Skip to content

Commit b306351

Browse files
authored
Merge branch 'develop' into develop-safe-harbor-v1
2 parents 9ec9964 + d81f35a commit b306351

110 files changed

Lines changed: 5500 additions & 1419 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

README.md

Lines changed: 51 additions & 32 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,38 @@
11
# Security Frameworks content repository
22

3-
Official repository to the Security Frameworks by SEAL. This repository contains the entire
4-
structure and contents of the frameworks. Feel free to suggest from new categories to grammar
5-
corrections. Collaboration is open to everyone. **This is a work in progress.**
3+
Official repository to the Security Frameworks by SEAL. This repository contains the entire structure and contents of the frameworks. Feel free to suggest from new categories to grammar corrections. Collaboration is open to everyone. **This is a work in progress.**
64

7-
If you want to know more about the frameworks or take a peek at the live book go to the following
8-
branches below: [Main](https://seal-frameworks.vercel.app/),
9-
[Development](https://frameworks-git-develop-seal-frameworks.vercel.app/?_vercel_share=zOI0Q3riUfDv1Lq1IylFz2hXQzYPcmLp).
10-
11-
Production will be at [frameworks.securityalliance.org](https://frameworks.securityalliance.org),
12-
but not yet available.
5+
If you want to know more about the frameworks or take a peek at the live book go to the following branches: [Main](frameworks.securityalliance.org), [Development](frameworks.securityalliance.dev).
136

147
## Quick installation and local setup
158

169
1. `gh repo clone security-alliance/frameworks`
1710
2. `git checkout develop`
18-
3. `cargo install mdbook mdbook-admonish mdbook-catppuccin`
11+
3. `cargo install mdbook mdbook-admonish`
1912
4. `./serve.sh`
2013

2114
## Collaboration
2215

23-
There are currently two ways to collaborate. The first one is by logging from your Vercel account
24-
and commenting directly on the deployed version of the book, and the second one is by forking the
25-
repository and creating a pull request.
16+
There are currently several ways to collaborate:
17+
18+
1. Using the "Suggest an edit" button on any page to make quick edits
19+
2. Contributing to a specific framework through its dedicated branch
20+
3. Forking the repository and creating a pull request to the develop branch
21+
4. Commenting directly on the deployed version
22+
23+
> ⚠️ Please sign and verify every commit.
24+
25+
### Framework-specific branches
26+
27+
Before contributing, check if there's a [Steward](src/contribute/stewards.md) for the specific framework you're interested in, and reach out. We usually have separate branches pre-develop for frameworks with stewards.
28+
29+
The naming convention is `fw_framework_name`, for example `fw_opsec`, `fw_community_mgmt`. Ideally, you'll fork these framework-specific branches, as they typically have more updated information than what's available in the develop branch.
30+
31+
After making your changes:
32+
1. Submit a PR to the framework-specific branch and let the steward know
33+
2. After reviews, a PR can be submitted from the framework branch to the develop branch
34+
35+
If there's no specific branch created, that framework is still "headless," which means you can become its steward! See more in the [Stewards](src/contribute/stewards.md) section.
2636

