mirror of
https://github.com/mukul975/Anthropic-Cybersecurity-Skills.git
synced 2026-09-07 17:00:50 +03:00
Initial commit - 611 cybersecurity skills across all subdomains
This commit is contained in:
mukul975
@@ -0,0 +1,63 @@
|
||||
# Standards Reference: SCA Dependency Scanning with Snyk
|
||||
|
||||
## OWASP Top 10 - A06:2021 Vulnerable and Outdated Components
|
||||
|
||||
- Applications using components with known vulnerabilities may be exploitable
|
||||
- SCA tools like Snyk identify vulnerable versions and provide upgrade paths
|
||||
- Includes both direct and transitive dependency scanning
|
||||
|
||||
## NIST SSDF (SP 800-218)
|
||||
|
||||
### PW.4: Reuse Existing, Well-Secured Software
|
||||
- PW.4.1: Verify that acquired software meets security requirements
|
||||
- PW.4.2: Review, analyze, and test software to identify vulnerabilities
|
||||
- SCA scanning of all third-party components before integration
|
||||
|
||||
### PW.4.4: Maintain Provenance Data
|
||||
- Track the origin and version of all third-party software components
|
||||
- Snyk monitor provides continuous tracking of dependency versions
|
||||
|
||||
## CIS Software Supply Chain Security
|
||||
|
||||
### Dependencies (DP) Controls
|
||||
- DP-1: Pin dependencies to specific versions
|
||||
- DP-2: Automate dependency vulnerability scanning in CI/CD
|
||||
- DP-3: Review and approve new dependency additions
|
||||
- DP-4: Monitor deployed dependencies for newly disclosed vulnerabilities
|
||||
|
||||
## OWASP SAMM - Software Security
|
||||
|
||||
### Security Testing - Maturity Level 1
|
||||
- Automated dependency scanning using default configurations
|
||||
- Visibility of vulnerable components to development teams
|
||||
|
||||
### Security Testing - Maturity Level 2
|
||||
- Custom policies for severity thresholds and license compliance
|
||||
- Automated fix PRs for upgradable vulnerabilities
|
||||
- Tracking of exploit maturity to prioritize remediation
|
||||
|
||||
### Security Testing - Maturity Level 3
|
||||
- Reachability analysis to identify actually exploitable vulnerabilities
|
||||
- Integration with vulnerability management for SLA tracking
|
||||
- Correlation with runtime monitoring for risk-based prioritization
|
||||
|
||||
## PCI DSS v4.0
|
||||
|
||||
- 6.2.4: Use automated methods to prevent common software attacks
|
||||
- 6.3.2: Maintain an inventory of custom and third-party software components
|
||||
- 6.3.3: Software components not needed for operation removed or identified
|
||||
|
||||
## Executive Order 14028 (US Federal)
|
||||
|
||||
- Section 4(e): Agencies shall employ automated tools for continuous monitoring of vulnerabilities in software
|
||||
- SBOM requirement: All software suppliers must provide SBOMs listing all components including open-source
|
||||
- Aligns with Snyk's SBOM generation and continuous monitoring capabilities
|
||||
|
||||
## License Compliance Framework
|
||||
|
||||
| License Type | Risk Level | Policy | Examples |
|
||||
|--------------|------------|--------|----------|
|
||||
| Permissive | Low | Auto-approve | MIT, BSD-2, BSD-3, ISC, Apache-2.0 |
|
||||
| Weak Copyleft | Medium | Review | LGPL-2.1, LGPL-3.0, MPL-2.0 |
|
||||
| Strong Copyleft | High | Restrict | GPL-2.0, GPL-3.0, AGPL-3.0 |
|
||||
| Unknown/Custom | High | Manual Review | Proprietary, SSPL, BSL |
|
||||
@@ -0,0 +1,130 @@
|
||||
# Workflow Reference: SCA Dependency Scanning with Snyk
|
||||
|
||||
## Dependency Scanning Pipeline
|
||||
|
||||
```
|
||||
Code Push / PR
|
||||
│
|
||||
▼
|
||||
┌──────────────────┐
|
||||
│ Install Deps │
|
||||
│ (npm ci, pip │
|
||||
│ install, etc.) │
|
||||
└──────┬───────────┘
|
||||
│
|
||||
▼
|
||||
┌──────────────────┐
|
||||
│ Snyk Test │──── Report JSON ───> Artifact Storage
