security-alliance
diff --git a/‎README.md‎
Lines changed: 8 additions & 34 deletions b/‎README.md‎
Lines changed: 8 additions & 34 deletions
diff --git a/‎docs/pages/incident-management/templates/incident-kickoff.mdx‎
Lines changed: 0 additions & 33 deletions b/‎docs/pages/incident-management/templates/incident-kickoff.mdx‎
Lines changed: 0 additions & 33 deletions
diff --git a/‎docs/pages/incident-management/templates/retro-form.mdx‎
Lines changed: 0 additions & 40 deletions b/‎docs/pages/incident-management/templates/retro-form.mdx‎
Lines changed: 0 additions & 40 deletions
diff --git a/‎docs/pages/safe-harbor/whitehat.mdx‎
Lines changed: 1 addition & 2 deletions b/‎docs/pages/safe-harbor/whitehat.mdx‎
Lines changed: 1 addition & 2 deletions
diff --git a/‎src/opsec-old/README.md‎
Lines changed: 31 additions & 0 deletions b/‎src/opsec-old/README.md‎
Lines changed: 31 additions & 0 deletions
diff --git a/‎src/opsec-old/cloud-third-party/README.md‎
Lines changed: 45 additions & 0 deletions b/‎src/opsec-old/cloud-third-party/README.md‎
Lines changed: 45 additions & 0 deletions
diff --git a/‎src/opsec-old/core-opsec-principles.md‎
Lines changed: 148 additions & 0 deletions b/‎src/opsec-old/core-opsec-principles.md‎
Lines changed: 148 additions & 0 deletions
@@ -2,47 +2,21 @@
 
 Official repository to the Security Frameworks by SEAL. This repository contains the entire structure and contents of the frameworks. Feel free to suggest from new categories to grammar corrections. Collaboration is open to everyone. **This is a work in progress.**
 
-If you want to know more about the frameworks or take a peek at the live book go to the following branches: [Main](frameworks.securityalliance.org), [Development](frameworks.securityalliance.dev).
+If you want to know more about the frameworks or take a peek at the live book go to the following
+branches below: [Main](https://seal-frameworks.vercel.app/),
+[Development](https://frameworks-git-develop-seal-frameworks.vercel.app/?_vercel_share=zOI0Q3riUfDv1Lq1IylFz2hXQzYPcmLp).
 
-# Prerequisites
-
-- [Rust/cargo](https://www.rust-lang.org/tools/install) (For building/serving mdBook)
-- [markdownlint-cli2](https://github.com/DavidAnson/markdownlint-cli2) (For linting markdown files)
-- [GNU Aspell](https://sourceforge.net/projects/aspell/) (For spell checking) - Note: For macOs you can use [Homebrew](https://brew.sh/) to install aspell. Just run `brew install aspell`.
-- [just](https://github.com/casey/just) (For running commands)
-- [Docker](https://docs.docker.com/get-docker/) (Optional: For running the devcontainer)
-- [GitHub CLI](https://cli.github.com/) (Optional: For using `gh` to interact with GitHub)
+Production will be at [frameworks.securityalliance.org](https://frameworks.securityalliance.org),
+but not yet available.
 
 ## Quick installation and local setup
 ### Option 1: Using DevContainer (Recommended)
 If you have VSCode with the Dev Containers extension and [Dev Container Extension](https://marketplace.visualstudio.com/items?itemName=ms-vscode-remote.remote-containers) installed:
 
 1. `gh repo clone security-alliance/frameworks`
-2. `git checkout develop` 
-3. Open in VSCode and run "Dev Containers: Reopen in Container"
-4. Once inside the container: `just serve`
-
-### Option 2: Using DevContainer with Docker (No VSCode Required)
-
-**Using DevContainer CLI:**
-- Install [DevContainer CLI](https://github.com/devcontainers/cli)
-```bash
-gh repo clone security-alliance/frameworks
-cd frameworks && git checkout develop
-devcontainer up --workspace-folder .
-devcontainer exec --workspace-folder . bash
-# Get the IP address of the container, by running `hostname -I | awk '{print $1}'`. Should be printed automatically in the terminal after the creation as well
-# Inside container: just serve
-# Access the mdBook at http://<IP>:3000
-```
-
-### Option 3: Local Installation
-If you prefer to install dependencies locally:
-
-1. Install prerequisites listed above
-2. `gh repo clone security-alliance/frameworks`
-3. `git checkout develop`
-4. `just serve`
+2. `git checkout develop`
+3. `cargo install mdbook mdbook-admonish mdbook-catppuccin`
+4. `./serve.sh`
 
