security program

security-program security-program.yaml

This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.

Validates against the security-program schema — try it: POST /v1/validate with {"schema": "security-program", "document": …}.

The document (YAML original)

examples/security-program.yaml — all identifiers and targets are demonstration placeholders

version: "1.0"
program_id: PROGRAM-DEMO-WEB
client_id: client-demo
owner: Bow Tie Kreative Security Operations
objectives:
  - Protect confidentiality and integrity of client website data.
  - Minimize public attack surface and privileged access.
  - Detect material control drift and compromise.
  - Restore the website and data from independently protected backups.
assets:
  - asset_id: demo-vps-01
    kind: vps
    environment: production
    criticality: 5
    owner: platform-team
    classification: confidential
    internet_exposed: true
    dependencies: [demo-domain, demo-database, demo-backup]
  - asset_id: demo-domain
    kind: website
    environment: production
    criticality: 5
    owner: application-team
    classification: public-and-confidential
    internet_exposed: true
    dependencies: [demo-vps-01]
  - asset_id: demo-backup
    kind: backup_repository
    environment: recovery
    criticality: 5
    owner: recovery-team
    classification: confidential
    internet_exposed: false
    dependencies: []
profiles:
  - profile: profiles/vps-web-baseline.yaml
    applies_to: [demo-vps-01]
    target_level: hardened
  - profile: profiles/website-passive-baseline.yaml
    applies_to: [demo-domain]
    target_level: verified
  - profile: profiles/drive-backup-baseline.yaml
    applies_to: [demo-backup]
    target_level: resilient
rules:
  - rule_id: RULE-PUBLIC-KEV
    if:
      - vulnerability.known_exploited == true
      - vulnerability.affected == true
      - vulnerability.reachable == true
    then:
      - priority = P0
      - open emergency mitigation workflow
    else:
      - continue contextual prioritization
  - rule_id: RULE-CHANGE-GATE
    if:
      - action.mode in [change, containment, recovery]
      - backup.verified == true
      - rollback.verified == true
      - maintenance_window.confirmed == true
      - kill_switch.configured == true
    then:
      - permit guarded runner
    else:
      - plan only
feedback_loops:
  - trigger: public exposure drift
    action:
      - open urgent finding
      - verify provider and host firewall
      - propose containment
  - trigger: backup restore test failed
    action:
      - mark recovery control failed
      - raise affected asset priority
      - suspend destructive changes

As JSON

Converted at build time; served at /v1/examples/security-program

{
  "version": "1.0",
  "program_id": "PROGRAM-DEMO-WEB",
  "client_id": "client-demo",
  "owner": "Bow Tie Kreative Security Operations",
  "objectives": [
    "Protect confidentiality and integrity of client website data.",
    "Minimize public attack surface and privileged access.",
    "Detect material control drift and compromise.",
    "Restore the website and data from independently protected backups."
  ],
  "assets": [
    {
      "asset_id": "demo-vps-01",
      "kind": "vps",
      "environment": "production",
      "criticality": 5,
      "owner": "platform-team",
      "classification": "confidential",
      "internet_exposed": true,
      "dependencies": [
        "demo-domain",
        "demo-database",
        "demo-backup"
      ]
    },
    {
      "asset_id": "demo-domain",
      "kind": "website",
      "environment": "production",
      "criticality": 5,
      "owner": "application-team",
      "classification": "public-and-confidential",
      "internet_exposed": true,
      "dependencies": [
        "demo-vps-01"
      ]
    },
    {
      "asset_id": "demo-backup",
      "kind": "backup_repository",
      "environment": "recovery",
      "criticality": 5,
      "owner": "recovery-team",
      "classification": "confidential",
      "internet_exposed": false,
      "dependencies": []
    }
  ],
  "profiles": [
    {
      "profile": "profiles/vps-web-baseline.yaml",
      "applies_to": [
        "demo-vps-01"
      ],
      "target_level": "hardened"
    },
    {
      "profile": "profiles/website-passive-baseline.yaml",
      "applies_to": [
        "demo-domain"
      ],
      "target_level": "verified"
    },
    {
      "profile": "profiles/drive-backup-baseline.yaml",
      "applies_to": [
        "demo-backup"
      ],
      "target_level": "resilient"
    }
  ],
  "rules": [
    {
      "rule_id": "RULE-PUBLIC-KEV",
      "if": [
        "vulnerability.known_exploited == true",
        "vulnerability.affected == true",
        "vulnerability.reachable == true"
      ],
      "then": [
        "priority = P0",
        "open emergency mitigation workflow"
      ],
      "else": [
        "continue contextual prioritization"
      ]
    },
    {
      "rule_id": "RULE-CHANGE-GATE",
      "if": [
        "action.mode in [change, containment, recovery]",
        "backup.verified == true",
        "rollback.verified == true",
        "maintenance_window.confirmed == true",
        "kill_switch.configured == true"
      ],
      "then": [
        "permit guarded runner"
      ],
      "else": [
        "plan only"
      ]
    }
  ],
  "feedback_loops": [
    {
      "trigger": "public exposure drift",
      "action": [
        "open urgent finding",
        "verify provider and host firewall",
        "propose containment"
      ]
    },
    {
      "trigger": "backup restore test failed",
      "action": [
        "mark recovery control failed",
        "raise affected asset priority",
        "suspend destructive changes"
      ]
    }
  ]
}

This example as JSON →