penthera 1.1.0

package/lib/compliance/index.js

@@ -0,0 +1,163 @@
+/**
+ * Compliance coverage mapping.
+ *
+ * Maps a Penthera scan result to a regulatory framework's technical measures,
+ * based on which probes ACTUALLY ran (result.executedProbes) and what they
+ * found. This is automated technical EVIDENCE toward a duty of care, not a
+ * compliance determination, an audit, or a certification. Organisational
+ * measures (governance, incident process, training) require human process.
+ * See the README "Compliance: NIS2 and the cyberwetgeving" section.
+ *
+ * Frameworks are declarative so national transpositions and other regimes
+ * (CyFun, ISO 27001) can be added as data without touching the engine.
+ */
+
+// NIS2 Directive, Article 21(2) risk-management measures. National transpositions
+//, NL Cyberbeveiligingswet, BE NIS2-wet, implement these same measures.
+//
+// level = the inherent ceiling of what a scanner can contribute to the measure:
+//   strong, automated technical testing is the heart of it
+//   partial, a scanner covers part of it
+//   evidence, output feeds it, but there is no direct test
+//   planned, not implemented yet
+//   out-of-scope, organisational/physical; a scanner cannot do it
+const NIS2_MEASURES = [
+  { id: "a", title: "Risk analysis & information-security policy", level: "evidence",
+    probes: [], categories: [],
+    note: "Findings, severity, and baseline history feed your risk analysis." },
+  { id: "b", title: "Incident handling", level: "planned",
+    probes: [], categories: [],
+    note: "Incident-report helper drafts the required 24h/72h/1-month reports (--incident); incident detection itself is not automated." },
+  { id: "c", title: "Business continuity, backup & crisis management", level: "out-of-scope",
+    probes: [], categories: [],
+    note: "Organisational, outside a scanner's reach." },
+  { id: "d", title: "Supply-chain security", level: "partial",
+    probes: ["retirejs", "secret-scanning"],
+    categories: ["cve", "secrets", "js-vulnerability"],
+    note: "JS dependency CVEs (Retire.js), leaked credentials (secret scan), a CycloneDX SBOM (--sbom), and passive supplier rating (--suppliers)." },
+  { id: "e", title: "Secure acquisition, development & maintenance; vulnerability handling", level: "strong",
+    probes: ["reachability", "endpoint-discovery", "openapi", "sensitive-files", "cors",
+      "security-headers", "email-dns", "sqli", "ssti", "ssrf", "xss", "cmdi", "open-redirect",
+      "api-fuzzing", "risky-patterns"],
+    categories: ["*"],
+    note: "The core scan: black- and white-box testing mapped to OWASP WSTG, with SARIF and baseline regression." },
+  { id: "f", title: "Assessing the effectiveness of measures", level: "evidence",
+    probes: [], categories: [],
+    note: "Baseline diff plus remediation/audit-loop tracking (--history): time-to-fix, ageing, and drift over time." },
+  { id: "g", title: "Cyber hygiene & training", level: "evidence",
+    probes: [], categories: [],
+    note: "Remediation playbook and secure-defaults guidance feed hygiene (guidance, not a training programme)." },
+  { id: "h", title: "Cryptography & encryption", level: "partial",
+    probes: ["tls"], categories: ["tls", "cookie"],
+    note: "TLS protocol/cipher/certificate audit, HSTS, cookie Secure (transport layer only)." },
+  { id: "i", title: "HR security, access control & asset management", level: "partial",
+    probes: ["auth-hardening", "client-auth", "jwt", "idor", "oauth", "trust-boundary"],
+    categories: ["auth", "auth-bypass"],
+    note: "Access control tested (auth hardening, JWT, IDOR/BOLA, OAuth, trust boundaries). HR & asset management out of scope." },
+  { id: "j", title: "Multi-factor authentication & secure communications", level: "planned",
+    probes: [], categories: [],
+    note: "An MFA probe is on the roadmap." },
+];
+
+const FRAMEWORKS = {
+  nis2: {
+    id: "nis2",
+    name: "NIS2 Directive, Article 21(2) duty of care",
+    measures: NIS2_MEASURES,
+  },
+};
+
+/** List supported framework ids. */
+export function listFrameworks() {
+  return Object.keys(FRAMEWORKS);
+}
+
+/**
+ * Build a per-scan compliance coverage object for a framework.
