Hartmut
b41c1d2501
CI / Architecture Guardrails (push) Successful in 2m38s
CI / Assistant Split Regression (push) Successful in 3m33s
CI / Typecheck (push) Successful in 3m51s
CI / Lint (push) Successful in 5m2s
CI / E2E Tests (push) Has been cancelled
CI / Fresh-Linux Docker Deploy (push) Has been cancelled
CI / Release Images (push) Has been cancelled
CI / Build (push) Has been cancelled
CI / Unit Tests (push) Has been cancelled
rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI (#61) Co-authored-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com> Co-committed-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com>
236 lines
20 KiB
Markdown
236 lines
20 KiB
Markdown
# Accenture Application Security Standard V7.30 — Compliance ToDo
|
|
|
|
> Basierend auf: Application Security Standard V 7.30, Effective Date: February 13, 2026
|
|
> Analysiert gegen: Nexus (Stand: 2026-03-27)
|
|
|
|
---
|
|
|
|
## Legende
|
|
|
|
- OK = Bereits compliant
|
|
- TODO = Muss implementiert werden
|
|
- PARTIAL = Teilweise compliant, Nacharbeit noetig
|
|
- N/A = Nicht anwendbar
|
|
|
|
---
|
|
|
|
## 3.1 Governance
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ----------- | --------------------------------------------------------------------- | ------ | ----------------- | ----------------- |
|
|
| EAPPS.3.1.1 | App muss im AIR (Application Information Repository) registriert sein | TODO | Nicht registriert | AIR-ID beantragen |
|
|
|
|
---
|
|
|
|
## 3.2.1 Application Architecture
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| -------- | ------------------------------------------------------ | ------- | --------------------------------------------------------------------- | -------------------------------------------------- |
|
|
| 3.2.1.01 | Architectural document muss vorhanden sein | PARTIAL | CLAUDE.md + docs/ vorhanden, kein formelles Security Architecture Doc | Formelles Security Architecture Document erstellen |
|
|
| 3.2.1.03 | Kein direkter Internet-Zugang zu Datenbanken | OK | PostgreSQL nur ueber Docker-Netzwerk, nicht extern exponiert | — |
|
|
| 3.2.1.04 | Proaktives Monitoring bei business-kritischen Systemen | PARTIAL | Health-Endpoints vorhanden, kein externes Monitoring | Uptime-Monitoring einrichten (UptimeRobot o.ae.) |
|
|
|
|
---
|
|
|
|
## 3.2.2.1 Identity and Access Management
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ---------- | ---------------------------------------------------------- | ------- | ------------------------------------------------------- | -------------------------------------------------- |
|
|
| 3.2.2.1.01 | Compliant mit Identification and Authentication Standard | PARTIAL | Auth.js v5 mit Argon2 Passwort-Hashing, RBAC vorhanden | ESO/ADFS Integration pruefen (aktuell eigene Auth) |
|
|
| 3.2.2.1.02 | OAuth v2.0 fuer APIs/Services | TODO | Kein OAuth — tRPC mit Session-basierter Auth | OAuth 2.0 oder JWT-basierte API Auth evaluieren |
|
|
| 3.2.2.1.03 | Token Validity: Access Token max 1h, Refresh Token max 24h | PARTIAL | Auth.js Session-basiert, kein Token-Expiry konfiguriert | Session-Timeout konfigurieren (idle + absolute) |
|
|
| 3.2.2.1.04 | Nur immutable Claims in Tokens | OK | Auth.js nutzt server-side Sessions, keine JWT-Claims | — |
|
|
|
|
---
|
|
|
|
## 3.2.2.2 Multi-Factor Authentication (MFA)
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ------- | --------------------------- | ------ | ------------------------------ | --------------------------------------------------------------- |
|
|
| 3.2.2.2 | MFA muss implementiert sein | TODO | Keine MFA — nur Email+Passwort | MFA via TOTP oder WebAuthn implementieren, oder ESO-Integration |
|
|
|
|
---
|
|
|
|
## 3.2.2.3 Input & Output Validation
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ---------- | ---------------------------------------- | ------- | --------------------------------------------------------- | ------------------------------------------------------------------------------- |
