-
Notifications
You must be signed in to change notification settings - Fork 19
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Changes to Common Controls Baseline #315
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
GWS.COMMONCONTROLS.2.1v0.2 still needs more work.
The note, "granular controls may be used if the agency needs it," is misleading because it kind of implies that specifying what controls you want context aware access to apply is optional. It's not. Simply doing what is currently the implementation for 2.1 doesn't do anything. The full instructions need to include the following elements:
-
Turn on context aware access (as instructed in the current implementation, see screenshot)
-
Determine the conditions of the rule, per agency discretion.
Finally, there are still a lot of open questions left.
- What should the conditions of the access levels be? Entirely up to agency discretion?
- Which apps should be assigned to those levels? All? Just the admin center? Agency discretion?
- Which users should be assigned to those levels? They can be assigned at the OU and or group level. All? Or agency discretion?
- What mode should those assignments be in? Just monitor? Or active? Left to agency discretion?
Recommendations:
- Clarify that "Note:" for 2.1. Maybe: "Note: the implementation details of context-aware access use cases will vary per agency. Refer to Google's documentation on implementing context-aware access for your specific use cases."
- Augment the implementation steps to include all that I detailed above.
- Delete the implementation steps for 2.2 (they're still there).
- Address the open questions listed above.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Feedback for GWS.COMMONCONTROLS.16.1
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
Removed Policy 10.1 because there is no implementation for the policy. Agencies will be evaluated on their in-house procedures for items such as this as part of their NIST 800-53 control assessments. The technical implementation steps are already covered within this policy group. |
…Baseline v0.2.md Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com>
…Baseline v0.2.md Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com>
Co-authored-by: Alden Hilton <106177711+adhilto@users.noreply.github.com>
Moved 11.2 to Policy Group 10 (#318) |
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Show resolved
Hide resolved
baselines/Common Controls Minimum Viable Secure Configuration Baseline v0.2.md
Outdated
Show resolved
Hide resolved
Looks like this change might not have been pushed yet? |
Made Common Controls 11.1 a SHALL. |
TTP Mappings have been added. |
As discussed, removed Issue 290 for 2.2. Context Aware Access revamp will happen in the next release after Coast. @adhilto Please review the 2.1 section for Coast release including changes to the implementation steps. |
…com/cisagov/ScubaGoggles into common-controls-changes-post-0.2-v2
11.2 is unchanged as @adhilto mentioned in the email thread. Since there is a separate issue for this( #318 ), recommend to create a separate branch for this and commit separately as this PR tackles multiple issues already. Having a separate branch and PR (per issue) would ease the tracking and updates. |
I agree, that's the right call (with the caveat that branch be made after this one is merged in to ease merge conflicts). I just edited the description of this PR to remove that issue so it's accurate and so that that issue won't auto-close once this PR is merged. |
Sounds good I will make sure #318 and #290 are in different branches for the next release. I think now that those two have been removed from the description of this PR, I think we should be good to do review of PR as is and merge for Coast. |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Baseline looks good, and Rego changes are complete. @snarve did half yesterday, I did the last half today.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Rev
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good
🗣 Description
The following changes were made within the common controls baseline:
💭 Motivation and context
Fixes #240
Fixes #252
Fixes #274
Fixes #276
🧪 Testing
✅ Pre-approval checklist
✅ Pre-merge Checklist
Squash and merge
button.✅ Post-merge Checklist