From dbc65c449fefa9aaebd7b5543122d1e14101be67 Mon Sep 17 00:00:00 2001 From: stefan Date: Sat, 21 Feb 2026 20:49:40 +0100 Subject: first version of Trust ontology in PlantUML --- PlantUML-ModelingTrust/6-3a.puml | 29 ++ PlantUML-ModelingTrust/6-3a.svg | 1 + PlantUML-ModelingTrust/6-3b.puml | 32 ++ PlantUML-ModelingTrust/6-3b.svg | 1 + PlantUML-ModelingTrust/6-3c.puml | 31 ++ PlantUML-ModelingTrust/6-3c.svg | 1 + .../8-7-GnuPG-Trust-Composition.puml | 62 +++ .../8-7-GnuPG-Trust-Composition.svg | 1 + PlantUML-ModelingTrust/8-7a-Trust-Composition.puml | 62 +++ PlantUML-ModelingTrust/8-7a-Trust-Composition.svg | 1 + .../9-9-GnuPG-RiskAssessmentPattern.puml | 40 ++ .../9-9-GnuPG-RiskAssessmentPattern.svg | 1 + .../9-9-RiskAssessmentPattern.puml | 40 ++ .../9-9-RiskAssessmentPattern.svg | 1 + PlantUML-ModelingTrust/README.adoc | 33 ++ PlantUML-ModelingTrust/README.html | 578 +++++++++++++++++++++ .../RSO9-10-RiskSecurityOverlay.puml | 94 ++++ .../RSO9-10-RiskSecurityOverlay.svg | 1 + PlantUML-ModelingTrust/index.adoc | 33 ++ PlantUML-ModelingTrust/index.html | 578 +++++++++++++++++++++ PlantUML-ModelingTrust/pumlit.sh | 2 + 21 files changed, 1622 insertions(+) create mode 100644 PlantUML-ModelingTrust/6-3a.puml create mode 100644 PlantUML-ModelingTrust/6-3a.svg create mode 100644 PlantUML-ModelingTrust/6-3b.puml create mode 100644 PlantUML-ModelingTrust/6-3b.svg create mode 100644 PlantUML-ModelingTrust/6-3c.puml create mode 100644 PlantUML-ModelingTrust/6-3c.svg create mode 100644 PlantUML-ModelingTrust/8-7-GnuPG-Trust-Composition.puml create mode 100644 PlantUML-ModelingTrust/8-7-GnuPG-Trust-Composition.svg create mode 100644 PlantUML-ModelingTrust/8-7a-Trust-Composition.puml create mode 100644 PlantUML-ModelingTrust/8-7a-Trust-Composition.svg create mode 100644 PlantUML-ModelingTrust/9-9-GnuPG-RiskAssessmentPattern.puml create mode 100644 PlantUML-ModelingTrust/9-9-GnuPG-RiskAssessmentPattern.svg create mode 100644 PlantUML-ModelingTrust/9-9-RiskAssessmentPattern.puml create mode 100644 PlantUML-ModelingTrust/9-9-RiskAssessmentPattern.svg create mode 100644 PlantUML-ModelingTrust/README.adoc create mode 100644 PlantUML-ModelingTrust/README.html create mode 100644 PlantUML-ModelingTrust/RSO9-10-RiskSecurityOverlay.puml create mode 100644 PlantUML-ModelingTrust/RSO9-10-RiskSecurityOverlay.svg create mode 100644 PlantUML-ModelingTrust/index.adoc create mode 100644 PlantUML-ModelingTrust/index.html create mode 100755 PlantUML-ModelingTrust/pumlit.sh (limited to 'PlantUML-ModelingTrust') diff --git a/PlantUML-ModelingTrust/6-3a.puml b/PlantUML-ModelingTrust/6-3a.puml new file mode 100644 index 0000000..4bfc3cf --- /dev/null +++ b/PlantUML-ModelingTrust/6-3a.puml @@ -0,0 +1,29 @@ +@startuml +!include +left to right direction + +Title Page 6: Fig. 3a: The Trust Assessment Pattern + +' Elemente +Motivation_Stakeholder(trustor, "Trustor\nStakeholder") +Motivation_Goal(intention, "Trustor\nIntention") + +Motivation_Assessment(trust, "<>\n[trust degree = high]") +Strategy_Resource(resource, "<>\nResource") + + + +trustor -[hidden]-> trust +trust -[hidden]-> resource +intention -[hidden]down-> trust + + + +' Beziehungen +Rel_Association(trustor, trust) +Rel_Association(trustor, intention) +Rel_Association(intention, trust) +Rel_Association(trust, resource) + +@enduml + diff --git a/PlantUML-ModelingTrust/6-3a.svg b/PlantUML-ModelingTrust/6-3a.svg new file mode 100644 index 0000000..7f425a9 --- /dev/null +++ b/PlantUML-ModelingTrust/6-3a.svg @@ -0,0 +1 @@ +Page 6: Fig. 3a: The Trust Assessment PatternPage 6: Fig. 3a: The Trust Assessment PatternTrustorStakeholderTrustorIntention«Trust»[trust degree = high]«Trustee»Resource     \ No newline at end of file diff --git a/PlantUML-ModelingTrust/6-3b.puml b/PlantUML-ModelingTrust/6-3b.puml new file mode 100644 index 0000000..8b9d6f6 --- /dev/null +++ b/PlantUML-ModelingTrust/6-3b.puml @@ -0,0 +1,32 @@ +@startuml +!include +left to right direction + + +Title Page 6: Fig. 3b: The Trust Assessment Pattern + +' Elemente +Motivation_Stakeholder(trustor, "Trustor\nBank Manager") +Motivation_Goal(intention, "Keep Money Safe") + +Motivation_Assessment(trust, "<>\nBank Vault is trustworthy\n[trust degree = high]") +Strategy_Resource(resource, "<>\nBank Vault") + + + +trustor -[hidden]-> trust +trust -[hidden]-> resource +intention -[hidden]down-> trust + + + +' Beziehungen +Rel_Association(trustor, trust) +Rel_Association(trustor, intention) +Rel_Association(intention, trust) +Rel_Association(trust, resource) + + + +@enduml + diff --git a/PlantUML-ModelingTrust/6-3b.svg b/PlantUML-ModelingTrust/6-3b.svg new file mode 100644 index 0000000..eeb1571 --- /dev/null +++ b/PlantUML-ModelingTrust/6-3b.svg @@ -0,0 +1 @@ +Page 6: Fig. 3b: The Trust Assessment PatternPage 6: Fig. 3b: The Trust Assessment PatternTrustorBank ManagerKeep Money Safe«Trust»Bank Vault is trustworthy[trust degree = high]«Trustee»Bank Vault     \ No newline at end of file diff --git a/PlantUML-ModelingTrust/6-3c.puml b/PlantUML-ModelingTrust/6-3c.puml new file mode 100644 index 0000000..9937ee7 --- /dev/null +++ b/PlantUML-ModelingTrust/6-3c.puml @@ -0,0 +1,31 @@ +@startuml +!include +left to right direction + +Title Page 6: Fig. 3: The Trust Assessment Pattern: GnuPG Download Signature + +' Elemente +Motivation_Stakeholder(trustor, "Trustor\nSecurity Officer\n Signer") +Motivation_Goal(intention, "Keep ISO-Image trustworthy (integrity)") + +Motivation_Assessment(trust, "<>\nCryptographic Signature is trustworthy\n[trust degree = high]") +Strategy_Resource(resource, "<>\nCryptographic Signature") + + + +trustor -[hidden]-> trust +trust -[hidden]-> resource +intention -[hidden]down-> trust + + + +' Beziehungen +Rel_Association(trustor, trust) +Rel_Association(trustor, intention) +Rel_Association(intention, trust) +Rel_Association(trust, resource) + + + +@enduml + diff --git a/PlantUML-ModelingTrust/6-3c.svg b/PlantUML-ModelingTrust/6-3c.svg new file mode 100644 index 0000000..d369bdd --- /dev/null +++ b/PlantUML-ModelingTrust/6-3c.svg @@ -0,0 +1 @@ +Page 6: Fig. 3: The Trust Assessment Pattern: GnuPG Download SignaturePage 6: Fig. 3: The Trust Assessment Pattern: GnuPG Download SignatureTrustorSecurity