Privacy-by-design In De Secure Development Lifecycle Voor Microsoft 365

<# .SYNOPSIS Privacy by Design assessment, monitoring en remediatie voor de Secure Development Lifecycle. .DESCRIPTION Controleert of privacycontacten, DPIA-documentatie, sensitivity labels en SRR-processen aantoonbaar zijn ingericht binnen Microsoft 365. Kan rapportages exporteren en remediatiestappen genereren. Ondersteunt LocalDebug zodat testen zonder modules mogelijk is. .NOTES Filename : privacy-by-design-sdlc.ps1 Author : Nederlandse Baseline voor Veilige Cloud Version : 1.0 Related : content/m365/development/privacy-by-design-sdlc.json .EXAMPLE .\privacy-by-design-sdlc.ps1 -Assessment -LocalDebug .EXAMPLE .\privacy-by-design-sdlc.ps1 -Monitoring -ExportPath .\privacy-monitoring.csv -LocalDebug .EXAMPLE .\privacy-by-design-sdlc.ps1 -Remediation -WhatIf #> #Requires -Version 5.1 [CmdletBinding(DefaultParameterSetName = 'Assessment')] param( [Parameter(ParameterSetName = 'Assessment')] [switch]$Assessment, [Parameter(ParameterSetName = 'Monitoring')] [switch]$Monitoring, [Parameter(ParameterSetName = 'Remediation')] [switch]$Remediation, [switch]$LocalDebug, [string]$ExportPath, [switch]$WhatIf ) Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' function Write-NbvcBanner { param([string]$Title) Write-Host "`n========================================" -ForegroundColor Cyan Write-Host "Privacy by Design SDLC - $Title" -ForegroundColor Cyan Write-Host "========================================`n" -ForegroundColor Cyan } function Initialize-NbvcPrivacyContext { if ($LocalDebug) { Write-Verbose "LocalDebug actief: Graph-verbinding wordt overgeslagen." return } $requiredModules = @('Microsoft.Graph.Beta') foreach ($module in $requiredModules) { if (-not (Get-Module -ListAvailable -Name $module)) { throw "Vereist PowerShell-module '$module' ontbreekt. Installeer dit module voordat je het script uitvoert." } } $context = Get-MgContext if (-not $context) { Write-Host "Verbinden met Microsoft Graph..." -ForegroundColor Yellow Connect-MgGraph -Scopes @( 'Organization.Read.All', 'InformationProtectionPolicy.Read.All', 'SubjectRightsRequest.Read.All', 'Policy.Read.All' ) -ErrorAction Stop | Out-Null $context = Get-MgContext } if ($context.ApiVersion -ne 'beta') { Select-MgProfile -Name 'beta' } } function Get-PrivacySdlcSampleData { $now = Get-Date return [pscustomobject]@{ Organization = [pscustomobject]@{ DisplayName = "NBVC Demo Organisatie" ContactEmail = "fg@demo.overheid.nl" StatementUrl = "https://demo.overheid.nl/privacy" } SensitivityLabels = @( [pscustomobject]@{ name = "Vertrouwelijk"; lastModifiedDateTime = $now.AddDays(-5); isDefault = $true } [pscustomobject]@{ name = "Zeer Vertrouwelijk"; lastModifiedDateTime = $now.AddDays(-9); isDefault = $false } [pscustomobject]@{ name = "Openbaar"; lastModifiedDateTime = $now.AddDays(-30); isDefault = $false } ) SubjectRights = @( [pscustomobject]@{ RequestType = "Access"; Status = "completed"; DaysOpen = 12 } [pscustomobject]@{ RequestType = "Deletion"; Status = "inProgress"; DaysOpen = 7 } ) Pipelines = @( [pscustomobject]@{ Name = "Burgerzaken-API"; PrivacyTests = 32; FailedPrivacyTests = 0; LastRun = $now.AddHours(-3) } [pscustomobject]@{ Name = "Justitie-Portal"; PrivacyTests = 18; FailedPrivacyTests = 1; LastRun = $now.AddHours(-6) } ) } } function Get-AdoPrivacyPipelines { $orgUrl = $env:NBVC_AZDO_ORG_URL $project = $env:NBVC_AZDO_PROJECT $pat = $env:NBVC_AZDO_PAT if (-not ($orgUrl -and $project -and $pat)) { Write-Verbose "Azure DevOps variabelen niet gevuld; pipeline-data wordt overgeslagen." return @() } $credential = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$pat")) $headers = @{ Authorization = "Basic $credential" } try { $pipelinesUri = "$orgUrl/$project/_apis/pipelines?api-version=7.0" $pipelines = Invoke-RestMethod -Method Get -Uri $pipelinesUri -Headers $headers -ErrorAction Stop $results = @() foreach ($pipeline in $pipelines.value) { $runsUri = "$orgUrl/$project/_apis/pipelines/$($pipeline.id)/runs?api-version=7.0&`$top=1" $runs = Invoke-RestMethod -Method Get -Uri $runsUri -Headers $headers -ErrorAction SilentlyContinue $latest = $runs.value | Select-Object -First 1 if ($latest) { $privacyTests = $latest.variables.PrivacyTests.value $failedTests = $latest.variables.PrivacyTestsFailed.value $lastRun = [datetime]$latest.createdDate } else { $privacyTests = 0 $failedTests = 0 $lastRun = $null } $results += [pscustomobject]@{ Name = $pipeline.name PrivacyTests = [int]$privacyTests FailedPrivacyTests = [int]$failedTests LastRun = $lastRun } } return $results } catch { Write-Warning "Kon Azure DevOps pipelinegegevens niet ophalen: $($_.Exception.Message)" return @() } } function Get-PrivacySdlcInventory { Initialize-NbvcPrivacyContext if ($LocalDebug) { return Get-PrivacySdlcSampleData } try { $org = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/organization?`$select=displayName,privacyProfile" -ErrorAction Stop $labels = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/security/informationProtection/sensitivityLabels?`$top=999" -ErrorAction Stop $subjectRights = Invoke-MgGraphRequest -Method GET -Uri "https://graph.microsoft.com/beta/privacy/subjectRightsRequests?`$top=50" -ErrorAction Stop return [pscustomobject]@{ Organization = [pscustomobject]@{ DisplayName = $org.value[0].displayName ContactEmail = $org.value[0].privacyProfile.contactEmail StatementUrl = $org.value[0].privacyProfile.statementUrl } SensitivityLabels = $labels.value SubjectRights = $subjectRights.value | ForEach-Object { [pscustomobject]@{ RequestType = $_.type Status = $_.status DaysOpen = [math]::Max(0, [int][math]::Round((New-TimeSpan -Start $_.createdDateTime -End (Get-Date)).TotalDays)) } } Pipelines = Get-AdoPrivacyPipelines } } catch { throw "Kon privacy-inventaris niet ophalen: $($_.Exception.Message)" } } function Invoke-PrivacyAssessment { Write-NbvcBanner -Title "Assessment" $inventory = Get-PrivacySdlcInventory $findings = @() if ([string]::IsNullOrWhiteSpace($inventory.Organization.ContactEmail)) { $findings += "Er is geen privacycontact (FG) e-mailadres geconfigureerd in Microsoft 365." } if ([string]::IsNullOrWhiteSpace($inventory.Organization.StatementUrl)) { $findings += "Er ontbreekt een tenant-brede privacyverklaring (statementUrl)." } if (@($inventory.SensitivityLabels).Count -lt 3) { $findings += "Er zijn minder dan drie sensitivity labels gepubliceerd; dataclassificatie is onvoldoende." } $openRequests = @($inventory.SubjectRights | Where-Object { $_.Status -ne 'completed' }) if ($openRequests.Count -gt 0) { $maxDays = ($openRequests | Measure-Object -Property DaysOpen -Maximum).Maximum if ($maxDays -gt 30) { $findings += "Ten minste één subject rights request staat langer dan 30 dagen open." } } $pipelines = @($inventory.Pipelines) if ($pipelines.Count -eq 0) { $findings += "Er zijn geen CI/CD-pipelines aangeleverd met privacytest-resultaten." } else { foreach ($pipeline in $pipelines) { if ($pipeline.FailedPrivacyTests -gt 0) { $findings += "Pipeline '$($pipeline.Name)' bevat mislukte privacytests." } } } if ($findings.Count -eq 0) { Write-Host "COMPLIANT: Privacy by design eisen voldoen aan de baseline." -ForegroundColor Green return 0 } Write-Host "NON-COMPLIANT: $($findings.Count) bevinding(en) gevonden." -ForegroundColor Red foreach ($finding in $findings) { Write-Host " - $finding" -ForegroundColor Yellow } return 1 } function Invoke-PrivacyMonitoring { param([string]$ExportPath) Write-NbvcBanner -Title "Monitoring" $inventory = Get-PrivacySdlcInventory $contactEmail = if ([string]::IsNullOrWhiteSpace($inventory.Organization.ContactEmail)) { 'Onbekend' } else { $inventory.Organization.ContactEmail } $statementUrl = if ([string]::IsNullOrWhiteSpace($inventory.Organization.StatementUrl)) { 'Niet ingesteld' } else { $inventory.Organization.StatementUrl } Write-Host "Tenant: $($inventory.Organization.DisplayName)" -ForegroundColor Cyan Write-Host "Privacycontact: $contactEmail" -ForegroundColor Cyan Write-Host "Privacyverklaring: $statementUrl" -ForegroundColor Cyan $labels = @($inventory.SensitivityLabels) Write-Host "`nSensitivity labels gepubliceerd: $($labels.Count)" -ForegroundColor White if ($labels.Count -gt 0) { $recentLabel = $labels | Sort-Object { $_.lastModifiedDateTime } -Descending | Select-Object -First 1 Write-Host "Laatste label-update: $($recentLabel.name) op $([datetime]$recentLabel.lastModifiedDateTime)" -ForegroundColor Gray } $srr = @($inventory.SubjectRights) $avgDays = if ($srr.Count -gt 0) { [math]::Round(($srr | Measure-Object -Property DaysOpen -Average).Average, 1) } else { 0 } Write-Host "`nSubject rights requests totaal: $($srr.Count) (gemiddeld $avgDays dagen open)" -ForegroundColor White $pipelines = @($inventory.Pipelines) if ($pipelines.Count -gt 0) { Write-Host "`nPipelines met privacytelemetrie: $($pipelines.Count)" -ForegroundColor White foreach ($pipeline in $pipelines) { $lastRunText = if ($pipeline.LastRun) { $pipeline.LastRun } else { 'onbekend' } Write-Host (" - {0}: {1} privacytests, {2} mislukt, laatste run {3}" -f $pipeline.Name, $pipeline.PrivacyTests, $pipeline.FailedPrivacyTests, $lastRunText) -ForegroundColor Gray } } else { Write-Host "`nGeen pipeline telemetrie beschikbaar." -ForegroundColor Yellow } if ($ExportPath) { $exportDir = Split-Path -Parent $ExportPath if ($exportDir -and -not (Test-Path $exportDir)) { New-Item -ItemType Directory -Path $exportDir -Force | Out-Null } $srr | Select-Object RequestType, Status, DaysOpen | Export-Csv -Path $ExportPath -Encoding UTF8 -NoTypeInformation Write-Host "`nMonitoring export opgeslagen naar $ExportPath" -ForegroundColor Green } if ($avgDays -gt 30 -or $pipelines.Count -eq 0) { return 1 } return 0 } function Invoke-PrivacyRemediation { Write-NbvcBanner -Title "Remediatie" $remediationSteps = @( "Configureer privacyProfile.contactEmail en statementUrl zodat burgers een aanspreekpunt hebben.", "Publiceer minimaal drie sensitivity labels en forceer hun gebruik via Purview policies.", "Integreer privacy unit tests en DPIA-validaties in iedere CI/CD-pipeline.", "Monitor SRR-doorlooptijden wekelijks en borg afhandeling binnen 30 dagen.", "Leg elke afwijking vast in een privacy manifest met hashing en retentielabel." ) foreach ($step in $remediationSteps) { Write-Host " - $step" -ForegroundColor White } if ($WhatIf) { Write-Host "`nWhatIf actief: geen wijzigingen aangebracht." -ForegroundColor Yellow return 0 } $plan = [pscustomobject]@{ Timestamp = Get-Date Owner = $env:USERNAME ContactEmail = $env:NBVC_PRIVACY_CONTACT Actions = $remediationSteps -join '; ' } $defaultPath = Join-Path -Path (Get-Location) -ChildPath "privacy-remediation-plan.csv" $plan | Export-Csv -Path $defaultPath -Encoding UTF8 -NoTypeInformation Write-Host "`nRemediatieplan opgeslagen naar $defaultPath" -ForegroundColor Green return 0 } try { switch ($PSCmdlet.ParameterSetName) { 'Assessment' { exit (Invoke-PrivacyAssessment) } 'Monitoring' { exit (Invoke-PrivacyMonitoring -ExportPath $ExportPath) } 'Remediation' { exit (Invoke-PrivacyRemediation) } default { Write-Host "Gebruik -Assessment, -Monitoring of -Remediation (optioneel -LocalDebug, -ExportPath, -WhatIf)." -ForegroundColor Yellow } } } catch { Write-Host "Onverwachte fout: $($_.Exception.Message)" -ForegroundColor Red exit 2 } finally { Write-Host "`n========================================`n" -ForegroundColor Cyan }