Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add POAM Constraints #1178

Merged
Merged
Show file tree
Hide file tree
Changes from 1 commit
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions features/fedramp_extensions.feature
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,9 @@ Examples:
| network-component-has-implementation-point |
| non-provider-responsible-role-references-user |
| party-has-name |
| poam-item-has-scheduled-completion-date |
| poam-item-has-status-date |
| poam-item-has-vendor-checkin-date |
| privilege-level |
| prop-response-point-has-cardinality-one |
| resource-has-base64-or-rlink |
Expand All @@ -191,9 +194,11 @@ Examples:
| saas-has-leveraged-authorization |
| scan-type |
| scan-type-has-remarks |
| scheduled-completion-date-type |
| security-level |
| security-sensitivity-level-matches-security-impact-level |
| statement-has-this-system-component |
| status-date-type |
| unique-inventory-item-asset-id |
| used-by-link-references-component |
| user-authentication |
Expand All @@ -204,6 +209,7 @@ Examples:
| user-sensitivity-level |
| user-type |
| validation-reference-has-correct-format |
| vendor-dependency |
#END_DYNAMIC_CONSTRAINT_IDS

@constraints
Expand Down Expand Up @@ -519,6 +525,12 @@ Examples:
| non-provider-responsible-role-references-user-PASS.yaml |
| party-has-name-FAIL.yaml |
| party-has-name-PASS.yaml |
| poam-item-has-scheduled-completion-date-FAIL.yaml |
| poam-item-has-scheduled-completion-date-PASS.yaml |
| poam-item-has-status-date-FAIL.yaml |
| poam-item-has-status-date-PASS.yaml |
| poam-item-has-vendor-checkin-date-FAIL.yaml |
| poam-item-has-vendor-checkin-date-PASS.yaml |
| privilege-level-FAIL.yaml |
| privilege-level-PASS.yaml |
| resource-has-base64-or-rlink-FAIL.yaml |
Expand Down Expand Up @@ -553,12 +565,16 @@ Examples:
| scan-type-PASS.yaml |
| scan-type-has-remarks-FAIL.yaml |
| scan-type-has-remarks-PASS.yaml |
| scheduled-completion-date-type-FAIL.yaml |
| scheduled-completion-date-type-PASS.yaml |
| security-level-FAIL.yaml |
| security-level-PASS.yaml |
| security-sensitivity-level-matches-security-impact-level-FAIL.yaml |
| security-sensitivity-level-matches-security-impact-level-PASS.yaml |
| statement-has-this-system-component-FAIL.yaml |
| statement-has-this-system-component-PASS.yaml |
| status-date-type-FAIL.yaml |
| status-date-type-PASS.yaml |
| unique-inventory-item-asset-id-FAIL.yaml |
| unique-inventory-item-asset-id-PASS.yaml |
| used-by-link-references-component-FAIL.yaml |
Expand All @@ -579,6 +595,8 @@ Examples:
| user-type-PASS.yaml |
| validation-reference-has-correct-format-FAIL.yaml |
| validation-reference-has-correct-format-PASS.yaml |
| vendor-dependency-FAIL.yaml |
| vendor-dependency-PASS.yaml |
#END_DYNAMIC_TEST_CASES