|
|
| 3.2.2.3.01 | Input Validation Controls | OK | Zod-Schemas auf allen tRPC-Inputs, TypeScript strict mode | — |
|
|
| 3.2.2.3.02 | Passwort-Felder muessen maskiert sein | OK | `type="password"` auf allen Passwort-Inputs | — |
|
|
| 3.2.2.3.03 | Laengen-Validierung auf Input-Parametern | OK | Zod `.min()` / `.max()` auf relevanten Feldern | — |
|
|
| 3.2.2.3.04 | Numerische Werte Bereichs-Validierung | OK | Zod `.min()` / `.max()` auf Number-Feldern | — |
|
|
| 3.2.2.3.05 | Malicious Characters ablehnen/sanitizen | PARTIAL | Zod validiert Typen, kein explizites XSS-Sanitizing | DOMPurify oder aehnliches fuer User-generierte Texte (Kommentare, Descriptions) |
|
|
| 3.2.2.3.06 | Parameterized SQL (kein SQL Injection) | OK | Prisma ORM — alle Queries sind parameterized | — |
|
|
| 3.2.2.3.13 | HTTP Security Headers auf gesamter Seite | PARTIAL | Einige Headers via next.config.ts, nicht vollstaendig | Siehe HTTP Headers Sektion unten |
|
|
|
|
---
|
|
|
|
## 3.2.2.4 Session Management
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ---------- | --------------------------------------------------------------- | ------- | -------------------------------------------------------------- | -------------------------------------------------------------------- |
|
|
| 3.2.2.4.01 | Session IDs muessen unpredictable sein, terminiert nach Timeout | PARTIAL | Auth.js generiert sichere Session-IDs, kein expliziter Timeout | Session Idle Timeout (30min) und Absolute Timeout (8h) konfigurieren |
|
|
| 3.2.2.4.02 | Concurrent Sessions limitieren fuer High-Impact Systeme | TODO | Keine Session-Limitierung | Max 3 concurrent Sessions pro User implementieren |
|
|
| 3.2.2.4.04 | Nur server-issued Session-IDs verwenden | OK | Auth.js server-side Sessions | — |
|
|
| 3.2.2.4.05 | Idle Timeout konfigurierbar (SaaS) | TODO | Kein konfigurierbarer Timeout | Idle Timeout in SystemSettings aufnehmen |
|
|
|
|
---
|
|
|
|
## 3.2.2.5 Insecure File Upload
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ------- | ------------------------------- | ------- | ----------------------------------------------------------------------- | --------------------------------------------------------------------------- |
|
|
| 3.2.2.5 | Sichere File-Upload Validierung | PARTIAL | Cover-Art Upload validiert Dateityp + Groesse, XLSX Import parst sicher | File-Type Validation verstaerken (Magic Bytes pruefen, nicht nur Extension) |
|
|
|
|
---
|
|
|
|
## 3.2.2.6 Error Handling
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ------- | --------------------------------------- | ------- | ------------------------------------------------------ | --------------------------------------------------------------- |
|
|
| 3.2.2.6 | Keine technischen Fehlerdetails an User | PARTIAL | tRPC gibt Error-Codes zurueck, Stack Traces nur in Dev | Sentry fuer Production error capturing (installiert, DSN fehlt) |
|
|
|
|
---
|
|
|
|
## 3.2.2.7 Application Security Assessments
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ------- | ---------------------------- | ------ | ----------------------------- | ------------------------------------------------------------------------------ |
|
|
| 3.2.2.7 | Regelmaessige Security Scans | TODO | Kein SAST/DAST, kein Pen-Test | npm audit in CI (Dependabot vorhanden), SAST-Tool evaluieren (SonarQube, Snyk) |
|
|
|
|
---
|
|
|
|
## 3.2.2.8 Other Additional Controls
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ------- | ---------------------------- | ------- | ------------------------------------------------------ | ------------------------------------------------------------------- |
|
|
| 3.2.2.8 | Secure Development Lifecycle | PARTIAL | CI/CD vorhanden, Code Review via PR, TypeScript strict | Formales SDLC-Dokument erstellen, Security Checklist in PR-Template |
|
|
|
|
---
|
|
|
|
