Skip to main content

Secure Compliance Suite Plugin System Implementation

Overview​

The Secure Compliance Suite plugin system provides a flexible and extensible architecture for implementing various compliance frameworks (like FedRAMP, PCI DSS, HIPAA, etc.) in a standardized way. This document outlines the implementation of the plugin system, focusing on the ComplianceFramework plugin type.

Plugin Architecture​

1. Core Components​

  • Annotation: ComplianceFramework.php - Defines the metadata for compliance framework plugins
  • Interface: ComplianceFrameworkInterface.php - Contract for all compliance framework plugins
  • Base Class: ComplianceFrameworkBase.php - Shared implementation for all frameworks
  • Plugin Manager: ComplianceFrameworkManager.php - Discovers and instantiates plugins
  • Service Integration: Updated service definitions in secure_compliance_suite.services.yml

2. Implementation Examples​

  • FedRAMP Framework: FedrampFramework.php - Implementation for Federal Risk and Authorization Management Program
  • PCI DSS Framework: PciDssFramework.php - Implementation for Payment Card Industry Data Security Standard

3. Service Layer​

  • ComplianceScanService: Performs scans using framework plugins
  • ComplianceCheckService: Validates compliance using framework plugins
  • ComplianceFrameworkController: UI for browsing and using frameworks
  • ComplianceReportController: Generates downloadable reports from frameworks

4. Routing and UI​

  • Updated routing definitions to support framework and regime-based navigation
  • Backward compatibility support through legacy route redirects

Plugin Discovery Flow​

  1. Registration: Plugins are registered through annotations in the codebase
  2. Discovery: ComplianceFrameworkManager discovers plugins during Drupal's initialization
  3. Instantiation: Services request plugins from the manager by ID or regime
  4. Execution: Framework methods are called to perform compliance checks or validation

Extending the System​

Adding New Frameworks​

To add a new compliance framework, create a new plugin class in the Plugin/ComplianceFramework/ directory:

<?php

namespace Drupal\secure_compliance_suite\Plugin\ComplianceFramework;

/**
 * Implementation of HIPAA compliance framework.
 *
 * @ComplianceFramework(
 *   id = "hipaa_security",
 *   label = @Translation("HIPAA Security Rule"),
 *   description = @Translation("Health Insurance Portability and Accountability Act Security Rule compliance framework."),
 *   regime = "hipaa",
 *   version = "2023",
 *   weight = 20
 * )
 */
class HipaaSecurityFramework extends ComplianceFrameworkBase [/**
   * {@inheritdoc]
   */
  public function getRequiredControls() [// Define HIPAA-specific controls here]

  /**
   * [@inheritdoc]
   */
  public function checkCompliance() [// Implement HIPAA-specific compliance checking logic]

}

Organizing by Regime​

Frameworks are organized by "regime" (e.g., fedramp, pci_dss, hipaa) to allow:

  1. Grouping related frameworks together
  2. Running compliance checks across all frameworks in a regime
  3. Providing a unified view of compliance status for a regulatory domain

Benefits of the Plugin System​

  1. Extensibility: Easy to add new compliance frameworks without modifying core code
  2. Standardization: Common interface ensures consistent implementation across frameworks
  3. Separation of Concerns: Each framework's logic is isolated in its own plugin
  4. Discovery: Automatic registration and discovery of frameworks
  5. Organization: Grouping by regime for better management

Usage Examples​

Running Compliance Checks​

// Check compliance for a specific framework
$results = $compliance_check_service->runFrameworkChecks('fedramp_moderate');

// Check compliance for all frameworks in a regime
$results = $compliance_check_service->runRegimeChecks('fedramp');

// Check compliance for all available frameworks
$results = $compliance_check_service->runAllChecks();

Generating Reports​

// Generate an HTML report
$report = $compliance_check_service->generateFrameworkReport('pci_dss_4', 'html');

// Generate a JSON report
$report = $compliance_check_service->generateFrameworkReport('pci_dss_4', 'json');

// Generate a PDF report (placeholder implementation)
$report = $compliance_check_service->generateFrameworkReport('pci_dss_4', 'pdf');

Future Enhancements​

  1. PDF Report Generation: Implement full PDF generation using a library like TCPDF or mPDF
  2. Control Inheritance: Allow frameworks to inherit controls from other frameworks
  3. Custom Control Validators: Create a plugin system for control validators
  4. Evidence Collection: Enhance evidence collection and storage
  5. Remediation Suggestions: Add more detailed remediation suggestions for non-compliant controls

Implementation by: Secure Drupal Team