@vorionsys/security 1.0.0

package/dist/security/incident/playbooks/configuration-error.js

@@ -0,0 +1,340 @@
+/**
+ * Configuration Error Response Playbook
+ *
+ * Streamlined playbook for responding to configuration error incidents.
+ * Covers verification, immediate mitigation, impact assessment, remediation,
+ * and post-incident configuration management improvements.
+ *
+ * Configuration errors are often quick to fix but may have security implications
+ * if they exposed data or created vulnerabilities.
+ *
+ * This playbook uses automated actions from the actions module that
+ * provide real implementations with rollback capabilities.
+ */
+import { createLogger } from '../../../common/logger.js';
+import { IncidentType, IncidentSeverity, NotificationChannel, StepType, } from '../types.js';
+const logger = createLogger({ component: 'incident-response' });
+// ============================================================================
+// Playbook Definition
+// ============================================================================
+/**
+ * Configuration error response steps using automated actions
+ *
+ * Steps are designed to:
+ * - Quickly verify the configuration issue and assess security impact
+ * - Implement immediate mitigation (fix config or disable service)
+ * - Assess if data was exposed or systems were compromised
+ * - Collect evidence if exposure occurred
+ * - Apply correct configuration and validate the fix
+ * - Restore normal operations
+ * - Update configuration management practices
+ */
+const configurationErrorSteps = [
+    // Phase 1: Detection and Verification
+    {
+        id: 'cfg-step-1',
+        name: 'Verify Configuration Issue',
+        type: StepType.MANUAL,
+        description: `
+      Verify the configuration error and assess security impact:
+      1. Review the alert or report identifying the configuration issue
+      2. Confirm the misconfiguration exists
+      3. Identify affected systems, services, or resources
+      4. Determine the type of misconfiguration (permissions, network, secrets, etc.)
+      5. Assess potential security impact (data exposure, unauthorized access, etc.)
+      6. Document initial findings and severity assessment
+
+      Mark this step complete once verification is done.
+    `,
+        requiresApproval: false,
+        onFailure: 'halt',
+    },
+    // Phase 2: Immediate Mitigation
+    {
+        id: 'cfg-step-2',
+        name: 'Apply Immediate Mitigation',
+        type: StepType.MANUAL,
+        description: `
+      Implement immediate mitigation to stop any ongoing exposure:
+      1. If possible, fix the configuration immediately
+      2. If fix is complex, disable or isolate the affected service
+      3. Revoke any exposed credentials or access tokens
+      4. Block unauthorized access paths if applicable
+      5. Verify mitigation is effective
+      6. Document mitigation actions taken
+
+      Choose the fastest path to stop any active security exposure.
+    `,
+        requiresApproval: false,
+        onFailure: 'halt',
+        dependencies: ['cfg-step-1'],
+    },
+    {
+        id: 'cfg-step-2b',
+        name: 'Notify Stakeholders',
+        type: StepType.AUTOMATED,
+        description: 'Send automated notifications to relevant stakeholders about the configuration incident.',
+        actionId: 'notify-stakeholders',
+        timeout: 120000,
+        requiresApproval: false,
+        onFailure: 'continue',
+        retryAttempts: 3,
+        dependencies: ['cfg-step-1'],
+    },
+    {
+        id: 'cfg-step-2c',
+        name: 'Enable Enhanced Monitoring',
+        type: StepType.AUTOMATED,
+        description: 'Activate enhanced monitoring to detect any exploitation attempts or ongoing unauthorized access.',
+        actionId: 'scale-monitoring',
+        timeout: 180000,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['cfg-step-1'],
+        metadata: {
+            monitoringLevel: 'elevated',
+            focusAreas: ['access-patterns', 'data-access', 'authentication'],
+        },
+    },
+    // Phase 3: Impact Assessment
+    {
+        id: 'cfg-step-3',
+        name: 'Assess Data Exposure',
+        type: StepType.MANUAL,
+        description: `
+      Determine if data was exposed during the misconfiguration window:
+      1. Identify the time window the misconfiguration was active
+      2. Review access logs for the affected resources
+      3. Identify any unauthorized access or data retrieval
+      4. Determine what data types were potentially exposed
+      5. Estimate the number of affected records/users
+      6. Document all findings
+
+      If data was exposed, proceed to evidence collection.
+      If no exposure, this may be documented and skipped.
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['cfg-step-2'],
+    },
+    {
+        id: 'cfg-step-3b',
+        name: 'Check for System Compromise',
+        type: StepType.MANUAL,
+        description: `
+      Assess if systems were compromised due to the misconfiguration:
+      1. Check for signs of unauthorized system access
+      2. Review authentication logs for suspicious activity
+      3. Check for unauthorized changes or deployments
+      4. Look for persistence mechanisms (new users, keys, scheduled tasks)
+      5. Verify system integrity
+      6. Document any indicators of compromise
+
+      If compromise indicators found, consider escalating to a broader incident type.
