4.5 KiB
CASAN — External Security Review / Penetration-Test Scope
This is the procurement and evidence baseline for an independent security review before an enterprise pilot. It is not a penetration-test report and must not be used as a claim that CASAN has passed an external assessment.
1. Engagement boundary
| In scope | Required test focus |
|---|---|
| Control Panel API, UI, reverse proxy and deployment manifests | authentication boundary, RBAC/SoD, tenant/project isolation, input/output validation, HTTP/TLS configuration |
| Harness CLIs and CI workflows | command/path injection, policy bypass, unsafe fallback, artifact/evidence tampering, secret handling and supply-chain controls |
| Governed Chat and approval paths | unauthorized tool execution, approval replay/bypass, audit-chain integrity, cross-tenant replay and data exfiltration |
| Evidence Pack and publication flow | manifest signature/verification, retention/immutability assumptions, artifact access control and chain of custody |
| Production-like deployment | OIDC claim mapping, Vault/KMS access, Object Lock, rootless runner/sandbox, network egress and observability |
Out of scope tests require a written change order. Production data, destructive load tests, phishing and social engineering are forbidden unless the customer explicitly authorizes them in writing.
2. Prerequisites supplied by CASAN/customer
- A dedicated, non-production test tenant with synthetic code, prompts and secrets; no customer production source code or personal data.
- DNS name, CA-issued test certificate, enterprise OIDC test application and least-privilege assessor accounts for viewer, operator, project-admin and org-admin roles.
- A deployment inventory: image digests, SBOM, workflow commit, configuration version, data-flow diagram, network/egress policy and known limitations.
- A change window, emergency contact, on-call escalation path and explicit stop-test authority.
- A current Evidence Pack and commands for
verify-pack, audit-chain verification, backup restore drill and release-provenance verification.
3. Required attack scenarios
The assessor must cover at least these scenario classes and record the exact target version/configuration for every finding:
- Authentication/session handling, OIDC issuer/audience/JWKS failures and browser-supplied identity-header spoofing.
- RBAC scope escalation, separation-of-duties bypass and cross-project or cross-tenant reads/writes/replays.
- Prompt/tool-output injection, unregistered tool execution, CODEGEN write attempts and approval-token replay.
- Secret/PII exfiltration via logs, Evidence Pack, model routing, artifacts, API responses, error paths and egress configuration.
- Evidence/audit/trace tampering, clock/retention assumptions and failure of manifest/provenance verification.
- Container/sandbox privilege, rootful daemon usage, writable host mounts, network escape, resource exhaustion and queue starvation.
- Dependency, image and CI supply-chain validation against the live scanner, SBOM and digest/provenance assertions.
4. Rules of engagement
- Assessors must use named accounts and an agreed source-IP range; all activity is captured in the H5 audit trail and preserved in a review Evidence Pack.
- Do not alter production state, delete artifacts, rotate real keys, or bypass legal/contractual third-party rate limits.
- Critical findings trigger immediate notification to the security contact; CASAN may engage the kill switch while preserving evidence.
- Retesting is required for every Critical/High finding and for any control used as an enterprise procurement claim.
5. Acceptance evidence
The independent assessor must deliver a dated, signed report with scope, methodology, target versions, findings/CVSS or agreed severity, reproduction evidence, limitations and retest results. CASAN must retain:
| Evidence | Owner |
|---|---|
| Signed statement of work and rules of engagement | Security owner |
| Report plus finding/remediation register | Security + engineering owners |
| Retest attestation for remediated findings | Assessor |
| Evidence Pack and audit export for the assessment window | Release/security owner |
| Risk acceptance signed by accountable business owner for any deferred finding | Customer/security owner |
Enterprise-pilot readiness requires no unresolved Critical findings. Any unresolved High finding needs a time-bounded, documented risk acceptance; this does not make the platform "pentest certified".