Package: octool
OCToolOverviewHow-toGet started with an exampleThe easy wayPull an already-built Docker imageGenerate an SSP from the example data with DockerRoll-your-own deploymentPrereqsInstall OCToolGenerate an SSP from the example data with your own deploymentWrite your own data filesPandoc filtersBuild and testConceptsEntitiesSystem vs componentBenefitsAdministriviaGoalsOverviewOCTool aspires to be an open compliance tool and library.It uses Pandoc, TeXLive, LuaTeX, and an open data schema to
produce compliance documents, such as System Security Plans (SSPs).This repo provides:Ruby gem:https://rubygems.org/gems/octoolDocker image:https://hub.docker.com/repository/docker/jumanjiman/octoolHow-toGet started with an exampleThis repo provides an example tree atexample-inputs/minimal.The easy wayPull an already-built Docker imagedockerpulljumanjiman/octoolGenerate an SSP from the example data with Dockerdockerrun--rm-it-v/tmp:/datajumanjiman/octoolssp/example-inputs/minimalThe above command builds the SSP and
saves it at/tmp/ssp.pdfon your Docker host.Roll-your-own deploymentPrereqsYour host needs these packages:Ruby 2.4+Pandoc 2.9+Python 3.6+TexLive full distribution, including LuaTeX and XeLaTeXInstall OCToolgeminstall--user-installoctoolGenerate an SSP from the example data with your own deploymentConfirm the example data is validoctoolvalidateexample-inputs/minimal/config.yamlBuild a PDFoctoolsspexample-inputs/minimal/config.yamlThe result should look like the example output atexample-outputs/minimal/ssp.pdf.Write your own data filesThe schemas are atsrc/schemas/.Things to know:All text strings are interpreted as markdown.You can use markdown in your data anywhere a string is required.Seeexample-inputs/minimalfor demo data.:bulb: Pandoc has its own flavor of markdown.Seehttps://pandoc.org/MANUAL.html#pandocs-markdownfor differences from other flavors.:bulb: When you reference paths to images within your markdown, thepath is relative to the directory in whichconfig.yamlis stored.See the example-inputs files for clarity.You can runoctool validate path/to/inputsto confirm your data structure.Do you want to runoctoolin a read-only container?TeX needs to write to at least one directory.Make at least one of these a volume in your container:${HOME}(inconvenient for unprivileged user with read-only homedir)/usr/share/texmf-var(writable only by root)The Docker image in this repo works around the issue toenable read-only containers.Pandoc filtersOCTool builds in support for these Pandoc filters via the schema:https://gitlab.com/mirkoboehm/pandoc-acronymsBuild and testThis repo builds, tests, and publishes a Docker image that includes the
full TeXLive distribution and OCTool. The test harness runs the container
with aread-onlyroot filesystem andreduced privilegesto demonstrate
good security practices for containerized applications.# Setup your dev environment.sdlc/bootstrap# Build and test.sdlc/build&&sdlc/testConceptsEntitiesThis diagram helps to illustrate the definitions that follow.It reads top-down and left-to-right.System: A potentially-complex technology architecture that
includes one or more components.ConfigFile: An OCTool configuration file.Component: A list of components within the system along with
attestations to satisfy one or more controls.Standard: A list that defines one or more security controls.An example of a standard is NIST 800-53 or Payment
Card Industry Data Security Standards (PCI DSS).Control: A specific requirement or process to describe and mitigate risk.Certification: A list that requires one or more controls.A certification requires all or a subset of controls
from one or more standards.A hypothetical certification could include
all of NIST 800-53plusa specific subset of PCI DSS.An Authority to Operate (ATO) is one example of a certification.
A request list from an auditor is another example.System vs componentA component and a system can be identical from a compliance perspective
in the simplest cases. It is common, however, that a complex system
delegates compliance to multiple responsible parties
along organizational boundaries in ashared servicesmodel.Consider, for example, an organization that owns its datacenter and
assigns responsibility for physical access to a dedicated team.The organization can describe the datacenter as a component and
describe its compliance to physical access controls
within a shareable component calleddatacenter.Teams that operate software within the datacenter can then
include thedatacentercomponent
within their own compliance documentation.With the shared services model, thesystemcompliance documentationincludesvarious components. Its compliance documentation is
assembled from various components.Thus some systems are described by multiple components;
smaller systems, by a single component.BenefitsIf an application owner requests an exception to a control from a
shared component, the InfoSec team can run an impact assessment
to see which other applications (systems) and/or certifications
would be impacted by the exception.The organization can use the system to ask what-if questions.Compliance and regulatory teams have a central source of truth
from which to answer questions.Git provides an audit log of changes to the compliance docs.The intermediate output (SQL database, CSV, etc.) is available
so teams can choose whatever analytical tools they prefer.AdministriviaGoalsRead input configuration in multiple formatsGenerate output documentation for governance and complianceExcelMarkdownPDFWordConvert inputs to a well-defined data structureIntermediate outputCSVExcelSQLiteFacilitate gap analysisFacilitate impact analysis for exceptions