48ca0a6bef
Adds a routing layer between Pass 0a and Pass 0b that classifies obligations into atomic/compound/framework_container. Framework-container obligations (e.g. "CCM-Praktiken fuer AIS") are decomposed into concrete sub-obligations via an internal framework registry before Pass 0b composition. - New: framework_decomposition.py with routing, matching, decomposition - New: Framework registry (NIST SP 800-53, OWASP ASVS, CSA CCM) as JSON - New: Composite detection flags on atomic controls (is_composite, atomicity) - New: gen_meta fields: framework_ref, framework_domain, decomposition_source - Integration: _route_and_compose() in run_pass0b() deterministic path - 248 tests (198 decomposition + 50 framework), all passing Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
354 lines
15 KiB
JSON
354 lines
15 KiB
JSON
{
|
|
"framework_id": "OWASP_ASVS",
|
|
"display_name": "OWASP Application Security Verification Standard 4.0",
|
|
"license": {
|
|
"type": "cc_by_sa_4",
|
|
"rag_allowed": true,
|
|
"use_as_metadata": true
|
|
},
|
|
"domains": [
|
|
{
|
|
"domain_id": "V1",
|
|
"title": "Architecture, Design and Threat Modeling",
|
|
"aliases": ["architecture", "architektur", "design", "threat modeling", "bedrohungsmodellierung"],
|
|
"keywords": ["architektur", "design", "threat model", "bedrohung", "modellierung"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V1.1",
|
|
"title": "Secure Software Development Lifecycle",
|
|
"statement": "Ein sicherer Softwareentwicklungs-Lebenszyklus (SSDLC) muss definiert und angewendet werden.",
|
|
"keywords": ["sdlc", "lifecycle", "lebenszyklus", "entwicklung"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Sicherer Entwicklungs-Lebenszyklus",
|
|
"object_class": "process"
|
|
},
|
|
{
|
|
"subcontrol_id": "V1.2",
|
|
"title": "Authentication Architecture",
|
|
"statement": "Die Authentifizierungsarchitektur muss dokumentiert und regelmaessig ueberprueft werden.",
|
|
"keywords": ["authentication", "authentifizierung", "architektur"],
|
|
"action_hint": "document",
|
|
"object_hint": "Authentifizierungsarchitektur",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "V1.4",
|
|
"title": "Access Control Architecture",
|
|
"statement": "Die Zugriffskontrollarchitektur muss dokumentiert und zentral durchgesetzt werden.",
|
|
"keywords": ["access control", "zugriffskontrolle", "architektur"],
|
|
"action_hint": "document",
|
|
"object_hint": "Zugriffskontrollarchitektur",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "V1.5",
|
|
"title": "Input and Output Architecture",
|
|
"statement": "Eingabe- und Ausgabevalidierung muss architektonisch verankert und durchgaengig angewendet werden.",
|
|
"keywords": ["input", "output", "eingabe", "ausgabe", "validierung"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Ein-/Ausgabevalidierung",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V1.6",
|
|
"title": "Cryptographic Architecture",
|
|
"statement": "Kryptographische Mechanismen muessen architektonisch definiert und standardisiert sein.",
|
|
"keywords": ["crypto", "kryptographie", "verschluesselung"],
|
|
"action_hint": "define",
|
|
"object_hint": "Kryptographie-Architektur",
|
|
"object_class": "cryptographic_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "V2",
|
|
"title": "Authentication",
|
|
"aliases": ["authentication", "authentifizierung", "anmeldung", "login"],
|
|
"keywords": ["authentication", "authentifizierung", "passwort", "login", "anmeldung", "credential"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V2.1",
|
|
"title": "Password Security",
|
|
"statement": "Passwortrichtlinien muessen Mindestlaenge, Komplexitaet und Sperrmechanismen definieren.",
|
|
"keywords": ["passwort", "password", "laenge", "komplexitaet"],
|
|
"action_hint": "define",
|
|
"object_hint": "Passwortrichtlinie",
|
|
"object_class": "policy"
|
|
},
|
|
{
|
|
"subcontrol_id": "V2.2",
|
|
"title": "General Authenticator Security",
|
|
"statement": "Authentifizierungsmittel muessen sicher gespeichert und uebertragen werden.",
|
|
"keywords": ["authenticator", "credential", "speicherung"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Sichere Credential-Verwaltung",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V2.7",
|
|
"title": "Out-of-Band Verification",
|
|
"statement": "Out-of-Band-Verifikationsmechanismen muessen sicher implementiert werden.",
|
|
"keywords": ["oob", "out-of-band", "sms", "push"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Out-of-Band-Verifikation",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V2.8",
|
|
"title": "Multi-Factor Authentication",
|
|
"statement": "Multi-Faktor-Authentifizierung muss fuer sicherheitskritische Funktionen verfuegbar sein.",
|
|
