[7.0] mgmtsystem_security_event

[max3903]

This module allows you to manage security events of your information security management system (ISMS) with:

• Security events
• Threat Scenario
• Threat Origins
• Security Measures
• Underlying and Essential Assets

Dependencies

• information_security_manual
• document_page_work_instructions
• mgmtsystem_severity
• mgmtsystem_probability

Menu

• Manuals
  • Manuals
  • Security Events
• Configuration
  • Security
    • Assets
      • Essential
      • Underlying
      • Category
    • Security Measure
    • Threats
      • Origins
      • Scenario

Models and fields

Assets Category

mgmtsystem.security.assets.category

• Name: char

Essential Assets

mgmtsystem.security.assets.essential

• Name: char
• Description: txt
• Responsible: m2o with res.user

Underlying Assets

mgmtsystem.security.assets.underlying

• Name: char
• Category: m2o with mgmtsystem.security.assets.category
• Essential Assets: m2m with mgmtsystem.security.assets.essential

Security Measure

mgmtsystem.security.measure

• Name: char
• Description: txt
• Work Instruction: m2o with document.page with a domain to filter with the Work Instructions category

Threat Origin

mgmtsystem.security.threat.origin

• Name: char

Threat Scenario

mgmtsystem.security.threat.scenario

• Name: char
• Description: txt
• Origin: m2o with mgmtsystem.security.threat.origin
• Underlying Assets: m2m with mgmtsystem.security.assets.underlying
• Original Probability:
  • m2o with mgmtsystem.probability filtered on category=security
  • help=Probability without any security measures
• Original Severity:
  • m2o with mgmtsystem.severity filtered on category=security,
  • help=Probability without any security measures
• Current Probability:
  • m2o with mgmtsystem.probability filtered on category=security,
  • help=Probability with existing security measures
• Current Severity:
  • m2o with mgmtsystem.severity filtered on category=security,
  • help=Severity with existing security measures
• Residual Probability:
  • m2o with mgmtsystem.probability filtered on category=security,
  • help=Probability after remediation
• Residual Severity:
  • m2o with mgmtsystem.severity filtered on category=security,
  • help=Severity after remediation

Security Events - Scenario Lines

mgmtsystem.security.event.scenario

• Scenario: m2o with mgmtsystem.security.threat.scenario
• Origin: m2o with mgmtsystem.security.threat.origin
• Severity: m2o with mgmtsystem.severity filtered on category=security
• Description: txt
• Name: Events - Scenario - Origin

Security Events - Measure Lines

mgmtsystem.security.event.measure

• Measure: m2o with mgmtsystem.security.measure
• Underlying Asset: m2o with mgmtsystem.security.assets.underlying
• Prevention: bool
• Protection: bool
• Recovery: bool
• Name: Events - Measure - Underlying Asset

Security Events

mgmtsystem.security.event

• Name: char
• Description:
  • m2o with document_page filtered with category=Security Events
  • document pages will also contain the information of the impact of the event
• Severity: m2o with mgmtsystem.severity filtered on category=security
• Scenarios: o2m with mgmtsystem.security.event.scenario
• Measures: o2m with mgmtsystem.security.event.measure

[llacroix]

Working on it

[llacroix]

I believe the model mgmtsystem.security.event.measure should have a name attribute that could be generated automatically if necessary. As it is, there is no named defined and openerp automatically decide how it gets rendered in the list box.

[max3903]

@llacroix I just added the name fields for mgmtsystem.security.event.measure and mgmtsystem.security.event.scenario as concatenation of other fields.

[llacroix]

ok

[llacroix]

I'm unsure about two things:

What is supposed to be shown in the Manuals section "Security Events"?

The description of "mgmtsystem.security.event" is filtered with "document.page" with category "Security Events" Yet this category doesn't seem to exists.

[max3903]

@llacroix

• the list of mgmtsystem.security.event
• it needs to be created

[llacroix]

Ok good