+ * Returns null for an unknown framework id.
+ */
+export function buildComplianceCoverage(result, frameworkId = "nis2") {
+  const fw = FRAMEWORKS[String(frameworkId).toLowerCase()];
+  if (!fw) return null;
+
+  const executed = new Set(result?.executedProbes || []);
+  const findings = result?.findings || [];
+
+  const measures = fw.measures.map((m) => {
+    const probesRun = m.probes.filter((p) => executed.has(p));
+    const relevant = m.categories.includes("*")
+      ? findings.filter((f) => f.severity !== "info")
+      : findings.filter((f) => m.categories.includes(f.category));
+
+    let status;
+    if (m.level === "out-of-scope") status = "out-of-scope";
+    else if (m.level === "planned") status = "planned";
+    else if (m.level === "evidence") status = "evidence";
+    else if (probesRun.length > 0) status = relevant.length > 0 ? "tested-findings" : "tested-clean";
+    else status = "not-run";
+
+    return {
+      id: m.id,
+      title: m.title,
+      ceiling: m.level,
+      status,
+      probesRun,
+      findings: relevant.length,
+      note: m.note,
+    };
+  });
+
+  const testable = measures.filter((m) => m.ceiling === "strong" || m.ceiling === "partial");
+  const coveredThisScan = testable.filter(
+    (m) => m.status === "tested-clean" || m.status === "tested-findings",
+  );
+
+  return {
+    framework: fw.id,
+    name: fw.name,
+    measures,
+    summary: {
+      total: measures.length,
+      testable: testable.length,
+      coveredThisScan: coveredThisScan.length,
+      findings: findings.filter((f) => f.severity !== "info").length,
+    },
+  };
+}
+
+const STATUS_LABEL = {
+  "tested-clean": "Tested, no gaps found",
+  "tested-findings": "Tested, gaps found",
+  "not-run": "Not run this scan",
+  evidence: "Evidence only",
+  planned: "Planned",
+  "out-of-scope": "Out of scope",
+};
+
+/** Render a compliance coverage object as a Markdown section. */
+export function formatComplianceMarkdown(coverage) {
+  if (!coverage) return "";
+  const L = [];
+  L.push(`## Compliance mapping, ${coverage.name}`);
+  L.push("");
+  L.push(
+    "> Automated technical **evidence** toward the duty of care, **not** a compliance " +
+    "determination, an audit, or a certification. Organisational measures (governance, " +
+    "incident process, supply-chain contracts, training) require human process. Consult " +
+    "your national authority (NCSC in the Netherlands, CCB in Belgium) or a qualified jurist.",
+  );
+  L.push("");
+  L.push(
+    `This scan exercised technical coverage for **${coverage.summary.coveredThisScan}** of ` +
+    `**${coverage.summary.testable}** testable Article 21 measures.`,
+  );
+  L.push("");
+  L.push("| Art. 21(2) | Measure | This scan | Findings |");
+  L.push("|-----------|---------|-----------|----------|");
+  for (const m of coverage.measures) {
+    const label = STATUS_LABEL[m.status] || m.status;
+    L.push(`| **(${m.id})** | ${m.title} | ${label} | ${m.findings || "-"} |`);
+  }
+  L.push("");
+  return L.join("\n");
+}

package/lib/compliance/policy-pack.js

@@ -0,0 +1,293 @@
+/**
+ * Proportionate policy-pack generator.
+ *
+ * NIS2 expects an in-scope entity to have basic written policies. For a small
+ * company these should be short, real, and used, not enterprise binders. This
+ * module emits editable Markdown starting points for the core policies, pre-
+ * filled where the scan/self-assessment gives us something concrete (the
+ * incident plan carries the jurisdiction's real deadlines; the vulnerability
+ * policy references the Penthera scan cadence).
+ *
+ * These are TEMPLATES, not legal documents. Every file says so.