2737
### Comments
2838

@@ -33,25 +43,35 @@ To comment on the live version of the book under development, you will need to l
3343
1. Fork the repository. Click on the "Fork" button at the top right corner of the page.
3444
2. Clone the forked repository to your local machine. Open your terminal or command prompt.
3545
`git clone https://github.com/your-username/frameworks.git`
36-
3. Make sure you're in the develop branch first.
46+
3. Check if there's a framework-specific branch you should be working on. If yes, use that branch instead of develop.
47+
4. Otherwise, make sure you're in the develop branch:
3748
`git checkout develop`
38-
4. Inside the folder create a new branch based on `develop`.
39-
`git checkout -b develop`
40-
5. Make your changes.
41-
6. Make sure your changes don't break anything by testing it in the local setup (see above).
42-
`./serve.sh`.
43-
7. Commit your changes.
49+
5. Inside the folder create a new branch based on the appropriate branch:
50+
`git checkout -b your-feature-branch`
51+
6. Make your changes.
52+
7. If adding new pages, consider adding appropriate tags in the frontmatter. Example:
53+
```
54+
---
55+
tags:
56+
- Engineer/Developer
57+
- Security Specialist
58+
- Devops
59+
- SRE
60+
---
61+
```
62+
8. If adding significant content, add attribution using the contributors system (see [using-contributors.md](src/config/using-contributors.md)).
63+
9. Make sure your changes don't break anything by testing it in the local setup:
64+
`./serve.sh`
65+
10. Commit your changes:
4466
`git add .`
45-
8. Commit the changes with a descriptive message:
46-
`git commit -m "Fixing typos and improving readability on XXX section"`
47-
9. Push the changes to your forked repository.
48-
`git push origin develop`
49-
10. Create a pull request. Go to your forked repository on GitHub. You should see a "Compare & pull
50-
request" button. Click on it. Provide a descriptive title and description for your pull request.
51-
11. Click on the "Create pull request" button.
52-
12. Wait for review. Once your pull request is approved, and no more changes are needed, we will
53-
merge it into the main repository.
54-
13. Congratulations! Your changes are now part of the security frameworks!
67+
11. Commit the changes with a descriptive message:
68+
`git commit -S -m "Fixing typos and improving readability on XXX section"`
69+
12. Push the changes to your forked repository:
70+
`git push origin your-feature-branch`
71+
13. Create a pull request. Go to your forked repository on GitHub. You should see a "Compare & pull request" button. Click on it. Provide a descriptive title and description for your pull request.
72+
14. Click on the "Create pull request" button.
73+
15. Wait for review. Once your pull request is approved, and no more changes are needed, we will merge it into the appropriate branch.
74+
16. Congratulations! Your changes are now part of the security frameworks!
5575

5676
## Editor area
5777

@@ -62,5 +82,4 @@ Editors merge PRs and push suggestions to the main branch which will be reflecte
6282
3. `git merge origin/develop`
6383
4. Manually merge files, solve conflicts and add a description.
6484

65-
- Using the `serve.sh` script instead of mdBook `serve` command is needed to be able to see properly
66-
the local deployment.
85+
- Using the `serve.sh` script instead of mdBook `serve` command is needed to be able to see properly the local deployment.

book.toml

Lines changed: 0 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -16,9 +16,6 @@ use-default-preprocessors = true
1616
command = "mdbook-admonish"
1717
assets_version = "3.0.2" # do not edit: managed by `mdbook-admonish install`
1818

19-
[preprocessor.catppuccin]
20-
assets_version = "2.1.0" # DO NOT EDIT: Managed by `mdbook-catppuccin install`
21-
2219
[preprocessor.metadata]
2320
command = "cargo run --manifest-path=plugin/mdbook-metadata/Cargo.toml --locked"
2421
tag_colors = { "SEAL/Initiative" = "#4339db" }
@@ -27,8 +24,6 @@ tag_colors = { "SEAL/Initiative" = "#4339db" }
2724

2825
[output.html]
2926
additional-css = [
30-
"./theme/catppuccin.css",
31-
"./theme/catppuccin-admonish.css",
3227
"./mdbook-admonish.css",
3328
"./theme/custom.css",
3429
"./theme/toc/pagetoc.css",

src/README.md

Lines changed: 0 additions & 50 deletions
This file was deleted.