@style-guide
Expand Down
34 changes: 26 additions & 8 deletions src/content/awesome-cloud/xml/AwesomeCloudPOAM.xml
Original file line number Diff line number Diff line change
Expand Up @@ -217,63 +217,81 @@
<title>Asset Inventory Out of Date</title>
<description>
<h1>AwesomeCloud asset inventory is out of date.</h1>
</description>
</description>
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/>
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-05-01+00:00"/>
<related-observation observation-uuid="727fd8c7-8bb6-4e2d-add2-0cd32b022d17"/>
<associated-risk risk-uuid="0683df1e-880b-469c-a146-2bd8a25019dd"/>
</poam-item>
<poam-item uuid="7b3a39fb-3450-4230-8c34-70d3d8a4f8b5">
<title>SSL Certificate Expiry</title>
<description>
<h1>AwesomeCloud is utilize an expired SSL certificate</h1>
</description>
</description>
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/>
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-05-01+00:00"/>
<related-observation observation-uuid="c6d956e2-e6fa-412a-8143-dbc85d56713e"/>
<associated-risk risk-uuid="5811184c-af7c-46fa-aaef-c9eef1a043ac"/>
</poam-item>
<poam-item uuid="19343c6e-742d-43e0-9f47-133eba174f00">
<title>Ethernet Driver Information Disclosure</title>
<description>
<h1>Vulnerabilty Ehternet Driver</h1>
</description>
</description>
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/>
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-05-01+00:00"/>
<related-observation observation-uuid="5904569a-6efc-4842-ae7c-69199ed7c2bd"/>
<associated-risk risk-uuid="2eb9e124-1997-4806-8a39-50903bce2c94"/>
</poam-item>
<poam-item uuid="52b2726f-8cf9-4773-befe-2c1c412b1712">
<title>Weak hash algorithm of the SSL certificate</title>
<description>
<h1>Weak hashing algorithims are utilized</h1>
</description>
</description>
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/>
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-05-01+00:00"/>
<related-observation observation-uuid="82a52a6f-cd50-47ba-837a-fefd455da4e8"/>
<associated-risk risk-uuid="2a59c148-5c5d-4905-852c-fe5ac19850aa"/>
</poam-item>
<poam-item uuid="fc16a330-a930-4dc5-a473-089a1da2e81c">
<title>SMB Signing Enforcement</title>
<description>
<h1>SMB Sigining is not enforced</h1>
</description>
</description>
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/>
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-05-01+00:00"/>
<related-observation observation-uuid="7f9cb6de-5c98-4c2b-a433-4759c034f7a0"/>
<associated-risk risk-uuid="df607526-c3b5-4891-857f-e6f2956b7410"/>
</poam-item>
<poam-item uuid="fc16a330-a930-4dc5-a473-089a1da2e81c">
<title>RSA Keys Less Than 2048 Bits</title>
<description>
<h1>Certificate key length does not meet industry standards.</h1>
</description>
</description>
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/>
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-05-01+00:00"/>
<related-observation observation-uuid="0f8ae9c9-3355-4d47-bbd2-e4b4cba484d1"/>
<associated-risk risk-uuid="f4520307-1f24-4843-999c-ca778bf4c320"/>
</poam-item>
<poam-item uuid="3ef1747e-374c-42f3-a1aa-021cdc2d5271">
<title>TLS Version 1.0 Protocol</title>
<description>
<h1>AwesomeCloud employs a week version of TLS</h1>
</description>
</description>
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/>
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-05-01+00:00"/>
<related-observation observation-uuid="ddec6e55-d009-4491-bd95-f0077957f51b"/>
<associated-risk risk-uuid="6b595947-145b-4fbe-9f84-0645a076c859"/>
</poam-item>
<poam-item uuid="9f07e816-388f-4096-b625-58bd462f748d">
<title>AwesomeCloud Access Control Procedures Out Of Date</title>
<description>
<h1>AwesomeCloud has not update its access control procedures in accordance with defined policy.</h1>
</description>
</description>
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/>
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-05-01+00:00"/>
<prop name="has-vendor-dependency" ns="http://fedramp.gov/ns/oscal" value="yes"/>
<prop name="vendor-checkin-date" ns="http://fedramp.gov/ns/oscal" value="2023-06-01+00:00"/>
<related-observation observation-uuid="58e34e49-32bb-4c63-b9e6-158a0620fcd5"/>
<associated-risk risk-uuid="56aff720-e21a-4def-8ea6-e91388c1d96f"/>
</poam-item>
Expand Down
7 changes: 4 additions & 3 deletions src/scripts/dev-constraint.js
Original file line number Diff line number Diff line change
Expand Up @@ -148,9 +148,10 @@ async function scaffoldTest(constraintId,context) {

const { model } = await prompt([
{
type: 'string',
type: 'list',
name: 'model',
message: `What is the constraint targeting?`,
choices: ["ssp", "poam"],
default: "ssp"
}
]);
Expand All @@ -172,7 +173,7 @@ async function scaffoldTest(constraintId,context) {

let invalidContent;
if (useTemplate === 'new') {
const templatePath = model === 'ssp' ? path.join(__dirname, '..', '..', 'src', 'content', 'rev5', 'examples', 'ssp/xml', 'fedramp-ssp-example.oscal.xml') : path.join(__dirname, '..', '..', 'src', 'validations', 'constraints', 'content', `${model}-all-VALID.xml`);
const templatePath = model === 'ssp' ? path.join(__dirname, '..', '..', 'src', 'content', 'rev5', 'examples', 'ssp/xml', 'fedramp-ssp-example.oscal.xml') : path.join(__dirname, '..', '..', 'src', 'content', 'awesome-cloud', 'xml', 'AwesomeCloudPOAM.xml');
const newInvalidPath = path.join(__dirname, '..', '..', 'src', 'validations', 'constraints', 'content', `${model}-${constraintId}-INVALID.xml`);

