+
+ +
+
diff --git a/Dashboard/.editorconfig b/Dashboard/.editorconfig new file mode 100644 index 0000000..e89330a --- /dev/null +++ b/Dashboard/.editorconfig @@ -0,0 +1,13 @@ +# Editor configuration, see https://editorconfig.org +root = true + +[*] +charset = utf-8 +indent_style = space +indent_size = 2 +insert_final_newline = true +trim_trailing_whitespace = true + +[*.md] +max_line_length = off +trim_trailing_whitespace = false diff --git a/Dashboard/.gitignore b/Dashboard/.gitignore new file mode 100644 index 0000000..f5c4290 --- /dev/null +++ b/Dashboard/.gitignore @@ -0,0 +1,47 @@ +# See http://help.github.com/ignore-files/ for more about ignoring files. + +# compiled output +/dist +/tmp +/out-tsc +# Only exists if Bazel was run +/bazel-out + +# dependencies +/node_modules + +# profiling files +chrome-profiler-events*.json +speed-measure-plugin*.json' +package-lock.json + +# IDEs and editors +/.idea +.project +.classpath +.c9/ +*.launch +.settings/ +*.sublime-workspace + +# IDE - VSCode +.vscode/* +!.vscode/settings.json +!.vscode/tasks.json +!.vscode/launch.json +!.vscode/extensions.json +.history/* + +# misc +/.sass-cache +/connect.lock +/coverage +/libpeerconnection.log +npm-debug.log +yarn-error.log +testem.log +/typings + +# System Files +.DS_Store +Thumbs.db diff --git a/Dashboard/README.md b/Dashboard/README.md new file mode 100644 index 0000000..a26a6f3 --- /dev/null +++ b/Dashboard/README.md @@ -0,0 +1,138 @@ +# OWASP SAMM 2.0 + +
+ + + +# SAMM + + +### Explanatory Video + + + + +### Login Page + + + + +### Home Dashboard + + + + +### Navigation Module + + + + + +### Security Practice Section + + + + +### Score Panel + + + + +### Checklist Module + + + + +### Report Generation + + + + +### Edit Score Module + + + + +This project was generated with [Angular CLI](https://github.com/angular/angular-cli) version 8.3.19. + +## Software Requirements + +1) NodeJS: https://nodejs.org/en/download/ + a. Make sure your node server is installed and check the version by running the command `npm -v` in command prompt. + Note: Make sure your npm path added to your environment variable. + +2) Angular CLI: After installing NodeJS, install angular CLI. + a. To install Angular CLI, run command `npm install -g @angular/cli` in your command line. + Reference: https://cli.angular.io/ + + b. You can check your angular cli version by running the command `npm -v` in command prompt. + Note: Make sure angular cli path is added to your environment variable. + +3) Mysql (Xampp Server): https://www.apachefriends.org/download.html or MYSQL Server + +## Installation Instructions + +1) Open XAMPP Control panel and open phpmyadmin +2) Make sure your phpmyadmin Username & Password is `root`. + In order to change the user credential, + 1) open the file `c:/xampp/phpMyAdmin/config.inc.php` + 2) Go to line number 20 and make changes to the folowing parameters, + + $cfg['Servers'][$i]['user'] = 'root'; + $cfg['Servers'][$i]['password'] = 'root'; + $cfg['Servers'][$i]['extension'] = 'mysqli'; + $cfg['Servers'][$i]['AllowNoPassword'] = false; + + 3) Save the file. + 4) Restart the Mysql Server via xampp control Pannel. + +3) From phpmyadmin and in database import the `samm.sql` file in a new database as `samm`. + #### For Mysql + Open command propmt in the parent directory and run `mysql` (Mysql should be added to the path of environment variables). Execute the following queries to import the `.sql` file, + `create database samm;` + `use samm;` + `mysql -u username –-password=your_password database_name < Path/to/samm.sql` +4) Navigate to `/server` directory and open command prompt and run the command: + `npm install nodemon` + Aftet installation, run the command:`npm start`(Do not close this terminal) +5) Navigate to `/server2` directory and open command prompt and run the command: + `npm install nodemon` + Aftet installation, run the command:`npm start`(Do not close this terminal) +6) To run the angular app, go to the parent directory `/SAMM` and run `ng serve` in cmd. (Do not close this terminal) +7) Open browser and navigate to `http://localhost:4208/`. The app will automatically reload if you change any