"keywords": ["mfa", "multi-faktor", "totp", "fido"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Multi-Faktor-Authentifizierung",
|
|
"object_class": "technical_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "V3",
|
|
"title": "Session Management",
|
|
"aliases": ["session", "sitzung", "session management", "sitzungsverwaltung"],
|
|
"keywords": ["session", "sitzung", "token", "cookie", "timeout"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V3.1",
|
|
"title": "Session Management Security",
|
|
"statement": "Sitzungstoken muessen sicher erzeugt, uebertragen und invalidiert werden.",
|
|
"keywords": ["token", "sitzung", "sicherheit"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Sichere Sitzungsverwaltung",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V3.3",
|
|
"title": "Session Termination",
|
|
"statement": "Sitzungen muessen nach Inaktivitaet und bei Abmeldung zuverlaessig beendet werden.",
|
|
"keywords": ["termination", "timeout", "abmeldung", "beenden"],
|
|
"action_hint": "configure",
|
|
"object_hint": "Sitzungstimeout",
|
|
"object_class": "configuration"
|
|
},
|
|
{
|
|
"subcontrol_id": "V3.5",
|
|
"title": "Token-Based Session Management",
|
|
"statement": "Tokenbasierte Sitzungsmechanismen muessen gegen Diebstahl und Replay geschuetzt sein.",
|
|
"keywords": ["jwt", "token", "replay", "diebstahl"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Token-Schutz",
|
|
"object_class": "technical_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "V5",
|
|
"title": "Validation, Sanitization and Encoding",
|
|
"aliases": ["validation", "validierung", "sanitization", "encoding", "eingabevalidierung"],
|
|
"keywords": ["validierung", "sanitization", "encoding", "xss", "injection", "eingabe"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V5.1",
|
|
"title": "Input Validation",
|
|
"statement": "Alle Eingabedaten muessen serverseitig validiert werden.",
|
|
"keywords": ["input", "eingabe", "validierung", "serverseitig"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Eingabevalidierung",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V5.2",
|
|
"title": "Sanitization and Sandboxing",
|
|
"statement": "Eingaben muessen bereinigt und in sicherer Umgebung verarbeitet werden.",
|
|
"keywords": ["sanitization", "bereinigung", "sandbox"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Eingabebereinigung",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V5.3",
|
|
"title": "Output Encoding and Injection Prevention",
|
|
"statement": "Ausgaben muessen kontextabhaengig kodiert werden, um Injection-Angriffe zu verhindern.",
|
|
"keywords": ["output", "encoding", "injection", "xss", "sql"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Ausgabe-Encoding",
|
|
"object_class": "technical_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "V6",
|
|
"title": "Stored Cryptography",
|
|
"aliases": ["cryptography", "kryptographie", "verschluesselung", "stored cryptography"],
|
|
"keywords": ["kryptographie", "verschluesselung", "hashing", "schluessel", "key management"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V6.1",
|
|
"title": "Data Classification",
|
|
"statement": "Daten muessen klassifiziert und entsprechend ihrer Schutzklasse behandelt werden.",
|
|
"keywords": ["klassifizierung", "classification", "schutzklasse"],
|
|
"action_hint": "define",
|
|
"object_hint": "Datenklassifizierung",
|
|
"object_class": "data"
|
|
},
|
|
{
|
|
"subcontrol_id": "V6.2",
|
|
"title": "Algorithms",
|
|
"statement": "Nur zugelassene und aktuelle kryptographische Algorithmen duerfen verwendet werden.",
|
|
"keywords": ["algorithmus", "algorithm", "aes", "rsa"],
|
|
"action_hint": "configure",
|
|
"object_hint": "Kryptographische Algorithmen",
|
|
"object_class": "cryptographic_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V6.4",
|
|
"title": "Secret Management",
|
|
"statement": "Geheimnisse (Schluessel, Passwoerter, Tokens) muessen in einem Secret-Management-System verwaltet werden.",
|
|
"keywords": ["secret", "geheimnis", "vault", "key management"],
|
|
"action_hint": "maintain",
|
|
"object_hint": "Secret-Management",
|
|
"object_class": "cryptographic_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "V8",
|
|
"title": "Data Protection",
|
|
"aliases": ["data protection", "datenschutz", "datenverarbeitung"],
|
|
"keywords": ["datenschutz", "data protection", "pii", "personenbezogen", "privacy"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V8.1",
|
|
"title": "General Data Protection",
|
|
"statement": "Personenbezogene Daten muessen gemaess Datenschutzanforderungen geschuetzt werden.",
|
|
"keywords": ["personenbezogen", "pii", "datenschutz"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Datenschutzmassnahmen",
|
|
"object_class": "data"
|
|
},
|
|
{
|
|
"subcontrol_id": "V8.2",
|
|
