Skip to content

Commit c53b4e0

Browse files
mattaerealmattaereal
authored
Updating develop to the new and more humane beginning of a written Opsec Framework (#154)
* Updating Opsec first iteration after re-write, CorPrinciples checkpoint * Updating Opsec structure and initial approach for some of the new contents. * Updating human centered security * Stop tracking generated tagsindex.js file * Updating gitignore * Removing old readme that explained how tags work. * New structure * First iter of Fundamentals * First iter of Fundamentals * Restructuring Opsec once again. Re-wrtitten principles and threat modeling * Forgot attribution. * Added key takeaways and removed redundancy * Updating Risk management and removing overlap from Threat modeling * Fixing broken link * Spellcheck's wordlist update * Spellcheck's wordlist update * Spellcheck's wordlist update
1 parent 3543ed7 commit c53b4e0

87 files changed

Lines changed: 3911 additions & 126 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎src/README.md‎

Lines changed: 0 additions & 50 deletions
This file was deleted.

‎src/SUMMARY.md‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,28 @@
1717
- [Cultivating a Security-Aware Mindset](./awareness/cultivating-a-security-aware-mindset.md)
1818
- [Staying Informed & Continuous Learning](./awareness/staying-informed-and-continuous-learning.md)
1919
- [Resources & Further Reading](./awareness/resources-and-further-reading.md)
20-
- [Operational Security](./operational-security/README.md)
21-
- [Detecting and Mitigating Insider Threats](./operational-security/detecting-and-mitigating-insider-threats.md)
22-
- [G Suite Security](./operational-security/g-suite-security.md)
23-
- [Password and Secrets Management](./operational-security/password-secrets-management.md)
24-
- [Physical Security](./operational-security/physical-security.md)
25-
- [SIM Swapping](./operational-security/sim-swapping.md)
26-
- [Standard Operating Environment](./operational-security/standard-operating-environment.md)
27-
- [Telegram](./operational-security/telegram.md)
28-
- [Wireless Security](./operational-security/wireless-security.md)
29-
- [Key Management](./key-management/README.md)
30-
- [Cold vs Hot Wallet](./key-management/cold-vs-hot-wallet.md)
31-
- [Custodial vs Non-Custodial](./key-management/custodial-vs-non-custodial.md)
32-
- [Hardware Wallets](./key-management/hardware-wallets.md)
33-
- [Signing Schemes](./key-management/signing-schemes.md)
34-
- [Software Wallets](./key-management/software-wallets.md)
20+
- [Operational Security](./opsec/README.md)
21+
- [Core principles](./opsec/principles/README.md)
22+
- [Principles in detail](./opsec/principles/principles.md)
23+
- [The five steps](./opsec/principles/five-steps.md)
24+
- [Web3 considerations](./opsec/principles/web3-considerations.md)
25+
- [Threat Modeling overview](./opsec/threat-modeling-overview.md)
26+
- [Risk Management](./opsec/risk-management.md)
27+
- [Governance & Program Management]()
28+
29+
- [Control Domains]()
30+
- [Lifecycle]()
31+
- [Monitoring & Detection]()
32+
- [Incident Response & Recovery]()
33+
- [Continuous Improvement & Metrics]()
34+
- [Integration & Mapping to Other Frameworks]()
35+
- [Appendices]()
36+
- [Wallet Security](./wallet-security/README.md)
37+
- [Cold vs Hot Wallet](./wallet-security/cold-vs-hot-wallet.md)
38+
- [Custodial vs Non-Custodial](./wallet-security/custodial-vs-non-custodial.md)
39+
- [Hardware Wallets](./wallet-security/hardware-wallets.md)
40+
- [Signing Schemes](./wallet-security/signing-schemes.md)
41+
- [Software Wallets](./wallet-security/software-wallets.md)
3542
- [External Security Reviews](./external-security-reviews/README.md)
3643
- [Expectation](./external-security-reviews/expectation.md)
3744
- [Preparation](./external-security-reviews/preparation.md)

‎src/community-management/README.md‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Here, we present essential best practices to safeguard your community. In the fo
2020

2121
### Strong Passwords and Two-Factor Authentication (2FA)
2222

23-
- Use unique, complex passwords for each service and store them securely in a reputable password manager. Refer to the [**Operational Security Framework**](../operational-security/README.md) and [**Key Management Framework**](../key-management/README.md) for more information on this.
23+
- Use unique, complex passwords for each service and store them securely in a reputable password manager. Refer to the [**Operational Security Framework**](../operational-security/README.md) and [**Wallet Security Framework**](../wallet-security/README.md) for more information on this.
2424
- Secure the email account linked to your community platforms with a unique password and 2FA.
2525
- Always enable 2FA. Prefer hardware-based tokens (e.g., Yubikey) or mobile authenticator apps over SMS-based methods, which are vulnerable to SIM-swapping.
2626
- If you use an authenticator app like Authy, 1Password, or Aegis to generate time-based one-time passwords (TOTP). Ensure that the secret keys are stored encrypted and protected with robust security measures.

