From 06b59fe2200eef73affcdb9745b1a6e8e72ed1f3 Mon Sep 17 00:00:00 2001 From: John Smith Date: Fri, 21 Aug 2026 16:25:49 +0100 Subject: [PATCH] Fix remaining IAM reference issues not covered by applied suggestions Follow-up to #82: removes the duplicate MFA UUIDs left in InfrastructureHardening.yaml (reintroduced by a main merge, already moved to IdentityAndAccessManagement.yaml), moves architecture/technology decisions (IdP, fine-grained access, policy-as-code, MFA, workload identity) off the generic O-EM-A SAMM2 code onto D-SA, fixes an Account inventory ISO 2013/2022 control mismatch, and adds verified MITRE D3FEND mappings where a real technique applies. --- .../IdentityAndAccessManagement.yaml | 43 +++++++----- .../InfrastructureHardening.yaml | 66 ------------------- 2 files changed, 27 insertions(+), 82 deletions(-) diff --git a/src/assets/YAML/default/Implementation/IdentityAndAccessManagement.yaml b/src/assets/YAML/default/Implementation/IdentityAndAccessManagement.yaml index 5174733..b1e2351 100644 --- a/src/assets/YAML/default/Implementation/IdentityAndAccessManagement.yaml +++ b/src/assets/YAML/default/Implementation/IdentityAndAccessManagement.yaml @@ -26,11 +26,13 @@ Implementation: - access-control references: samm2: - - O-EM-A-1 # Configuration Hardening + - O-EM-A-1 # Configuration Hardening iso27001-2017: - 9.4.1 # Information Access Restriction iso27001-2022: - 8.3 # Information Access Restriction + d3f: + - PasswordAuthentication comments: "" MFA for admins: @@ -56,7 +58,7 @@ Implementation: - mfa references: samm2: - - O-EM-A-1 # Configuration Hardening + - D-SA-B-1 # Technology Management iso27001-2017: - 9.2.4 # Management of secret authentication information - 9.4.2 # Secure log-on procedures @@ -135,12 +137,11 @@ Implementation: - inventory references: samm2: - - O-EM-A-1 + - O-EM-A-1 # Configuration Hardening iso27001-2017: - - 9.2.1 + - 9.2.1 # User registration and de-registration iso27001-2022: - 5.16 # Identity management - - 8.2 # Privileged access rights comments: "" Central identity provider for human access: @@ -179,7 +180,7 @@ Implementation: - sso references: samm2: - - O-EM-A-1 # Configuration Hardening + - D-SA-A-2 # Architecture Design iso27001-2017: - 9.2.1 # User registration and de-registration - 9.2.4 # Management of secret authentication information @@ -213,7 +214,7 @@ Implementation: - mfa references: samm2: - - O-EM-A-1 #Configuration Hardening + - D-SA-B-2 # Technology Management iso27001-2017: - 9.2.4 # Management of secret authentication information - 9.4.2 # Secure log-on procedures @@ -315,11 +316,13 @@ Implementation: - oidc references: samm2: - - D-SR-A-2 + - D-SR-A-2 # Software Requirements iso27001-2017: - - 9.4.2 + - 9.4.2 # Secure log-on procedures iso27001-2022: - - 8.5 + - 8.5 # Secure authentication + d3f: + - Token-basedAuthentication comments: "" Fine-Grained Access Controls for authentication and authorization: @@ -363,11 +366,13 @@ Implementation: - pbac references: samm2: - - O-EM-A-2 # Configuration Hardening + - D-SA-A-3 # Architecture Design iso27001-2017: - 9.4.1 # Information Access Restriction iso27001-2022: - 8.3 # Information Access Restriction + d3f: + - AccessModeling comments: "" Automated authorization test coverage: @@ -525,12 +530,14 @@ Implementation: - workload-identity references: samm2: - - O-EM-A-3 # Configuration Hardening + - D-SA-B-2 # Technology Management iso27001-2017: - 9.2.4 # Management of secret authentication information iso27001-2022: - 5.16 # Identity management - 8.3 # Information access restriction + d3f: + - Certificate-basedAuthentication comments: "" Just-in-time privileged access: @@ -617,6 +624,8 @@ Implementation: iso27001-2022: - 5.18 # Access rights - 8.2 # Privileged access rights + d3f: + - AccessModeling comments: "" # ---------- Level 5: continuous verification & policy as code ---------- @@ -659,11 +668,11 @@ Implementation: - policy-as-code references: samm2: - - O-EM-A-3 + - D-SA-B-3 # Technology Management iso27001-2017: - - 9.4.1 + - 9.4.1 # Information Access Restriction iso27001-2022: - - 8.3 + - 8.3 # Information access restriction comments: "" Continuous and risk-adaptive access: @@ -703,8 +712,10 @@ Implementation: samm2: - O-EM-A-3 # Configuration Hardening iso27001-2017: - - 9.4.1 # Information Access Restriction + - 9.2.3 # Management of privileged access rights iso27001-2022: - 8.2 # Privileged access rights - 8.16 # Monitoring activities + d3f: + - UserBehaviorAnalysis comments: "" diff --git a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml index 1d6c95b..7fc2ef9 100755 --- a/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml +++ b/src/assets/YAML/default/Implementation/InfrastructureHardening.yaml @@ -2,72 +2,6 @@ --- Implementation: Infrastructure Hardening: - MFA for admins: - uuid: 8098e416-e1ed-4ae4-a561-83efbe76bf57 - risk: - One factor authentication is more vulnerable to brute force attacks and - is considered less secure. - measure: - Two ore more factor authentication for all privileged accounts on systems and - applications - difficultyOfImplementation: - knowledge: 2 - time: 1 - resources: 2 - usefulness: 4 - level: 1 - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/yubikey - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sms - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/totp - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - 9.2.4 - - 6.1.2 # Segregation of duties. - - 14.2.1 # Secure development policies. - iso27001-2022: - - 5.17 # Authentication information - - 5.3 - - 8.25 - d3f: - - Multi-factorAuthentication - comments: "" - MFA: - uuid: 598e9f13-1ac8-4a01-b85e-8fab93ee81de - risk: - One factor authentication is more vulnerable to brute force attacks and - is considered less secure. - measure: - Two ore more factor authentication for all accounts on all (important) systems and - applications - difficultyOfImplementation: - knowledge: 2 - time: 2 - resources: 2 - usefulness: 4 - level: 2 - dependsOn: - - 8098e416-e1ed-4ae4-a561-83efbe76bf57 # MFA for admins - implementation: - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/yubikey - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/sms - - $ref: src/assets/YAML/default/implementations.yaml#/implementations/totp - references: - samm2: - - O-EM-A-1 - iso27001-2017: - - 9.2.4 - - 6.1.2 # Segregation of duties. - - 14.2.1 # Secure development policies. - iso27001-2022: - - 5.17 # Authentication information - - 5.3 - - 8.25 - d3f: - - Multi-factorAuthentication - comments: "" Usage of containers: uuid: 3a94d55e-fd82-4996-9eb3-20d23ff2a873 risk: