Certificeringsprogramma's Voor Microsoft 365 Security Operations

<# .SYNOPSIS Certificeringsbewaking voor Microsoft 365 security operations. .DESCRIPTION Dit script ondersteunt CISO- en SOC-teams bij het plannen, controleren en rapporteren van certificeringen voor kritieke Microsoft 365-rollen. Het werkt volledig met lokale configuraties zodat het veilig toepasbaar is in gescheiden overheidsnetwerken. .NOTES Project : Nederlandse Baseline voor Veilige Cloud Author : Nederlandse Baseline voor Veilige Cloud Team File : certification-programs.ps1 .EXAMPLE .\certification-programs.ps1 -Remediation Maakt of herstelt de basisconfiguratie voor certificeringsdoelen. .EXAMPLE .\certification-programs.ps1 -Assess Toont dekking per rol, aflopende certificeringen en exporteert een gap-analyse. .EXAMPLE .\certification-programs.ps1 -Report Genereert een managementrapport met hashwaarde voor auditdossiers. #> #Requires -Version 5.1 [CmdletBinding(DefaultParameterSetName = 'Help')] param( [Parameter(ParameterSetName = 'Assess')] [switch]$Assess, [Parameter(ParameterSetName = 'Inventory')] [switch]$Inventory, [Parameter(ParameterSetName = 'Report')] [switch]$Report, [Parameter(ParameterSetName = 'Remediation')] [switch]$Remediation, [Parameter(ParameterSetName = 'Revert')] [switch]$Revert, [Parameter(Mandatory = $false)] [switch]$WhatIf ) Set-StrictMode -Version Latest $ErrorActionPreference = 'Stop' Write-Host "`n===============================================" -ForegroundColor Cyan Write-Host "Certificeringsmonitor Microsoft 365 SOC" -ForegroundColor Cyan Write-Host "Nederlandse Baseline voor Veilige Cloud" -ForegroundColor Cyan Write-Host "===============================================`n" -ForegroundColor Cyan function Get-ConfigPath { param() $scriptDir = Split-Path -Parent $PSCommandPath return (Join-Path -Path $scriptDir -ChildPath 'certification-programs.config.json') } function Get-GapPath { param() $scriptDir = Split-Path -Parent $PSCommandPath return (Join-Path -Path $scriptDir -ChildPath 'certification-programs-gaps.csv') } function Get-ReportPath { param() $scriptDir = Split-Path -Parent $PSCommandPath return (Join-Path -Path $scriptDir -ChildPath 'certification-programs-report.txt') } function Initialize-CertificationConfig { $today = (Get-Date).ToString('yyyy-MM-dd') $nextQuarter = (Get-Date).AddDays(45).ToString('yyyy-MM-dd') $nextHalfYear = (Get-Date).AddDays(160).ToString('yyyy-MM-dd') $config = [ordered]@{ version = '1.0' lastUpdated = $today owner = 'SOC Certification Lead' targets = [ordered]@{ expiryThresholdDays = 90 minimumCoveragePct = 120 criticalCerts = @( [ordered]@{ id = 'SC-200'; minHolders = 4 }, [ordered]@{ id = 'SC-300'; minHolders = 3 }, [ordered]@{ id = 'SC-100'; minHolders = 2 } ) } personnel = @( [ordered]@{ name = 'Analist Noord' role = 'SOC Analyst' required = @('SC-200','SC-300') certificates = @( [ordered]@{ id = 'SC-200'; expires = $nextHalfYear; issuer = 'Microsoft'; status = 'Active' }, [ordered]@{ id = 'SC-300'; expires = $nextQuarter; issuer = 'Microsoft'; status = 'Active' } ) }, [ordered]@{ name = 'Analist Zuid' role = 'SOC Analyst' required = @('SC-200') certificates = @( [ordered]@{ id = 'SC-200'; expires = (Get-Date).AddDays(20).ToString('yyyy-MM-dd'); issuer = 'Microsoft'; status = 'Active' } ) }, [ordered]@{ name = 'Use Case Engineer' role = 'Use Case Engineer' required = @('SC-200','SC-100') certificates = @( [ordered]@{ id = 'SC-200'; expires = $nextHalfYear; issuer = 'Microsoft'; status = 'Active' }, [ordered]@{ id = 'SC-100'; expires = (Get-Date).AddDays(-15).ToString('yyyy-MM-dd'); issuer = 'Microsoft'; status = 'Expired' } ) }, [ordered]@{ name = 'Incident Commander' role = 'Incident Commander' required = @('SC-100') certificates = @() } ) } return $config } function Save-CertificationConfig { param( [Parameter(Mandatory = $true)] [hashtable]$Config ) $configPath = Get-ConfigPath $configJson = $Config | ConvertTo-Json -Depth 6 if ($WhatIf) { Write-Host "[WhatIf] Configuratie zou worden geschreven naar $configPath" -ForegroundColor Yellow Write-Host $configJson return } $configDir = Split-Path -Parent $configPath if (-not (Test-Path -Path $configDir)) { New-Item -ItemType Directory -Path $configDir -Force | Out-Null } $configJson | Out-File -FilePath $configPath -Encoding UTF8 -Force Write-Host "[OK] Configuratie opgeslagen op $configPath" -ForegroundColor Green } function Get-CertificationData { $configPath = Get-ConfigPath if (-not (Test-Path -Path $configPath)) { throw "Geen configuratie gevonden. Voer '.\certification-programs.ps1 -Remediation' uit om te initialiseren." } $raw = Get-Content -Path $configPath -Raw return ($raw | ConvertFrom-Json -Depth 6) } function Invoke-CertificationRemediation { try { $configPath = Get-ConfigPath if (Test-Path -Path $configPath) { $backup = "$configPath.bak_{0}" -f (Get-Date -Format 'yyyyMMddHHmmss') if (-not $WhatIf) { Copy-Item -Path $configPath -Destination $backup -Force } Write-Host "[INFO] Back-up opgeslagen als $backup" -ForegroundColor Cyan } $config = Initialize-CertificationConfig Save-CertificationConfig -Config $config } catch { Write-Host "[FAIL] Remediatie mislukt: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-CertificationCoverage { try { $config = Get-CertificationData $now = Get-Date $threshold = [int]$config.targets.expiryThresholdDays $personResults = @() $portfolio = @{} foreach ($person in $config.personnel) { $missing = @() $expiring = @() foreach ($req in $person.required) { $cert = $person.certificates | Where-Object { $_.id -eq $req } if (-not $cert) { $missing += $req continue } $expires = [datetime]$cert.expires if ($expires -lt $now) { $missing += "$req (verlopen)" } elseif ($expires -lt $now.AddDays($threshold)) { $daysLeft = [math]::Round(($expires - $now).TotalDays, 0) $expiring += "$req ($daysLeft dagen)" } if (-not $portfolio.ContainsKey($cert.id)) { $portfolio[$cert.id] = [ordered]@{ Holders = 0 Active = 0 Expiring = 0 Expired = 0 } } $portfolio[$cert.id].Holders++ if ($expires -lt $now) { $portfolio[$cert.id].Expired++ } elseif ($expires -lt $now.AddDays($threshold)) { $portfolio[$cert.id].Expiring++ $portfolio[$cert.id].Active++ } else { $portfolio[$cert.id].Active++ } } $personResults += [pscustomobject]@{ Name = $person.name Role = $person.role Required = ($person.required -join ', ') MissingCerts = if ($missing) { $missing -join '; ' } else { '' } ExpiringSoon = if ($expiring) { $expiring -join '; ' } else { '' } } } Write-Host "[INFO] Overzicht personeelscertificeringen" -ForegroundColor Cyan $personResults | Format-Table -AutoSize $portfolioTable = foreach ($key in ($portfolio.Keys | Sort-Object)) { [pscustomobject]@{ Certification = $key Holders = $portfolio[$key].Holders Active = $portfolio[$key].Active Expiring = $portfolio[$key].Expiring Expired = $portfolio[$key].Expired } } if ($portfolioTable) { Write-Host "`n[INFO] Portfolio-overzicht" -ForegroundColor Cyan $portfolioTable | Format-Table -AutoSize } $gapPath = Get-GapPath if ($WhatIf) { Write-Host "[WhatIf] Gap-analyse zou worden geëxporteerd naar $gapPath" -ForegroundColor Yellow } else { $personResults | Export-Csv -Path $gapPath -NoTypeInformation -Encoding UTF8 Write-Host "[OK] Gap-analyse geëxporteerd naar $gapPath" -ForegroundColor Green } foreach ($target in $config.targets.criticalCerts) { $certId = $target.id $min = [int]$target.minHolders $current = if ($portfolio.ContainsKey($certId)) { $portfolio[$certId].Active } else { 0 } if ($current -lt $min) { Write-Host ("[WARN] Onvoldoende actieve houders voor {0}: {1}/{2}" -f $certId, $current, $min) -ForegroundColor Yellow } else { Write-Host ("[OK] Certificeringsdoel voor {0} gehaald ({1}/{2})." -f $certId, $current, $min) -ForegroundColor Green } } } catch { Write-Host "[FAIL] Assessment