 ## Collaboration
 
 
@@ -6,7 +6,6 @@ tags:
 contributors:
   - role: wrote
     users: [robert]
-
 ---
 
 import { TagList, AttributionList, TagProvider, TagFilter, ContributeFooter } from '../../../components'
@@ -69,4 +68,4 @@ After the funds have been recovered, it is your responsibility to ensure their s
 ---
 
 </TagProvider>
-<ContributeFooter />
+<ContributeFooter />
@@ -0,0 +1,31 @@
+---
+tags:
+  - Security Specialist
+  - Operations & Strategy
+  - Devops
+  - SRE
+---
+
+# Operational Security
+
+
+Operational security, often abbreviated as **OpSec** provides a range of practices and measures designed to safeguard an organization's sensitive information, assets, and operations from unauthorized access, espionage, disruption, or compromise.
+
+Operational security is not just a concern for large corporations or government agencies; it is relevant to any project that handles sensitive information, including personal data or digital assets. The consequences of failing to implement robust OpSec measures can be severe, ranging from financial losses to reputational damage, and legal liabilities.
+
+The level of Operational Security to apply will differ greatly depending on the risk appetite the team is willing to accept.
+
+## Framework Contents
+
+1. [Core OpSec Principles](./core-opsec-principles.md) - Foundational security concepts and methodologies
+2. [Human-Centered Security](./human-centered-security/README.md) - Security measures focused on the human element
+3. [Digital Identity and Access Management](./digital-identity-access/README.md) - Managing digital identities and controlling access
+4. [Device and Endpoint Security](./device-endpoint-security/README.md) - Securing individual devices and endpoints
+5. [Network and Communication Security](./network-communication/README.md) - Securing networks and communications channels
+6. [Data Protection](./data-protection/README.md) - Safeguarding sensitive data throughout its lifecycle
+7. [Cloud and Third-Party Security](./cloud-third-party/README.md) - Securing cloud environments and third-party relationships
+8. [Physical Security](./physical-security/README.md) - Protecting physical assets and environments
+9. [Incident Response and Recovery](./incident-response-recovery.md) - Responding to and recovering from security incidents
+10. [Compliance and Governance](./compliance-governance.md) - Meeting regulatory requirements and establishing governance
+11. [Web3-Specific OpSec](./web3-specific-opsec/README.md) - Operational security considerations unique to Web3
+12. [Resources and Tools](./resources-tools.md) - Useful tools, templates, and further reading
@@ -0,0 +1,45 @@
+---
+tags:
+  - Security Specialist
+  - Operations & Strategy
+  - Devops
+  - SRE
+---
+
+# Cloud and Third-Party Security
+
+In today's interconnected digital ecosystem, organizations rely heavily on cloud services and third-party vendors to operate efficiently. However, these dependencies introduce security risks that must be carefully managed.
+
+## Introduction
+
+Cloud and third-party security focuses on protecting data and operations that depend on external providers. It encompasses the assessment, monitoring, and management of security risks associated with cloud services, software-as-a-service (SaaS) applications, and third-party vendors that have access to your systems or data.
+
+## Key Components
+
+This section covers the following aspects of cloud and third-party security:
+
+1. [G-Suite Security](./g-suite-security.md) - Securing Google Workspace (formerly G-Suite) environments
+2. [Cloud Security Fundamentals](./cloud-security-fundamentals.md) - Essential security considerations for cloud environments
+3. [SaaS Security](./saas-security.md) - Securing software-as-a-service applications
+4. [Vendor Security Assessment](./vendor-security-assessment.md) - Evaluating and monitoring the security of third-party vendors
+5. [API Security](./api-security.md) - Securing application programming interfaces
+
+## Risk-Based Approach
+
+Cloud and third-party security should be implemented based on the sensitivity of the data being handled and the criticality of the services provided:
+
+1. Inventory all cloud services and third-party relationships
+2. Classify providers based on the data they handle and criticality to operations
+3. Implement appropriate security controls and monitoring based on risk levels
+4. Regularly review and audit third-party security practices
+
