15 KiB
15 KiB
Plan of Action & Milestones (POA&M) — Diskless Fleet Boot System
| Field | Value |
|---|---|
| POA&M version | 1.2 (adds P-24 / SAR F-08 — DNS/DHCP residual flows: kiosk HTTP, UKI rollback) |
| Date raised | 2026-07-10 |
| Last updated | 2026-07-11 |
| Review cadence | Monthly by System Manager; quarterly to the AO |
| Overall status | 0 of 24 items closed; P-02 engineering-complete (awaiting assessor M2) |
2026-07-11 remediation (
poam-hardeningbranch). The build pipeline is now a fail-closed production profile (POA&M P-03). Changes: (i) the passwordless debug shell was deleted entirely from the Packer template — nodebug_shellvariable, nodebug-shell.serviceprovisioner (P-02, R-02); (ii)enable_stigis enforcedtrueby Packer variable validation — a build with it false failspacker validate/build(P-04); (iii) the CI "Production build gate" aborts the run unlessSB_KEY,SB_CERTandFLEET_CAare set — no unsigned fallback, no placeholder RADIUS CA (P-03, P-05, P-06 CA wiring); the signedfleet-ipxebootloader build is gated the same way. Not yet done in P-03 M1:disable_dot1x=false(blocked on P-01 secure-path bench) and distinct production-artifact tagging (M2). See the row-level status below.
Severity = assessor's pre-treatment rating. Milestone dates are the assessor's recommended targets, to be confirmed by the System Owner on appointment. Items marked [GATE] are conditions precedent for a production ATO (SAR §7.2) — they cannot be risk-accepted.
1. Production-ATO gating items
| # | Weakness | Source | Severity | Remediation actions & milestones | Owner | Target | Status |
|---|---|---|---|---|---|---|---|
| P-01 [GATE] | Secure path (802.1X EAP-TLS + MACsec) implemented but never verified end-to-end; disabled in current builds (disable_dot1x=true). |
R-01 | High | M1: complete serving/dot1x-bench/ harness config (swtpm + hostapd + FreeRADIUS) — 2026-08-07. M2: bench pass: port Authorized, macsec0 addressed + DHCP, MKA survives switch-root, NVMe root over macsec0, lease renews — 2026-08-21. M3: re-enable in CI (DISABLE_DOT1X=false) — 2026-08-28. M4: assessor witness at delta assessment. |
Platform team | 2026-08-28 | Open |
| P-02 [GATE] | Passwordless root debug shell (debug_shell=true) present in lab builds — undocumented privileged access path. |
R-02 | High | M1: debug_shell=false default + CI assertiondebug_shell variable and the debug-shell.service provisioner were removed entirely from the template; no build can bake it. M2: assessor verifies absence on the assessed digest. |
Platform team | 2026-07-31 | M1 done — awaiting assessor (M2) |
| P-03 [GATE] | No enforced production build profile — security toggles (dot1x, STIG, signing, debug shell, RADIUS CA) individually settable; drift detectable only by human review. | F-01 | High | M1: define a CI "production" profile hard-asserting disable_dot1x=false, enable_stig=true, debug_shell=false, SB_KEY/SB_CERT set, non-placeholder RADIUS CA — 2026-08-14. Partly DONE 2026-07-11: CI "Production build gate" hard-asserts SB_KEY/SB_CERT/FLEET_CA (fail-closed); enable_stig=true enforced by template validation; debug_shell removed. Still open: disable_dot1x=false (blocked on P-01) + M2 distinct production-artifact tagging. |
Platform team + pipeline owner | 2026-08-21 | M1 partial |
| P-04 [GATE] | STIG hardening verified but enable_stig was toggled off during bring-up; production CI posture unconfirmed. |
R-03 | Medium | M1: ENABLE_STIG=true in CIenable_stig is enforced true by Packer variable validation (folds into P-03); enable_stig=false fails the build. M2: regenerate deviations report on the assessed build; confirm 0 unjustified REVIEW rows — 2026-08-21. |
