pussinscreen/autocompliance

Automating the Implementation of a Cybersecurity Governance, Risk and Compliance Programme using Distributed Ledger Technologies

AutoCompliance

Automating the Implementation of a Cybersecurity Governance, Risk and Compliance Programme using Distributed Ledger Technologies

Research Questions and Deliverables (WIP)

1. Can DLTs help implement a GRC programme better than other means?
   • A comparison report of DLT performance compared to the conventional means for implementing a GRC programme.
   • DLT solution(s) that assist with the implementation of a GRC programme in any given organisation.
2. Is there anything that can’t or should not be automated in the implementation? Why?
   • A breakdown on all items that can not be automated with in depth technical analysis as to why that is the case.
3. Are existing implementation solutions suitable or is there more work to be done?
   • A definition on what is to be classified as “suitable”.
   • An outline of all that needs to be done to reach a suitable state.
4. What possible future technical developments need to be accounted for in the GRC space?
   • A list of future technical areas and a description on how they should be accounted for in the future.
5. Is machine learning the best way towards total zero trust security solutions?
   • A comparison report of ML performance compared to the conventional means for implementing zero trust security in an organisation’s network.
   • ML solution(s) that assist with the implementation of a zero trust security network in any given organisation.

Project Abstract

This project takes a look at how to automate the implementation of a programme of Cybersecurity governance, risk management and compliance in any given organisation through the use of Distributed Ledger Technologies. A comprehensive review of relevant and appropriate literature has been undertook to inform the knowledge contained within the report. Consideration has been given for Cybersecurity and governance frameworks, risk management frameworks as well as global laws and regulations. Generic security missions, visions and values have been outlined to better inform the identification of GRC requirements for any given organisation. Using various professional practices that dynamically apply to any given organisation, a plan is to be automatically outlined and executed to implement the aforementioned programme of Cybersecurity governance, risk management and compliance using Distributed Ledger Technologies.

The report has been broken down into several sections for this. These sections are the introduction, background research, Cybersecurity GRC requirements, implementation approach and conclusions. The introduction sets the scene for the project. Background research examines the legal and regulatory issues relevant to different kinds of organisations as well as governance and risk management frameworks that may be of assistance when implementing a programme of Cybersecurity governance, risk and compliance in the organisation. In the Cybersecurity GRC requirements section various kinds of organisations are introduced and so too are the GRC requirements of each kind of organisation. A description of how Cybersecurity governance, risk management and compliance could be implemented using Distributed Ledger Technologies in a given organisation type is covered in the implementation approach. Finally, the conclusion enumerates on the conclusions of this project.

The following frameworks are covered and implemented within this project to some extent; NIST, OSSTMM, PMMM, PMBoK, COBIT, ISO/IEC 27014:2020, National Cyber Security Strategy - Government of Ireland, NIST RMF, ISO/IEC 27005:2018, CMMC, GDPR, PCI DSS, ENISA Strategy, AT-101 (SOC2), ISO 9001:2015 and ISO/IEC 27001:- 2013.

autocompliance's Issues

Add Tests for Main Class

Needs to be done to get the main build working

Machine Learning Solution for Detecting GRC Requirements

Is your feature request related to a problem? Please describe.
Need a way to tell what GRC programme steps are to be implemented

Describe the solution you'd like
An automated ML solution which can apply a "profile" for a specific business domain.

Describe alternatives you've considered
Hardcoding profiles and basing relationships on "closeness" but this doesn't account for new combinations of business models and domains.

Additional context
To be added.

Add a requirements.txt

Is your feature request related to a problem? Please describe.
Currently the install script doesn't really disclose version numbers for pip packages or allows users to install using the pip -r method, we also need a way to allow us to freeze dependencies at specific versions if needed. Granted we always want to try and use the latest pip packages regardless.

Describe the solution you'd like
A requirements.txt file that users can run pip -r requirements.txt with.

Describe alternatives you've considered
Once this is done, requirements.txt can be directly referenced in the install script so that way we're not worrying about keeping track of used dependencies and instead can focus on just gathering said dependencies with pip freeze > requirements.txt.

Additional context
This issue was created in reference to this pull request; #21

Include Initial Functions for Blockchain Functionality

Is your feature request related to a problem? Please describe.
Initial solution for storing sensitive information related to hosts in a domain.

Describe the solution you'd like
A dBFT 2.0 blockchain that can set up nodes when needed / able.

Describe alternatives you've considered
Database, but saving that for later when working on a comparison report.