Officer SignerKeep ISO-Image trustworthy (integrity)«Trust»Cryptographic Signature is trustworthy[trust degree = high]«Trustee»Cryptographic Signature     \ No newline at end of file diff --git a/PlantUML-ModelingTrust/8-7-GnuPG-Trust-Composition.puml b/PlantUML-ModelingTrust/8-7-GnuPG-Trust-Composition.puml new file mode 100644 index 0000000..10b0c0d --- /dev/null +++ b/PlantUML-ModelingTrust/8-7-GnuPG-Trust-Composition.puml @@ -0,0 +1,62 @@ +@startuml +!include + +top to bottom direction +skinparam linetype polyline + +Title Page 8 Figure 7: Trust Composition: Downloading a GnuPG signed NetBSD ISO Install Image + +Grouping(M_Group,"Motivation"){ + +together { + Motivation_Stakeholder(trustor, "<>\nDownloader") + Motivation_Assessment(intention, "Download an authentic\n ISO image with integrity") +} + + +together { +Motivation_Assessment(trust, "<>\nDownload and Signature\n are trustworthy\n[trust degree = high]") +} + +Rel_Association(trustor,trust) +Rel_Association(intention,trust) + +together { + Motivation_Assessment(capBelief, "Downloading the ISO Image\n to update the OS") + Motivation_Assessment(vulBelief, "The GnuPG Signature protects\n the integrity and authenticity\n of the ISO Image") +} + +' group Motivation +} + + +Rel_Aggregation(trust, capBelief) +Rel_Aggregation(trust, vulBelief) + +Grouping(S_Group,"Strategy"){ + + +together { + Strategy_Capability(capability, "Secure Download") + Strategy_Capability(vulCapability, "<>\nSecurity Breach\nManipulated Download-Image") +} + +Rel_Association(capBelief, capability) +Rel_Association(vulBelief, vulCapability) + + +Strategy_Resource(trustee, "<>\nGnuPG Signature") + +Rel_Association(capability, trustee) +Rel_Association(vulCapability, trustee) + + + +' Group Strategy +} + + +Rel_Association(trust, trustee) + +@enduml + diff --git a/PlantUML-ModelingTrust/8-7-GnuPG-Trust-Composition.svg b/PlantUML-ModelingTrust/8-7-GnuPG-Trust-Composition.svg new file mode 100644 index 0000000..5902f20 --- /dev/null +++ b/PlantUML-ModelingTrust/8-7-GnuPG-Trust-Composition.svg @@ -0,0 +1 @@ +Page 8 Figure 7: Trust Composition: Downloading a GnuPG signed NetBSD ISO Install ImagePage 8 Figure 7: Trust Composition: Downloading a GnuPG signed NetBSD ISO Install ImageMotivationStrategy«Trustor»DownloaderDownload an authentic ISO image with integrity«Trust»Download and Signature are trustworthy[trust degree = high]Downloading the ISO Image to update the OSThe GnuPG Signature protects the integrity and authenticity of the ISO ImageSecure Download«Vulnerability»Security BreachManipulated Download-Image«Trustee»GnuPG Signature          \ No newline at end of file diff --git a/PlantUML-ModelingTrust/8-7a-Trust-Composition.puml b/PlantUML-ModelingTrust/8-7a-Trust-Composition.puml new file mode 100644 index 0000000..51ceb9c --- /dev/null +++ b/PlantUML-ModelingTrust/8-7a-Trust-Composition.puml @@ -0,0 +1,62 @@ +@startuml +!include + +top to bottom direction +skinparam linetype polyline + +Title Trust Composition + +Grouping(M_Group,"Motivation"){ + +together { + Motivation_Stakeholder(trustor, "<>\nStakeholder") + Motivation_Assessment(intention, "Trustor\nIntention") +} + + +together { +Motivation_Assessment(trust, "<>\n[trust degree = high]") +} + +Rel_Association(trustor,trust) +Rel_Association(intention,trust) + +together { + Motivation_Assessment(capBelief, "Capability\nBelief") + Motivation_Assessment(vulBelief, "Vulnerability\nBelief") +} + +' group Motivation +} + + +Rel_Aggregation(trust, capBelief) +Rel_Aggregation(trust, vulBelief) + +Grouping(S_Group,"Strategy"){ + + +together { + Strategy_Capability(capability, "Capability") + Strategy_Capability(vulCapability, "<>\nCapability") +} + +Rel_Association(capBelief, capability) +Rel_Association(vulBelief, vulCapability) + + +Strategy_Resource(trustee, "<>\nResource") + +Rel_Association(capability, trustee) +Rel_Association(vulCapability, trustee) + + + +' Group Strategy +} + + +Rel_Association(trust, trustee) + +@enduml + diff --git a/PlantUML-ModelingTrust/8-7a-Trust-Composition.svg b/PlantUML-ModelingTrust/8-7a-Trust-Composition.svg new file mode 100644 index 0000000..3d43d5d --- /dev/null +++ b/PlantUML-ModelingTrust/8-7a-Trust-Composition.svg @@ -0,0 +1 @@ +Trust CompositionTrust CompositionMotivationStrategy«Trustor»StakeholderTrustorIntention«Trust»[trust degree = high]CapabilityBeliefVulnerabilityBeliefCapability«Vulnerability»Capability«Trustee»Resource          \ No newline at end of file diff --git a/PlantUML-ModelingTrust/9-9-GnuPG-RiskAssessmentPattern.puml b/PlantUML-ModelingTrust/9-9-GnuPG-RiskAssessmentPattern.puml new file mode 100644 index 0000000..08a84ca --- /dev/null +++ b/PlantUML-ModelingTrust/9-9-GnuPG-RiskAssessmentPattern.puml @@ -0,0 +1,40 @@ +@startuml +!include +left to right direction + +Title Page 9: Fig. 9: NetBSD Download Risk Assessment Pattern + +Grouping(M_Group,"RiskExperience"){ +' Elemente +together{ +Motivation_Driver(driver, "»Risk«\nDriver") +Motivation_Stakeholder(assessor, "Risk\nAssessor") +} + +Motivation_Assessment(assessment, "Risk\nAssessment") + +} + + +together{ +Motivation_Goal(goal, "<>\nGoal") + +Motivation_Requirement(req, "<>\nRequirement") +} + + +' driver -[hidden]-> trust +' trust -[hidden]-> resource +' intention -[hidden]down-> trust + + + +' Beziehungen +Rel_Association(driver, assessment) +Rel_Association(assessor, assessment) +Rel_Association(assessment,goal) + +Rel_Realization(req,goal) + +@enduml + diff --git a/PlantUML-ModelingTrust/9-9-GnuPG-RiskAssessmentPattern.svg b/PlantUML-ModelingTrust/9-9-GnuPG-RiskAssessmentPattern.svg new file mode 100644 index 0000000..7fbc4ae --- /dev/null +++ b/PlantUML-ModelingTrust/9-9-GnuPG-RiskAssessmentPattern.svg @@ -0,0 +1 @@ +Page 9: Fig. 9: NetBSD Download Risk Assessment PatternPage 9: Fig. 9: NetBSD Download Risk Assessment PatternRiskExperience»Risk«DriverRiskAssessorRiskAssessment«ControlObjective»Goal«Control Measure»Requirement     \ No newline at end of file diff --git a/PlantUML-ModelingTrust/9-9-RiskAssessmentPattern.puml b/PlantUML-ModelingTrust/9-9-RiskAssessmentPattern.puml new file mode 100644 index 0000000..582388b --- /dev/null +++ b/PlantUML-ModelingTrust/9-9-RiskAssessmentPattern.puml @@ -0,0 +1,40 @@ +@startuml +!include +left to right direction + +Title Page 9: Fig. 9: The Risk Assessment Pattern + +Grouping(M_Group,"RiskExperience"){ +' Elemente +together{ +Motivation_Driver(driver, "»Risk«\nDriver") +Motivation_Stakeholder(assessor, "Risk\nAssessor") +} + +Motivation_Assessment(assessment, "Risk\nAssessment") + +} + + +together{ +Motivation_Goal(goal, "<>\nGoal") + +Motivation_Requirement(req, "<>\nRequirement") +} + + +' driver -[hidden]-> trust +' trust -[hidden]-> resource +' intention -[hidden]down-> trust + + + +' Beziehungen +Rel_Association(driver, assessment) +Rel_Association(assessor, assessment) +Rel_Association(assessment,goal) + +Rel_Realization(req,goal) + +@enduml + diff --git a/PlantUML-ModelingTrust/9-9-RiskAssessmentPattern.svg b/PlantUML-ModelingTrust/9-9-RiskAssessmentPattern.svg new file mode 100644 index 0000000..18aecc0 --- /dev/null +++ b/PlantUML-ModelingTrust/9-9-RiskAssessmentPattern.svg @@ -0,0 +1 @@ +Page 9: Fig. 9: The Risk Assessment PatternPage 9: Fig. 9: The Risk Assessment PatternRiskExperience»Risk«DriverRiskAssessorRiskAssessment«ControlObjective»Goal«Control Measure»Requirement     \ No newline at end of file diff --git a/PlantUML-ModelingTrust/README.adoc b/PlantUML-ModelingTrust/README.adoc new file mode 100644 index 0000000..ed40f79 --- /dev/null +++ b/PlantUML-ModelingTrust/README.adoc @@ -0,0 +1,33 @@ += Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate +0.0.1 + +== Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate + +* »Ontological Analysis and Redesign of Risk Modeling in ArchiMate« +** by Prince Sales, Tiago & Almeida, João & Santini, Sebastiano & Baião, Fernanda & Guizzardi, Giancarlo. +*** https://www.researchgate.net/publication/326835902_Ontological_Analysis_and_Redesign_of_Risk_Modeling_in_ArchiMate +* »Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate« +** by Glenda Amaral, Tiago Prince Sales, Giancarlo Guizzardi, João Paulo A. Almeida, and Daniele Porello +*** https://www.researchgate.net/publication/344319377_Modeling_Trust_in_Enterprise_Architecture_A_Pattern_Language_for_ArchiMate + +I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures. + +As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts« + +I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees. + + + + +== Archimate Diagrams + +[cols="~a,5%,~a",options="header",width="100%",frame=none,grid=none] +|=== +| Example from Paper | | Applied to the NetBSD download + +| image::6-3a.svg[] | | image::6-3c.svg[] +| image::8-7a-Trust-Composition.svg[] | | image::8-7-GnuPG-Trust-Composition.svg[] +| image::RSO9-10-RiskSecurityOverlay.svg[] | | image::RSO9-10-GnuPG-RiskSecurityOverlay.svg[] +| image::9-9-RiskAssessmentPattern.svg[] | | image::9-9-GnuPG-RiskAssessmentPattern.svg[] +|=== + diff --git a/PlantUML-ModelingTrust/README.html b/PlantUML-ModelingTrust/README.html new file mode 100644 index 0000000..b04ae20 --- /dev/null +++ b/PlantUML-ModelingTrust/README.html @@ -0,0 +1,578 @@ + + + + + + + + +Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate + + + + + +
+
+

Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate

+
+
+ +
+
+

I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures.

+
+
+

As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts«

+
+
+

I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees.

+
+
+
+
+

Archimate Diagrams

+
+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Example from PaperApplied to the NetBSD download
+
+6 3a +
+
+
+6 3c +
+
+
+8 7a Trust Composition +
+
+
+8 7 GnuPG Trust Composition +
+
+
+RSO9 10 RiskSecurityOverlay +
+
+
+RSO9 10 GnuPG RiskSecurityOverlay +
+
+
+9 9 RiskAssessmentPattern +
+
+
+9 9 GnuPG RiskAssessmentPattern +
+
+
+
+
+ + + \ No newline at end of file diff --git a/PlantUML-ModelingTrust/RSO9-10-RiskSecurityOverlay.puml b/PlantUML-ModelingTrust/RSO9-10-RiskSecurityOverlay.puml new file mode 100644 index 0000000..9800e0c --- /dev/null +++ b/PlantUML-ModelingTrust/RSO9-10-RiskSecurityOverlay.puml @@ -0,0 +1,94 @@ +@startuml +!include +left to right direction +skinparam linetype polyline + + +Title RSO Page 9: Fig. 20: Risk and Security Overlay + +' grouping +Grouping(riskex, "Risk Experience"){ + +Motivation_Assessment(hazard_ass, "Hazard Assessment") + +' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''' +' STRATEGY +' together{ +Strategy_Resource(threat_enabler, "Threat Enabler") +Strategy_Resource(asset, "Asset at Risk") +Strategy_Capability(vuln, "Vulnerability\nCapability") +' } + +' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''' +' business +' together{ +Business_Actor(threat_agent, "ThreatAgent\nBusiness Actor") +Business_Event(threat_event, "Business Threat Event") +Business_Event(loss_event, "Business Loss Event") +' } +Business_Service(control, "Implemented Control Measure") + +' grouping +} + +' ''''''''''''''''''''''''''''''''''''''''''''''''''''''''' +' Motivation +together{ +Motivation_Goal(global_goal, "Goal") +Motivation_Assessment(risk_assessment, "Risk Assessment") +Motivation_Goal(goal, "<>\nGoal") +Motivation_Driver(risk_driver, "»Risk«\nDriver") +Motivation_Stakeholder(risk_assessor, "Risk\nAssessor") +Motivation_Stakeholder(risk_subj, "Risk\nSubject") +Motivation_Requirement(sec_req, "Security\nRequirement") +Motivation_Requirement(control_req, "ControlMeasure\nRequirement") +Motivation_Principle(sec_princ, "Security_Principle") +} + + +' Beziehungen +Rel_Association(hazard_ass, threat_event) +Rel_Association(vuln, threat_event) +Rel_Association(vuln, threat_enabler) +Rel_Association(vuln, loss_event) +Rel_Association(vuln, asset) + +Rel_Association(control, threat_enabler) +Rel_Association(control, asset) + +Rel_Association(threat_event, threat_enabler) +Rel_Association(loss_event, asset) + + +Rel_Association(riskex, risk_driver) + + +Rel_Association(risk_subj,global_goal) +Rel_Association(risk_assessment,risk_driver) +Rel_Association(risk_assessment,risk_assessor) +Rel_Association(risk_assessment,goal) + ' Rel_Association(, ) + +Rel_Realization(sec_req,goal,Realise) +Rel_Realization(sec_princ,goal,Realise) +Rel_Realization(control_req,sec_princ,Realise) + +' Rel_Realization(control,sec_princ,Realise) + +Rel_Realization(control,control_req,Realise) + +Rel_Flow(loss_event,global_goal,Flow) + +Rel_Assignment(threat_agent,threat_event,Assign) + + + + +Strategy_Resource(root, "<>\nRoot Public Key") +Strategy_Resource(system, "Application") +Rel_Association(root, system) + + + +@enduml + diff --git a/PlantUML-ModelingTrust/RSO9-10-RiskSecurityOverlay.svg b/PlantUML-ModelingTrust/RSO9-10-RiskSecurityOverlay.svg