Platform team | 2026-08-21 | M1 done |
| P-05 [GATE] | Boot-chain signing + Secure Boot not the standing default (unsigned/SB-off builds possible; db not enrolled fleet-wide). |
R-13 | Low (High impact if regressed) | M1: SB_KEY/SB_CERT; no unsigned-UKI fallback remains (the signed fleet-ipxe build is gated too). M2: db enrolled on all production hosts via fleet-sb-enroll; enrolment recorded per host — 2026-09-11. M3: assessor spot-checks mokutil --sb-state + sbverify — delta assessment. |
Platform team | 2026-09-11 | M1 done |
| P-06 [GATE] | Placeholder RADIUS CA — real EAP-TLS trust anchor not provisioned. | R-08 | Medium | M1: provision environment RADIUS CA out-of-band (classification permitting, not committed) — 2026-08-07 (pre-req for P-01 M2). | Environment owner | 2026-08-07 | Open |
| P-07 [GATE] | Governance layer absent: AO/System Owner/CISO unappointed; data classification unconfirmed; documentation unapproved. | SAR §1.4, §2.4.2 | High (blocks ATO structurally) | M1: appoint AO, System Owner, CISO — 2026-08-14. M2: System Owner confirms data classification; re-baseline SSP if above STARFLEET RESTRICTED — 2026-08-28. M3: AO approves documentation set — with ATO decision. | Organisation / System Owner | 2026-08-28 | Open |
| P-08 [GATE] | No Incident Response Plan, continuous-monitoring plan, or log-retention policy; volatile RAM overlay complicates forensics (no break-glass procedure). | R-12 | Medium | M1: author IRP incl. stateless-host forensics (capture-before-reboot guidance, collector/SIEM as evidence store) — 2026-09-04. M2: continuous-monitoring plan + log-retention policy — 2026-09-04. M3: tabletop exercise of the IRP — 2026-09-25. | SecOps | 2026-09-25 | Open |
| P-09 [GATE] | Audit-log offload plaintext on both hops (host→collector, collector→Wazuh); retention/archival unconfigured; Wazuh default credentials; dashboard/API unrestricted. | R-07 | Low–Medium | M1: rsyslog TLS (gtls/6514, fleet CA) host→collector; re-select the 3 waived rsyslog_encrypt_offload_* STIG rules — 2026-09-04 (also closes the DNS-spoofable audit-stream flow — F-08/P-24). M2: TLS collector→Wazuh — 2026-09-04. M3: rotate Wazuh credentials, restrict dashboard/API, set allowed-ips — 2026-08-21. M4: configure retention/archival per policy from P-08 — 2026-09-18. |
Platform / SecOps | 2026-09-18 | Open |
| P-10 [GATE] | ISM control identifiers unreconciled against the May 2026 ISM release (representative numbering throughout Annex A). | SAR §2.4.1 (P-17 in SAR text) | Medium (assurance) | M1: reconcile all ISM-NNNN*; map any new May-2026 controls; disposition retired ones — 2026-08-21 (assessor task, System Owner to facilitate). |
IRAP assessor + System Owner | 2026-08-21 | Open |
| P-11 [GATE] | Management/enrolment plane (fleet-manager, broker, step-ca fleet CA, InfluxDB) is an unauthorised connected system the host now trusts; fleet CA key protection unassessed. | R-14 | Medium | M1: author management-plane SSP (CA key protection, broker hardening incl. F-04 abuse controls, InfluxDB token/data, admin-plane exposure) — 2026-09-11. M2: separate assessment/authorisation or AO interim risk position covering the fleet CA — 2026-10-02. | Platform / SecOps | 2026-10-02 | Open |
2. Risk-acceptance candidates (production at STARFLEET ROUTINE, isolated LAN) — treat on roadmap
| # | Weakness | Source | Severity | Remediation actions & milestones | Owner | Target | Status |
|---|---|---|---|---|---|---|---|