+## Web3 Considerations
+
+In Web3 environments, cloud and third-party security includes additional considerations:
+
+- The security of blockchain infrastructure providers
+- The risks associated with decentralized services and protocols
+- The assessment of smart contract dependencies
+- The security of Web3 development and deployment tools
+
+The guidance in this section addresses both traditional and Web3-specific cloud and third-party security considerations. 
@@ -0,0 +1,148 @@
+---
+tags:
+  - Security Specialist
+  - Operations & Strategy
+  - Devops
+  - SRE
+---
+
+# Core OpSec Principles
+
+Operational security is built on fundamental principles that guide the implementation of security controls and practices. These principles provide a foundation for developing a comprehensive security posture that protects your organization's assets, operations, and reputation.
+
+> **Practical Example: Web3 Organization**
+>
+> Consider a Web3 project managing a DeFi protocol with a treasury of $10M in assets. Proper operational security would involve:
+>
+> - **Multiple security layers**: Hardware wallets for cold storage, multi-signature requirements for transactions, regular security audits, and continuous monitoring
+> - **Access control**: Only specific team members have access to deployment keys, with different permission levels for development, testing, and production environments
+> - **Compartmentalized information**: Private keys for multi-signature wallets are distributed among trusted team members with no single person having access to all keys, and sensitive incident response procedures are only shared with the security team
+> - **Regular threat assessment**: The team conducts quarterly reviews of potential attack vectors, from smart contract vulnerabilities to [social engineering](../awareness/social-engineering.md) attempts targeting team members
+
+## Defense in Depth
+
+Defense in Depth is the practice of layering security controls throughout your systems and processes, so that if one control fails, others will provide protection.
+
+> **🔗 Related Framework:** This principle is applied across multiple frameworks including [Infrastructure](../infrastructure/) with [Zero-Trust Principles](../infrastructure/zero-trust-principles.md) and [Network Security](../infrastructure/network-security.md).
+
+### Implementation
+
+1. Deploy multiple security controls that address the same risk in different ways
+2. Implement security at various layers: physical, technical, administrative, and human
+3. Ensure no single point of failure exists in your security architecture
+4. Review the effectiveness of security layers regularly to identify gaps
+5. Foster a [security-aware mindset](../awareness/cultivating-a-security-aware-mindset.md) across all team members
+
+## Principle of Least Privilege
+
+The Principle of Least Privilege dictates that users, systems, and processes should have only the minimum access rights necessary to perform their functions.
+
+> **🔗 Related Framework:** For comprehensive implementation, see [Identity and Access Management](../iam/) and [Role-Based Access Control](../iam/role-based-access-control.md).
+
+### Implementation
+
+1. Grant the minimum level of access required for users to perform their duties
+2. Review and adjust access rights when roles change
+3. Implement role-based access control (RBAC) to standardize permissions
+4. Use time-limited and just-in-time access for administrative privileges
+5. Regularly audit access rights to identify and remove excessive permissions
+6. Establish a thorough offboarding process to immediately revoke access when team members leave
+7. Remove credentials for deactivated accounts, as these can become security liabilities even when dormant
+
+## Need-to-Know Basis
+
+Information should only be shared with individuals who require that information to perform their duties.
+
+> **🔗 Related Framework:** This principle is supported by practices in [Data Protection](../operational-security/data-protection/) and aspects of [Privacy](../privacy/).
+
+### Implementation
+
+1. Classify information based on sensitivity and restrict access accordingly
+2. Compartmentalize sensitive information to limit exposure in case of a breach
+3. Implement clear data handling and sharing policies
+4. Train team members on proper handling and sharing of sensitive information through regular [security training](../awareness/security-training.md)
