1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
@startuml
!include <archimate/Archimate>
left to right direction
skinparam linetype polyline
Title SLSA4 - Risk and Security Overlay
' grouping
Grouping(riskex, "Risk Experience"){
Motivation_Assessment(hazard_ass, "Hazard Assessment")
' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' STRATEGY
' together{
Strategy_Resource(threat_enabler, "Threat Enabler\nGnuPG Signature Secret Key")
Strategy_Resource(asset, "Asset at Risk\nISO-Image gets manipulated")
Strategy_Capability(vuln, "Vulnerability Capability\n")
' }
' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' business
' together{
Business_Actor(threat_agent, "Threat Agent\nBlackHat manipulates ISO-Image")
Business_Event(threat_event, "Business Threat Event\nManipulated ISO-Image gets installed")
Business_Event(loss_event, "Business Loss Event\nNetBSD-Server has to be shutdown")
' }
Business_Service(control, "Implemented Control Measure\n")
' grouping
}
' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Motivation
together{
Motivation_Goal(global_goal, "Gloabl Goal:Run NetBSD-Server that is free from manipulation")
Motivation_Assessment(risk_assessment, "Risk Assessment\nISO-Image might be manipulated")
Motivation_Goal(goal, "<<ControlObjective>>\nGoal")
Motivation_Driver(risk_driver, "Risk Driver\nInstall Non-Manipulated ISO-Image")
Motivation_Stakeholder(risk_assessor, "Risk Assessor\nInstall-Admin verifying Signature")
Motivation_Stakeholder(risk_subj, "Risk Subject\nService Owner running NetBSD")
Motivation_Requirement(sec_req, "sec. requirement\nIntegrity of ISO-Image")
Motivation_Requirement(control_req, "control requirement\nInstall Non-Manipulated ISO-Image")
Motivation_Principle(sec_princ, "Security_Principle\n")
}
' Beziehungen
Rel_Association(hazard_ass, threat_event)
Rel_Association(vuln, threat_event)
Rel_Association(vuln, threat_enabler)
Rel_Association(vuln, loss_event)
Rel_Association(vuln, asset)
Rel_Association(control, threat_enabler)
Rel_Association(control, asset)
Rel_Association(threat_event, threat_enabler)
Rel_Association(loss_event, asset)
Rel_Association(riskex, risk_driver)
Rel_Association(risk_subj,global_goal)
Rel_Association(risk_assessment,risk_driver)
Rel_Association(risk_assessment,risk_assessor)
Rel_Association(risk_assessment,goal)
' Rel_Association(, )
Rel_Realization(sec_req,goal,Realise)
Rel_Realization(sec_princ,goal,Realise)
Rel_Realization(control_req,sec_princ,Realise)
' Rel_Realization(control,sec_princ,Realise)
Rel_Realization(control,control_req,Realise)
Rel_Flow(loss_event,global_goal,Flow)
Rel_Assignment(threat_agent,threat_event,Assign)
@enduml
|