+ */
+
+function header(title, ctx) {
+  return [
+    `# ${title}`,
+    "",
+    `**Organisation:** ${ctx.org}  `,
+    `**Owner:** _(name a responsible person)_  `,
+    `**Version:** 0.1 (draft)  `,
+    `**Last reviewed:** ${ctx.date}  `,
+    `**Next review:** _(set a date, at least yearly)_`,
+    "",
+  ].join("\n");
+}
+
+function footer() {
+  return [
+    "",
+    "---",
+    "",
+    "> **Editable template, not legal advice and not a certification.** Adapt it to",
+    "> how your organisation actually works, then keep it short and used. An honest",
+    "> two-page policy that people follow beats a long one nobody reads.",
+    "> Generated by Penthera.",
+    "",
+  ].join("\n");
+}
+
+/** Optional one-line note about current readiness for this measure. */
+function readinessNote(ctx, measure) {
+  const m = ctx.readiness?.measures?.find((x) => x.id === measure);
+  if (!m) return "";
+  const gaps = (m.gaps || []).filter((g) => g.type !== "unanswered").map((g) => g.question);
+  const gapLine = gaps.length ? ` Gaps to close: ${gaps.join("; ")}.` : "";
+  return `\n> _Current readiness for this measure (from your latest Penthera run): **${m.status}**.${gapLine}_\n`;
+}
+
+const POLICIES = [
+  {
+    id: "information-security", measure: "a", filename: "information-security-policy.md",
+    title: "Information Security Policy",
+    render: (ctx) => header("Information Security Policy", ctx) + readinessNote(ctx, "a") + `
+## Purpose
+
+This policy states how ${ctx.org} protects the confidentiality, integrity, and
+availability of its information and systems, proportionate to our size and risk.
+
+## Our commitments
+
+- We identify our most important systems and data and the main risks to them, and review this at least yearly.
+- We take appropriate, proportionate technical and organisational measures to manage those risks (see the supporting policies: access control, backup, incident response, supplier security, vulnerability management).
+- Management is accountable for cyber-risk and reviews it regularly.
+- Every staff member is responsible for following this policy and reporting security concerns.
+
+## Risk approach
+
+We keep a short risk list: for each key asset, the main threats, current measures, and any accepted gaps. It is reviewed after significant changes or incidents.
+
+## Responsibilities
+
+- **Management:** owns cyber-risk, approves this policy, ensures resources.
+- **Security owner:** maintains the policies, runs/reviews scans, tracks remediation.
+- **All staff:** follow the policies, complete awareness guidance, report issues.
+
+## Review
+
+Reviewed at least annually and after any significant incident or change.
+` + footer(),
+  },
+  {
+    id: "access-control", measure: "i", filename: "access-control-policy.md",
+    title: "Access Control Policy",
+    render: (ctx) => header("Access Control Policy", ctx) + readinessNote(ctx, "i") + `
+## Purpose
+
+Ensure people and systems have only the access they need, and that access is removed promptly when no longer needed.
+
+## Our commitments
+
+- **Least privilege:** access is granted based on role and business need, not convenience.
+- **Joiners/movers/leavers:** access is provisioned on start, changed on role change, and revoked on the last working day (keep a simple checklist).
+- **Multi-factor authentication (MFA)** is enforced for email, admin/privileged accounts, and remote access.
+- **Shared accounts are avoided;** where unavoidable, credentials are stored in a password manager and rotated.
+- **Access is reviewed** periodically (e.g. quarterly) to catch stale accounts.
+
+## Asset & account inventory
+
+We keep a simple inventory of systems, who has admin access, and what data each holds. It is updated when systems or people change.
+
+## Responsibilities
+
+- **Security owner:** maintains the inventory and runs access reviews.
+- **Managers:** request/confirm access changes for their team.
+
+## Review
+
+Reviewed at least annually.
+` + footer(),
+  },
+  {
+    id: "incident-response", measure: "b", filename: "incident-response-plan.md",
+    title: "Incident Response Plan",
+    render: (ctx) => {
+      const j = ctx.jurisdiction;
+      const deadlines = (j?.incidentDeadlines || []).map(
+        (d) => `- **Within ${d.within}** of ${d.of} → notify ${d.to}: ${d.content}`,
+      ).join("\n") || "- _(add your jurisdiction's reporting deadlines)_";
+      return header("Incident Response Plan", ctx) + readinessNote(ctx, "b") + `
+## Purpose
+
+A simple, usable plan for detecting, handling, and reporting security incidents.
