C06 — Quản lý bên thứ ba

#!/bin/bash
# Vendor Security Posture Check — kiểm tra TLS, cert, security headers

VENDOR="${1:-example-vendor.com}"
REPORT="/tmp/vendor-check-${VENDOR}-$(date +%Y%m%d).txt"
PASS=0; WARN=0; FAIL=0

log() { echo "[$(date +%H:%M:%S)] $1" | tee -a $REPORT; }
chk()  { printf "  %-40s [%s] %s\n" "$1" "$2" "$3" | tee -a $REPORT
         case $2 in PASS) (( PASS++ ));; WARN) (( WARN++ ));; FAIL) (( FAIL++ ));; esac; }

log "=== Vendor Security Check: $VENDOR ==="

# 1. TLS version check (reject TLS 1.0/1.1)
TLS_VER=$(openssl s_client -connect ${VENDOR}:443 -tls1_2 </dev/null 2>&1 | grep "Protocol" | awk '{print $NF}')
if [ -n "$TLS_VER" ]; then
    chk "TLS version (min TLS 1.2)" "PASS" "Supports TLS 1.2"
else
    chk "TLS version" "FAIL" "TLS 1.2 not available"
fi

# 2. Certificate expiry check
CERT_EXPIRY=$(echo | openssl s_client -connect ${VENDOR}:443 2>/dev/null | openssl x509 -noout -enddate 2>/dev/null | cut -d= -f2)
DAYS_LEFT=$(( ( $(date -d "$CERT_EXPIRY" +%s) - $(date +%s) ) / 86400 ))
if   [ $DAYS_LEFT -gt 30 ]; then chk "Certificate expiry" "PASS" "${DAYS_LEFT} days remaining"
elif [ $DAYS_LEFT -gt 0  ]; then chk "Certificate expiry" "WARN" "Expiring soon: ${DAYS_LEFT} days"
else                               chk "Certificate expiry" "FAIL" "EXPIRED!"
fi

# 3. Security headers check
HEADERS=$(curl -sI https://${VENDOR} --max-time 10 2>/dev/null)
for header in "Strict-Transport-Security" "X-Content-Type-Options" "X-Frame-Options" "Content-Security-Policy"; do
    if echo "$HEADERS" | grep -qi "$header"; then
        chk "Header: $header" "PASS" "Present"
    else
        chk "Header: $header" "WARN" "Missing — security risk"
    fi
done

# 4. HTTP → HTTPS redirect
HTTP_CODE=$(curl -so /dev/null -w "%{http_code}" http://${VENDOR} --max-time 5 2>/dev/null)
if [ "$HTTP_CODE" = "301" ] || [ "$HTTP_CODE" = "308" ]; then
    chk "HTTPS redirect" "PASS" "HTTP redirects to HTTPS (${HTTP_CODE})"
else
    chk "HTTPS redirect" "WARN" "HTTP response: ${HTTP_CODE} — verify redirect"
fi

log ""
log "=== RESULT: PASS=$PASS WARN=$WARN FAIL=$FAIL | Report: $REPORT ==="

[09:20:00] === Vendor Security Check: cloudpay-vendor.com ===
  TLS version (min TLS 1.2)              [PASS] Supports TLS 1.2
  Certificate expiry                     [PASS] 187 days remaining
  Header: Strict-Transport-Security      [PASS] Present
  Header: X-Content-Type-Options         [PASS] Present
  Header: X-Frame-Options                [PASS] Present
  Header: Content-Security-Policy        [WARN] Missing — security risk
  HTTPS redirect                         [PASS] HTTP redirects to HTTPS (301)

[09:20:05] === RESULT: PASS=6 WARN=1 FAIL=0 | Report: /tmp/vendor-check-...txt ===
Action: Request vendor add Content-Security-Policy header within 30 days

Dragon Bank sử dụng một vendor HR software bị breach qua zero-day vulnerability trong file transfer tool (tương tự MOVEit 2023). 45,000 bản ghi nhân viên bị exfiltrate gồm: họ tên, CCCD, lương, số tài khoản ngân hàng.