@startuml
!include <archimate/Archimate>
left to right direction
skinparam linetype polyline


Title  SLSA4 - Risk and Security Overlay 

' grouping
Grouping(riskex, "Risk Experience"){

Motivation_Assessment(hazard_ass, "Hazard Assessment")

' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' STRATEGY
' together{
Strategy_Resource(threat_enabler, "Threat Enabler\nGnuPG Signature Secret Key")
Strategy_Resource(asset, "Asset at Risk\nISO-Image gets manipulated")
Strategy_Capability(vuln, "Vulnerability Capability\n")
' }

' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' business
' together{
Business_Actor(threat_agent, "Threat Agent\nBlackHat manipulates ISO-Image")
Business_Event(threat_event, "Business Threat Event\nManipulated ISO-Image gets installed")
Business_Event(loss_event, "Business Loss Event\nNetBSD-Server has to be shutdown")
' }
Business_Service(control, "Implemented Control Measure\n")

' grouping
}

' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Motivation
together{
Motivation_Goal(global_goal, "Gloabl Goal:Run NetBSD-Server that is free from manipulation")
Motivation_Assessment(risk_assessment, "Risk Assessment\nISO-Image might be manipulated")
Motivation_Goal(goal, "<<ControlObjective>>\nGoal")
Motivation_Driver(risk_driver, "Risk Driver\nInstall Non-Manipulated ISO-Image") 
Motivation_Stakeholder(risk_assessor, "Risk Assessor\nInstall-Admin verifying Signature")
Motivation_Stakeholder(risk_subj, "Risk Subject\nService Owner running NetBSD")
Motivation_Requirement(sec_req, "sec. requirement\nIntegrity of ISO-Image")
Motivation_Requirement(control_req, "control requirement\nInstall Non-Manipulated ISO-Image")
Motivation_Principle(sec_princ, "Security_Principle\n")
}


' Beziehungen
Rel_Association(hazard_ass, threat_event)
Rel_Association(vuln, threat_event)
Rel_Association(vuln, threat_enabler)
Rel_Association(vuln, loss_event)
Rel_Association(vuln, asset)

Rel_Association(control, threat_enabler)
Rel_Association(control, asset)

Rel_Association(threat_event, threat_enabler)
Rel_Association(loss_event, asset)


Rel_Association(riskex, risk_driver)


Rel_Association(risk_subj,global_goal)
Rel_Association(risk_assessment,risk_driver)
Rel_Association(risk_assessment,risk_assessor)
Rel_Association(risk_assessment,goal)
 ' Rel_Association(, )

Rel_Realization(sec_req,goal,Realise)
Rel_Realization(sec_princ,goal,Realise)
Rel_Realization(control_req,sec_princ,Realise)

' Rel_Realization(control,sec_princ,Realise)

Rel_Realization(control,control_req,Realise)

Rel_Flow(loss_event,global_goal,Flow)

Rel_Assignment(threat_agent,threat_event,Assign)



@enduml