src/SUMMARY.md

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,32 @@
1717
- [Cultivating a Security-Aware Mindset](./awareness/cultivating-a-security-aware-mindset.md)
1818
- [Staying Informed & Continuous Learning](./awareness/staying-informed-and-continuous-learning.md)
1919
- [Resources & Further Reading](./awareness/resources-and-further-reading.md)
20-
- [Operational Security](./operational-security/README.md)
21-
- [Detecting and Mitigating Insider Threats](./operational-security/detecting-and-mitigating-insider-threats.md)
22-
- [G Suite Security](./operational-security/g-suite-security.md)
23-
- [Password and Secrets Management](./operational-security/password-secrets-management.md)
24-
- [Physical Security](./operational-security/physical-security.md)
25-
- [SIM Swapping](./operational-security/sim-swapping.md)
26-
- [Standard Operating Environment](./operational-security/standard-operating-environment.md)
27-
- [Telegram](./operational-security/telegram.md)
28-
- [Wireless Security](./operational-security/wireless-security.md)
29-
- [Key Management](./key-management/README.md)
30-
- [Cold vs Hot Wallet](./key-management/cold-vs-hot-wallet.md)
31-
- [Custodial vs Non-Custodial](./key-management/custodial-vs-non-custodial.md)
32-
- [Hardware Wallets](./key-management/hardware-wallets.md)
33-
- [Signing Schemes](./key-management/signing-schemes.md)
34-
- [Software Wallets](./key-management/software-wallets.md)
20+
- [Operational Security](./opsec/README.md)
21+
- [Overview](./opsec/overview/README.md)
22+
- [Security Fundamentals](./opsec/overview/security-fundamentals.md)
23+
- [Implementation Process](./opsec/overview/implementation-process.md)
24+
- [Web3 considerations](./opsec/overview/web3-considerations.md)
25+
- [Threat Modeling Overview](./opsec/threat-modeling-overview.md)
26+
- [Risk Management Overview](./opsec/risk-management-overview.md)
27+
- [While Traveling](./opsec/travel/README.md)
28+
- [Guide](./opsec/travel/guide.md)
29+
- [TL;DR](./opsec/travel/tldr.md)
30+
- [Governance & Program Management]()
31+
- [Control Domains]()
32+
- [Lifecycle]()
33+
- [Monitoring & Detection]()
34+
- [Incident Response & Recovery]()
35+
- [Continuous Improvement & Metrics]()
36+
- [Integration & Mapping to Other Frameworks]()
37+
- [Appendices]()
38+
- [Wallet Security](./wallet-security/README.md)
39+
- [Cold vs Hot Wallet](./wallet-security/cold-vs-hot-wallet.md)
40+
- [Custodial vs Non-Custodial](./wallet-security/custodial-vs-non-custodial.md)
41+
- [Hardware Wallets](./wallet-security/hardware-wallets.md)
42+
- [Signing Schemes](./wallet-security/signing-schemes.md)
43+
- [Software Wallets](./wallet-security/software-wallets.md)
44+
- [Secure Multisig Best Practices](./wallet-security/secure-multisig-best-practices.md)
45+
- [Secure Multisig Signing Process](./wallet-security/secure-multisig-signing-process.md)
3546
- [External Security Reviews](./external-security-reviews/README.md)
3647
- [Expectation](./external-security-reviews/expectation.md)
3748
- [Preparation](./external-security-reviews/preparation.md)

src/community-management/README.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,7 +20,7 @@ Here, we present essential best practices to safeguard your community. In the fo
2020

2121
### Strong Passwords and Two-Factor Authentication (2FA)
2222

23-
- Use unique, complex passwords for each service and store them securely in a reputable password manager. Refer to the [**Operational Security Framework**](../operational-security/README.md) and [**Key Management Framework**](../key-management/README.md) for more information on this.
23+
- Use unique, complex passwords for each service and store them securely in a reputable password manager. Refer to the [**Operational Security Framework**](../operational-security/README.md) and [**Wallet Security Framework**](../wallet-security/README.md) for more information on this.
2424
- Secure the email account linked to your community platforms with a unique password and 2FA.
2525
- Always enable 2FA. Prefer hardware-based tokens (e.g., Yubikey) or mobile authenticator apps over SMS-based methods, which are vulnerable to SIM-swapping.
2626
- If you use an authenticator app like Authy, 1Password, or Aegis to generate time-based one-time passwords (TOTP). Ensure that the secret keys are stored encrypted and protected with robust security measures.

