valitydev/wazuh-kibana-app
14
0
Fork 0
mirror of https://github.com/valitydev/wazuh-kibana-app.git synced 2024-11-06 18:05:20 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

Added pdfmake format to pci/gdpr

Browse Source
This commit is contained in:
Jesús Ángel 2018-07-19 15:18:18 +02:00
parent 3001bdbe5b
commit d6a875be43
4 changed files with 168 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

24
server/integration-files/gdpr-requirements-pdfmake.js Normal file
View File

@ -0,0 +1,24 @@
/*
* Wazuh app - Module for GDPR requirements (Reporting)
* Copyright (C) 2018 Wazuh, Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* Find more information about this on the LICENSE file.
*/
export default {
"II_5.1.f": "Ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services, verifying its modifications, accesses, locations and guarantee the safety of them. File sharing protection and file sharing technologies that meet the requirements of data protection.",
"III_14.2.c": " Restrict the processing of personal data temporarily.",
"III_17": " Permanently erase personal information of a subject.",
"IV_24.2": "Be able to demonstrate compliance with the GDPR by complying with data protection policies.",
"IV_28": " Ensure data protection during processing, through technical and organizational measures.",
"IV_30.1.g": "It is necessary to keep all processing activities documented, to carry out an inventory of data from beginning to end and an audit, in order to know all the places where personal and sensitive data are located, processed, stored or transmitted.",
"IV_32.1.c": "Data Loss Prevention (DLP) capabilities to examine data flows and identify personal data that is not subject to adequate safeguards or authorizations. DLP tools can block or quarantine such data flows. Classify current data appropriately to determine specific categories of data that will be subject to the GDPR.",
"IV_32.2": "Account management tools that closely monitor actions taken by standard administrators and users who use standard or privileged account credentials are required to control access to data. ",
"IV_33": " Notify the supervisory authority of a violation of the data in 72 hours and in certain cases, the injured parties.",
"IV_35.1": "Perform a data protection impact evaluation for high risk processes. Implement appropriate technical measures to safeguard the rights and freedoms of data subjects, informed by an assessment of the risks to these rights and freedoms.",
"IV_35.7.d": "Capabilities for identification, blocking and forensic investigation of data breaches by malicious actors, through compromised credentials, unauthorized network access, persistent threats and verification of the correct operation of all components. Network perimeter and endpoint security tools to prevent unauthorized access to the network, prevent the entry of unwanted data types and malicious threats. Anti-malware and anti-ransomware to prevent malware and ransomware threats from entering your devices. A behavioral analysis that uses machine intelligence to identify people who do anomalous things on the network, in order to give early visibility and alert employees who start to become corrupt."
};

2
server/integration-files/gdpr-requirements.js
View File

@ -21,4 +21,4 @@ export default {
"IV_33": " Notify the supervisory authority of a violation of the data in 72 hours and in certain cases, the injured parties.",
"IV_35.1": "Perform a data protection impact evaluation for high risk processes. Implement appropriate technical measures to safeguard the rights and freedoms of data subjects, informed by an assessment of the risks to these rights and freedoms.",
"IV_35.7.d": "Capabilities for identification, blocking and forensic investigation of data breaches by malicious actors, through compromised credentials, unauthorized network access, persistent threats and verification of the correct operation of all components.<br>Network perimeter and endpoint security tools to prevent unauthorized access to the network, prevent the entry of unwanted data types and malicious threats. Anti-malware and anti-ransomware to prevent malware and ransomware threats from entering your devices.<br>A behavioral analysis that uses machine intelligence to identify people who do anomalous things on the network, in order to give early visibility and alert employees who start to become corrupt."
}
};