## 3.2.3 Data Protection
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| -------- | ------------------------------------- | ------ | ------------------------------------------ | ---------------------------------------------------------------------------- |
|
|
| 3.2.3.01 | Autocomplete=off fuer Passwort-Felder | TODO | Nicht explizit gesetzt | `autocomplete="off"` oder `autocomplete="new-password"` auf Passwort-Feldern |
|
|
| 3.2.3.02 | Source-Code Zugang nur fuer Dev-Team | OK | Gitea mit User-Authentifizierung | — |
|
|
| 3.2.3.03 | Keine Produktionsdaten in Non-Prod | OK | Seed-Daten sind fiktiv (Marvel-Characters) | — |
|
|
|
|
---
|
|
|
|
## 3.2.4 Change Management
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ----- | ------------------------- | ------- | ------------------------------------------------------ | ---------------------------------------------- |
|
|
| 3.2.4 | Change Management Prozess | PARTIAL | Git-basiert mit PRs und CI, Activity History vorhanden | Formalen Change-Approval-Prozess dokumentieren |
|
|
|
|
---
|
|
|
|
## 3.2.7 Logging and Auditing
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| -------- | ------------------------------------------ | ------- | ---------------------------------------------------------------------------- | ----------------------------------------------- |
|
|
| 3.2.7.01 | Authorization/Access Failures loggen | PARTIAL | RBAC Fehler werden als tRPC FORBIDDEN zurueckgegeben, nicht explizit geloggt | Failed Auth Attempts in Audit-Log aufnehmen |
|
|
| 3.2.7.01 | Input Validation Failures loggen | TODO | Zod-Errors werden an Client zurueckgegeben, nicht geloggt | Validation Failures an Pino Logger weiterleiten |
|
|
| 3.2.7.01 | Application Errors loggen | OK | Pino Structured Logging auf allen tRPC-Procedures | — |
|
|
| 3.2.7.01 | Config Changes loggen | OK | Activity History System audited 29/36 Router | — |
|
|
| 3.2.7.01 | High-Risk Functionality (User-Mgmt) loggen | OK | User Create/Delete/SetPassword/SetPermissions audited | — |
|
|
| 3.2.7.01 | API/Third-Party Access loggen | PARTIAL | AI-Aufrufe (OpenAI, Gemini) nicht explizit geloggt | API-Calls an externe Services loggen |
|
|
| 3.2.7.03 | Access Logs fuer alle User inkl. Vendor | PARTIAL | Audit-Log vorhanden, kein Login-Log | Login/Logout Events loggen |
|
|
|
|
---
|
|
|
|
## 3.3.1.3 HTTP Response Headers
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| ------------------------------------------------ | ----------- | ----------------------------------------------------- | ---------------------------------------------------------------------------- | ---- |
|
|
| X-Frame-Options: DENY | OK | In next.config.ts gesetzt | — |
|
|
| X-Content-Type-Options: nosniff | OK | In next.config.ts gesetzt | — |
|
|
| Referrer-Policy: strict-origin-when-cross-origin | OK | In next.config.ts gesetzt | — |
|
|
| Permissions-Policy | OK | In next.config.ts gesetzt (camera, mic, geo disabled) | — |
|
|
| Strict-Transport-Security (HSTS) | TODO | Nicht gesetzt | `Strict-Transport-Security: max-age=31536000; includeSubDomains` hinzufuegen |
|
|
| Content-Security-Policy (CSP) | TODO | Nicht gesetzt | CSP Header definieren (script-src, style-src, img-src etc.) |
|
|
| X-XSS-Protection | TODO | Nicht gesetzt | `X-XSS-Protection: 0` (Browser-eigener XSS-Filter, CSP preferred) |
|
|
| Cache-Control fuer sensitive Seiten | TODO | Nicht gesetzt | `Cache-Control: no-store` fuer Auth-Seiten |
|
|
| Server Header entfernen | TODO | nginx/openresty zeigt Server-Version | `server_tokens off` in nginx Config |
|
|
| X-Powered-By entfernen | OK | Next.js entfernt X-Powered-By automatisch | — |
|
|
|
|
---
|
|
|
|
## 3.3.1.6 Cookies & Attributes
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| -------------------------------------- | ----------- | -------------------------------------------- | ---------------------------------------------------- | ---- |
|
|
| HttpOnly Flag | OK | Auth.js Session-Cookie ist HttpOnly | — |
|
|