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['cfg-step-2'],
+    },
+    // Phase 4: Evidence Collection (Conditional - if data exposure)
+    {
+        id: 'cfg-step-4',
+        name: 'Collect Evidence',
+        type: StepType.AUTOMATED,
+        description: 'Collect and preserve evidence if data exposure or unauthorized access occurred. Includes logs, access records, and system state.',
+        actionId: 'collect-evidence',
+        timeout: 300000, // 5 minutes
+        requiresApproval: false,
+        onFailure: 'continue', // Evidence is important but don't halt remediation
+        dependencies: ['cfg-step-3'],
+        metadata: {
+            evidenceTypes: ['access-logs', 'audit-trails', 'configuration-snapshots'],
+            preserveChainOfCustody: true,
+        },
+    },
+    // Phase 5: Remediation
+    {
+        id: 'cfg-step-5',
+        name: 'Apply Correct Configuration',
+        type: StepType.MANUAL,
+        description: `
+      Apply the correct configuration:
+      1. Determine the correct/secure configuration settings
+      2. Review changes with appropriate team members
+      3. Apply configuration changes through proper change management
+      4. Verify configuration is applied correctly
+      5. Test that services function as expected
+      6. Document the configuration change
+
+      Requires approval to ensure proper review.
+    `,
+        requiresApproval: true,
+        approvers: ['security-lead', 'operations-lead'],
+        onFailure: 'halt',
+        dependencies: ['cfg-step-2'],
+    },
+    {
+        id: 'cfg-step-5b',
+        name: 'Validate Fix',
+        type: StepType.MANUAL,
+        description: `
+      Validate the configuration fix:
+      1. Verify the security issue is resolved
+      2. Test that unauthorized access is no longer possible
+      3. Confirm services are functioning correctly
+      4. Run security scan against affected resources
+      5. Verify no regression in functionality
+      6. Document validation results
+    `,
+        requiresApproval: false,
+        onFailure: 'halt',
+        dependencies: ['cfg-step-5'],
+    },
+    // Phase 6: Recovery
+    {
+        id: 'cfg-step-6',
+        name: 'Restore Normal Operations',
+        type: StepType.MANUAL,
+        description: `
+      Restore normal operations:
+      1. Re-enable any services that were disabled
+      2. Remove temporary access restrictions
+      3. Return monitoring to normal levels
+      4. Verify all services are operating normally
+      5. Confirm with stakeholders that operations are restored
+      6. Update incident status
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['cfg-step-5b'],
+    },
+    // Phase 7: Post-Incident
+    {
+        id: 'cfg-step-7',
+        name: 'Update Configuration Management',
+        type: StepType.MANUAL,
+        description: `
+      Improve configuration management to prevent recurrence:
+      1. Add configuration validation rules to catch this type of error
+      2. Update infrastructure-as-code templates if applicable
+      3. Add automated configuration scanning
+      4. Update deployment pipelines with configuration checks
+      5. Review and update configuration documentation
+      6. Consider configuration drift detection tools
+
+      Document all changes for the incident report.
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['cfg-step-5b'],
+    },
+    {
+        id: 'cfg-step-7b',
+        name: 'Post-Incident Review',
+        type: StepType.MANUAL,
+        description: `
+      Conduct post-incident review:
+      1. Document root cause of the misconfiguration
+      2. Identify how the error was introduced
+      3. Review detection and response timeline
+      4. Identify process improvements
+      5. Update runbooks and playbooks
+      6. Create final incident report
+      7. Share lessons learned with relevant teams
+    `,
+        requiresApproval: false,
+        onFailure: 'continue',
+        dependencies: ['cfg-step-6', 'cfg-step-7'],
+    },
+];
+const triggerConditions = [
+    {
+        field: 'type',
+        operator: 'equals',
+        value: IncidentType.CONFIGURATION_ERROR,
+    },
+];
+const notifications = [
+    {
+        channel: NotificationChannel.SLACK,
+        target: '#security-incidents',
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+    {
+        channel: NotificationChannel.SLACK,
+        target: '#ops-alerts',
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+    {
+        channel: NotificationChannel.PAGERDUTY,
+        target: 'security-oncall',
+        severityFilter: [IncidentSeverity.P1, IncidentSeverity.P2],
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+    {
+        channel: NotificationChannel.EMAIL,
+        target: 'security@company.com',
+        enabled: true,
+        retryAttempts: 3,
+        retryDelayMs: 5000,
+    },
+];
+const escalation = {
+    enabled: true,
+    levels: [
+        {
+            level: 1,
+            afterMinutes: 15,
+            targets: ['security-team', 'operations-team'],
+            channels: [NotificationChannel.SLACK],
+            message: 'Configuration error incident not acknowledged - please review',
+        },
+        {
+            level: 2,
+            afterMinutes: 30,
+            targets: ['security-lead', 'operations-lead'],
+            channels: [NotificationChannel.SLACK, NotificationChannel.PAGERDUTY],
+            message: 'Configuration error requires attention - escalating to leadership',
+        },
+        {
+            level: 3,
+            afterMinutes: 60,
+            targets: ['ciso', 'cto'],
+            channels: [NotificationChannel.PAGERDUTY, NotificationChannel.EMAIL],
+            message: 'Configuration error incident unresolved - executive escalation',
+        },
+    ],
+    maxLevel: 3,
+    resetOnAcknowledge: true,
+};
+// ============================================================================
+// Export Playbook
+// ============================================================================
+export const configurationErrorPlaybook = {
+    id: 'playbook-configuration-error-v1',
+    name: 'Configuration Error Response',
+    description: `
+    Streamlined playbook for responding to configuration error incidents.