try {
Expand Down Expand Up @@ -300,7 +301,7 @@ async function scaffoldTest(constraintId,context) {
'test-case': {
name: `Positive Test for ${constraintId}`,
description: `This test case validates the behavior of constraint ${constraintId}`,
content: model === 'ssp' ? '../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml' : `../content/${model}-all-VALID.xml`,
content: model === 'ssp' ? '../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml' : `../../../content/awesome-cloud/xml/AwesomeCloudPOAM.xml`,
expectations: [
{
'constraint-id': constraintId,
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
<plan-of-action-and-milestones xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="5f7afa40-3d9d-475b-9e34-47a768371be3">
<poam-item uuid="a908cb44-446a-450d-970d-73c968fd5389">
<!-- <prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/> Missing "scheduled-completion-date" prop. -->
</poam-item>
</plan-of-action-and-milestones>
Original file line number Diff line number Diff line change
@@ -0,0 +1,5 @@
<plan-of-action-and-milestones xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="5f7afa40-3d9d-475b-9e34-47a768371be3">
<poam-item uuid="a908cb44-446a-450d-970d-73c968fd5389">
<!-- <prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="2023-01-01+00:00"/> Missing "status-date" prop. -->
</poam-item>
</plan-of-action-and-milestones>
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
<plan-of-action-and-milestones xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="5f7afa40-3d9d-475b-9e34-47a768371be3">
<poam-item uuid="9f07e816-388f-4096-b625-58bd462f748d">
<prop name="has-vendor-dependency" ns="http://fedramp.gov/ns/oscal" value="yes"/>
<!-- <prop name="vendor-checkin-date" ns="http://fedramp.gov/ns/oscal" value="2023-06-01+00:00"/> Missing "vendor-checkin-date" prop. -->
<related-observation observation-uuid="58e34e49-32bb-4c63-b9e6-158a0620fcd5"/>
<associated-risk risk-uuid="56aff720-e21a-4def-8ea6-e91388c1d96f"/>
</poam-item>
</plan-of-action-and-milestones>
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
<plan-of-action-and-milestones xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="5f7afa40-3d9d-475b-9e34-47a768371be3">
<poam-item uuid="a908cb44-446a-450d-970d-73c968fd5389">
<!-- Invalid format for "scheduled-completion-date" prop. -->
<prop name="scheduled-completion-date" ns="http://fedramp.gov/ns/oscal" value="Invalid"/>
</poam-item>
</plan-of-action-and-milestones>
Original file line number Diff line number Diff line change
@@ -0,0 +1,6 @@
<plan-of-action-and-milestones xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="5f7afa40-3d9d-475b-9e34-47a768371be3">
<poam-item uuid="a908cb44-446a-450d-970d-73c968fd5389">
<!-- Invalid format for "status date" prop. -->
<prop name="status-date" ns="http://fedramp.gov/ns/oscal" value="Invalid"/>
</poam-item>
</plan-of-action-and-milestones>
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
<?xml version="1.0" encoding="UTF-8"?>
<plan-of-action-and-milestones
xmlns="http://csrc.nist.gov/ns/oscal/1.0"
uuid="5f7afa40-3d9d-475b-9e34-47a768371be3">
<poam-item uuid="9f07e816-388f-4096-b625-58bd462f748d">
<!-- Invalid value for "has-vendor-dependency" prop. -->
<prop name="has-vendor-dependency" ns="http://fedramp.gov/ns/oscal" value="invalid"/>
</poam-item>
</plan-of-action-and-milestones>
Original file line number Diff line number Diff line change
Expand Up @@ -659,6 +659,14 @@
<enum value="privileged">Privileged</enum>
</allowed-values>

<allowed-values id="vendor-dependency" target="poam-item/prop[@ns='http://fedramp.gov/ns/oscal' and @name='has-vendor-dependency']/@value" allow-other="no" level="ERROR">
<formal-name>Vendor Dependency</formal-name>
<description>Identifies if vendor dependency is indicated.</description>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/poam/4-poam-template-to-oscal-mapping/"/>
<enum value="yes">Yes</enum>
<enum value="no">No</enum>
</allowed-values>

</constraints>
</context>

Expand Down
31 changes: 31 additions & 0 deletions src/validations/constraints/fedramp-external-constraints.xml
Original file line number Diff line number Diff line change
Expand Up @@ -208,6 +208,37 @@