Additional context
Same akin to what was done as part of this project, solution was based on supply chain management though; Link

EDIT: Typo

EDIT 2: Redefined blockchain consensus needed

Add all strings to strings.py

Is your feature request related to a problem? Please describe.
Currently, there's a lot of hard coded strings that duplicate across multiple functions, and even the ones that don't are likely to be duplicated in the future. Changing a string in one place doesn't change it across the application.

Describe the solution you'd like
Put all strings into the "strings.py"

Describe alternatives you've considered
None

Additional context
Example of a string which needs to be pulled out into strings.py;

Password File Handling, Encrypted File?

Is your feature request related to a problem? Please describe.
Right now passwords are passed into the program and stored via a plaintext file THIS IS NOT A GOOD SOLUTION

Describe the solution you'd like
Passwords should be stored encrypted on the blockchain, look at how password managers handle password exporting/importing and mimic that behaviour.

Describe alternatives you've considered
Bruteforcing entirely, but honestly, user defined password strings are the ideal solution.

Additional context
Test password files and tests in general will need to be updated too.

Finish "test_net_propagation.py" and add proper logging

Is your feature request related to a problem? Please describe.
There's currently only two functions within this test.

Describe the solution you'd like
Ideally this test should cover every function within the "net_propagation.py" file and each function should provide appropriate logging.

Describe alternatives you've considered
None

Additional context
See the TODO items here;

[Proposal] Refactoring the codebase

net_propagation.py is full with functions but instead of that if we can make a class named NetPropagation which will handle all the functionality of current net_propagation then it would be much better and after that we can work on the argument parsing of the main program. We can use a lib like (argparse)[https://docs.python.org/3/library/argparse.html] so that the program will be more user friendly overall and the code will be more manageable.
Let me know what do you think about it.

OOP Refactor

Is your feature request related to a problem? Please describe.
Code is monolithic, unruly to maintain.

Describe the solution you'd like
Static functions and classes, better OOP principles implemented

Describe alternatives you've considered
Starting from scratch, not necessary though.

Additional context
First set of changes to be included as part of getting the tests working for the build process.

Initial Work on the GUI Elements

Is your feature request related to a problem? Please describe.
The GUI for AutoCompliance needs to be created.

Describe the solution you'd like
A functional GUI which can call the underlying logic when needed.

Describe alternatives you've considered
Headerless, but I think it best to have a GUI since other tools incorporated will have a GUI later down the line.

Additional context
These figures are a good starting point, also, a link to the Glade project used to build these mock-ups; Link

EDIT: Missing mock-up image
EDIT 2: Work on a password prompt would be ideal

SECURITY: Sanitise or Remove all string literals given by the user that end up in SSH commands

Describe the bug
Right now SSH commands are built dynamically from user input, this includes filenames and usernames mostly.

To Reproduce
Look at SSH functions in net_propagation.py

Expected behavior
No oppurtunities for injection attacks, or at least protection from them

Screenshots

The problem in question, picked up by CodeFactor scans.

Desktop (please complete the following information):

• All

Smartphone (please complete the following information):

• All

Additional context
Maybe look into how to transfer files securely across the network in python, there must be an SCP library or something that automatically sanitises inputs? Worth investigating anyway.

New More Secure File Propagation Methods

Is your feature request related to a problem? Please describe.
Right now the code is highly dependant on using SSH/SCP commands for transferring, propagating and checking the existence of files on another device.

Describe the solution you'd like
Investigate what other solutions could be, maybe work it into the blockchain itself somehow? Lots to consider.

Describe alternatives you've considered
Leaving it as is but there must be a more secure and easier to implement method.

Additional context
Came about as a result of the removed Telnet functionality and the lack of user specified SSH/SCP command strings.

Add Automated Tests

Is your feature request related to a problem? Please describe.
Test Coverage for pre-existing functions could be better.

Describe the solution you'd like
Aiming for 60%+ coverage total (unit testing).

Describe alternatives you've considered
Smoke, UI and Manual tests, but honestly more automated low level testing the better.

Additional context

Trying to get this kind of proportion going

Multiple Git Workflows and Finally Get the Build Running

Is your feature request related to a problem? Please describe.
Need to have a build running for specific feature commits, sprint commits, develop commits and main commits.

Describe the solution you'd like
Four build and test process pairings for each kind of branch

Describe alternatives you've considered
Changing the branch every time in the .yml, however this can lead to conflicts when amendments need to be made for branch specific requirements.

Additional context
While I'm at it I might as well get everything going with no errors. A man can dream...

[UPDATE] main.py as a demo script

Is your feature request related to a problem? Please describe.
Main.py is a carryover from older purposes, it really serves no purpose anymore, especially in light of upcoming refactors.