+
+## Roles & contacts (fill in)
+
+- **Incident lead:** _(name, phone)_
+- **Deputy:** _(name, phone)_
+- **Comms/legal:** _(name)_
+- **Competent authority / CSIRT:** ${j?.authorities?.csirt || "_(your CSIRT)_"} (supervisor: ${j?.authorities?.supervisor || "_(your supervisor)_"})
+
+## Steps
+
+1. **Detect & record**, anyone who spots something tells the incident lead. Log time, what was seen, systems affected.
+2. **Contain**, limit the damage (isolate systems, rotate credentials, revoke access).
+3. **Assess**, how significant is it? Data affected, users affected, cross-border impact?
+4. **Report**, meet the regulatory deadlines below.
+5. **Recover**, restore from clean backups; confirm the threat is gone.
+6. **Learn**, short post-incident review; update measures and this plan.
+
+## Regulatory reporting deadlines
+
+${deadlines}
+
+${j?.penalties ? `> ${j.penalties}\n` : ""}
+> Penthera's incident-report helper can draft the early-warning / notification /
+> final-report documents against these deadlines.
+
+## Review
+
+Reviewed at least annually and exercised with a simple tabletop test where possible.
+` + footer();
+    },
+  },
+  {
+    id: "backup-continuity", measure: "c", filename: "backup-continuity-policy.md",
+    title: "Backup & Business Continuity Policy",
+    render: (ctx) => header("Backup & Business Continuity Policy", ctx) + readinessNote(ctx, "c") + `
+## Purpose
+
+Ensure we can recover important data and keep operating after data loss, ransomware, or an outage.
+
+## Our commitments
+
+- **Regular backups** of important data and systems (automated where possible).
+- **Off-site or immutable copies** so backups survive ransomware and accidental deletion.
+- **Restore testing:** we test restoring from backup at least once a year, an untested backup is not a backup.
+- **Recovery targets:** we know roughly how quickly we must recover (RTO) and how much data we can afford to lose (RPO).
+
+## What we back up (fill in)
+
+- _(list key systems/data, where each is backed up, and how often)_
+
+## Responsibilities
+
+- **Security/ops owner:** runs backups, performs the annual restore test, records the result.
+
+## Review
+
+Reviewed at least annually.
+` + footer(),
+  },
+  {
+    id: "acceptable-use", measure: "g", filename: "acceptable-use-policy.md",
+    title: "Acceptable Use & Awareness Policy",
+    render: (ctx) => header("Acceptable Use & Awareness Policy", ctx) + readinessNote(ctx, "g") + `
+## Purpose
+
+Set clear, proportionate expectations for how staff use company systems, and keep basic security awareness alive.
+
+## Our commitments
+
+- **Strong, unique passwords** stored in a password manager; **MFA** where offered.
+- **Phishing awareness:** be cautious with links/attachments; verify unexpected payment or access requests out-of-band.
+- **Devices** are kept updated, locked when unattended, and encrypted.
+- **Data handling:** company data stays in approved systems; no sensitive data in unapproved tools.
+- **Reporting:** report anything suspicious to the security owner immediately, no blame for honest reports.
+
+## Awareness
+
+New joiners get a short security briefing; everyone gets occasional reminders (e.g. a phishing note each quarter).
+
+## Review
+
+Reviewed at least annually.
+` + footer(),
+  },
+  {
+    id: "supplier-security", measure: "d", filename: "supplier-security-policy.md",
+    title: "Supplier Security Policy",
+    render: (ctx) => header("Supplier Security Policy", ctx) + readinessNote(ctx, "d") + `
+## Purpose
+
+Manage the security risk from suppliers and vendors, especially those with access to our data or systems.
+
+## Our commitments
+
+- **Supplier inventory:** we keep a list of key suppliers and what access/data each has.
+- **Assessment:** before onboarding a supplier with access to sensitive data, we check their security (questionnaire, certification such as ISO 27001/SOC 2, or Penthera's passive rating for the technical part).
+- **Contracts:** where proportionate, supplier contracts include security and breach-notification clauses.
+- **Review:** supplier risk is reviewed periodically and when a supplier's role changes.
+
+## Supplier list (fill in)
+
+| Supplier | What they access | Security check done | Notes |
+|----------|------------------|---------------------|-------|
+| _(name)_ | _(data/systems)_ | _(yes/no + how)_    |       |
+
+## Review
+
+Reviewed at least annually.
