'use client' import React, { useState } from 'react' import { useSDK } from '@/lib/sdk' // ============================================================================= // TYPES // ============================================================================= interface SecurityItem { id: string title: string description: string type: 'vulnerability' | 'misconfiguration' | 'compliance' | 'hardening' severity: 'critical' | 'high' | 'medium' | 'low' status: 'open' | 'in-progress' | 'resolved' | 'accepted-risk' source: string cve: string | null cvss: number | null affectedAsset: string assignedTo: string | null createdAt: Date dueDate: Date | null remediation: string } // ============================================================================= // MOCK DATA // ============================================================================= const mockItems: SecurityItem[] = [ { id: 'sec-001', title: 'SQL Injection in Login-Modul', description: 'Unzureichende Validierung von Benutzereingaben ermoeglicht SQL Injection', type: 'vulnerability', severity: 'critical', status: 'in-progress', source: 'Penetrationstest', cve: 'CVE-2024-12345', cvss: 9.8, affectedAsset: 'auth-service', assignedTo: 'Entwicklung', createdAt: new Date('2024-01-15'), dueDate: new Date('2024-01-25'), remediation: 'Parameterisierte Queries verwenden, Input-Validierung implementieren', }, { id: 'sec-002', title: 'Veraltete TLS-Version', description: 'Server unterstuetzt noch TLS 1.0 und 1.1', type: 'misconfiguration', severity: 'high', status: 'open', source: 'Vulnerability Scanner', cve: null, cvss: 7.5, affectedAsset: 'web-server', assignedTo: null, createdAt: new Date('2024-01-18'), dueDate: new Date('2024-02-01'), remediation: 'TLS 1.2 als Minimum konfigurieren, TLS 1.3 bevorzugen', }, { id: 'sec-003', title: 'Fehlende Content-Security-Policy', description: 'HTTP-Header CSP nicht konfiguriert', type: 'hardening', severity: 'medium', status: 'open', source: 'Security Audit', cve: null, cvss: 5.4, affectedAsset: 'website', assignedTo: 'DevOps', createdAt: new Date('2024-01-10'), dueDate: new Date('2024-02-15'), remediation: 'Strikte CSP-Header implementieren', }, { id: 'sec-004', title: 'Unsichere Cookie-Konfiguration', description: 'Session-Cookies ohne Secure und HttpOnly Flags', type: 'misconfiguration', severity: 'medium', status: 'resolved', source: 'Code Review', cve: null, cvss: 5.3, affectedAsset: 'auth-service', assignedTo: 'Entwicklung', createdAt: new Date('2024-01-05'), dueDate: new Date('2024-01-15'), remediation: 'Cookie-Flags setzen: Secure, HttpOnly, SameSite', }, { id: 'sec-005', title: 'Veraltete Abhaengigkeit lodash', description: 'Bekannte Schwachstelle in lodash < 4.17.21', type: 'vulnerability', severity: 'high', status: 'in-progress', source: 'SBOM Scan', cve: 'CVE-2021-23337', cvss: 7.2, affectedAsset: 'frontend-app', assignedTo: 'Entwicklung', createdAt: new Date('2024-01-20'), dueDate: new Date('2024-01-30'), remediation: 'Abhaengigkeit auf Version 4.17.21 oder hoeher aktualisieren', }, { id: 'sec-006', title: 'Fehlende Verschluesselung at Rest', description: 'Datenbank-Backup ohne Verschluesselung', type: 'compliance', severity: 'high', status: 'accepted-risk', source: 'Compliance Audit', cve: null, cvss: null, affectedAsset: 'database-backup', assignedTo: 'IT Operations', createdAt: new Date('2024-01-08'), dueDate: null, remediation: 'Backup-Verschluesselung aktivieren (AES-256)', }, ] // ============================================================================= // COMPONENTS // ============================================================================= function SecurityItemCard({ item }: { item: SecurityItem }) { const typeLabels = { vulnerability: 'Schwachstelle', misconfiguration: 'Fehlkonfiguration', compliance: 'Compliance', hardening: 'Haertung', } const typeColors = { vulnerability: 'bg-red-100 text-red-700', misconfiguration: 'bg-orange-100 text-orange-700', compliance: 'bg-purple-100 text-purple-700', hardening: 'bg-blue-100 text-blue-700', } const severityColors = { critical: 'bg-red-500 text-white', high: 'bg-orange-500 text-white', medium: 'bg-yellow-500 text-white', low: 'bg-green-500 text-white', } const statusColors = { open: 'bg-blue-100 text-blue-700', 'in-progress': 'bg-yellow-100 text-yellow-700', resolved: 'bg-green-100 text-green-700', 'accepted-risk': 'bg-gray-100 text-gray-600', } const statusLabels = { open: 'Offen', 'in-progress': 'In Bearbeitung', resolved: 'Behoben', 'accepted-risk': 'Akzeptiert', } const isOverdue = item.dueDate && item.dueDate < new Date() && item.status !== 'resolved' return (
{item.severity.toUpperCase()} {typeLabels[item.type]} {statusLabels[item.status]}