new file mode 100644 index 0000000..72398f4 --- /dev/null +++ b/PlantUML-ModelingTrust/RSO9-10-RiskSecurityOverlay.svg @@ -0,0 +1 @@ +RSO Page 9: Fig. 20: Risk and Security OverlayRSO Page 9: Fig. 20: Risk and Security OverlayRisk ExperienceHazard AssessmentThreat EnablerAsset at RiskVulnerabilityCapabilityThreatAgentBusiness ActorBusiness Threat EventBusiness Loss EventImplemented Control MeasureGoalRisk Assessment«ControlObjective»Goal»Risk«DriverRiskAssessorRiskSubjectSecurityRequirementControlMeasureRequirementSecurity_Principle«Trust Anchor»Root Public KeyApplication              RealiseRealiseRealiseRealiseFlowAssign  \ No newline at end of file diff --git a/PlantUML-ModelingTrust/index.adoc b/PlantUML-ModelingTrust/index.adoc new file mode 100644 index 0000000..ed40f79 --- /dev/null +++ b/PlantUML-ModelingTrust/index.adoc @@ -0,0 +1,33 @@ += Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate +0.0.1 + +== Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate + +* »Ontological Analysis and Redesign of Risk Modeling in ArchiMate« +** by Prince Sales, Tiago & Almeida, João & Santini, Sebastiano & Baião, Fernanda & Guizzardi, Giancarlo. +*** https://www.researchgate.net/publication/326835902_Ontological_Analysis_and_Redesign_of_Risk_Modeling_in_ArchiMate +* »Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate« +** by Glenda Amaral, Tiago Prince Sales, Giancarlo Guizzardi, João Paulo A. Almeida, and Daniele Porello +*** https://www.researchgate.net/publication/344319377_Modeling_Trust_in_Enterprise_Architecture_A_Pattern_Language_for_ArchiMate + +I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures. + +As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts« + +I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees. + + + + +== Archimate Diagrams + +[cols="~a,5%,~a",options="header",width="100%",frame=none,grid=none] +|=== +| Example from Paper | | Applied to the NetBSD download + +| image::6-3a.svg[] | | image::6-3c.svg[] +| image::8-7a-Trust-Composition.svg[] | | image::8-7-GnuPG-Trust-Composition.svg[] +| image::RSO9-10-RiskSecurityOverlay.svg[] | | image::RSO9-10-GnuPG-RiskSecurityOverlay.svg[] +| image::9-9-RiskAssessmentPattern.svg[] | | image::9-9-GnuPG-RiskAssessmentPattern.svg[] +|=== + diff --git a/PlantUML-ModelingTrust/index.html b/PlantUML-ModelingTrust/index.html new file mode 100644 index 0000000..e2906d4 --- /dev/null +++ b/PlantUML-ModelingTrust/index.html @@ -0,0 +1,578 @@ + + + + + + + + +Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate + + + + + +
+
+

Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate

+
+
+ +
+
+

I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures.

+
+
+

As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts«

+
+
+

I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees.

+
+
+
+
+

Archimate Diagrams

+
+ +++++ + + + + + + + + + + + + + + + + + + + + + + + + + + + + + +
Example from PaperApplied to the NetBSD download
+
+6 3a +
+
+
+6 3c +
+
+
+8 7a Trust Composition +
+
+
+8 7 GnuPG Trust Composition +
+
+
+RSO9 10 RiskSecurityOverlay +
+
+
+RSO9 10 GnuPG RiskSecurityOverlay +
+
+
+9 9 RiskAssessmentPattern +
+
+
+9 9 GnuPG RiskAssessmentPattern +
+
+
+
+
+ + + \ No newline at end of file diff --git a/PlantUML-ModelingTrust/pumlit.sh b/PlantUML-ModelingTrust/pumlit.sh new file mode 100755 index 0000000..8d556bf --- /dev/null +++ b/PlantUML-ModelingTrust/pumlit.sh @@ -0,0 +1,2 @@ +plantuml -svg *.puml +asciidoctor index.adoc -- cgit v1.2.3