+    Covers verification, immediate mitigation, impact assessment, evidence
+    collection (if data exposed), remediation, and configuration management
+    improvements. Designed for efficient resolution of misconfigurations
+    while ensuring security implications are properly addressed.
+  `.trim(),
+    version: '1.0.0',
+    triggerConditions,
+    steps: configurationErrorSteps,
+    notifications,
+    escalation,
+    enabled: true,
+    tags: ['configuration', 'misconfiguration', 'config-error', 'security', 'operations'],
+    createdAt: new Date('2024-01-01'),
+    updatedAt: new Date('2024-01-15'),
+};
+export default configurationErrorPlaybook;
+//# sourceMappingURL=configuration-error.js.map

package/dist/security/incident/playbooks/configuration-error.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configuration-error.js","sourceRoot":"","sources":["../../../../src/security/incident/playbooks/configuration-error.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,2BAA2B,CAAC;AACzD,OAAO,EAML,YAAY,EACZ,gBAAgB,EAChB,mBAAmB,EACnB,QAAQ,GACT,MAAM,aAAa,CAAC;AAErB,MAAM,MAAM,GAAG,YAAY,CAAC,EAAE,SAAS,EAAE,mBAAmB,EAAE,CAAC,CAAC;AAEhE,+EAA+E;AAC/E,sBAAsB;AACtB,+EAA+E;AAE/E;;;;;;;;;;;GAWG;AACH,MAAM,uBAAuB,GAAwB;IACnD,sCAAsC;IACtC;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;KAUZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,MAAM;KAClB;IAED,gCAAgC;IAChC;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;KAUZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,qBAAqB;QAC3B,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,yFAAyF;QACtG,QAAQ,EAAE,qBAAqB;QAC/B,OAAO,EAAE,MAAM;QACf,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,kGAAkG;QAC/G,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,MAAM;QACf,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,eAAe,EAAE,UAAU;YAC3B,UAAU,EAAE,CAAC,iBAAiB,EAAE,aAAa,EAAE,gBAAgB,CAAC;SACjE;KACF;IAED,6BAA6B;IAC7B;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;;KAWZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;KAUZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IAED,gEAAgE;IAChE;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,kBAAkB;QACxB,IAAI,EAAE,QAAQ,CAAC,SAAS;QACxB,WAAW,EAAE,kIAAkI;QAC/I,QAAQ,EAAE,kBAAkB;QAC5B,OAAO,EAAE,MAAM,EAAE,YAAY;QAC7B,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU,EAAE,mDAAmD;QAC1E,YAAY,EAAE,CAAC,YAAY,CAAC;QAC5B,QAAQ,EAAE;YACR,aAAa,EAAE,CAAC,aAAa,EAAE,cAAc,EAAE,yBAAyB,CAAC;YACzE,sBAAsB,EAAE,IAAI;SAC7B;KACF;IAED,uBAAuB;IACvB;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,6BAA6B;QACnC,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;KAUZ;QACD,gBAAgB,EAAE,IAAI;QACtB,SAAS,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;QAC/C,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,cAAc;QACpB,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;KAQZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,MAAM;QACjB,YAAY,EAAE,CAAC,YAAY,CAAC;KAC7B;IAED,oBAAoB;IACpB;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,2BAA2B;QACjC,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;KAQZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