142
server/integration-files/pci-requirements-pdfmake.js Normal file
View File

@ -0,0 +1,142 @@
/*
* Wazuh app - Module for PCI requirements (Reporting)
* Copyright (C) 2018 Wazuh, Inc.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License as published by
* the Free Software Foundation; either version 2 of the License, or
* (at your option) any later version.
*
* Find more information about this on the LICENSE file.
*/
export default {
"1.1.1": "A formal process for approving and testing all network connections and changes to the firewall and router configurations",
"1.3.4": "Do not allow unauthorized outbound traffic from the cardholder data environment to the Internet.",
"1.4": {
stack: [
"Install personal firewall software or equivalent functionality on any portable computing devices (including company and/or employee-owned) that connect to the Internet when outside the network (for example, laptops used by employees), and which are also used to access the CDE. Firewall (or equivalent) configurations include:",
{
ul: [
"Specific configuration settings are defined.",
"Personal firewall (or equivalent functionality) is actively running.",
"Personal firewall (or equivalent functionality) is not alterable by users of the portable computing devices."
]
}
]
},
"2.2": "Develop configuration standards for all system components. Assure that these standards address all known security vulnerabilities and are consistent with industry accepted system hardening standards (CIS, ISO, SANS, NIST).",
"2.2.2": "Enable only necessary services, protocols, daemons, etc., as required for the function of the system. ",
"2.2.3": "Implement additional security features for any required services, protocols, or daemons that are considered to be insecure",
"2.2.4": "Configure system security parameters to prevent misuse.",
"4.1": {
stack: [
"Use strong cryptography and security protocols (for example, SSL/TLS, IPSEC, SSH, etc.) to safeguard sensitive cardholder data during transmission over open, public networks, including the following:",
{
ul: [
"Only trusted keys and certificates are accepted.",
"The protocol in use only supports secure versions or configurations.",
"The encryption strength is appropriate for the encryption methodology in use."
]
}
]
},
"5.1": "Deploy anti-virus software on all systems commonly affected by malicious software (particularly personal computers and servers).",
"5.2": {
stack: [
"Ensure that all anti-virus mechanisms are maintained as follows:",
{
ul: [
"Are kept current.",
"Perform periodic scans.",
"Generate audit logs which are retained per PCI DSS Requirement 10.7."
]
}
]
},
"6.2": "Ensure that all system components and software are protected from known vulnerabilities by installing applicable vendor-supplied security patches. Install critical security patches within one month of release.",
"6.5": {
stack: [
"Address common coding vulnerabilities in software development processes as follows:",
{
ul: [
"Train developers in secure coding techniques, including how to avoid common coding vulnerabilities, and understanding how sensitive data is handled in memory.",
"Develop applications based on secure coding guidelines."
]
}
]
},
"6.5.1": "Injection flaws, particularly SQL injection. Also consider OS Command Injection, LDAP and XPath injection flaws as well as other injection flaws.",
"6.5.2": "Buffer overflows",
"6.5.5": "Improper error handling",
"6.5.7": "Cross-site scripting (XSS)",
"6.5.8": "Improper access control (such an insecure direct object references, failure to restrict URL access, directory traversal, and failure to restrict user access to functions).",
"6.5.10": "Broken authentication and session management.",
"6.6": {
stack: [
"For public-facing web applications, address new threats and vulnerabilities on an ongoing basis and ensure these applications are protected against known attacks by either of the following methods:",
{
ul: [
"Reviewing public-facing web applications via manual or automated application vulnerability security assessment tools or methods, at least annually and after any changes",
"Installing an automated technical solution that detects and prevents web-based attacks (for example, a web-application firewall) in front of public-facing web applications, to continually check all traffic."
]
}
]
},
"8.1.2": "Control addition, deletion, and modification of user IDs, credentials, and other identifier objects.",
"8.1.4": "Remove/disable inactive user accounts within 90 days.",
"8.1.5":
{
stack: [
"Manage IDs used by third parties to access, support, or maintain system components via remote access as follows:",
{
ul: [
"Enabled only during the time period needed and disabled when not in use.",
"Monitored when in use."
]
}
]
},