+` + footer(),
+  },
+  {
+    id: "vulnerability-management", measure: "e", filename: "vulnerability-management-policy.md",
+    title: "Vulnerability Management Policy",
+    render: (ctx) => header("Vulnerability Management Policy", ctx) + readinessNote(ctx, "e") + `
+## Purpose
+
+Find and fix security weaknesses before they are exploited, and handle reports responsibly.
+
+## Our commitments
+
+- **Regular scanning:** we run Penthera against our applications and repositories on a set cadence (e.g. before each release and monthly), and track findings to closure.
+- **Dependency updates:** we keep dependencies patched (e.g. Dependabot / \`npm audit\`) and act on known-vulnerable versions.
+- **Prioritisation:** we fix by real risk (severity × exposure), not raw count, and record time-to-fix.
+- **Disclosure:** we provide a way to report vulnerabilities to us (a \`SECURITY.md\` / security contact) and respond promptly.
+- **Verification:** fixes are confirmed by re-scanning against a baseline before they're considered closed.
+
+## Cadence (fill in)
+
+- Application scan: _(e.g. every release + monthly)_
+- Dependency review: _(e.g. weekly automated)_
+- Review of open findings: _(e.g. monthly)_
+
+## Review
+
+Reviewed at least annually.
+` + footer(),
+  },
+];
+
+/** Build the policy pack as [{ filename, content }]. */
+export function buildPolicyPack(ctx = {}) {
+  const context = {
+    org: ctx.org || "Your organisation",
+    date: ctx.date || "",
+    jurisdiction: ctx.jurisdiction || null,
+    readiness: ctx.readiness || null,
+  };
+  return POLICIES.map((p) => ({
+    id: p.id,
+    measure: p.measure,
+    filename: p.filename,
+    title: p.title,
+    content: p.render(context),
+  }));
+}
+
+/** Index/README for the pack. */
+export function policyPackIndex(pack, ctx = {}) {
+  const L = [];
+  L.push(`# Policy pack, ${ctx.org || "Your organisation"}`);
+  L.push("");
+  L.push("Proportionate, editable starting points for the core policies NIS2 expects. **Templates, not legal advice.** Fill in the blanks, keep them short and used, and review at least yearly.");
+  L.push("");
+  L.push("| Policy | Art. 21(2) |");
+  L.push("|--------|-----------|");
+  for (const p of pack) L.push(`| [${p.title}](${p.filename}) | (${p.measure}) |`);
+  L.push("");
+  return L.join("\n");
+}
+
+export { POLICIES };

package/lib/compliance/questionnaire.js

@@ -0,0 +1,113 @@
+/**
+ * Customer security-questionnaire answerer (the wedge).
+ *
+ * Takes a pasted/exported questionnaire (one question per line) and drafts an
+ * answer for each by mapping it to the readiness report's evidence: what the
+ * scan measured plus what the owner attested. Questions it can't map are marked
+ * NEEDS HUMAN INPUT rather than guessed.
+ *
+ * Offline and deterministic. This drafts a response grounded in evidence; it is
+ * not a certification, and the owner must review every answer before sending.
+ */
+
+// Keyword -> NIS2 measure. First match wins; order specific before general.