+5. Use secure communication channels for sensitive information
+
+## Threat Modeling for OpSec
+
+Threat modeling involves systematically identifying potential threats, vulnerabilities, and attack vectors to prioritize security controls.
+
+> **🔗 Related Framework:** For detailed methodology and implementation, see the [Threat Modeling](../threat-modeling/) framework, including guides on how to [Create and Maintain Threat Models](../threat-modeling/create-maintain-threat-models.md) and [Identify and Mitigate Threats](../threat-modeling/identity-mitigate-threats.md).
+
+### Implementation
+
+1. Identify critical assets and operations that need protection
+2. Enumerate potential threats and their impact on your organization
+3. Assess vulnerabilities that could be exploited
+4. Evaluate existing controls and their effectiveness
+5. Develop a prioritized plan to address identified risks
+6. Maintain awareness of common [threat vectors](../awareness/understanding-threat-vectors.md) relevant to your organization
+
+## Risk Assessment and Management
+
+Systematic evaluation and prioritization of security risks to guide resource allocation and security decision-making.
+
+> **🔗 Related Framework:** For comprehensive risk management strategies, refer to [Governance](../governance/) and [Risk Management](../governance/risk-management.md).
+
+### Implementation
+
+1. Identify and categorize assets based on their value and criticality
+2. Assess threats and vulnerabilities relevant to those assets
+3. Determine the likelihood and potential impact of security incidents
+4. Implement controls based on risk levels
+5. Regularly reassess risks as the environment and threats evolve
+
+## Continuous Monitoring and Improvement
+
+Security is not a one-time implementation but a continuous process of monitoring, evaluating, and improving.
+
+> **🔗 Related Framework:** For implementation details, see the [Monitoring](../monitoring/) framework, including [Guidelines](../monitoring/guidelines.md) and [Thresholds](../monitoring/thresholds.md). Also relevant is [Incident Management](../incident-management/) for response to detected issues.
+
+### Implementation
+
+1. Establish security metrics to measure the effectiveness of controls
+2. Implement monitoring systems to detect security events and anomalies
+3. Conduct regular security assessments and penetration tests
+4. Learn from security incidents and near-misses
+5. Update security controls based on new threats, vulnerabilities, and technologies
+6. Ensure team members are [staying informed and continuously learning](../awareness/staying-informed-and-continuous-learning.md) about evolving security threats
+7. Utilize available [security resources](../awareness/resources-and-further-reading.md) to keep your security practices current
+
+## Web3-Specific OpSec Principles
+
+In addition to traditional OpSec principles, Web3 environments require consideration of:
+
+> **🔗 Related Framework:** Explore the dedicated [Web3-Specific OpSec](../operational-security/web3-specific-opsec/) framework for comprehensive guidance.
+
+### Transparency vs. Privacy
+
+Balancing the transparent nature of blockchain with the need for operational privacy.
+
+### Implementation
+
+1. Understand what information is publicly visible on-chain
+2. Develop strategies to maintain operational privacy while utilizing public blockchains
+3. Use privacy-enhancing technologies where appropriate
+
+### Immutability and Finality
+
+Recognizing that blockchain transactions are generally irreversible, requiring heightened security before execution.
+
+### Implementation
+
+1. Implement robust verification procedures before executing transactions
+2. Use multi-signature requirements for high-value transactions
+3. Deploy transaction simulation tools to verify outcomes before execution
+
+### Self-Custody Responsibility
+
+> **🔗 Related Framework:** For detailed guidance on wallet security practices, see the [Wallet Security](../wallet-security/) framework.
+
+### Implementation
+
+1. Develop clear procedures for wallet security
+2. Implement separation of duties for transaction approval
+3. Balance security with operational efficiency
+4. [Stay up-to-date](../awareness/staying-up-to-date.md) with best practices in wallet security and custody solutions
+
+By adhering to these core principles, organizations can build a strong foundation for operational security that addresses both traditional and Web3-specific security challenges.