| P-12 | NVMe/TCP root traffic plaintext on the LAN. | R-04 | Medium | M1: document transport decision (TLS/IPsec vs MACsec end-to-end across fabric) — 2026-09-25. M2: implement chosen transport protection — 2026-11-27. Interim: isolated LAN + dm-verity integrity accepted. | Platform / network | 2026-11-27 | Open |
| P-13 | Host admin access: NOPASSWD, fleet-generic, non-rotatable key; no human MFA on host SSH. | R-05 | Medium | M1: design per-host/rotatable access (SSH CA TrustedUserCAKeys or config agent) — 2026-10-16. M2: implement + bench under staff_u confinement — 2026-11-27. |
Platform team | 2026-11-27 | Open |
| P-14 | AACA/AACP conformance not asserted; FIPS off; crypto-module evaluation unconfirmed. Escalates to blocking if classification > STARFLEET RESTRICTED (P-07 M2). | R-06 | Medium | M1: AACA/AACP conformance statement for EAP-TLS, MACsec-GCM, mTLS, SSH suites — 2026-09-25. M2: FIPS/evaluated-module decision alongside signing posture — 2026-10-30. | Security + platform | 2026-10-30 | Open |
| P-15 | Host firewall (firewalld) disabled on the workstation. | R-09 | Low–Medium | M1 (after P-01): re-enable with explicit allows (NVMe/TCP 4420, DHCP, log offload 6514, SSH; reciprocal egress rules) + bench NVMe/NM stability — 2026-09-25. | Platform / network | 2026-09-25 | Open |
| P-16 | Patch cadence / critical-CVE SLA undefined for the rebuild-redeploy model. | R-10 | Medium | M1: define cadence + CVE SLA — 2026-08-28. M2: automate rebuild triggers on upstream advisories — 2026-10-30. | Platform team | 2026-10-30 | Open |
| P-17 | SSH host keys regenerate every boot — admin connections are perpetual TOFU; LAN MITM undetectable client-side. | F-02 (new — add to Annex A register) | Medium | M1: add to risk register — 2026-07-24. M2: poam-hardening) — the SSH host CA path (Design A, broker-mediated): fleet-ssh-hostcert (files/ssh-hostcert) gets each host's per-boot key signed by the fleet SSH CA via the enrol-broker host plane (TPM-identity mTLS) at boot; admins trust via one @cert-authority line. Keeps step-ca behind the single front door. BENCH-VERIFY the broker↔step-ca SSH-CA contract + principal policy + SELinux (docs/ssh-host-certificate-design.md). M3: bench-verify end-to-end on a booted+enrolled host; roll the @cert-authority anchor to admins — 2026-10-16. |
Platform team | 2026-10-16 | M2 implemented — bench-verify (M3) |
| P-18 | Time source unauthenticated (DHCP-handed NTP, no NTS) — host clock is an input to all certificate validation. | F-03 (new — add to register) | Low–Medium | M1: add to register — 2026-07-24. M2: secure-ntp) — NTS (RFC 8915): the serving NTP server's NTS-KE TLS cert is fleet-CA-signed; the host (secure_ntp=true) verifies it against radius-ca.pem and syncs authenticated time. The server name is derived at runtime from the DHCP domain (ntp.<domain>) — no baked FQDN, so a site-domain change needs no rebuild. A DHCP/DNS spoofer can only DoS, not shift the clock. BENCH-VERIFY chronyc authdata NTS cookies + DHCP option-15 domain handout + tcp/4460 + STIG chrony (docs/secure-ntp-design.md). M3: bench-verify end-to-end; issue the NTS server cert per environment — 2026-10-30. |
Platform team | 2026-10-30 | M2 implemented — bench-verify (M3) |
| P-19 | Fleet-wide availability SPOF: single unreplicated NVMe/TCP root target. | F-05 (new — add to register) | Medium (availability) | M1: interim ctrl_loss_tmo/reconnect_delay tuning at connect time — 2026-08-28. M2: multipath/ANA replica design (byte-identical same-UUID namespaces, multi-path discovery) — 2026-11-27. M3: document fleet RTO in IRP (P-08). |
