Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Implemented defenses should show "and" instead of "or" #65

Open
kityansiu opened this issue Aug 11, 2020 · 1 comment
Open

Implemented defenses should show "and" instead of "or" #65

kityansiu opened this issue Aug 11, 2020 · 1 comment
Assignees
Labels
bug Something isn't working

Comments

@kityansiu
Copy link
Contributor

In DeliveryDrone.aadl:

			actuation: system Actuation
			{
				-- VERDICT Component Properties
				CASE_Consolidated_Properties::componentType => Hardware;
				CASE_Consolidated_Properties::hasSensitiveInfo => true;
				CASE_Consolidated_Properties::insideTrustedBoundary => true;
				CASE_Consolidated_Properties::pedigree => InternallyDeveloped;

				
				-- VERDICT Cyber Defense and DAL Mitigations
				CASE_Consolidated_Properties::physicalAccessControl => 7;
				CASE_Consolidated_Properties::supplyChainSecurity => 7;
				CASE_Consolidated_Properties::systemAccessControl => 7;
			};

MBAA Result (Security Failure Paths tab) shows the following in the Implemented Defenses column:
image

But it should really be: actuation:physicalAccessControl and systemAccessControl.

It's currently displaying "or" because it is reading the following from Defenses.csv:
image

Have to modify Defenses.csv, or think of some other way to read that both defenses are listed under actuation in the aadl file.

@kityansiu kityansiu added the bug Something isn't working label Aug 11, 2020
@kityansiu kityansiu changed the title Implemented defenses shoudl show "and" instead of "or" Implemented defenses should show "and" instead of "or" Aug 11, 2020
@AbhaMoitra
Copy link
Contributor

If you look at lines 8 and 9 in the Defenses.csv shown in the screen capture above, they are both "correct" representation. Each line of this file is related to a Capec on a component/connection and for it the ApplicableDefenseProperties as well as the information about presence of those properties in the implementation is presented. If for a Capec we have "A or B" as mitigation then they will appear over 2 lines in Defenses.csv. If both "A" and "B" are implemented in the AADL model then SOTERIA++ needs to reflect that in the console output.

A simple solution would be for SOTERIA++ to use "and" instead of "or" in "Implemented Defenses" if multiple items are present.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

2 participants