83 lines
4.5 KiB
Markdown
83 lines
4.5 KiB
Markdown
# CASAN — External Security Review / Penetration-Test Scope
|
|
|
|
This is the procurement and evidence baseline for an **independent** security
|
|
review before an enterprise pilot. It is not a penetration-test report and must
|
|
not be used as a claim that CASAN has passed an external assessment.
|
|
|
|
## 1. Engagement boundary
|
|
|
|
| In scope | Required test focus |
|
|
|---|---|
|
|
| Control Panel API, UI, reverse proxy and deployment manifests | authentication boundary, RBAC/SoD, tenant/project isolation, input/output validation, HTTP/TLS configuration |
|
|
| Harness CLIs and CI workflows | command/path injection, policy bypass, unsafe fallback, artifact/evidence tampering, secret handling and supply-chain controls |
|
|
| Governed Chat and approval paths | unauthorized tool execution, approval replay/bypass, audit-chain integrity, cross-tenant replay and data exfiltration |
|
|
| Evidence Pack and publication flow | manifest signature/verification, retention/immutability assumptions, artifact access control and chain of custody |
|
|
| Production-like deployment | OIDC claim mapping, Vault/KMS access, Object Lock, rootless runner/sandbox, network egress and observability |
|
|
|
|
Out of scope tests require a written change order. Production data, destructive
|
|
load tests, phishing and social engineering are forbidden unless the customer
|
|
explicitly authorizes them in writing.
|
|
|
|
## 2. Prerequisites supplied by CASAN/customer
|
|
|
|
- A dedicated, non-production test tenant with synthetic code, prompts and
|
|
secrets; no customer production source code or personal data.
|
|
- DNS name, CA-issued test certificate, enterprise OIDC test application and
|
|
least-privilege assessor accounts for viewer, operator, project-admin and
|
|
org-admin roles.
|
|
- A deployment inventory: image digests, SBOM, workflow commit, configuration
|
|
version, data-flow diagram, network/egress policy and known limitations.
|
|
- A change window, emergency contact, on-call escalation path and explicit
|
|
stop-test authority.
|
|
- A current Evidence Pack and commands for `verify-pack`, audit-chain
|
|
verification, backup restore drill and release-provenance verification.
|
|
|
|
## 3. Required attack scenarios
|
|
|
|
The assessor must cover at least these scenario classes and record the exact
|
|
target version/configuration for every finding:
|
|
|
|
1. Authentication/session handling, OIDC issuer/audience/JWKS failures and
|
|
browser-supplied identity-header spoofing.
|
|
2. RBAC scope escalation, separation-of-duties bypass and cross-project or
|
|
cross-tenant reads/writes/replays.
|
|
3. Prompt/tool-output injection, unregistered tool execution, CODEGEN write
|
|
attempts and approval-token replay.
|
|
4. Secret/PII exfiltration via logs, Evidence Pack, model routing, artifacts,
|
|
API responses, error paths and egress configuration.
|
|
5. Evidence/audit/trace tampering, clock/retention assumptions and failure of
|
|
manifest/provenance verification.
|
|
6. Container/sandbox privilege, rootful daemon usage, writable host mounts,
|
|
network escape, resource exhaustion and queue starvation.
|
|
7. Dependency, image and CI supply-chain validation against the live scanner,
|
|
SBOM and digest/provenance assertions.
|
|
|
|
## 4. Rules of engagement
|
|
|
|
- Assessors must use named accounts and an agreed source-IP range; all activity
|
|
is captured in the H5 audit trail and preserved in a review Evidence Pack.
|
|
- Do not alter production state, delete artifacts, rotate real keys, or bypass
|
|
legal/contractual third-party rate limits.
|
|
- Critical findings trigger immediate notification to the security contact;
|
|
CASAN may engage the kill switch while preserving evidence.
|
|
- Retesting is required for every Critical/High finding and for any control
|
|
used as an enterprise procurement claim.
|
|
|
|
## 5. Acceptance evidence
|
|
|
|
The independent assessor must deliver a dated, signed report with scope,
|
|
methodology, target versions, findings/CVSS or agreed severity, reproduction
|
|
evidence, limitations and retest results. CASAN must retain:
|
|
|
|
| Evidence | Owner |
|
|
|---|---|
|
|
| Signed statement of work and rules of engagement | Security owner |
|
|
| Report plus finding/remediation register | Security + engineering owners |
|
|
| Retest attestation for remediated findings | Assessor |
|
|
| Evidence Pack and audit export for the assessment window | Release/security owner |
|
|
| Risk acceptance signed by accountable business owner for any deferred finding | Customer/security owner |
|
|
|
|
Enterprise-pilot readiness requires no unresolved Critical findings. Any
|
|
unresolved High finding needs a time-bounded, documented risk acceptance; this
|
|
does not make the platform "pentest certified".
|