whatWeDo.json

{
  "whatWeDo": [
    {
      "sectionHeader": "When To Use It",
      "sectionDesc" : "Develop and programmatically automate security in planning, development, assessment, and operational activities",
      "chevrons": [
        "planning_chevron",
        "development_chevron",
        "assessment_chevron",
        "operations_chevron"
      ],
      "items": [
        {
          "name": "During PLANNING,<br />use CMS SAF to:",
          "link": "",
          "bullets" : [
            "Identify applicable security and privacy requirements",
            "Assess development best practices guidance",
            "Identify CMS SAF tools to support development, assessment, & operations security processes",
            "Become a participant through the Continuous Collaboration Agreement"
          ]
        },
        {
          "name": "During DEVELOPMENT,<br />use CMS SAF to:",
          "link": "",
          "bullets" : [
            "Implement relevant security hardening scripts",
            "Validate security status and aggregate security testing data at each build",
            "Drill-down in visualization tools to identify security defect root cause and mitigations",
            "Set security testing results thresholds ","Assess development best practices guidance",
            "Store or export “evidence” for assessors"
          ]
        },
        {
          "name": "During ASSESSMENT,<br />use CMS SAF to:",
          "link": "",
          "bullets" : [
            "Aggregate all security control assessment data ",
            "Visualize security status to prioritize assessment activities",
            "Run validation checks on prioritized areas",
            "Drill-down in visualization tools to identify root cause and inform risk assessment"
          ]
        },
        {
          "name": "During OPERATIONS,<br />use CMS SAF to:",
          "link": "",
          "bullets" : [
            "Monitor security posture through validation checks",
            "Aggregate normalized security testing content to enable data visualization, drill-down, and root cause analysis",
            "Assign remediation actions for identified security risks"
          ]
        }
      ]
    },
    {
      "sectionHeader": "How We Support It",
      "items": [
        {
          "name": "ACT Support",
          "router_link": "CMSTeams",
          "desc": "Aid ISPG ACT team in deploying tools for security assessments",
          "svg": "",
          "icon": ""
        },
        {
          "name": "DevOps Onboarding for CMS Teams",
          "router_link": "CMSTeams",
          "desc": "Engage CMS DevOps teams to incorporate SAF tools and techniques",
          "svg": "",
          "icon": ""
        },
        {
          "name": "Training for DevOps Teams",
          "router_link": "training",
          "desc": "7 classes provided, including DHS staff and contractors 48 CMS contractors trained to develop InSpec profiles",
          "svg": "",
          "icon": ""
        },
        {
          "name": "Control Status Reporting",
          "link": "https://heimdall-demo.mitre.org",
          "desc": "Expand Heimdall to meet IUSG enterprise-level demands and new DevOps requirements",
          "svg": "",
          "icon": ""
        },
        {
          "name": "Heimdall Lite",
          "link": "",
          "desc": "A lightweight version of Heimdall for simple use cases",
          "icon": "",
          "png" : "heimdall_logo",
          "app_link": "https://heimdall-lite.mitre.org",
          "app_svg": "app",
          "doc_link": "https://github.com/mitre/heimdall2/blob/master/README.md",
          "github_link": "https://github.com/mitre/heimdall2",
          "svg": "",
          "tools": "",
          "shields": [
            "https://img.shields.io/github/v/tag/mitre/heimdall2?label=version",
            "https://img.shields.io/npm/dt/heimdall-lite?label=npm%20downloads"
          ]
        },
        {
          "name": "Heimdall Server",
          "link": "",
          "desc": "The complete Heimdall application - store results, coordinate across the development team, and more",
          "icon": "",
          "png" : "heimdall_logo",
          "app_link": "https://heimdall-demo.mitre.org",
          "app_svg": "app",
          "doc_link": "https://github.com/mitre/heimdall2/blob/master/README.md",
          "github_link": "https://github.com/mitre/heimdall2",
          "svg": "",
          "tools": "",
          "shields": [
            "https://img.shields.io/github/v/tag/mitre/heimdall2?label=version",
            "https://img.shields.io/docker/pulls/mitre/heimdall2?label=docker%20hub%20pulls"
          ]
        },
        {
          "name": "Vulcan (alpha)",
          "link": "",
          "desc": "Application for streamlining InSpec profile and overlay development using the Security Requirements Guide (SRG)",
          "icon": "",
          "app_link": "",
          "app_svg": "app",
          "doc_link": "https://vulcan.mitre.org",
          "github_link": "https://github.com/mitre/vulcan",
          "svg": "",
          "tools": ""
        },
        {
          "name": "InSpec Tools",
          "link": "",
          "desc": "A set of Ruby utilities for creating, converting, and processing security baseline formats, results, and data",
          "icon": "",
          "png" : "inspec_logo",
          "app_link": "",
          "app_svg": "app",
          "doc_link": "https://inspec-tools.mitre.org",
          "github_link": "https://github.com/mitre/inspec_tools/",
          "svg": "",
          "tools": "",
          "shields": [
            "https://img.shields.io/github/v/release/mitre/inspec_tools?label=version",
