
144+
[![Timo Pagel IT-Consulting](https://raw.githubusercontent.com/DefectDojo/Documentation/master/doc/img/timo-pagel-logo.png)](https://pagel.pro)
145+
146+
[![Apprio Inc](https://github.com/wurstbrot/DevSecOps-MaturityModel/raw/master/assets/images/Apiiro_black_logo.png)](https://apiiro.com/)
147+
148+
149+
# Donations
150+
151+
If you are using the model or you are inspired by it, want to help but don't want to create pull requests? You can donate at the [OWASP Project Wiki Page](https://owasp.org/donate/?reponame=www-project-devsecops-maturity-model&title=OWASP+Devsecops+Maturity+Model). Donations might be used for the design of logos/images/design or travels.
152+
153+
# License
154+
155+
This program is free software: you can redistribute it and/or modify it under the terms of the [GPL 3](https://www.gnu.org/licenses/) license.
156+
157+
The intellectual property (content in the _data_ folder) is licensed under Attribution-ShareAlike.
158+
An example attribution by changing the content:
159+
> This work is based on the [OWASP DevSecOps Maturity Model](https://dsomm.timo-pagel.de).
160+
161+
The OWASP DevSecOps Maturity Model and any contributions are Copyright © by Timo Pagel 2017-2022.

‎src/app/app-routing.module.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,15 +2,13 @@ import { Component, NgModule } from '@angular/core';
22
import { RouterModule, Routes } from '@angular/router';
33
import { AboutUsComponent } from './component/about-us/about-us.component';
44
import { CircularHeatmapComponent } from './component/circular-heatmap/circular-heatmap.component';
5-
import { MainContentComponent } from './component/main-content/main-content.component';
65
import { MappingComponent } from './component/mapping/mapping.component';
76
import { MatrixComponent } from './component/matrix/matrix.component';
87
import { TaskDescriptionComponent } from './component/task-description/task-description.component';
98
import { UsageComponent } from './component/usage/usage.component';
109

1110

1211
const routes: Routes = [
13-
{path: 'home',component: MainContentComponent},
1412
{path: '', component: MatrixComponent},
1513
{path: 'circular-heatmap', component: CircularHeatmapComponent},
1614
{path: 'task-description', component: TaskDescriptionComponent},

‎src/app/app.component.css‎

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,4 +16,7 @@
1616
.example-sidenav {
1717
padding: 20px;
1818
}
19-
19+
20+
.github-fork-ribbon:before {
21+
background-color: #333;
22+
}

‎src/app/app.component.html‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,7 @@
88
<button type="button" mat-button (click)="drawer.toggle()" color="primary">
99
<mat-icon>menu</mat-icon>
1010
</button>
11+
<a class="github-fork-ribbon" href="https://github.com/wurstbrot/DevSecOps-MaturityModel" data-ribbon="Fork me on GitHub" title="Fork me on GitHub">Fork me on GitHub</a>
1112
</div>
1213
<mat-divider></mat-divider>
1314
<router-outlet></router-outlet>

‎src/app/app.module.ts‎

Lines changed: 0 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,6 @@ import { AppRoutingModule } from './app-routing.module';
66
import { AppComponent } from './app.component';
77
import { BrowserAnimationsModule } from '@angular/platform-browser/animations';
88
import { MaterialModule } from './material/material.module';
9-
import { MainContentComponent } from './component/main-content/main-content.component';
109
import { LogoComponent } from './component/logo/logo.component';
1110
import { MatrixComponent } from './component/matrix/matrix.component';
1211
import { SidenavButtonsComponent } from './component/sidenav-buttons/sidenav-buttons.component';
@@ -25,7 +24,6 @@ import { DependencyGraphComponent } from './component/dependency-graph/dependenc
2524
@NgModule({
2625
declarations: [
2726
AppComponent,
28-
MainContentComponent,
2927
LogoComponent,
3028
MatrixComponent,
3129
SidenavButtonsComponent,

‎src/app/component/main-content/main-content.component.css‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎src/app/component/main-content/main-content.component.html‎

Lines changed: 0 additions & 1 deletion
This file was deleted.

‎src/app/component/main-content/main-content.component.spec.ts‎

Lines changed: 0 additions & 25 deletions
This file was deleted.

‎src/app/component/main-content/main-content.component.ts‎

Lines changed: 0 additions & 15 deletions
This file was deleted.

0 commit comments

Comments
 (0)