"8.1.6": "Limit repeated access attempts by locking out the user ID after not more than six attempts.",
"8.1.8": "If a session has been idle for more than 15 minutes, require the user to reauthenticate to re-activate the terminal or session.",
"8.2.4": "Change user passwords/passphrases at least once every 90 days.",
"8.5.1": "Additional requirement for service providers: Service providers with remote access to customer premises (for example, for support of POS systems or servers) must use a unique authentication credential (such as a password/phrase) for each customer.",
"8.7": {
stack: [
"All access to any database containing cardholder data (including access by applications, administrators, and all other users) is restricted as follows:",
{
ul: [
"All user access to, user queries of, and user actions on databases are through programmatic methods.",
"Only database administrators have the ability to directly access or query databases.",
"Application IDs for database applications can only be used by the applications (and not by individual users or other non-application processes)."
]
}
]
},
"10.1": "Implement audit trails to link all access to system components to each individual user.",
"10.2.1": "All individual user accesses to cardholder data",
"10.2.2": "All actions taken by any individual with root or administrative privileges.",
"10.2.4": "Invalid logical access attempts",
"10.2.5": "Use of and changes to identification and authentication mechanisms including but not limited to creation of new accounts and elevation of privileges and all changes, additions, or deletions to accounts with root or administrative privileges.",
"10.2.6": "Initialization, stopping, or pausing of the audit logs",
"10.2.7": "Creation and deletion of system level objects",
"10.5.2": "Protect audit trail files from unauthorized modifications",
"10.5.5": "Use file integrity monitoring or change detection software on logs to ensure that existing log data cannot be changed without generating alerts (although new data being added should not cause an alert).",
"10.4": "Using time-synchronization technology, synchronize all critical system clocks and times and ensure that the following is implemented for acquiring, distributing, and storing time.",
"10.6": "Review logs and security events for all system components to identify anomalies or suspicious activity",
"10.6.1": {
stack: [
"Review the following at least daily:",
{
ul: [
"All security events.",
"Logs of all system components that store, process, or transmit CHD and/or SAD, or that could impact the security of CHD and/or SAD.",
"Logs of all critical system components.",
"Logs of all servers and system components that perform security functions (for example, firewalls, intrusion detection systems/intrusion prevention systems (IDS/IPS), authentication servers, ecommerce redirection servers, etc.)"
]
}
],
style: 'standard'
},
"11.4": "Use intrusion detection and/or intrusion prevention techniques to detect and/or prevent intrusions into the network. Monitor all traffic at the perimeter of the cardholder data environment as well as at critical points in the cardholder data environment, and alert personnel to suspected compromises. Keep all intrusion detection and prevention engines, baselines, and signatures up to date.",
"11.5": "Deploy a change detection mechanism (for example, file integrity monitoring tools) to alert personnel to unauthorized modification of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly."
};

2
server/integration-files/pci-requirements.js
View File

@ -51,4 +51,4 @@ export default {
"10.6.1": "Review the following at least daily: <br><ul><li>All security events</li><li>Logs of all system components that store, process, or transmit CHD and/or SAD, or that could</li>impact the security of CHD and/or SAD</li><li>Logs of all critical system components</li><li>Logs of all servers and system components that perform security functions (for example, firewalls, intrusion detection systems/intrusion prevention systems (IDS/IPS), authentication servers, ecommerce redirection servers, etc.)</li></ul>",
"11.4": "Use intrusion detection and/or intrusion prevention techniques to detect and/or prevent intrusions into the network.<br>Monitor all traffic at the perimeter of the cardholder data environment as well as at critical points in the cardholder data environment, and alert personnel to suspected compromises. Keep all intrusion detection and prevention engines, baselines, and signatures up to date.",
"11.5": "Deploy a change detection mechanism (for example, file integrity monitoring tools) to alert personnel to unauthorized modification of critical system files, configuration files, or content files; and configure the software to perform critical file comparisons at least weekly."
}
};