Security audit report: NIST 800-53 / DISA STIG V-220629 to V-220641 / 800-207 ZTA cross-repo findings

[devin-ai-integration]

Summary

Adds docs/security-audit-report.md — the executive deliverable for the 9-phase security audit that covered both COG-GTM/federal_security_compliance and COG-GTM/USArmy-Dshell.

The report consolidates:

• Phase 1 (SAST) — SonarQube findings for COG-GTM_USArmy-Dshell (4 BLOCKER + 65 CRIT + 32 MAJ + 74 MIN + 49 INFO + 7 hotspots) and bandit findings for both repos (FSC = 0, Dshell = 11 with 4 HIGH weak-hash + 1 MEDIUM eval() + 1 MEDIUM request without timeout + 3 LOW try/except/pass).
• Phase 2 (Compliance) — NIST 800-53 (AC/AU/IA/SC/SI) + DISA STIG V-220629 to V-220641 + NIST 800-207 ZTA matrices for both repos, with verdicts (Compliant / Partially Compliant / Non-Compliant) before and after remediation.
• Phase 3 (CVE) — pip-audit against latest available versions of all declared deps in both repos: zero known CVEs. Finding F-11 calls out that dshell/setup.py is unpinned, which is a supply-chain stability risk addressed in the Dshell remediation PR.
• Phase 4 (Tests) — FSC baseline: 21 tests pass, 18% coverage overall (auth_manager / security_utils / audit_logger / cac_piv_handler all at 0%). Dshell has no test suite; remediation PR introduces fuzz harness.
• Phase 5 (Code Review) — FSC templates audited against devin/knowledge.md, devin/playbook.md, and devin/zero-trust-knowledge.md. Confirmed runtime bug F-01: ZeroTrustConfig.PUBLIC_ENDPOINTS = field(default_factory=...) evaluates to a dataclasses.Field object (NOT a list) because ZeroTrustConfig is a plain class. Iterating it crashes.
• Phase 7 (Verification) — pass criteria documented; runs after remediation PRs merge.
• Phase 8 (this PR) — full report at docs/security-audit-report.md.
• Phase 9 (Jira) — Epic + Stories to be created in the UF project; links populated in §12 after creation.

16 findings (F-01 through F-16) ranging from High (PUBLIC_ENDPOINTS runtime bug, 18% coverage, 4 weak-hash HIGH) to Informational (duplicate Session/AuditEventType classes). Remediation routed through two parallel child sessions:

• Child A — FSC: PUBLIC_ENDPOINTS fix, datetime.utcnow → datetime.now(timezone.utc), full-SHA-256 chained integrity hash with verify_log_chain(), password-expiration enforcement (NIST IA-5), 4 new test files to push coverage ≥90%.
• Child B — Dshell: bandit B324/B113/B307/B105/B110 fixes, S5852 ReDoS hardening, top-2 S3776 refactors (decode.py:166, httpdump.py:56), pinned setup.py deps, new dshell/security_utils.py, fuzz tests, .pre-commit-config.yaml, .github/workflows/security.yml.

Review & Testing Checklist for Human

Risk: yellow (documentation-only delivery; the child PRs carry the actual code changes).

• Confirm the F-01 PUBLIC_ENDPOINTS runtime bug reproduces in your environment: cd templates/python && python -c "from zero_trust_middleware import ZeroTrustConfig; print(type(ZeroTrustConfig.PUBLIC_ENDPOINTS))" — should print <class 'dataclasses.Field'>.
• Confirm the §3.1 STIG/NIST compliance matrix correctly maps each control to the FSC module/test you would expect.
• Sanity-check the residual-risk list (§9) against your own ownership map — anything you'd downgrade/upgrade?
• Once Child A and Child B PRs land, link them in §12 (or merge a follow-up PR that adds the links).

Notes

This PR contains only docs/security-audit-report.md so it can land independently of the remediation PRs. The two child PRs (FSC + Dshell remediation) are open against their respective repos; their links will be added to §12 once Devin Review and CI clear. See parent session for the full audit log.

Link to Devin session: https://app.devin.ai/sessions/13fa523dc5d241c7bb17b9296ec7c1c4
Requested by: @jakexcosme

---

Devin Review

Status	Commit
⚪ Not started	—

Run Devin Review

💡 Connect your GitHub account to enable automatic code reviews.

[devin-ai-integration]

Original prompt from Jake

This is a multi-phase security audit across two repositories: COG-GTM/federal_security_compliance and COG-GTM/USArmy-Dshell.

#``# Phase 1: SonarQube Scan

• Connect to the Sonar MCP server and run a full scan on both repositories
• Scan all Python files in COG-GTM/federal_security_compliance/templates/python/ (zero_trust_middleware.py, auth_manager.py, audit_logger.py, security_utils.py, cac_piv_handler.py)
• Scan all Python files in COG-GTM/USArmy-Dshell/dshell/ including dshell/plugins/
• Export all findings: bugs, vulnerabilities, security hotspots, code smells
• Categorize by severity (Critical/High/Medium/Low) and map to CWE IDs

#``# Phase 2: NIST & STIG Compliance Cross-Check

• Audit federal_security_compliance against its claimed NIST 800-53 controls (AC, AU, IA, SC, SI families) and DISA STIG identifiers V-220629 through V-220641 using the mapping in docs/zero-trust-architecture.md lines 259-297
• Verify each control has corresponding implementation AND test coverage
• Audit USArmy-Dshell against the same standards — identify gaps in input validation, audit logging, session management, encryption
• Document compliance status per control: Compliant / Partially Compliant / Non-Compliant

#``# Phase 3: CVE & Dependency Scan

• Run pip-audit or equivalent on both repos' dependencies
• federal_security_compliance uses: bcrypt, flask (optional)
• USArmy-Dshell uses: pcapy-ng, pypacker, geoip2, elasticsearch (check setup.py)
• Cross-reference all dependencies against NVD
• Document each CVE: ID, severity (CVSS), affected component, remediation

#``# Phase 4: Test Execution (Child Sessions)

• Child Session 1: Run pytest tests/test_zero_trust.py -v --cov=templates/python in federal_security_compliance — verify all 7 test classes pass (TestIPBoundSessions, TestSessionTimeout, TestSessionRegeneration, TestContinuousVerification, TestAuditLogging, TestAccountLockout, TestSessionSecurity)
• Child Session 2: Run existing tests in USArmy-Dshell, add sec... (2209 chars truncated...)

[devin-ai-integration]

🤖 Devin AI Engineer

I'll be helping with this pull request! Here's what you should know:

✅ I will automatically:

• Address comments on this PR that start with 'DevinAI' or '@devin'.
• Look at CI failures and help fix them

Note: I can only respond to comments from users who have write access to this repository.

⚙️ Control Options:

• Disable automatic comment and CI monitoring