mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
61 lines
2.9 KiB
Markdown
61 lines
2.9 KiB
Markdown
# Standards and References - Authenticated Scanning with OpenVAS
|
|
|
|
## Primary Standards
|
|
|
|
### NIST SP 800-115
|
|
- **Title**: Technical Guide to Information Security Testing and Assessment
|
|
- **URL**: https://csrc.nist.gov/publications/detail/sp/800-115/final
|
|
- **Relevance**: Defines vulnerability scanning methodologies including credentialed vs non-credentialed approaches
|
|
|
|
### NIST SP 800-53 Rev 5 - RA-5
|
|
- **Title**: Vulnerability Monitoring and Scanning
|
|
- **URL**: https://csrc.nist.gov/publications/detail/sp/800-53/rev-5/final
|
|
- **Requirement**: Organizations must scan for vulnerabilities in information systems and hosted applications with both authenticated and unauthenticated methods
|
|
|
|
### CIS Controls v8 - Control 7
|
|
- **Title**: Continuous Vulnerability Management
|
|
- **URL**: https://www.cisecurity.org/controls/continuous-vulnerability-management
|
|
- **Sub-controls**:
|
|
- 7.1: Establish and maintain a vulnerability management process
|
|
- 7.4: Perform authenticated vulnerability scanning with agents or credentialed scans
|
|
- 7.5: Perform automated vulnerability scans of internal enterprise assets on a quarterly basis
|
|
|
|
### PCI DSS v4.0 - Requirement 11.3
|
|
- **Title**: External and Internal Vulnerabilities Are Regularly Identified, Prioritized, and Addressed
|
|
- **Requirement**: Internal vulnerability scans must be performed at least quarterly and after any significant change; authenticated scanning is required for comprehensive assessment
|
|
|
|
## OpenVAS/GVM Technical References
|
|
|
|
### Greenbone Community Edition
|
|
- **URL**: https://greenbone.github.io/docs/latest/
|
|
- **Components**: gvmd (manager), openvas-scanner, gsad (web UI), ospd-openvas
|
|
- **Feed**: Greenbone Community Feed with 180,000+ NVT checks
|
|
|
|
### GVM Architecture
|
|
- **Scanner**: openvas-scanner performs the actual vulnerability tests
|
|
- **Manager**: gvmd manages scan tasks, credentials, targets, and results
|
|
- **Web Interface**: Greenbone Security Assistant (GSA) provides browser-based management
|
|
- **Database**: PostgreSQL stores configurations and results
|
|
- **Cache**: Redis provides high-speed NVT metadata caching
|
|
|
|
### python-gvm Library
|
|
- **URL**: https://github.com/greenbone/python-gvm
|
|
- **PyPI**: https://pypi.org/project/python-gvm/
|
|
- **Documentation**: https://python-gvm.readthedocs.io/
|
|
|
|
### GMP Protocol
|
|
- **Title**: Greenbone Management Protocol
|
|
- **URL**: https://docs.greenbone.net/API/GMP/gmp-22.04.html
|
|
- **Purpose**: XML-based protocol for programmatic interaction with gvmd
|
|
|
|
## Compliance Mapping
|
|
|
|
| Framework | Control | Authenticated Scan Requirement |
|
|
|-----------|---------|-------------------------------|
|
|
| NIST 800-53 | RA-5 | Credentialed scanning for host-level assessment |
|
|
| PCI DSS 4.0 | 11.3.1 | Internal vulnerability scanning quarterly |
|
|
| CIS Controls v8 | 7.4 | Authenticated vulnerability scanning |
|
|
| ISO 27001 | A.8.8 | Technical vulnerability management |
|
|
| HIPAA | 164.312(a)(1) | Technical safeguards evaluation |
|
|
| SOC 2 | CC7.1 | Vulnerability identification and remediation |
|