further fixes

Author: ioggstream

data-new/Implementation/InfrastructureHardening.yaml

@@ -12,11 +12,16 @@ Infrastructure Hardening:
     usefulness: 4
     level: 2
     implementation:
-    - <a href='https://www.cisecurity.org/cis-benchmarks/'>CIS Kubernetes Bench for
-      Security</a>
-    - <a href='https://www.cisecurity.org/cis-benchmarks/'>CIS Docker Bench for Security</a>
-    - 'For example for Containers: Deny running containers as root, deny using advanced
-      privileges, deny mounting of the hole filesystem, ...'
+    - name: CIS Kubernetes Bench for Security
+      tags: []
+      url: https://www.cisecurity.org/cis-benchmarks/
+    - name: CIS Docker Bench for Security
+      tags: []
+      url: https://www.cisecurity.org/cis-benchmarks/
+    - name: For example for Cont
+      tags: []
+      description: 'For example for Containers: Deny running containers as root, deny
+        using advanced privileges, deny mounting of the hole filesystem, ...'
     samm2: o-environment-management|A|1
     iso27001-2017:
     - system hardening is not explicitly covered by ISO 27001 - too specific
@@ -70,9 +75,12 @@ Infrastructure Hardening:
     level: 1
     dependsOn: []
     implementation:
-    - istio
-    - bridges
-    - firewalls
+    - name: istio
+      tags: []
+    - name: bridges
+      tags: []
+    - name: firewalls
+      tags: []
     samm2: o-environment-management|A|1
     iso27001-2017:
     - virtual environments are not explicitly covered by ISO 27001 - too specific
@@ -90,8 +98,10 @@ Infrastructure Hardening:
     level: 2
     dependsOn: []
     implementation:
-    - Open Policy Agent
-    - firewalls
+    - name: Open Policy Agent
+      tags: []
+    - name: firewalls
+      tags: []
     samm2: o-environment-management|A|1
     iso27001-2017:
     - virtual environments are not explicitly covered by ISO 27001 - too specific
@@ -110,11 +120,16 @@ Infrastructure Hardening:
     usefulness: 4
     level: 3
     implementation:
-    - GitOps
-    - Ansible
-    - Chef
-    - Puppet
-    - Jenkinsfile
+    - name: GitOps
+      tags: []
+    - name: Ansible
+      tags: []
+    - name: Chef
+      tags: []
+    - name: Puppet
+      tags: []
+    - name: Jenkinsfile
+      tags: []
     samm2: o-environment-management|A|1
     iso27001-2017:
     - not explicitly covered by ISO 27001 - too specific
@@ -133,8 +148,10 @@ Infrastructure Hardening:
     dependsOn:
     - Applications are running in virtualized environments
     implementation:
-    - seccomp
-    - strace
+    - name: seccomp
+      tags: []
+    - name: strace
+      tags: []
     samm2: o-environment-management|A|1
     iso27001-2017:
     - system hardening is not explicitly covered by ISO 27001 - too specific
@@ -153,7 +170,8 @@ Infrastructure Hardening:
     - Usage of <a href="https://semver.org/">Semantic Versioning</a> for components
       like project images
     implementation:
-    - Remove direct access to infrastructure
+    - name: Remove direct access to infrastructure
+      tags: []
     samm2: o-environment-management|A|1
     iso27001-2017:
     - not explicitly covered by ISO 27001 - too specific
@@ -211,8 +229,10 @@ Infrastructure Hardening:
     usefulness: 3
     level: 3
     implementation:
-    - Directory Service
-    - Plugins
+    - name: Directory Service
+      tags: []
+    - name: Plugins
+      tags: []
     dependsOn:
     - Defined deployment process
     - Defined build process
@@ -232,10 +252,14 @@ Infrastructure Hardening:
     usefulness: 4
     level: 3
     implementation:
-    - Smartcard
-    - YubiKey
-    - SMS
-    - TOTP
+    - name: Smartcard
+      tags: []
+    - name: YubiKey
+      tags: []
+    - name: SMS
+      tags: []
+    - name: TOTP
+      tags: []
     samm2: TODO
     iso27001-2017:
     - not explicitly covered by ISO 27001 - too specific
@@ -255,8 +279,10 @@ Infrastructure Hardening:
     dependsOn:
     - Defined deployment process
     implementation:
-    - HTTP-Basic Authentication
-    - VPN
+    - name: HTTP-Basic Authentication
+      tags: []
+    - name: VPN
+      tags: []
     samm: EH1-B
     samm2: o-environment-management|A|1
     iso27001-2017:
@@ -292,10 +318,14 @@ Infrastructure Hardening:
     usefulness: 3
     level: 2
     implementation:
-    - For applications: Check default encoding
-    - managing secrets
-    - crypto
-    - authentication
+    - name: 'For applications: Check default encoding'
+      tags: []
+    - name: managing secrets
+      tags: []
+    - name: crypto
+      tags: []
+    - name: authentication
+      tags: []
     dependsOn:
     - Defined build process
     samm2: o-environment-management|A|1

data-new/TestAndVerification/Consolidation.yaml

@@ -62,13 +62,12 @@ Consolidation:
     - name: SAST
       tags: []
       description: 'At SAST (Static Application Security Testing): Server-side / client-side
-        teams can easily be recorded.
-        With microservice architecture individual microservices can be used usually Teams.'
+        teams can easily be recorded. With microservice architecture individual microservices
+        can be used usually Teams.'
     - name: DAST
       tags: []
-      description: 'At DAST (Dynamic
-        Application Security Testing): vulnerabilities are classified and can be assigned
-        to server-side and client-side teams.'
+      description: 'At DAST (Dynamic Application Security Testing): vulnerabilities
+        are classified and can be assigned to server-side and client-side teams.'
     samm2: i-defect-management|B|2
     iso27001-2017:
     - not explicitly covered by ISO 27001 - too specific