            "https://img.shields.io/gem/dt/inspec_tools?label=gem%20downloads"
          ]
        },
        {
          "name": "InSpec Tools GitHub Action",
          "link": "",
          "desc": "Add InSpec Tools to your GitHub Actions workflow",
          "icon": "github",
          "icon_sizer" : "600%",
          "app_link": "",
          "app_svg": "",
          "doc_link": "https://github.com/marketplace/actions/inspec-tools-action",
          "github_link": "https://github.com/mitre/inspec_tools_action",
          "svg": "",
          "tools": ""
        },
        {
          "name": "Heimdall Tools",
          "link": "",
          "desc": "A set of Ruby utilities for converting and working with compliance data for use in Heimdall apps",
          "icon": "",
          "png" : "heimdall_logo",
          "app_link": "",
          "app_svg": "app",
          "doc_link": "https://heimdall-tools.mitre.org",
          "github_link": "https://github.com/mitre/heimdall_tools",
          "svg": "",
          "tools": "",
          "shields": [
            "https://img.shields.io/github/v/release/mitre/heimdall_tools?label=version",
            "https://img.shields.io/gem/dt/heimdall_tools?label=gem%20downloads"
          ]
        },
        {
          "name": "Heimdall Tools GitHub Action",
          "link": "",
          "desc": "Add Heimdall Tools to your GitHub Actions workflow",
          "icon": "github",
          "icon_sizer" : "600%",
          "app_link": "",
          "app_svg": "",
          "doc_link": "https://github.com/marketplace/actions/heimdall-tools-action",
          "github_link": "https://github.com/mitre/heimdall_tools_action",
          "svg": ""
        },
        {
          "name": "InSpecJS",
          "link": "",
          "desc": "A Typescript library for working with InSpec data",
          "icon": "",
          "png" : "inspec_logo",
          "app_link": "",
          "app_svg": "app",
          "doc_link": "https://inspecjs.mitre.org",
          "github_link": "https://github.com/mitre/inspecjs",
          "svg": "",
          "tools": "",
          "shields": [
            "https://img.shields.io/npm/v/inspecjs?label=version",
            "https://img.shields.io/npm/dt/inspecjs?label=npm%20downloads"
          ]
        },
        {
          "name": "InSpecJS Tools",
          "link": "",
          "desc": "A set of JavaScript utilities for creating, converting, and processing security baseline formats, results, and data",
          "icon": "",
          "png" : "inspec_logo",
          "app_link": "",
          "app_svg": "app",
          "doc_link": "https://inspec-tools-js.mitre.org",
          "github_link": "https://github.com/mitre/inspec_tools_js",
          "svg": "",
          "tools": ""
        },
        {
          "name": "HDF Splunk Plugin",
          "link": "",
          "desc": "Splunk plugin to upload Inspec output, Heimdall Tools output, and any other HDF format files to Splunk, for consumption by Heimdall Lite",
          "icon": "",
          "png" : "splunk-white-black-bg",
          "png_dark" : "splunk-black-white-bg",
          "app_link": "",
          "app_svg": "app",
          "doc_link": "https://hdf-json-to-splunk.mitre.org",
          "github_link": "https://github.com/mitre/hdf-json-to-splunk/",
          "svg": "",
          "tools": "",
          "shields": [
            "https://img.shields.io/github/v/release/mitre/hdf-json-to-splunk?label=version",
            "https://img.shields.io/github/downloads/mitre/hdf-json-to-splunk/total?label=github%20downloads"
          ]
        },
        {
          "name": "InSpec Delta",
          "link": "",
          "desc": "Gem aiming to make the maintenance of InSpec profiles representing security benchmarks less of a maintenance burden by providing helpful command line tools",
          "icon": "",
          "png" : "inspec-delta-icon",
          "app_link": "",
          "app_svg": "app",
          "doc_link": "https://engineering.cerner.com/blog/inspec-delta/",
          "github_link": "https://github.com/cerner/inspec_delta",
          "svg": "",
          "tools": ""
        },
        {
          "name": "Serverless InSpec (AWS)",
          "link": "",
          "desc": "Lambda function that allows execution of InSpec profiles in a serverless fashion",
          "icon": "",
          "png" : "aws_lambda_logo",
          "app_link": "",
          "app_svg": "app",
          "doc_link": "",
          "github_link": "https://github.com/mitre/serverless-inspec-lambda",
          "svg": "",
          "tools": "",
          "shields": [
            "https://img.shields.io/github/v/release/mitre/serverless-inspec-lambda?label=version",
            "https://img.shields.io/github/downloads/mitre/serverless-inspec-lambda/total?label=github%20downloads"
          ]
        },
        {
          "name": "Baseline Parser",
          "link": "",
          "desc": "Script to determine the set of NIST SP 800-53 controls covered by a baseline stored in GitHub",
          "icon": "",
          "app_link": "",
          "app_svg": "",
          "doc_link": "",
          "github_link": "https://github.com/mitre/saf-baseline-ingestion",
          "svg": "",
          "tools": ""
        },
        {
          "name": "HeimdallJS Tools (Coming Soon!)",
          "link": "",
          "desc": "A set of JavaScript utilities for converting and working with compliance data for use in Heimdall apps",
          "icon": "",
          "png" : "heimdall_logo",
          "app_link": "",
          "app_svg": "",
          "doc_link": "",
          "github_link": "",
          "svg": "",
          "tools": ""
        }        
      ]
    }
  ]
}