src/config/SUMMARY.md.develop

Lines changed: 26 additions & 15 deletions
Original file line numberDiff line numberDiff line change
@@ -17,21 +17,32 @@
1717
- [Cultivating a Security-Aware Mindset](./awareness/cultivating-a-security-aware-mindset.md)
1818
- [Staying Informed & Continuous Learning](./awareness/staying-informed-and-continuous-learning.md)
1919
- [Resources & Further Reading](./awareness/resources-and-further-reading.md)
20-
- [Operational Security](./operational-security/README.md)
21-
- [Detecting and Mitigating Insider Threats](./operational-security/detecting-and-mitigating-insider-threats.md)
22-
- [G Suite Security](./operational-security/g-suite-security.md)
23-
- [Password and Secrets Management](./operational-security/password-secrets-management.md)
24-
- [Physical Security](./operational-security/physical-security.md)
25-
- [SIM Swapping](./operational-security/sim-swapping.md)
26-
- [Standard Operating Environment](./operational-security/standard-operating-environment.md)
27-
- [Telegram](./operational-security/telegram.md)
28-
- [Wireless Security](./operational-security/wireless-security.md)
29-
- [Key Management](./key-management/README.md)
30-
- [Cold vs Hot Wallet](./key-management/cold-vs-hot-wallet.md)
31-
- [Custodial vs Non-Custodial](./key-management/custodial-vs-non-custodial.md)
32-
- [Hardware Wallets](./key-management/hardware-wallets.md)
33-
- [Signing Schemes](./key-management/signing-schemes.md)
34-
- [Software Wallets](./key-management/software-wallets.md)
20+
- [Operational Security](./opsec/README.md)
21+
- [Overview](./opsec/overview/README.md)
22+
- [Security Fundamentals](./opsec/overview/security-fundamentals.md)
23+
- [Implementation Process](./opsec/overview/implementation-process.md)
24+
- [Web3 considerations](./opsec/overview/web3-considerations.md)
25+
- [Threat Modeling Overview](./opsec/threat-modeling-overview.md)
26+
- [Risk Management Overview](./opsec/risk-management-overview.md)
27+
- [While Traveling](./opsec/travel/README.md)
28+
- [Guide](./opsec/travel/guide.md)
29+
- [TL;DR](./opsec/travel/tldr.md)
30+
- [Governance & Program Management]()
31+
- [Control Domains]()
32+
- [Lifecycle]()
33+
- [Monitoring & Detection]()
34+
- [Incident Response & Recovery]()
35+
- [Continuous Improvement & Metrics]()
36+
- [Integration & Mapping to Other Frameworks]()
37+
- [Appendices]()
38+
- [Wallet Security](./wallet-security/README.md)
39+
- [Cold vs Hot Wallet](./wallet-security/cold-vs-hot-wallet.md)
40+
- [Custodial vs Non-Custodial](./wallet-security/custodial-vs-non-custodial.md)
41+
- [Hardware Wallets](./wallet-security/hardware-wallets.md)
42+
- [Signing Schemes](./wallet-security/signing-schemes.md)
43+
- [Software Wallets](./wallet-security/software-wallets.md)
44+
- [Secure Multisig Best Practices](./wallet-security/secure-multisig-best-practices.md)
45+
- [Secure Multisig Signing Process](./wallet-security/secure-multisig-signing-process.md)
3546
- [External Security Reviews](./external-security-reviews/README.md)
3647
- [Expectation](./external-security-reviews/expectation.md)
3748
- [Preparation](./external-security-reviews/preparation.md)

0 commit comments

Comments
 (0)