+const RULES = [
+  { re: /\b(mfa|multi.?factor|two.?factor|2fa)\b/i, measure: "j" },
+  { re: /\b(spf|dkim|dmarc)\b|email (auth|spoof|security)/i, measure: "j" },
+  { re: /encrypt.*(at.?rest|storage|database|disk)|data.?at.?rest/i, measure: "h" },
+  { re: /\b(tls|https|ssl)\b|encrypt.*(transit|transport)|in transit/i, measure: "h" },
+  { re: /incident (response|handling|management|report)|breach notif|report.*breach/i, measure: "b" },
+  { re: /backup|business continuity|disaster recovery|\bdr\b|resilien/i, measure: "c" },
+  { re: /supplier|vendor|third.?part|supply.?chain|sub.?processor|sbom/i, measure: "d" },
+  { re: /access control|least privilege|\brbac\b|authoris|authoriz|joiner|leaver|offboard|privileged access/i, measure: "i" },
+  { re: /asset (inventory|management|register)|inventory of/i, measure: "i" },
+  { re: /vulnerab|patch|penetration|pentest|secure (develop|coding|sdlc)|dependency|cve/i, measure: "e" },
+  { re: /risk (assessment|analysis|management|register)|security polic|infosec|isms/i, measure: "a" },
+  { re: /training|awareness|phishing|security education/i, measure: "g" },
+  { re: /effectiveness|periodic review|internal audit|security metrics|kpi/i, measure: "f" },
+  { re: /secret|hardcoded credential|key management|api key/i, measure: "d" },
+];
+
+const STATUS_ANSWER = {
+  met: "Yes",
+  partial: "Partial",
+  gap: "In progress",
+  "n/a": "N/A",
+};
+
+/** Parse a questionnaire file: one question per line; blanks and # comments skipped. */
+export function parseQuestionnaire(text) {
+  return String(text || "").split(/\r?\n/)
+    .map((l) => l.trim())
+    .filter((l) => l && !l.startsWith("#"))
+    // strip a leading numbering/bullet ("1. ", "- ", "* ", "Q3: ")
+    .map((l) => l.replace(/^(\d+[.)]\s*|[-*]\s*|q\d+[:.]\s*)/i, "").trim())
+    .filter(Boolean);
+}
+
+/**
+ * Answer a questionnaire from a readiness report.
+ * @param {string[]} questions
+ * @param {object} readiness - from buildReadiness()
+ */
+export function answerQuestionnaire(questions, readiness) {
+  const byId = new Map((readiness?.measures || []).map((m) => [m.id, m]));
+
+  const answers = questions.map((question) => {
+    const rule = RULES.find((r) => r.re.test(question));
+    if (!rule) {
+      return { question, measure: null, answer: "NEEDS HUMAN INPUT", evidence: [] };
+    }
+    const m = byId.get(rule.measure);
+    if (!m) {
+      return { question, measure: rule.measure, answer: "NEEDS HUMAN INPUT", evidence: [] };
+    }
+    const evidence = (m.evidence || []).map((e) =>
+      e.source === "scan" ? `scan:${e.method}` : `attested:${e.answer}`,
+    );
+    return {
+      question,
+      measure: rule.measure,
+      measureTitle: m.title,
+      status: m.status,
+      answer: STATUS_ANSWER[m.status] || "NEEDS HUMAN INPUT",
+      evidence,
+    };
+  });
+
+  const summary = { answered: 0, needsHuman: 0 };
+  for (const a of answers) {
+    if (a.answer === "NEEDS HUMAN INPUT") summary.needsHuman++;
+    else summary.answered++;
+  }
+  return { total: answers.length, summary, answers };
+}
+
+/** Render the answered questionnaire as Markdown. */
+export function formatQuestionnaireMarkdown(result) {
+  if (!result) return "";
+  const L = [];
+  L.push("# Security questionnaire, draft response");
+  L.push("");
+  L.push("> Draft answers mapped from a Penthera scan and self-assessment. **Review every answer before sending.** Items marked NEEDS HUMAN INPUT could not be mapped and must be answered by a person. This is a drafting aid, not a certification.");
+  L.push("");
+  L.push(`**${result.total}** questions: ${result.summary.answered} drafted, ${result.summary.needsHuman} need human input.`);
+  L.push("");
+  L.push("| Question | Draft answer | Basis (Art. 21 / evidence) |");
+  L.push("|----------|--------------|----------------------------|");
+  for (const a of result.answers) {
+    const basis = a.measure
+      ? `(${a.measure}) ${a.status || "?"}${a.evidence?.length ? `: ${a.evidence.slice(0, 3).join(", ")}` : ""}`
+      : "unmapped";
+    L.push(`| ${a.question.replace(/\|/g, "\\|")} | ${a.answer} | ${basis.replace(/\|/g, "\\|")} |`);
+  }
+  L.push("");
+  const gaps = result.answers.filter((a) => a.answer === "NEEDS HUMAN INPUT").map((a) => a.question);
+  if (gaps.length) {
+    L.push("## Needs human input");
+    L.push("");
+    gaps.forEach((q) => L.push(`- ${q}`));
+    L.push("");
+  }
+  return L.join("\n");
+}