</context>

<context>
<metapath target="/plan-of-action-and-milestones/poam-item"/>
<constraints>
<expect id="poam-item-has-scheduled-completion-date" target="." test="count(prop[@ns='http://fedramp.gov/ns/oscal' and @name='scheduled-completion-date']) = 1" level="ERROR">
<formal-name>POAM Item Has Scheduled Completion Date</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/poam/4-poam-template-to-oscal-mapping/"/>
<message>A POAM item MUST have a scheduled completion date.</message>
</expect>
<expect id="poam-item-has-status-date" target="." test="count(prop[@ns='http://fedramp.gov/ns/oscal' and @name='status-date']) = 1" level="ERROR">
<formal-name>POAM Item Has Status Date</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/poam/4-poam-template-to-oscal-mapping/"/>
<message>A POAM item MUST have a status date.</message>
</expect>
<expect id="poam-item-has-vendor-checkin-date" target=".[prop[@ns='http://fedramp.gov/ns/oscal' and @name='has-vendor-dependency' and @value='yes']]" test="count(prop[@ns='http://fedramp.gov/ns/oscal' and @name='vendor-checkin-date']) = 1" level="ERROR">
<formal-name>POAM Item Has Vendor Check-in Date</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/poam/4-poam-template-to-oscal-mapping/"/>
<message>A POAM item MUST have a vendor check-in date if it is vendor dependent.</message>
</expect>
<matches id="scheduled-completion-date-type" target="prop[@ns='http://fedramp.gov/ns/oscal' and @name='scheduled-completion-date']/@value" datatype="date-with-timezone" level="ERROR">
<formal-name>Scheduled Completion Date Type</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/poam/4-poam-template-to-oscal-mapping/"/>
<message>A POAM item MUST specify the scheduled completion date as a "full-date" per RFC3339 with the addition of a timezone.</message>
</matches>
<matches id="status-date-type" target="prop[@ns='http://fedramp.gov/ns/oscal' and @name='status-date']/@value" datatype="date-with-timezone" level="ERROR">
<formal-name>Status Date Type</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/poam/4-poam-template-to-oscal-mapping/"/>
<message>A POAM item MUST specify the status date as a "full-date" per RFC3339 with the addition of a timezone.</message>
</matches>
</constraints>
</context>

<context>
<metapath target="/system-security-plan/back-matter"/>
<constraints>
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for poam-item-has-scheduled-completion-date
description: >-
This test case validates the behavior of constraint
poam-item-has-scheduled-completion-date
content: ../content/poam-poam-item-has-scheduled-completion-date-INVALID.xml
expectations:
- constraint-id: poam-item-has-scheduled-completion-date
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for poam-item-has-scheduled-completion-date
description: >-
This test case validates the behavior of constraint
poam-item-has-scheduled-completion-date
content: ../../../content/awesome-cloud/xml/AwesomeCloudPOAM.xml
expectations:
- constraint-id: poam-item-has-scheduled-completion-date
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for poam-item-has-status-date
description: >-
This test case validates the behavior of constraint
poam-item-has-status-date
content: ../content/poam-poam-item-has-status-date-INVALID.xml
expectations:
- constraint-id: poam-item-has-status-date
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for poam-item-has-status-date
description: >-
This test case validates the behavior of constraint
poam-item-has-status-date
content: ../../../content/awesome-cloud/xml/AwesomeCloudPOAM.xml
expectations:
- constraint-id: poam-item-has-status-date
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for poam-item-has-vendor-checkin-date
description: >-
This test case validates the behavior of constraint
poam-item-has-vendor-checkin-date
content: ../content/poam-poam-item-has-vendor-checkin-date-INVALID.xml
expectations:
- constraint-id: poam-item-has-vendor-checkin-date
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for poam-item-has-vendor-checkin-date
description: >-
This test case validates the behavior of constraint
poam-item-has-vendor-checkin-date
content: ../../../content/awesome-cloud/xml/AwesomeCloudPOAM.xml
expectations:
- constraint-id: poam-item-has-vendor-checkin-date
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Negative Test for scheduled-completion-date-type
description: >-
This test case validates the behavior of constraint
scheduled-completion-date-type
content: ../content/poam-scheduled-completion-date-type-INVALID.xml
expectations:
- constraint-id: scheduled-completion-date-type
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,9 @@
test-case:
name: Positive Test for scheduled-completion-date-type
description: >-
This test case validates the behavior of constraint
scheduled-completion-date-type
content: ../../../content/awesome-cloud/xml/AwesomeCloudPOAM.xml
expectations:
- constraint-id: scheduled-completion-date-type
result: pass
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Negative Test for status-date-type
description: This test case validates the behavior of constraint status-date-type
content: ../content/poam-status-date-type-INVALID.xml
expectations:
- constraint-id: status-date-type
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Positive Test for status-date-type
description: This test case validates the behavior of constraint status-date-type
content: ../../../content/awesome-cloud/xml/AwesomeCloudPOAM.xml
expectations:
- constraint-id: status-date-type
result: pass
Loading
Loading