1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
|
= Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate
0.0.1
== Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate
* »Ontological Analysis and Redesign of Risk Modeling in ArchiMate«
** by Prince Sales, Tiago & Almeida, João & Santini, Sebastiano & Baião, Fernanda & Guizzardi, Giancarlo.
*** https://www.researchgate.net/publication/326835902_Ontological_Analysis_and_Redesign_of_Risk_Modeling_in_ArchiMate
* »Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate«
** by Glenda Amaral, Tiago Prince Sales, Giancarlo Guizzardi, João Paulo A. Almeida, and Daniele Porello
*** https://www.researchgate.net/publication/344319377_Modeling_Trust_in_Enterprise_Architecture_A_Pattern_Language_for_ArchiMate
I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures.
As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts«
I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees.
= Applied Examples: GnuPG Key Signing
The sub directory `GnuPG-WoT-Download` contains applied examples of the trust modeling. It is work in progress, but already contains some diagrams.
My goal is to model a reproducible builds distribution process with a zero trust architecture. And threat model it in PASTA as well as STRIDE.
== Archimate Diagrams
[cols="~a,5%,~a",options="header",width="100%",frame=none,grid=none]
|===
| Example from Paper | | Applied to the NetBSD download
| image::6-3a.png[] | | image::6-3c.png[]
| image::8-7a-Trust-Composition.png[] | | image::8-7-GnuPG-Trust-Composition.png[]
| image::RSO9-10-RiskSecurityOverlay.png[] | | image::RSO9-10-GnuPG-RiskSecurityOverlay.png[]
| image::9-9-RiskAssessmentPattern.png[] | | image::9-9-GnuPG-RiskAssessmentPattern.png[]
| | | image::9-9-GnuPG-RiskAssessmentPattern2.png[]
| | | image::9-9-GnuPG-RiskAssessmentPattern3.png[]
|===
|