Platform team | 2026-11-27 | Open |
| P-20 | No remote attestation of TPM boot measurements (compromised boot not centrally detectable). | R-11 | Low–Medium | M1: design TPM quote → verifier flow (candidate: extend fleet-agent/manager, gated on P-11 authorisation) — 2027 roadmap. Interim compensation: SB + signed UKI + dm-verity + F-07 posture telemetry. | Platform team | 2027-Q1 | Open |
| P-21 | Runtime posture drift not fully monitored (SB state, fapolicyd enforcement, cmdline hash not in telemetry). | F-07 (new) | Low | M1: extend fleet-agent facts + manager drift alerts — 2026-09-25 (pairs with P-05 M2). | Platform team | 2026-09-25 | Open |
| P-22 | Cross-protocol TPM key reuse ("one identity, three stages") — domain-separation analysis and revocation blast-radius plan undocumented. | F-06 (observation) | Low | M1: add a short analysis + revocation procedure to the SSP — 2026-08-28. | Platform + security | 2026-08-28 | Open |
| P-23 | Agent reconcile actuators deferred; enabling them creates a remote host-mutation channel outside this assessment's scope. | R-15 | Low (v1) | Standing condition, not a dated milestone: delta assessment of the command/authZ path required before any actuator is enabled (SAR §7.3 revocation trigger). Keep behind an explicit build flag. | Platform team | At actuator build | Open (condition) |
| P-24 | DNS/DHCP untrusted-input pattern undocumented, and two flows escape it: kiosk content over plain HTTP (DNS/DHCP spoof → attacker page fullscreen on every workstation; Chromium PNA allowance to the loopback host-info agent reachable from it) and UKI rollback (a spoofer can serve an older, still-validly-signed UKI — Secure Boot does not prevent this). The plaintext audit offload was the third such flow; it is closed by P-09 M1 (cross-ref). DNSSEC/DoT is explicitly not the treatment — authenticate above resolution, per the system's own pattern. | F-08 (new — add to register) | Medium | M1: add F-08 to the Annex A register + state the "DNS/DHCP are untrusted; every security-relevant connection authenticates its peer above name resolution" principle in the SSP — 2026-08-14. M2: serve the kiosk over TLS with a fleet-CA-signed cert (serving nginx/kiosk proxy; pin the fleet CA via Chromium enterprise policy; kiosk URL → https://) — 2026-09-25. M3: record the UKI-rollback residual against R-13 and document the anti-rollback design decision (dbx revocation / TPM monotonic counter, design v2 §6) — 2026-11-27. |
Platform team | 2026-11-27 | Open |
3. Milestone timeline (summary)
2026-07 P-02 debug shell off ── P-17/P-18 register updates
2026-08 P-06 RADIUS CA ── P-01 secure-path bench ── P-03/P-04/P-05 prod profile+signing
P-07 roles+classification ── P-10 ISM reconciliation ── P-16 patch SLA ── P-22
P-24 register+SSP DNS principle
2026-09 P-08 IRP/monitoring ── P-09 log TLS+retention ── P-11 mgmt-plane SSP
P-15 firewall ── P-21 posture telemetry ── P-12/P-14 decisions ── P-24 kiosk TLS
2026-10 P-11 mgmt-plane authorisation ── P-13/P-17 access model ── P-14/P-18 crypto/NTS
── DELTA ASSESSMENT + production ATO decision window
2026-11 P-12 storage transport ── P-13 rotatable access ── P-19 multipath
P-24 anti-rollback decision
2027-Q1 P-20 remote attestation
Earliest realistic production-ATO decision: mid-October 2026, contingent on the delta assessment witnessing P-01 through P-11 closed.
End of POA&M. Maintain alongside TODO.md; update item status at each monthly review and re-issue to the AO quarterly or on material change.