‎src/config/SUMMARY.md.develop‎

Lines changed: 22 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,28 @@
1717
- [Cultivating a Security-Aware Mindset](./awareness/cultivating-a-security-aware-mindset.md)
1818
- [Staying Informed & Continuous Learning](./awareness/staying-informed-and-continuous-learning.md)
1919
- [Resources & Further Reading](./awareness/resources-and-further-reading.md)
20-
- [Operational Security](./operational-security/README.md)
21-
- [Detecting and Mitigating Insider Threats](./operational-security/detecting-and-mitigating-insider-threats.md)
22-
- [G Suite Security](./operational-security/g-suite-security.md)
23-
- [Password and Secrets Management](./operational-security/password-secrets-management.md)
24-
- [Physical Security](./operational-security/physical-security.md)
25-
- [SIM Swapping](./operational-security/sim-swapping.md)
26-
- [Standard Operating Environment](./operational-security/standard-operating-environment.md)
27-
- [Telegram](./operational-security/telegram.md)
28-
- [Wireless Security](./operational-security/wireless-security.md)
29-
- [Key Management](./key-management/README.md)
30-
- [Cold vs Hot Wallet](./key-management/cold-vs-hot-wallet.md)
31-
- [Custodial vs Non-Custodial](./key-management/custodial-vs-non-custodial.md)
32-
- [Hardware Wallets](./key-management/hardware-wallets.md)
33-
- [Signing Schemes](./key-management/signing-schemes.md)
34-
- [Software Wallets](./key-management/software-wallets.md)
20+
- [Operational Security](./opsec/README.md)
21+
- [Core principles](./opsec/principles/README.md)
22+
- [Principles in detail](./opsec/principles/principles.md)
23+
- [The five steps](./opsec/principles/five-steps.md)
24+
- [Web3 considerations](./opsec/principles/web3-considerations.md)
25+
- [Threat Modeling overview](./opsec/threat-modeling-overview.md)
26+
- [Risk Management](./opsec/risk-management.md)
27+
- [Governance & Program Management]()
28+
29+
- [Control Domains]()
30+
- [Lifecycle]()
31+
- [Monitoring & Detection]()
32+
- [Incident Response & Recovery]()
33+
- [Continuous Improvement & Metrics]()
34+
- [Integration & Mapping to Other Frameworks]()
35+
- [Appendices]()
36+
- [Wallet Security](./wallet-security/README.md)
37+
- [Cold vs Hot Wallet](./wallet-security/cold-vs-hot-wallet.md)
38+
- [Custodial vs Non-Custodial](./wallet-security/custodial-vs-non-custodial.md)
39+
- [Hardware Wallets](./wallet-security/hardware-wallets.md)
40+
- [Signing Schemes](./wallet-security/signing-schemes.md)
41+
- [Software Wallets](./wallet-security/software-wallets.md)
3542
- [External Security Reviews](./external-security-reviews/README.md)
3643
- [Expectation](./external-security-reviews/expectation.md)
3744
- [Preparation](./external-security-reviews/preparation.md)