of the source files. + +## Default User Credentials +Normal User Credentials - Can update scores for the business functions and security practices +Username - User +Passowrd - User@123 + +Auditor Credentials - Can review the scores updated by users for the business functions and security practices +Username - Auditor +Password - Auditor@123 + +Admin Credentials - Admin can add users to the portal and edit the questions. +Username - Admin +Password - Admin@123 + + +## To Serve Outside + +Static Public IP Configuration: +Navigate to `samm\src\environments\environment.ts` file. +Assign Public IP to the const token `hostname` + +Run Command: +Run ng serve `ng serve --host 0.0.0.0 --port| OrderID | \\nShipAddress | \\nShipCity | \\nShipCountry | \\n
|---|---|---|---|
| {{OrderID}} | \\n{{ShipAddress}} | \\n{{ShipCity}} | \\n{{ShipCountry}} | \\n
+ Our mission is to provide an effective and measurable way for all types of organizations to analyze and improve + their software security posture. We want to raise awareness and educate organizations on how to design, develop, + and deploy secure software through our self-assessment model. SAMM supports the complete software lifecycle and + is technology and process agnostic. We built SAMM to be evolutive and risk-driven in nature, as there is no single + recipe that works for all organizations.
+
+ SAMM is a prescriptive model, an open framework which is simple to use, fully defined, and measurable. The solution
+ details are easy enough to follow even for non-security personnel. It helps organizations analyze their current software
+ security practices, build a security program in defined iterations, show progressive improvements in secure practices, and
+ define and measure security-related activities.
+ SAMM was defined with flexibility in mind so that small, medium, and large organizations using any style of development can
+ customize and adopt it. It provides a means of knowing where your organization is on its journey towards software assurance
+ and understanding what is recommended to move to the next level of maturity.
+ SAMM does not insist that all organizations achieve the maximum maturity level in every category.
+ Each organization can determine the target maturity level for each Security Practice that is the best fit and adapt
+ the available templates for their specific needs.
+ The structure and setup of the SAMM model support:
+
disabled: {{ matCarouselSlide.disabled }}
+ +| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Security Requirements + | +{{security_rating}} | +
|---|---|
| Threat Assessment + | +{{threat_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Design | +|
|---|---|
| Architecture Design level 1 | +{{Architecture_Design_l1}} | +
| Architecture Design level 2 | +{{Architecture_Design_l2}} | +
| Architecture Design level 3 | +{{Architecture_Design_l3}} | +
| Technology Management level 1 | +{{Technology_Management_l1}} | +
| Technology Management level 2 | +{{Technology_Management_l2}} | +
| Technology Management level 3 | +{{Technology_Management_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Security Requirements + | +{{security_rating}} | +
|---|---|
| Threat Assessment + | +{{threat_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Design | +|
|---|---|
| Software Requirements level 1 | +{{Software_Requirements_l1}} | +
| Software Requirements level 2 | +{{Software_Requirements_l2}} | +
| Software Requirements level 3 | +{{Software_Requirements_l3}} | +
| Supplier Security level 1 | +{{Supplier_Security_l1}} | +
| Supplier Security level 2 | +{{Supplier_Security_l2}} | +
| Supplier Security level 3 | +{{Supplier_Security_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Security Requirements + | +{{security_rating}} | +
|---|---|
| Threat Assessment + | +{{threat_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Design | +|
|---|---|
| Application Risk Profile level 1 | +{{Application_Risk_Profile_l1}} | +
| Application Risk Profile level 2 | +{{Application_Risk_Profile_l3}} | +
| Application Risk Profile level 3 | +{{Application_Risk_Profile_l2}} | +
| Threat Modeling level 1 | +{{Threat_Modeling_l1}} | +