mislukt: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Export-CertificationInventory { try { $config = Get-CertificationData $inventoryPath = Get-GapPath $now = Get-Date $rows = foreach ($person in $config.personnel) { foreach ($cert in $person.certificates) { $expires = [datetime]$cert.expires $daysLeft = [math]::Round(($expires - $now).TotalDays, 0) [pscustomobject]@{ Name = $person.name Role = $person.role Certification = $cert.id Issuer = $cert.issuer Expires = $cert.expires DaysLeft = $daysLeft Status = if ($expires -lt $now) { 'Expired' } else { $cert.status } } } } if ($WhatIf) { Write-Host "[WhatIf] Inventaris zou worden geschreven naar $inventoryPath" -ForegroundColor Yellow $rows | Format-Table -AutoSize return } $rows | Export-Csv -Path $inventoryPath -NoTypeInformation -Encoding UTF8 Write-Host "[OK] Inventaris geëxporteerd naar $inventoryPath" -ForegroundColor Green } catch { Write-Host "[FAIL] Inventaris export mislukt: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Publish-CertificationPortfolio { try { $config = Get-CertificationData $reportPath = Get-ReportPath $now = Get-Date $lines = @() $lines += "Rapport: Certificeringsprogramma Microsoft 365 SOC" $lines += "Datum : $now" $lines += "Eigenaar: $($config.owner)" $lines += "" $lines += "Doelstellingen:" $lines += ("- Minimum dekking: {0}% | Expiry drempel: {1} dagen" -f $config.targets.minimumCoveragePct, $config.targets.expiryThresholdDays) $lines += "" foreach ($person in $config.personnel) { $lines += ("Persoon: {0} ({1})" -f $person.name, $person.role) $lines += (" Vereist : {0}" -f ($person.required -join ', ')) if ($person.certificates.Count -eq 0) { $lines += " Beschikt over : geen certificeringen geregistreerd" } else { foreach ($cert in $person.certificates) { $lines += (" Certificaat: {0} | vervaldatum {1} | status {2}" -f $cert.id, $cert.expires, $cert.status) } } $lines += "" } if (-not $WhatIf) { $lines | Out-File -FilePath $reportPath -Encoding UTF8 -Force $hash = Get-FileHash -Path $reportPath -Algorithm SHA256 Write-Host "[OK] Rapport opgeslagen op $reportPath" -ForegroundColor Green Write-Host ("[INFO] SHA256: {0}" -f $hash.Hash) -ForegroundColor Cyan } else { Write-Host "[WhatIf] Rapport zou worden opgeslagen op $reportPath" -ForegroundColor Yellow $lines | ForEach-Object { Write-Host $_ } } } catch { Write-Host "[FAIL] Rapportage mislukt: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } function Invoke-CertificationCleanup { try { $paths = @( (Get-ConfigPath), (Get-GapPath), (Get-ReportPath) ) foreach ($path in $paths) { if (-not (Test-Path -Path $path)) { continue } if ($WhatIf) { Write-Host "[WhatIf] Bestand zou worden verwijderd: $path" -ForegroundColor Yellow } else { Remove-Item -Path $path -Force Write-Host "[OK] Bestand verwijderd: $path" -ForegroundColor Green } } } catch { Write-Host "[FAIL] Opschonen mislukt: $($_.Exception.Message)" -ForegroundColor Red exit 2 } } try { switch ($PSCmdlet.ParameterSetName) { 'Assess' { Invoke-CertificationCoverage; break } 'Inventory' { Export-CertificationInventory; break } 'Report' { Publish-CertificationPortfolio; break } 'Remediation' { Invoke-CertificationRemediation; break } 'Revert' { Invoke-CertificationCleanup; break } default { Write-Host "Gebruik:" -ForegroundColor Yellow Write-Host " -Remediation Maak of herstel de basisconfiguratie" -ForegroundColor Gray Write-Host " -Assess Controleer dekking en exporteer gap-analyse" -ForegroundColor Gray Write-Host " -Inventory Exporteer een detailoverzicht per certificaat" -ForegroundColor Gray Write-Host " -Report Genereer managementrapport met hashwaarde" -ForegroundColor Gray Write-Host " -Revert Verwijder configuratie- en rapportbestanden" -ForegroundColor Gray } } } catch { Write-Host "[FAIL] Onverwachte fout: $($_.Exception.Message)" -ForegroundColor Red exit 2 } finally { Write-Host "`n===============================================`n" -ForegroundColor Cyan }