‎src/config/SUMMARY.md.main‎

Lines changed: 118 additions & 19 deletions
Original file line numberDiff line numberDiff line change
@@ -17,31 +17,130 @@
1717
- [Cultivating a Security-Aware Mindset](./awareness/cultivating-a-security-aware-mindset.md)
1818
- [Staying Informed & Continuous Learning](./awareness/staying-informed-and-continuous-learning.md)
1919
- [Resources & Further Reading](./awareness/resources-and-further-reading.md)
20-
- [Operational Security]()
21-
- [Key Management]()
22-
- [External Security Reviews]()
23-
- [Vulnerability Disclosure]()
24-
- [Infrastructure]()
25-
- [Monitoring]()
26-
- [Front-End/Web Application]()
27-
- [Incident Management]()
28-
- [Threat Modeling]()
29-
- [Governance]()
30-
- [DevSecOps]()
31-
- [Privacy]()
32-
- [Supply Chain]()
33-
- [Security Automation]()
34-
- [Identity and Access Management IAM]()
35-
- [Secure Software Development]()
36-
- [Security Testing]()
20+
- [Operational Security](./opsec/README.md)
21+
- [Fundamentals](./opsec/fundamentals.md)
22+
- [Governance & Program Management](./opsec/governance.md)
23+
- [Risk Management](./opsec/risk-management.md)
24+
- [Control Domains](./opsec/control-domains.md)
25+
- [Organizational Controls](./opsec/control-domains/organizational.md)
26+
- [People & Personnel](./opsec/control-domains/people.md)
27+
- [Physical & Environmental](./opsec/control-domains/physical-environmental.md)
28+
- [Technical & Digital](./opsec/control-domains/technical.md)
29+
- [Lifecycle](./opsec/lifecycle.md)
30+
- [Identify Information & Assets](./opsec/lifecycle/identify.md)
31+
- [Threat Modeling & Analysis](./opsec/lifecycle/threat-modeling.md)
32+
- [Vulnerability Assessment](./opsec/lifecycle/vulnerability-assessment.md)
33+
- [Risk Assessment & Prioritization](./opsec/lifecycle/risk-prioritization.md)
34+
- [Countermeasure Selection & Implementation](./opsec/lifecycle/countermeasures.md)
35+
- [Monitoring & Detection](./opsec/monitoring-detection.md)
36+
- [Incident Response & Recovery](./opsec/incident-response.md)
37+
- [Continuous Improvement & Metrics](./opsec/continuous-improvement.md)
38+
- [Integration & Mapping to Other Frameworks](./opsec/integration.md)
39+
- [Appendices](./opsec/appendices.md)
40+
- [Policy & Template Library](./opsec/appendices/policies.md)
41+
- [Case Studies & Exercises](./opsec/appendices/case-studies.md)
42+
- [Glossary of Terms](./opsec/appendices/glossary.md)
43+
- [Wallet Security](./wallet-security/README.md)
44+
- [Cold vs Hot Wallet](./wallet-security/cold-vs-hot-wallet.md)
45+
- [Custodial vs Non-Custodial](./wallet-security/custodial-vs-non-custodial.md)
46+
- [Hardware Wallets](./wallet-security/hardware-wallets.md)
47+
- [Signing Schemes](./wallet-security/signing-schemes.md)
48+
- [Software Wallets](./wallet-security/software-wallets.md)
49+
- [External Security Reviews](./external-security-reviews/README.md)
50+
- [Expectation](./external-security-reviews/expectation.md)
51+
- [Preparation](./external-security-reviews/preparation.md)
52+
- [Security Policies and Procedures](./external-security-reviews/security-policies-procedures.md)
53+
- [Vendor Selection](./external-security-reviews/vendor-selection.md)
54+
- [Vulnerability Disclosure](./vulnerability-disclosure/README.md)
55+
- [Security Contact](./vulnerability-disclosure/security-contact.md)
56+
- [Bug Bounties](./vulnerability-disclosure/bug-bounties.md)
57+
- [Infrastructure](./infrastructure/README.md)
58+
- [Asset Inventory](./infrastructure/asset-inventory.md)
59+
- [Cloud Infrastructure](./infrastructure/cloud.md)
60+
- [DDoS Protection](./infrastructure/ddos-protection.md)
61+
- [DNS and Domain Registration](./infrastructure/dns-and-domain-registration.md)
62+
- [Identity and Access Management](./infrastructure/identity-and-access-management.md)
63+
- [Network Security](./infrastructure/network-security.md)
64+
- [Operating System Security](./infrastructure/operating-system-security.md)
65+
- [Zero-Trust Principles](./infrastructure/zero-trust-principles.md)
66+
- [Monitoring](./monitoring/README.md)
67+
- [Guidelines](./monitoring/guidelines.md)
68+
- [Thresholds](./monitoring/thresholds.md)
69+
- [Front-End/Web Application](./front-end-web-app/README.md)
70+
- [Web Application Security](./front-end-web-app/web-application-security.md)
71+
- [Mobile Application Security](./front-end-web-app/mobile-application-security.md)
72+
- [Common Vulnerabilities](./front-end-web-app/common-vulnerabilities.md)
73+
- [Security Tools and Resources](./front-end-web-app/security-tools-resources.md)
74+
- [Incident Management](./incident-management/README.md)
75+
- [Communication Strategies](./incident-management/communication-strategies.md)
76+
- [Incident Detection and Response](./incident-management/incident-detection-and-response.md)
77+