| Threat Modeling level 2 | +{{Threat_Modeling_l2}} | +
| Threat Modeling level 3 | +{{Threat_Modeling_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Governance | +|
|---|---|
| Training and Awareness level 1 | +{{Training_and_Awareness_l1 }} | +
| Training and Awareness level 2 | +{{Training_and_Awareness_l2 }} | +
| Training and Awareness level 3 | +{{Training_and_Awareness_l3 }} | +
| Organization and Culture level 1 | +{{Organization_and_Culture_l1}} | +
| Organization and Culture level 2 | +{{Organization_and_Culture_l2 }} | +
| Organization and Culture level 3 | +{{Organization_and_Culture_l3 }} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | +
| {{month_before_2}} | +{{score_before_2}} | +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Governance | +|
|---|---|
| Policy and Standards level 1 | +{{Policy_and_Standards_l1 }} | +
| Policy and Standards level 2 | +{{Policy_and_Standards_l2 }} | +
| Policy and Standards level 3 | +{{Policy_and_Standards_l3 }} | +
| Compliance Management level 1 | +{{Compliance_Management_l1}} | +
| Compliance Management level 2 | +{{Compliance_Management_l2 }} | +
| Compliance Management level 3 | +{{Compliance_Management_l3 }} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | +
| {{month_before_2}} | +{{score_before_2}} | +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Governance | +|
|---|---|
| Create and Promote level 1 | +{{Create_and_Promote_l1}} | +
| Create and Promote level 2 | +{{Create_and_Promote_l2}} | +
| Create and Promote level 3 | +{{Create_and_Promote_l3}} | +
| Measure and Improve level 1 | +{{Measure_and_Improve_l1}} | +
| Measure and Improve level 2 | +{{Measure_and_Improve_l2}} | +
| Measure and Improve level 3 | +{{Measure_and_Improve_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | +
| {{month_before_2}} | +{{score_before_2}} | +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Defect Management + | +{{defect_rating}} | +
|---|---|
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Implementation | +|
|---|---|
| Defect Tracking level 1 | +{{Defect_Tracking_l1}} | +
| Defect Tracking level 2 | +{{Defect_Tracking_l2}} | +
| Defect Tracking level 3 | +{{Defect_Tracking_l3}} | +
| Metrics and Feedback level 1 | +{{Metrics_and_Feedback_l1}} | +
| Metrics and Feedback level 2 | +{{Metrics_and_Feedback_l2}} | +
| Metrics and Feedback level 3 | +{{Metrics_and_Feedback_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Defect Management + | +{{defect_rating}} | +
|---|---|
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Implementation | +|
|---|---|
| Build Process level 1 | +{{Build_Process_l1}} | +
| Build Process level 2 | +{{Build_Process_l2}} | +
| Build Process level 3 | +{{Build_Process_l3}} | +
| Software Dependencies level 1 | +{{Software_Dependencies_l1}} | +
| Software Dependencies level 2 | +{{Software_Dependencies_l2}} | +
| Software Dependencies level 3 | +{{Software_Dependencies_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Defect Management + | +{{defect_rating}} | +
|---|---|
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Implementation | +|
|---|---|
| Deployment Process level 1 | +{{Deployment_Process_l1}} | +
| Deployment Process level 2 | +{{Deployment_Process_l2}} | +
| Deployment Process level 3 | +{{Deployment_Process_l3}} | +
| Secret Management level 1 | +{{Secret_Management_l1}} | +
| Secret Management level 2 | +{{Secret_Management_l2}} | +
| Secret Management level 3 | +{{Secret_Management_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
|---|---|
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Implementation | +|
|---|---|
| Configuration Hardening level 1 | +{{Configuration_Hardening_l1}} | +
| Configuration Hardening level 2 | +{{Configuration_Hardening_l2}} | +
| Configuration Hardening level 3 | +{{Configuration_Hardening_l3}} | +
| Patching and Updating level 1 | +{{Patching_and_Updating_l1}} | +
| Patching and Updating level 2 | +{{Patching_and_Updating_l2}} | +
| Patching and Updating level 3 | +{{Patching_and_Updating_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
|---|---|