,aAAa,CAAC;KAC9B;IAED,yBAAyB;IACzB;QACE,EAAE,EAAE,YAAY;QAChB,IAAI,EAAE,iCAAiC;QACvC,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;;KAUZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,aAAa,CAAC;KAC9B;IACD;QACE,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,QAAQ,CAAC,MAAM;QACrB,WAAW,EAAE;;;;;;;;;KASZ;QACD,gBAAgB,EAAE,KAAK;QACvB,SAAS,EAAE,UAAU;QACrB,YAAY,EAAE,CAAC,YAAY,EAAE,YAAY,CAAC;KAC3C;CACF,CAAC;AAEF,MAAM,iBAAiB,GAAuB;IAC5C;QACE,KAAK,EAAE,MAAM;QACb,QAAQ,EAAE,QAAQ;QAClB,KAAK,EAAE,YAAY,CAAC,mBAAmB;KACxC;CACF,CAAC;AAEF,MAAM,aAAa,GAAyB;IAC1C;QACE,OAAO,EAAE,mBAAmB,CAAC,KAAK;QAClC,MAAM,EAAE,qBAAqB;QAC7B,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;IACD;QACE,OAAO,EAAE,mBAAmB,CAAC,KAAK;QAClC,MAAM,EAAE,aAAa;QACrB,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;IACD;QACE,OAAO,EAAE,mBAAmB,CAAC,SAAS;QACtC,MAAM,EAAE,iBAAiB;QACzB,cAAc,EAAE,CAAC,gBAAgB,CAAC,EAAE,EAAE,gBAAgB,CAAC,EAAE,CAAC;QAC1D,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;IACD;QACE,OAAO,EAAE,mBAAmB,CAAC,KAAK;QAClC,MAAM,EAAE,sBAAsB;QAC9B,OAAO,EAAE,IAAI;QACb,aAAa,EAAE,CAAC;QAChB,YAAY,EAAE,IAAI;KACnB;CACF,CAAC;AAEF,MAAM,UAAU,GAAqB;IACnC,OAAO,EAAE,IAAI;IACb,MAAM,EAAE;QACN;YACE,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;YAC7C,QAAQ,EAAE,CAAC,mBAAmB,CAAC,KAAK,CAAC;YACrC,OAAO,EAAE,+DAA+D;SACzE;QACD;YACE,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,CAAC,eAAe,EAAE,iBAAiB,CAAC;YAC7C,QAAQ,EAAE,CAAC,mBAAmB,CAAC,KAAK,EAAE,mBAAmB,CAAC,SAAS,CAAC;YACpE,OAAO,EAAE,mEAAmE;SAC7E;QACD;YACE,KAAK,EAAE,CAAC;YACR,YAAY,EAAE,EAAE;YAChB,OAAO,EAAE,CAAC,MAAM,EAAE,KAAK,CAAC;YACxB,QAAQ,EAAE,CAAC,mBAAmB,CAAC,SAAS,EAAE,mBAAmB,CAAC,KAAK,CAAC;YACpE,OAAO,EAAE,gEAAgE;SAC1E;KACF;IACD,QAAQ,EAAE,CAAC;IACX,kBAAkB,EAAE,IAAI;CACzB,CAAC;AAEF,+EAA+E;AAC/E,kBAAkB;AAClB,+EAA+E;AAE/E,MAAM,CAAC,MAAM,0BAA0B,GAAkB;IACvD,EAAE,EAAE,iCAAiC;IACrC,IAAI,EAAE,8BAA8B;IACpC,WAAW,EAAE;;;;;;GAMZ,CAAC,IAAI,EAAE;IACR,OAAO,EAAE,OAAO;IAChB,iBAAiB;IACjB,KAAK,EAAE,uBAAuB;IAC9B,aAAa;IACb,UAAU;IACV,OAAO,EAAE,IAAI;IACb,IAAI,EAAE,CAAC,eAAe,EAAE,kBAAkB,EAAE,cAAc,EAAE,UAAU,EAAE,YAAY,CAAC;IACrF,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;IACjC,SAAS,EAAE,IAAI,IAAI,CAAC,YAAY,CAAC;CAClC,CAAC;AAEF,eAAe,0BAA0B,CAAC"}

package/dist/security/incident/playbooks/data-breach.d.ts

@@ -0,0 +1,13 @@
+/**
+ * Data Breach Response Playbook
+ *
+ * Comprehensive playbook for responding to data breach incidents.
+ * Follows industry best practices and regulatory requirements.
+ *
+ * This playbook uses automated actions from the actions module that
+ * provide real implementations with rollback capabilities.
+ */
+import { PlaybookInput } from '../types.js';
+export declare const dataBreachPlaybook: PlaybookInput;
+export default dataBreachPlaybook;
+//# sourceMappingURL=data-breach.d.ts.map

package/dist/security/incident/playbooks/data-breach.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"data-breach.d.ts","sourceRoot":"","sources":["../../../../src/security/incident/playbooks/data-breach.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,aAAa,EASd,MAAM,aAAa,CAAC;AA8XrB,eAAO,MAAM,kBAAkB,EAAE,aAiBhC,CAAC;AAEF,eAAe,kBAAkB,CAAC"}