- [Lessons Learned](./incident-management/lessons-learned.md)
78+
- [Playbooks](./incident-management/playbooks.md)
79+
- [SEAL 911 War Room Guidelines](./incident-management/seal-911-war-room-guidelines.md)
80+
- [Threat Modeling](./threat-modeling/README.md)
81+
- [Create and Maintain Threat Models](./threat-modeling/create-maintain-threat-models.md)
82+
- [Identity Mitigate Threats](./threat-modeling/identity-mitigate-threats.md)
83+
- [Governance](./governance/README.md)
84+
- [Compliance with Regulatory Requirements](./governance/compliance-regulatory-requirements.md)
85+
- [Risk Management](./governance/risk-management.md)
86+
- [Security Metrics and KPIs](./governance/security-metrics-kpis.md)
87+
- [DevSecOps](./devsecops/README.md)
88+
- [Code Signing](./devsecops/code-signing.md)
89+
- [Continuous Integration and Deployment](./devsecops/continuous-integration-continuous-deployment.md)
90+
- [Integrated Development Environments](./devsecops/integrated-development-environments.md)
91+
- [Repository Hardening](./devsecops/repository-hardening.md)
92+
- [Security Testing](./devsecops/security-testing.md)
93+
- [Privacy](./privacy/README.md)
94+
- [Secure Browsing](./privacy/secure-browsing.md)
95+
- [Data Removal Services](./privacy/data-removal-services.md)
96+
- [Digital Footprint](./privacy/digital-footprint.md)
97+
- [Encrypted Communication Tools](./privacy/encrypted-communication-tools.md)
98+
- [Financial Privacy Services](./privacy/financial-privacy-services.md)
99+
- [Privacy-Focused Operating Systems and Tools](./privacy/privacy-focused-operating-systems-tools.md)
100+
- [VPN Services](./privacy/vpn-services.md)
101+
- [Supply Chain](./supply-chain/README.md)
102+
- [Dependency Awareness](./supply-chain/dependency-awareness.md)
103+
- [Supply Chain Levels for Software Artifacts](./supply-chain/supply-chain-levels-software-artifacts.md)
104+
- [Security Automation](./security-automation/README.md)
105+
- [Threat Detection and Response](./security-automation/threat-detection-response.md)
106+
- [Compliance Checks](./security-automation/compliance-checks.md)
107+
- [Infrastructure as Code](./security-automation/infrastructure-as-code.md)
108+
- [Identity and Access Management IAM](./iam/README.md)
109+
- [Role-Based Access Control](./iam/role-based-access-control.md)
110+
- [Secure Authentication](./iam/secure-authentication.md)
111+
- [Access Management Best Practices](./iam/access-management.md)
112+
- [Secure Software Development](./secure-software-development/README.md)
113+
- [Secure Coding Standards Guidelines](./secure-software-development/secure-coding-standards-guidelines.md)
114+
- [Code Reviews and Peer Audits](./secure-software-development/code-reviews-peer-audits.md)
115+
- [Secure Code Repositories and Version Control](./secure-software-development/secure-code-repositories-version-control.md)
116+
- [Threat Modeling and Secure Design Principles](./secure-software-development/threat-modeling-secure-design-principles.md)
117+
- [Security Testing](./security-testing/README.md)
118+
- [Dynamic Application Security Testing](./security-testing/dynamic-application-security-testing.md)
119+
- [Fuzz Testing](./security-testing/fuzz-testing.md)
120+
- [Security Regression Testing](./security-testing/security-regression-testing.md)
121+
- [Static Application Security Testing](./security-testing/static-application-security-testing.md)
37122
- [ENS](./ens/README.md)
38123
- [Data Integrity & Verification](./ens/data-integrity-verification.md)
39124
- [Cross-Chain Compatibility](./ens/cross-chain-compatibility.md)
40125
- [Smart Contract Integration](./ens/smart-contract-integration.md)
41126
- [Interface Compliance](./ens/interface-compliance.md)
42127
- [Name Handling & Normalization](./ens/name-handling-normalization.md)
43-
- [Safe Harbor]()
44-
- [Encryption]()
128+
- [Safe Harbor](./safe-harbor/README.md)
129+
- [Key Terms](./safe-harbor/key-terms.md)
130+
- [Protocol](./safe-harbor/protocol.md)
131+
- [Technical Outline](./safe-harbor/technical-outline.md)
132+
- [Whitehat](./safe-harbor/whitehat.md)
133+
- [Encryption](./encryption/README.md)
134+
- [Cloud Data Encryption](./encryption/cloud-data-encryption.md)
135+
- [Communication Encryption](./encryption/communication-encryption.md)
136+
- [Database Encryption](./encryption/database-encryption.md)
137+
- [Email Encryption](./encryption/email-encryption.md)
138+
- [Encryption in Transit](./encryption/encryption-in-transit.md)
139+
- [File Encryption](./encryption/file-encryption.md)
140+
- [Full Disk Encryption](./encryption/full-disk-encryption.md)
141+
- [Hardware Encryption](./encryption/hardware-encryption.md)
142+
- [Partition Encryption](./encryption/partition-encryption.md)
143+
- [Volume Encryption](./encryption/volume-encryption.md)
45144

