docs: add external security review engagement scope

2026-07-18 09:21:42 +07:00
parent 777ce342fd
commit 083a1de875
2 changed files with 83 additions and 0 deletions
@@ -0,0 +1,82 @@
+# CASAN — External Security Review / Penetration-Test Scope
+
+This is the procurement and evidence baseline for an **independent** security
+review before an enterprise pilot. It is not a penetration-test report and must
+not be used as a claim that CASAN has passed an external assessment.
+
+## 1. Engagement boundary
+
+| In scope | Required test focus |
+|---|---|
+| Control Panel API, UI, reverse proxy and deployment manifests | authentication boundary, RBAC/SoD, tenant/project isolation, input/output validation, HTTP/TLS configuration |
+| Harness CLIs and CI workflows | command/path injection, policy bypass, unsafe fallback, artifact/evidence tampering, secret handling and supply-chain controls |
+| Governed Chat and approval paths | unauthorized tool execution, approval replay/bypass, audit-chain integrity, cross-tenant replay and data exfiltration |
+| Evidence Pack and publication flow | manifest signature/verification, retention/immutability assumptions, artifact access control and chain of custody |
+| Production-like deployment | OIDC claim mapping, Vault/KMS access, Object Lock, rootless runner/sandbox, network egress and observability |
+
+Out of scope tests require a written change order. Production data, destructive
+load tests, phishing and social engineering are forbidden unless the customer
+explicitly authorizes them in writing.
+
+## 2. Prerequisites supplied by CASAN/customer
+
+- A dedicated, non-production test tenant with synthetic code, prompts and
+  secrets; no customer production source code or personal data.
+- DNS name, CA-issued test certificate, enterprise OIDC test application and
+  least-privilege assessor accounts for viewer, operator, project-admin and
+  org-admin roles.
+- A deployment inventory: image digests, SBOM, workflow commit, configuration
+  version, data-flow diagram, network/egress policy and known limitations.
+- A change window, emergency contact, on-call escalation path and explicit
+  stop-test authority.
+- A current Evidence Pack and commands for `verify-pack`, audit-chain
+  verification, backup restore drill and release-provenance verification.
+
+## 3. Required attack scenarios
+
+The assessor must cover at least these scenario classes and record the exact
+target version/configuration for every finding:
+
+1. Authentication/session handling, OIDC issuer/audience/JWKS failures and
+   browser-supplied identity-header spoofing.
+2. RBAC scope escalation, separation-of-duties bypass and cross-project or
+   cross-tenant reads/writes/replays.
+3. Prompt/tool-output injection, unregistered tool execution, CODEGEN write
+   attempts and approval-token replay.
+4. Secret/PII exfiltration via logs, Evidence Pack, model routing, artifacts,
+   API responses, error paths and egress configuration.
+5. Evidence/audit/trace tampering, clock/retention assumptions and failure of
+   manifest/provenance verification.
+6. Container/sandbox privilege, rootful daemon usage, writable host mounts,
+   network escape, resource exhaustion and queue starvation.
+7. Dependency, image and CI supply-chain validation against the live scanner,
+   SBOM and digest/provenance assertions.
+
+## 4. Rules of engagement
+
+- Assessors must use named accounts and an agreed source-IP range; all activity
+  is captured in the H5 audit trail and preserved in a review Evidence Pack.
+- Do not alter production state, delete artifacts, rotate real keys, or bypass
+  legal/contractual third-party rate limits.
+- Critical findings trigger immediate notification to the security contact;
+  CASAN may engage the kill switch while preserving evidence.
+- Retesting is required for every Critical/High finding and for any control
+  used as an enterprise procurement claim.
+
+## 5. Acceptance evidence
+
+The independent assessor must deliver a dated, signed report with scope,
+methodology, target versions, findings/CVSS or agreed severity, reproduction
+evidence, limitations and retest results. CASAN must retain:
+
+| Evidence | Owner |
+|---|---|
+| Signed statement of work and rules of engagement | Security owner |
+| Report plus finding/remediation register | Security + engineering owners |
+| Retest attestation for remediated findings | Assessor |
+| Evidence Pack and audit export for the assessment window | Release/security owner |
+| Risk acceptance signed by accountable business owner for any deferred finding | Customer/security owner |
+
+Enterprise-pilot readiness requires no unresolved Critical findings. Any
+unresolved High finding needs a time-bounded, documented risk acceptance; this
+does not make the platform "pentest certified".