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Implementation | +|
|---|---|
| Incident Detection level 1 | +{{Incident_Detection_l1}} | +
| Incident Detection level 2 | +{{Incident_Detection_l2}} | +
| Incident Detection level 3 | +{{Incident_Detection_l3}} | +
| Incident Response level 1 | +{{Incident_Response_l1}} | +
| Incident Response level 2 | +{{Incident_Response_l2}} | +
| Incident Response level 3 | +{{Incident_Response_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
|---|---|
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Implementation | +|
|---|---|
| Data Protection level 1 | +{{Data_Protection_l1}} | +
| Data Protection level 2 | +{{Data_Protection_l2}} | +
| Data Protection level 3 | +{{Data_Protection_l3}} | +
| System decommissioning Legacy management level 1 | +{{System_decommissioningLegacy_management_l1}} | +
| System decommissioning Legacy management level 2 | +{{System_decommissioningLegacy_management_l2}} | +
| System decommissioning Legacy management level 3 | +{{System_decommissioningLegacy_management_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| ID | +{{element.id}} | +Question | +{{element.question}} | +Group Name | +{{element.groupname}} | +Security Practice | +{{element.secpractice}} | +Score | +{{element.score}} | +Commentor | +{{element.commentor}} | +Date | +{{element.created}} | +
|---|
{{hr1}}0h
+ + +{{hr2}}0h
+ + +0{{hr3}}h
+ + +{{hr4}}0h
+ + +{{hr4}}770h
+ + +{{hr6}}0h
+ + +{{hr7}}0h
+ + +{{hr7}}0h
+ + +{{hr8}}0h
+ + +{{hr9}}0h
+ + +{{hr10}}0h
+ + +{{hr11}}0h
+ + +{{hr12}}0h
+ + +{{hr13}}0h
+ + +{{hr14}}0h
+ + +| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
|---|---|
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Implementation | +|
|---|---|
| Architecture Validation level 1 | +{{Architecture_Validation_l1}} | +
| Architecture Validation level 2 | +{{Architecture_Validation_l2}} | +
| Architecture Validation level 3 | +{{Architecture_Validation_l3}} | +
| Architecture Compliance level 1 | +{{Architecture_Compliance_l1}} | +
| Architecture Compliance level 2 | +{{Architecture_Compliance_l2}} | +
| Architecture Compliance level 3 | +{{Architecture_Compliance_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
|---|---|
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Implementation | +|
|---|---|
| Control Verification level 1 | +{{Control_Verification_l1}} | +
| Control Verification level 2 | +{{Control_Verification_l2}} | +
| Control Verification level 3 | +{{Control_Verification_l3}} | +
| Misuse Abuse Testing level 1 | +{{MisuseAbuse_Testing_l1}} | +
| Misuse Abuse Testing level 2 | +{{MisuseAbuse_Testing_l2}} | +
| Misuse Abuse Testing level 3 | +{{MisuseAbuse_Testing_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +
| Strategy & Metrics + | +{{strategy_rating}} | +
|---|---|
| Education & Guidance + | +{{education_rating}} | +
| Policy & Compliance + | +{{policy_rating}} | +
| Threat Assessment + | +{{threat_rating}} | +
| Security Requirements + | +{{security_rating}} | +
| Secure Architecture + | +{{secure_arch_rating}} | +
| Defect Management + | +{{defect_rating}} | +
| Secure Build + | +{{secure_build_rating}} | +
| Secure Deployment + | +{{secure_deploy_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Environment Management + | +{{operate_environment_rating}} | +
| Incident Management + | +{{operate_incident_rating}} | +
| Operational Management + | +{{operate_operational_rating}} | +
| Architecture Assessment + | +{{verify_arch_rating}} | +
|---|---|
| Requirements Driven Testing + | +{{verify_requirement_rating}} | +
| Security Testing + | +{{verify_security_rating}} | +
| Implementation | +|
|---|---|
| Scalable Baseline level 1 | +{{Scalable_Baseline_l1}} | +
| Scalable Baseline level 2 | +{{Scalable_Baseline_l2}} | +
| Scalable Baseline level 3 | +{{Scalable_Baseline_l3}} | +
| Deep Understanding level 1 | +{{Deep_Understanding_l1}} | +
| Deep Understanding level 2 | +{{Deep_Understanding_l2}} | +
| Deep Understanding level 3 | +{{Deep_Understanding_l3}} | +
| {{month_pre}} | +{{score_cur}} | + +
|---|---|
| {{month_before_1}} | +{{score_before_1}} | + +
| {{month_before_2}} | +{{score_before_1}} | + +