runbooks 0.7.9__py3-none-any.whl → 0.9.0__py3-none-any.whl

runbooks/security/enterprise_security_policies.json

@@ -0,0 +1,293 @@
+{
+  "security_framework_version": "1.0.0",
+  "last_updated": "2024-08-30T00:00:00Z",
+  "compliance_frameworks": {
+    "AWS_Well_Architected_Security": {
+      "enabled": true,
+      "minimum_score": 90.0,
+      "critical_controls": [
+        "identity_foundation",
+        "apply_security_at_all_layers",
+        "enable_traceability",
+        "automate_security_best_practices",
+        "protect_data_in_transit_and_at_rest",
+        "keep_people_away_from_data",
+        "prepare_for_security_events"
+      ]
+    },
+    "SOC2_Type_II": {
+      "enabled": true,
+      "minimum_score": 95.0,
+      "critical_controls": [
+        "access_controls",
+        "logical_physical_access",
+        "system_operations",
+        "change_management",
+        "risk_mitigation"
+      ]
+    },
+    "NIST_Cybersecurity_Framework": {
+      "enabled": true,
+      "minimum_score": 85.0,
+      "functions": [
+        "identify",
+        "protect", 
+        "detect",
+        "respond",
+        "recover"
+      ]
+    },
+    "PCI_DSS": {
+      "enabled": true,
+      "minimum_score": 100.0,
+      "requirements": [
+        "install_maintain_firewall",
+        "not_use_vendor_defaults",
+        "protect_stored_cardholder_data",
+        "encrypt_transmission_data",
+        "protect_systems_against_malware",
+        "develop_secure_systems",
+        "restrict_access_need_to_know",
+        "identify_authenticate_access",
+        "restrict_physical_access",
+        "track_monitor_access",
+        "regularly_test_security",
+        "maintain_information_security_policy"
+      ]
+    },
+    "HIPAA": {
+      "enabled": true,
+      "minimum_score": 95.0,
+      "safeguards": [
+        "administrative_safeguards",
+        "physical_safeguards", 
+        "technical_safeguards"
+      ]
+    },
+    "ISO27001": {
+      "enabled": true,
+      "minimum_score": 90.0,
+      "control_categories": [
+        "information_security_policies",
+        "organization_information_security",
+        "human_resource_security",
+        "asset_management",
+        "access_control",
+        "cryptography",
+        "physical_environmental_security",
+        "operations_security",
+        "communications_security",
+        "system_acquisition_development_maintenance",
+        "supplier_relationships",
+        "information_security_incident_management",
+        "information_security_business_continuity",
+        "compliance"
+      ]
+    }
+  },
+  "encryption_requirements": {
+    "data_at_rest": {
+      "required": true,
+      "algorithm": "AES-256",
+      "key_management": "AWS_KMS",
+      "key_rotation": {
+        "enabled": true,
+        "frequency_days": 90
+      }
+    },
+    "data_in_transit": {
+      "required": true,
+      "minimum_tls_version": "1.2",
+      "certificate_validation": true,
+      "cipher_suites": [
+        "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384",
+        "TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256"
+      ]
+    },
+    "encryption_exemptions": {
+      "allowed_unencrypted_services": [],
+      "approval_required": true,
+      "documentation_required": true
+    }
+  },
+  "access_control_policies": {
+    "authentication": {
+      "mfa_required": true,
+      "mfa_methods": ["hardware_token", "software_token", "sms"],
+      "password_policy": {
+        "minimum_length": 14,
+        "require_uppercase": true,
+        "require_lowercase": true,
+        "require_numbers": true,
+        "require_symbols": true,
+        "max_age_days": 90,
+        "password_history": 12,
+        "account_lockout": {
+          "failed_attempts": 5,
+          "lockout_duration_minutes": 30
+        }
+      }
+    },
+    "authorization": {
+      "principle_of_least_privilege": true,
+      "regular_access_review": {
+        "frequency_days": 90,
+        "automated_review": true,
+        "manual_review": true
+      },
+      "privileged_access": {
+        "separate_accounts": true,
+        "elevated_authentication": true,
+        "session_recording": true,