|
||||
│ (vuln scan) │
|
||||
└──────┬───────────┘
|
||||
│
|
||||
┌────┴────┐
|
||||
│ │
|
||||
PASS FAIL ──────> PR Comment with vuln details
|
||||
│ │
|
||||
│ ▼
|
||||
│ ┌──────────────┐
|
||||
│ │ Snyk Fix PR │
|
||||
│ │ (auto-gen) │
|
||||
│ └──────────────┘
|
||||
▼
|
||||
┌──────────────────┐
|
||||
│ Snyk Monitor │
|
||||
│ (continuous) │
|
||||
└──────┬───────────┘
|
||||
│
|
||||
▼
|
||||
Ongoing alerts for
|
||||
new disclosures
|
||||
```
|
||||
|
||||
## Snyk CLI Command Reference
|
||||
|
||||
### Scanning Commands
|
||||
```bash
|
||||
# Basic vulnerability test
|
||||
snyk test
|
||||
|
||||
# Test with severity filter
|
||||
snyk test --severity-threshold=high
|
||||
|
||||
# Test with exploit maturity filter
|
||||
snyk test --severity-threshold=high
|
||||
|
||||
# Test specific manifest
|
||||
snyk test --file=package-lock.json
|
||||
|
||||
# Test all projects in monorepo
|
||||
snyk test --all-projects
|
||||
|
||||
# Test with dev dependencies excluded
|
||||
snyk test --production
|
||||
|
||||
# Output in JSON
|
||||
snyk test --json --json-file-output=results.json
|
||||
|
||||
# Output in SARIF
|
||||
snyk test --sarif --sarif-file-output=results.sarif
|
||||
```
|
||||
|
||||
### Monitoring Commands
|
||||
```bash
|
||||
# Monitor project for new vulnerabilities
|
||||
snyk monitor --project-name="my-app-prod"
|
||||
|
||||
# Monitor specific branch
|
||||
snyk monitor --target-reference=main
|
||||
|
||||
# Monitor with tags
|
||||
snyk monitor --project-tags=env=production,team=platform
|
||||
```
|
||||
|
||||
### Fix Commands
|
||||
```bash
|
||||
# Preview available fixes
|
||||
snyk fix --dry-run
|
||||
|
||||
# Apply fixes to direct dependencies
|
||||
snyk fix
|
||||
|
||||
# Apply fixes including dev dependencies
|
||||
snyk fix --dev
|
||||
```
|
||||
|
||||
## Vulnerability Prioritization Matrix
|
||||
|
||||
| Factor | Score Weight | Description |
|
||||
|--------|-------------|-------------|
|
||||
| CVSS Score | 30% | Base vulnerability severity |
|
||||
| Exploit Maturity | 25% | Mature > POC > No Known Exploit |
|
||||
| Reachability | 20% | Function called > Imported > Present |
|
||||
| Fix Availability | 15% | Upgrade available > Patch > None |
|
||||
| Dependency Depth | 10% | Direct > Transitive (1 hop) > Deep transitive |
|
||||
|
||||
## Snyk Integration Options
|
||||
|
||||
| Platform | Integration Method | Features |
|
||||
|----------|--------------------|----------|
|
||||
| GitHub | GitHub App | Auto-scan PRs, fix PRs, SARIF upload |
|
||||
| GitLab | GitLab Integration | MR comments, dependency scanning |
|
||||
| Jenkins | Snyk Plugin | Pipeline step, HTML reports |
|
||||
| Azure DevOps | Extension | Pipeline task, dashboard widget |
|
||||
| Bitbucket | Bitbucket App | PR checks, fix PRs |
|
||||
| CLI | npm/binary | Local scanning, CI/CD integration |
|
||||
|
||||
## Remediation Strategy by Vulnerability Type
|
||||
|
||||
### Direct Dependency Vulnerability
|
||||
1. Check if upgrade is available: `snyk test --json | jq '.vulnerabilities[] | select(.isUpgradable)'`
|
||||
2. If upgradable: run `snyk fix` or manually upgrade
|
||||
3. Verify no breaking changes in the upgrade
|
||||
4. If not upgradable: check for patch or accept risk with ignore
|
||||
|
||||
### Transitive Dependency Vulnerability
|
||||
1. Identify the dependency chain: `snyk test --json | jq '.vulnerabilities[].from'`
|
||||
2. Check if upgrading the direct dependency resolves it
|
||||
3. If not: use version overrides in package manager
|
||||
4. npm: `overrides` in package.json
|
||||
5. Maven: `dependencyManagement` in pom.xml
|
||||
6. Gradle: `constraints` in build.gradle
|
||||
7. Poetry: `tool.poetry.extras` or constraint resolution
|
||||
Reference in New Issue
Block a user