-
Notifications
You must be signed in to change notification settings - Fork 126
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Infer CIA ratings of tech assets #19
Conversation
Default confidentiality, integrity and availability (CIA) values of technical assets to the highest value of all data assets processed and stored by the technical asset. - Set `Confidentiality` of technical assets to `HighestConfidentiality()` iff `confidentiality` is not set. - Set `Integrity` of technical assets to `HighestIntegrity()` iff `integrity` is not set. - Set `Availability` of technical assets to `HighestAvailability()` iff `availability` is not set. - Otherwise keep the set value. - Do not require `confidentiality`, `integrity` or `availability` on `technical_assets` in JSON schema.
If no data asset is processed or stored by a technical asset and no CIA value is explicitly set, falling back to the lowest CIA value. This should happen very rarely in practice.
@@ -4296,6 +4296,9 @@ func parseModel(inputFilename string) { | |||
confidentiality = model.Confidential | |||
case model.StrictlyConfidential.String(): | |||
confidentiality = model.StrictlyConfidential | |||
case "": | |||
// Temporary placeholder, will later be set to `HighestConfidentiality()` | |||
confidentiality = -1 |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
suggestion: Probably it is better to use something like model.UnsetConfidentialityValue
instead of a raw int.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thank you @klahnen, I think this is a good idea, but unfortunately I won't invest more time for now, as the present PR is working reliably for me since almost a year. Furthermore any feedback from @cschneider4711 would be great, to see if there is any intention at all to consider merging this PR.
@joreiche this PR joreiche#5 is for merging this PR into your fork which later may be used in #57 |
this pr has been resolved with #57 |
Hi,
just another pull request from my side.
Rationale
Confidentiality, Integrity and Availability (CIA) of a tech asset may be inferred from the data that tech asset processes.
Proposal
Infer CIA based on the data assets processed. If CIA can not be inferred, i.e. if no data asset is processed (probably this rarely happens in practice), fall back to the lowest possible level. If a value for CIA is set, it takes precedence.