"title": "Client-Side Data Protection",
|
|
"statement": "Clientseitig gespeicherte sensible Daten muessen geschuetzt und minimiert werden.",
|
|
"keywords": ["client", "browser", "localstorage", "cookie"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Clientseitiger Datenschutz",
|
|
"object_class": "technical_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V8.3",
|
|
"title": "Sensitive Private Data",
|
|
"statement": "Sensible Daten muessen bei Speicherung und Verarbeitung besonders geschuetzt werden.",
|
|
"keywords": ["sensibel", "vertraulich", "speicherung"],
|
|
"action_hint": "encrypt",
|
|
"object_hint": "Verschluesselung sensibler Daten",
|
|
"object_class": "data"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "V9",
|
|
"title": "Communication",
|
|
"aliases": ["communication", "kommunikation", "tls", "transport"],
|
|
"keywords": ["tls", "ssl", "https", "transport", "kommunikation", "verschluesselung"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V9.1",
|
|
"title": "Client Communication Security",
|
|
"statement": "Alle Client-Server-Kommunikation muss ueber TLS verschluesselt werden.",
|
|
"keywords": ["tls", "https", "client", "server"],
|
|
"action_hint": "encrypt",
|
|
"object_hint": "TLS-Transportverschluesselung",
|
|
"object_class": "cryptographic_control"
|
|
},
|
|
{
|
|
"subcontrol_id": "V9.2",
|
|
"title": "Server Communication Security",
|
|
"statement": "Server-zu-Server-Kommunikation muss authentifiziert und verschluesselt erfolgen.",
|
|
"keywords": ["server", "mtls", "backend"],
|
|
"action_hint": "encrypt",
|
|
"object_hint": "Server-Kommunikationsverschluesselung",
|
|
"object_class": "cryptographic_control"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "V13",
|
|
"title": "API and Web Service",
|
|
"aliases": ["api", "web service", "rest", "graphql", "webservice"],
|
|
"keywords": ["api", "rest", "graphql", "webservice", "endpoint", "schnittstelle"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V13.1",
|
|
"title": "Generic Web Service Security",
|
|
"statement": "Web-Services muessen gegen gaengige Angriffe abgesichert werden.",
|
|
"keywords": ["web service", "sicherheit", "angriff"],
|
|
"action_hint": "implement",
|
|
"object_hint": "Web-Service-Absicherung",
|
|
"object_class": "interface"
|
|
},
|
|
{
|
|
"subcontrol_id": "V13.2",
|
|
"title": "RESTful Web Service",
|
|
"statement": "REST-APIs muessen Input-Validierung, Rate Limiting und sichere Authentifizierung implementieren.",
|
|
"keywords": ["rest", "api", "rate limiting", "input"],
|
|
"action_hint": "implement",
|
|
"object_hint": "REST-API-Absicherung",
|
|
"object_class": "interface"
|
|
},
|
|
{
|
|
"subcontrol_id": "V13.4",
|
|
"title": "GraphQL and Web Services",
|
|
"statement": "GraphQL-Endpoints muessen gegen Query-Complexity-Angriffe und Introspection geschuetzt werden.",
|
|
"keywords": ["graphql", "query", "complexity", "introspection"],
|
|
"action_hint": "configure",
|
|
"object_hint": "GraphQL-Absicherung",
|
|
"object_class": "interface"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"domain_id": "V14",
|
|
"title": "Configuration",
|
|
"aliases": ["configuration", "konfiguration", "hardening", "haertung"],
|
|
"keywords": ["konfiguration", "hardening", "haertung", "header", "deployment"],
|
|
"subcontrols": [
|
|
{
|
|
"subcontrol_id": "V14.1",
|
|
"title": "Build and Deploy",
|
|
"statement": "Build- und Deployment-Prozesse muessen sicher konfiguriert und reproduzierbar sein.",
|
|
"keywords": ["build", "deploy", "ci/cd", "pipeline"],
|
|
"action_hint": "configure",
|
|
"object_hint": "Sichere Build-Pipeline",
|
|
"object_class": "configuration"
|
|
},
|
|
{
|
|
"subcontrol_id": "V14.2",
|
|
"title": "Dependency Management",
|
|
"statement": "Abhaengigkeiten muessen auf Schwachstellen geprueft und aktuell gehalten werden.",
|
|
"keywords": ["dependency", "abhaengigkeit", "sca", "sbom"],
|
|
"action_hint": "maintain",
|
|
"object_hint": "Abhaengigkeitsverwaltung",
|
|
"object_class": "system"
|
|
},
|
|
{
|
|
"subcontrol_id": "V14.3",
|
|
"title": "Unintended Security Disclosure",
|
|
"statement": "Fehlermeldungen und Debug-Informationen duerfen keine sicherheitsrelevanten Details preisgeben.",
|
|
"keywords": ["disclosure", "fehlermeldung", "debug", "information leakage"],
|
|
"action_hint": "configure",
|
|
"object_hint": "Fehlerbehandlung",
|
|
"object_class": "configuration"
|
|
},
|
|
{
|
|
"subcontrol_id": "V14.4",
|
|
"title": "HTTP Security Headers",
|
|
"statement": "HTTP-Sicherheitsheader muessen korrekt konfiguriert sein.",
|
|
"keywords": ["header", "csp", "hsts", "x-frame"],
|
|
"action_hint": "configure",
|
|
"object_hint": "HTTP-Sicherheitsheader",
|
|
"object_class": "configuration"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|