{item.title}

{item.description}

Betroffenes Asset: {item.affectedAsset}
Quelle: {item.source}
{item.cve && (
CVE: {item.cve}
)} {item.cvss && (
CVSS: = 9 ? 'text-red-600' : item.cvss >= 7 ? 'text-orange-600' : item.cvss >= 4 ? 'text-yellow-600' : 'text-green-600' }`}>{item.cvss}
)}
Zugewiesen: {item.assignedTo || 'Nicht zugewiesen'}
{item.dueDate && (
Frist: {item.dueDate.toLocaleDateString('de-DE')} {isOverdue && ' (ueberfaellig)'}
)}
Empfohlene Massnahme: {item.remediation}
Erstellt: {item.createdAt.toLocaleDateString('de-DE')} {item.status !== 'resolved' && (
)}
) } // ============================================================================= // MAIN PAGE // ============================================================================= export default function SecurityBacklogPage() { const { state } = useSDK() const [items] = useState(mockItems) const [filter, setFilter] = useState('all') const filteredItems = filter === 'all' ? items : items.filter(i => i.severity === filter || i.status === filter || i.type === filter) const openItems = items.filter(i => i.status === 'open').length const criticalCount = items.filter(i => i.severity === 'critical' && i.status !== 'resolved').length const highCount = items.filter(i => i.severity === 'high' && i.status !== 'resolved').length const overdueCount = items.filter(i => i.dueDate && i.dueDate < new Date() && i.status !== 'resolved' ).length return (
{/* Header */}

Security Backlog

Verwalten Sie Sicherheitsbefunde und verfolgen Sie deren Behebung

{/* Stats */}
Offen
{openItems}
Kritisch
{criticalCount}
Hoch
{highCount}
Ueberfaellig
{overdueCount}
{/* Critical Alert */} {criticalCount > 0 && (

{criticalCount} kritische Schwachstelle(n) erfordern sofortige Aufmerksamkeit

Diese Befunde haben ein CVSS von 9.0 oder hoeher und sollten priorisiert werden.

)} {/* Filter */}
Filter: {['all', 'open', 'in-progress', 'critical', 'high', 'vulnerability', 'misconfiguration'].map(f => ( ))}
{/* Items List */}
{filteredItems .sort((a, b) => { // Sort by severity and status const severityOrder = { critical: 0, high: 1, medium: 2, low: 3 } const statusOrder = { open: 0, 'in-progress': 1, 'accepted-risk': 2, resolved: 3 } const severityDiff = severityOrder[a.severity] - severityOrder[b.severity] if (severityDiff !== 0) return severityDiff return statusOrder[a.status] - statusOrder[b.status] }) .map(item => ( ))}
{filteredItems.length === 0 && (

Keine Befunde gefunden

Passen Sie den Filter an oder fuehren Sie einen neuen Scan durch.

)}
) }