| Secure Flag | PARTIAL | In Production ja (HTTPS), in Dev nein (HTTP) | Sicherstellen dass Secure Flag in Prod immer gesetzt |
|
|
| SameSite Attribute | PARTIAL | Auth.js setzt SameSite=Lax | Pruefen ob Strict moeglich |
|
|
| Cookie-Prefix (**Host- oder **Secure-) | TODO | Keine Cookie-Prefixe | `__Host-` Prefix fuer Session-Cookie evaluieren |
|
|
|
|
---
|
|
|
|
## 3.3.1.12 API Management
|
|
|
|
| # | Anforderung | Status | Nexus Stand | ToDo |
|
|
| -------------------- | ----------- | ---------------------------------------------- | -------------------------------------------------------------------------------------------- | ---- |
|
|
| Rate Limiting | TODO | Kein Rate Limiting | Rate Limiting auf tRPC-Endpoints implementieren (z.B. `express-rate-limit` oder nginx level) |
|
|
| API Versioning | N/A | Internes Tool, kein oeffentliches API | — |
|
|
| API Authentication | OK | Alle tRPC-Procedures hinter protectedProcedure | — |
|
|
| API Input Validation | OK | Zod-Schemas auf allen Inputs | — |
|
|
|
|
---
|
|
|
|
## Priorisierte ToDo-Liste
|
|
|
|
### Prioritaet 1: KRITISCH (muss vor Production)
|
|
|
|
1. **[ ] MFA implementieren** — TOTP oder WebAuthn, oder ESO/ADFS Integration
|
|
2. **[ ] Session Timeouts** — Idle (30min) + Absolute (8h) konfigurieren
|
|
3. **[ ] HTTP Security Headers vervollstaendigen:**
|
|
- `Strict-Transport-Security: max-age=31536000; includeSubDomains`
|
|
- `Content-Security-Policy` definieren
|
|
- `Cache-Control: no-store` fuer Auth-Seiten
|
|
4. **[ ] Rate Limiting** auf API-Endpoints (Brute-Force Schutz)
|
|
5. **[ ] Sentry DSN konfigurieren** fuer Production Error Tracking
|
|
6. **[ ] Failed Auth Attempts loggen** (Audit-Log oder separater Security-Log)
|
|
|
|
### Prioritaet 2: HOCH (innerhalb 30 Tage)
|
|
|
|
7. **[ ] AIR Registration** — Application Information Repository Eintrag
|
|
8. **[ ] Security Architecture Document** erstellen
|
|
9. **[ ] SAST/DAST Tool** evaluieren und in CI integrieren (Snyk, SonarQube)
|
|
10. **[ ] XSS Sanitization** — DOMPurify fuer User-generierte Texte
|
|
11. **[ ] Autocomplete="new-password"** auf allen Passwort-Feldern
|
|
12. **[ ] Login/Logout Events** im Audit-Log erfassen
|
|
13. **[ ] External API Calls loggen** (OpenAI, Gemini Aufrufe)
|
|
14. **[ ] nginx Server-Header entfernen** (`server_tokens off`)
|
|
15. **[ ] Concurrent Session Limit** (max 3 pro User)
|
|
|
|
### Prioritaet 3: MITTEL (innerhalb 90 Tage)
|
|
|
|
16. **[ ] Cookie Prefix** (`__Host-`) evaluieren
|
|
17. **[ ] SameSite=Strict** evaluieren (statt Lax)
|
|
18. **[ ] File Upload Magic Bytes** Validierung
|
|
19. **[ ] Input Validation Failures** an Logger weiterleiten
|
|
20. **[ ] Change Management Prozess** formell dokumentieren
|
|
21. **[ ] Security Checklist** in PR-Template aufnehmen
|
|
22. **[ ] Session Idle Timeout** in Admin-Settings konfigurierbar machen
|
|
23. **[ ] Formaler SDLC** dokumentieren
|
|
|
|
---
|
|
|
|
## Bereits Compliant (kein Handlungsbedarf)
|
|
|
|
| Bereich | Standard-Anforderung | Nexus Feature |
|
|
| ------------------------ | -------------------------------- | ------------------------------------------------- |
|
|
| SQL Injection Prevention | Parameterized Queries | Prisma ORM |
|
|
| Password Hashing | Sichere Hash-Funktion | Argon2 via @node-rs/argon2 |
|
|
| RBAC | Rollenbasierte Zugriffskontrolle | 5-stufiges RBAC (USER→ADMIN) + Per-User Overrides |
|
|
| Input Validation | Alle Inputs validiert | Zod-Schemas auf allen tRPC-Procedures |
|
|
| Audit Logging | Aenderungen nachvollziehbar | Activity History System (29/36 Router) |
|
|
| Data Masking | Passwort-Felder maskiert | `type="password"` durchgehend |
|
|
| Source Code Access | Nur Dev-Team | Gitea mit Auth |
|
|
| No Prod Data in Dev | Fiktive Testdaten | Marvel-Character Seed |
|
|
| X-Frame-Options | Clickjacking-Schutz | DENY in next.config.ts |
|
|
| X-Content-Type-Options | MIME-Sniffing Schutz | nosniff in next.config.ts |
|
|
| API Auth | Alle Endpoints geschuetzt | protectedProcedure Middleware |
|