+        "approval_workflow": true
+      }
+    },
+    "session_management": {
+      "idle_timeout_minutes": 30,
+      "maximum_session_duration_hours": 8,
+      "concurrent_session_limit": 3
+    }
+  },
+  "audit_requirements": {
+    "cloudtrail": {
+      "enabled": true,
+      "multi_region": true,
+      "include_global_services": true,
+      "log_file_encryption": true,
+      "log_file_validation": true,
+      "sns_notification": true,
+      "s3_bucket_logging": true
+    },
+    "aws_config": {
+      "enabled": true,
+      "all_regions": true,
+      "include_global_resources": true,
+      "delivery_channel_encryption": true,
+      "conformance_packs": [
+        "Operational-Best-Practices-for-AWS-Well-Architected-Security-Pillar",
+        "Operational-Best-Practices-for-SOC2",
+        "Operational-Best-Practices-for-PCI-DSS"
+      ]
+    },
+    "log_retention": {
+      "security_logs": "7_years",
+      "operational_logs": "1_year", 
+      "application_logs": "6_months"
+    },
+    "monitoring": {
+      "real_time_alerting": true,
+      "anomaly_detection": true,
+      "automated_response": true,
+      "escalation_procedures": true
+    }
+  },
+  "network_security": {
+    "vpc_requirements": {
+      "flow_logs": {
+        "enabled": true,
+        "capture_level": "ALL",
+        "destination": "cloudwatch_logs",
+        "encryption": true
+      },
+      "default_security_group": {
+        "restrict_default": true,
+        "no_ingress_rules": true,
+        "minimal_egress_rules": true
+      }
+    },
+    "security_groups": {
+      "no_unrestricted_access": true,
+      "principle_of_least_privilege": true,
+      "regular_review": true,
+      "documentation_required": true
+    },
+    "network_acls": {
+      "explicit_deny_rules": true,
+      "logging_enabled": true,
+      "regular_review": true
+    }
+  },
+  "data_protection": {
+    "data_classification": {
+      "classification_required": true,
+      "classification_levels": ["public", "internal", "confidential", "restricted"],
+      "handling_procedures": true
+    },
+    "data_loss_prevention": {
+      "enabled": true,
+      "scanning_enabled": true,
+      "automated_remediation": true
+    },
+    "backup_requirements": {
+      "automated_backups": true,
+      "cross_region_replication": true,
+      "backup_encryption": true,
+      "backup_testing": {
+        "frequency": "monthly",
+        "automated": true,
+        "documentation": true
+      }
+    }
+  },
+  "incident_response": {
+    "response_plan": {
+      "documented": true,
+      "tested_regularly": true,
+      "roles_responsibilities": true,
+      "communication_plan": true
+    },
+    "detection_capabilities": {
+      "automated_monitoring": true,
+      "threat_intelligence": true,
+      "behavioral_analytics": true
+    },
+    "response_capabilities": {
+      "automated_containment": true,
+      "forensic_capabilities": true,
+      "recovery_procedures": true
+    }
+  },
+  "compliance_thresholds": {
+    "overall_security_score": {
+      "minimum": 90.0,
+      "target": 95.0,
+      "critical_threshold": 85.0
+    },
+    "finding_thresholds": {
+      "critical_findings_allowed": 0,
+      "high_findings_threshold": 5,
+      "medium_findings_threshold": 20,
+      "low_findings_threshold": 50
+    },
+    "remediation_timeframes": {
+      "critical_findings": "4_hours",
+      "high_findings": "24_hours",
+      "medium_findings": "7_days",
+      "low_findings": "30_days"
+    }
+  },
+  "automation_requirements": {
+    "security_automation": {
+      "auto_remediation_enabled": true,
+      "approval_workflows": true,
+      "rollback_capabilities": true
+    },
+    "compliance_automation": {
+      "continuous_compliance": true,
+      "automated_reporting": true,
+      "exception_management": true
+    }
+  },
+  "vendor_security": {
+    "third_party_assessments": {
+      "security_questionnaires": true,
+      "penetration_testing": true,
+      "certification_verification": true
+    },
+    "supply_chain_security": {
+      "vendor_risk_assessment": true,
+      "contract_security_requirements": true,
+      "ongoing_monitoring": true
+    }
+  }
+}