scm

Security Control Management

SCM (Security Control Management) is a simple ways to manage your security control management system based on industry standards.

------------------------------------------------------------------

SCM is under development and is considered a work in progress.

------------------------------------------------------------------

Features ( Roadmap #1 ):

1. Definitions

• 1.1. PCI-DSS Requirements and Security Assessment Procedures Version 3.2.1 |||-->[ ✅ MVP Done ]
• 1.2. CIS Controls Version 7.1 |||-->[ ✅ MVP Done ]
• 1.3. CIS Kubernetes Benchmark Version 1.5.1 |||-->[ 🔂 In Progress ]
• 1.4. CIS Docker Benchmark Version 1.2.0

2. Mappings

• 2.1. Mapping CIS Kubernetes Benchmark Versionn 1.5.1 To CIS Control Version 7.1 |||-->[ 🔂 In Progress ]
• 2.2. Mapping CIS Controls Version 7.1 To PCI-DSS Requirement and Security Assessment Procedures Version 3.2.1 |||-->[ ✅ MVP Done ]

3. Tools

• 3.1. Using/Import kube-bench Capabilities (https://github.com/aquasecurity/kube-bench) |||-->[ 🔂 In Progress ]
• 3.2. Using/Import docker-bench Capabilities (https://github.com/aquasecurity/docker-bench) OR
• 3.3. Using/Import docker-bench-security Capabilities (https://github.com/docker/docker-bench-security)

4. Reports

• 4.1. CIS Kubernetes Benchmark Report
• 4.2. CIS Docker Benchmark Report
• 4.3. CIS Controls Report |||-->[ 🔂 In Progress ]
• 4.4. PCI DSS Controls Report |||-->[ 🔂 In Progress ]

5. Integration: Automation

• 5.1. Ansible

6. Integration: Notifications/Alerts

• 6.1. Slack
• 6.2. Email

References:

• PCI DSS (https://www.pcisecuritystandards.org/document_library)
• CIS Controls (https://www.cisecurity.org/controls/)
• CIS Kubernetes Benchmark (https://www.cisecurity.org/benchmark/kubernetes/)
• CIS Docker Benchmark (https://www.cisecurity.org/benchmark/docker/)
• CIS CSAT (https://csat.cisecurity.org/)
• AuditScripts Critical Security Controls (https://www.auditscripts.com/free-resources/critical-security-controls/)
• Ansible (https://docs.ansible.com/ansible/latest/)