46145
# About this
47146

‎src/config/template.md‎

Lines changed: 70 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,70 @@
1+
---
2+
tags:
3+
- Security Specialist
4+
- Operations & Strategy
5+
- Community & Marketing
6+
- HR
7+
- Engineer/Developer
8+
contributors:
9+
- role: wrote
10+
users: [mattaereal]
11+
- role: reviewed
12+
users: []
13+
- role: fact-checked
14+
users: []
15+
---
16+
17+
# {{ Title of this Page }}
18+
19+
20+
Key Takeaway prompt: Without removing or modifying anything in the document, just after the heading, describe in a succint way (no more than 40 words), all the key points or tl;dr so that anyone can get a good grasp of the contents just by reading it. Don't add unnecessary sentences that sound like conclusions, like "By ensuring this..." "Doing all these...", "Having these security practinces...". Use the following format > 🔑 **Key Takeaway**:
21+
22+
[Context / Problem statement. In this first part, we introduce the topic, in no more than a few paragraphs. For example for Threat Modeling inside Operational Security Framework: "Effective security requires understanding **what you're protecting and who you're protecting it from**. Without a structured threat model, security efforts become unfocused and inefficient. Different entities face different threats based on their assets, visibility, and technological footprint." It can be this short, or it can have more context]
23+
24+
## Practical guidance
25+
26+
1. **Step-by-Step Actions** – numbered list users can follow.
27+
2. **Best-Practice Checklist** – bullet list they can literally tick.
28+
3. **Role-Based Tips** – highlight differences for Ops, HR, Dev, etc.
29+
(This mirrors OWASP Cheat Sheet brevity.)
30+
31+
## Why is it important
32+
33+
Explain consequences of ignoring this guidance and link to real incidents or CISA/NIST advisories supporting each risk.
34+
35+
## Implementation details
36+
37+
| Sub-Topic | Related Page |
38+
|-----------|--------------|
39+
| Device Hardening | `../endpoint-security/...` |
40+
| Network Segmentation | `../network-security/...` |
41+
42+
Cross-linking reduces duplication, following docs-as-code best practice.
43+
44+
## 5 Common pitfalls & examples
45+
46+
Real-world breach snippets or failure stories that illustrate mistakes to avoid. <!-- :contentReference[oaicite:6]{index=6} -->
47+
48+
## 6 Quick-reference / Cheat sheet
49+
50+
A compact table or numbered list for on-the-job use, inspired by OWASP cheat sheets. <!-- :contentReference[oaicite:7]{index=7} -->
51+
52+
## 7 Further Reading & Tools
53+
54+
Automatically generated from the `references:` field or add authoritative links here.
55+
56+
<!--
57+
CITATION SOURCES
58+
turn0search0 Jekyll front-matter basics – validates YAML metadata structure.
59+
turn0search2 NIST practice guides use an executive-summary section.
60+
turn0search3 CISA report templates also open with Executive Summary.
61+
turn0search4 OWASP Cheat Sheet series shows concise prescriptive guidance.
62+
turn0search5 Kubernetes style guide recommends short sections & headings.
63+
turn0search6 Google developer style guide echoes those principles.
64+
turn0search7 Version-history tables are a best practice for change control.
65+
turn0search8 Jekyll step-by-step docs reinforce YAML front-matter placement.
66+
turn0search11 CISA advisories supply risk context references.
67+
turn0search12 OWASP Cheat Sheet project cited for quick-reference idea.
68+
turn0search13 Kubernetes “page content types” shows cross-linking strategy.
69+
turn0search10 NIST CSF overview underpins risk-management rationale.
70+
-->

0 commit comments

Comments
 (0)