Describe the solution you'd like
Repurpose main.py as a demo/testing script for back-end functionality

Describe alternatives you've considered
Removing it altogether, but a demo script is needed anyway so ¯_(ツ)_/¯

Additional context
None

Review comments in all source files

Is your feature request related to a problem? Please describe.
Revise comments, just double check they're revelancy, that's it.

Describe the solution you'd like
Fix the comments which contain inaccurate, irrelevant or outdated information.

Describe alternatives you've considered
Updating as you go, but honestly that'll fall by the wayside so here's a dedicated issue for it. :)

Additional context
Areas to look at are trace references to old telnet functionality, SSH command formation and residual comments that are irrelevant in light of TODOs being turned into issues.

Review Code for Use of "Incorrect" Language

Is your feature request related to a problem? Please describe.
Net_propagation.py and Main.py started off as scripts for maliciously sharing and executing scripts across a controlled network as part of a student project, thus some naming conventions are a little outdated.

Describe the solution you'd like
Revised, reviewed and edited where needed naming conventions and language in the code to give a better idea of what the code is actually trying to do.

Describe alternatives you've considered
Ignoring it altogether, though I don't think it bodes well if something like "try_attack" is used in a cyber-security defence tool such as this. :)

Additional context
Based on the TODO here;

Example of the kind of language that needs to be changed;

Refactor strings.py, move functions to strings_functions.py

Is your feature request related to a problem? Please describe.
Right now there is a 1:1 relationship with string building and the strings themselves, this is an issue for other languages which follow different syntaxes and grammar rules.

Describe the solution you'd like
Remove the string building functions of strings.py and move them to a new file called strings_functions.py

Describe alternatives you've considered
Not supporting other languages, but considering this is an open source tool there may be people out there that will want to freely provide translations and this would be a great accomadation for them.

Additional context
I will link this issue to any future translations based issues as this should certainly be done before those.

SECURITY: Remove all Telnet related functionality, replace with detecting and disabling Telnet where possible

Describe the bug
Telnet propagation is currently being utilised, the use of Telnetlib needs to be stripped out entriely and instead should be replaced with the ability to detect the use of Telnet.

To Reproduce
See telnetlib usage in net_propagation.py

Expected behavior
Removed telnet funnctionality, replaced with telnet detection and "disablement"

Screenshots
If applicable, add screenshots to help explain your problem.

Desktop (please complete the following information):

• All

Smartphone (please complete the following information):

• All

Additional context
Came from the results of this; CodeFactor.io Link

Add "param" and "return" Keywords to Block Comments

Is your feature request related to a problem? Please describe.
Most pre-existing block comments within the source code are missing param and return keywords.

Describe the solution you'd like
Add theses keywords and their associated relevant descriptions for each unique block comment.

Describe alternatives you've considered
Maybe build off this with automatic documentation generation?

Additional context
Based on this TODO in the code;

Address all security alerts from present code

There's a lot of security issues with the current code, mostly involving showing sensitive information as plaintext, need to address and fix this.

Update Security Policy

Is your feature request related to a problem? Please describe.
Right now the security policy is mostly just template text.

Describe the solution you'd like
A proper security policy for the project.

Describe alternatives you've considered
No alternatives are being considered.

Additional context
May be changed later.

Arparser for Arguments to demo.py

Is your feature request related to a problem? Please describe.
Currently arguments are parsed manually, this is a problem whenever changes need to be made in how arguments are handled / used.

Describe the solution you'd like
Implement the arparser library.

Describe alternatives you've considered
None, other than to ignore, but should be included in the codebase I feel.

Additional context
Based on this discussion;

Link

Tidy up the python code

Commenting was a bit of a mess, need to tidy it up and put the classes in the right places

Fleshed Out Wiki

Is your feature request related to a problem? Please describe.
Need to finish off and flesh out the wiki for newcomers / devs to the project.

Describe the solution you'd like
A wiki which gives a full rundown of all that is needed to be known about the project itself.

Describe alternatives you've considered
Not creating one? lol

Additional context
Look at previous compliance research, where the project will go next, development environment setup etc.

Finish Off Blockchain Functionality and Tests

Is your feature request related to a problem? Please describe.
Currently, only the fundamental blockchain functionality is implemented and it's not called by anything.

Describe the solution you'd like
A fully completed and integrated blockchain solution

Describe alternatives you've considered
Not having a blockchain solution? Kind of crucial for this project tbh

Additional context
Files to be worked on are blockchain.py, blockchain_delegate.py, blockchain_functions.py, blockchain_speaker.py and all their associated test files. The consensus algorithm being implemented is here; https://docs.neo.org/v2/docs/en-us/tooldev/consensus/consensus_algorithm.html