Powershell-Copilot-Standards securitycompliance.instructions.md

PowerShell Security and Compliance Implementation

Implement security controls for PowerShell solutions: input validation, credential handling, audit logging, and threat mitigation. Apply security-by-design principles throughout development.

These patterns support regulatory work such as SOX, GDPR, and HIPAA by producing the audit trails, access controls, and data-handling evidence those programmes rely on. They do not make a system compliant on their own — that depends on controls, evidence, and audit outside this codebase. Do not describe generated code as compliant with any regulation.

Security Assessment and Implementation

Security Requirements Analysis

Evaluate and implement security controls based on:

Security Classification

• Public: No restrictions, publicly accessible code
• Internal: Internal use only, basic access controls required
• Confidential: Sensitive data, enhanced protection required
• Restricted: Highly sensitive, strict access controls mandatory
• Top Secret: Maximum security, compartmentalized access

Threat Model Assessment

Identify and mitigate threats using STRIDE methodology:

• Spoofing: Identity verification and authentication controls
• Tampering: Data integrity and code signing requirements
• Repudiation: Audit logging and non-repudiation controls
• Information Disclosure: Data protection and access controls
• Denial of Service: Availability and resilience measures
• Elevation of Privilege: Authorization and privilege management

Input Validation and Sanitization

Implement comprehensive input validation for all user inputs:

function Protect-UserInput {
    param(
        [Parameter(Mandatory = $true)]
        [string]$InputString,
        [ValidateSet('ComputerName', 'FileName', 'UserName', 'FilePath', 'EmailAddress')]
        [string]$InputType = 'General',
        [string]$CorrelationId = [System.Guid]::NewGuid().ToString()
    )

    # Log security validation attempt
    Write-SecurityLog -SecurityEventType 'DataValidation' -Message "Input validation requested" -Outcome 'Attempt' -CorrelationId $CorrelationId -SecurityContext @{
        InputType = $InputType
        InputLength = $InputString.Length
    }

    # Length validation
    if ($InputString.Length -gt 1000) {
        throw [SecurityException]::new("Input exceeds maximum length of 1000 characters", 'InputValidation', 'Length-Check')
    }

    # Type-specific validation patterns
    switch ($InputType) {
        'ComputerName' {
            if ($InputString -notmatch '^[a-zA-Z0-9\-\.]+$') {
                throw [SecurityException]::new("Invalid computer name format", 'InputValidation', 'Format-Check')
            }
        }
        'FileName' {
            $invalidChars = [System.IO.Path]::GetInvalidFileNameChars()
            foreach ($char in $invalidChars) {
                if ($InputString.Contains($char)) {
                    throw [SecurityException]::new("Invalid file name character: $char", 'InputValidation', 'Character-Check')
                }
            }
        }
        'FilePath' {
            # Prevent path traversal attacks
            $normalizedPath = [System.IO.Path]::GetFullPath($InputString)
            if ($normalizedPath.Contains('..') -or $normalizedPath.Contains('~')) {
                throw [SecurityException]::new("Path traversal attempt detected", 'InputValidation', 'Path-Traversal')
            }
        }
        'EmailAddress' {
            if ($InputString -notmatch '^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$') {
                throw [SecurityException]::new("Invalid email address format", 'InputValidation', 'Email-Format')
            }
        }
    }

    # Check for common injection patterns
    $dangerousPatterns = @(
        ';',           # Command separator
        '&',           # Command separator
        '|',           # Pipe operator
        '<',           # Redirect
        '>',           # Redirect
        '`',           # Backtick execution
        '$(',          # Subexpression
        'Invoke-',     # Dangerous cmdlets
        'iex',         # Invoke-Expression alias
        'Remove-',     # Destructive operations
        'Format-'      # Format string attacks
    )

    foreach ($pattern in $dangerousPatterns) {
        if ($InputString -like "*$pattern*") {
            Write-SecurityLog -SecurityEventType 'SecurityViolation' -Message "Dangerous pattern detected in input" -Outcome 'Failure' -CorrelationId $CorrelationId -SecurityContext @{
                Pattern = $pattern
                InputSample = $InputString.Substring(0, [Math]::Min(50, $InputString.Length))
            } -RiskLevel 'High'

            throw [SecurityException]::new("Input contains potentially dangerous pattern: $pattern", 'InputValidation', 'Injection-Prevention')
        }
    }

    Write-SecurityLog -SecurityEventType 'DataValidation' -Message "Input validation successful" -Outcome 'Success' -CorrelationId $CorrelationId
    return $InputString.Trim()
}