1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
|
= Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate
0.0.1
== Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate
* »Ontological Analysis and Redesign of Risk Modeling in ArchiMate«
** by Prince Sales, Tiago & Almeida, João & Santini, Sebastiano & Baião, Fernanda & Guizzardi, Giancarlo.
*** https://www.researchgate.net/publication/326835902_Ontological_Analysis_and_Redesign_of_Risk_Modeling_in_ArchiMate
* »Modeling Trust in Enterprise Architecture: A Pattern Language for ArchiMate«
** by Glenda Amaral, Tiago Prince Sales, Giancarlo Guizzardi, João Paulo A. Almeida, and Daniele Porello
*** https://www.researchgate.net/publication/344319377_Modeling_Trust_in_Enterprise_Architecture_A_Pattern_Language_for_ArchiMate
I use the patterns develop in this paper to model trust relationships (trust boarders, trust anchors) in Zero Trust Architectures.
As an example, I model the process of Downloading an NetBSD ISO Install Image, which has been signed by the NetBSD security officer with a detached GnuPG signature. This is SLSA Level 1 according to the »Supply-chain Levels for Software Artifacts«
I will extend the process from SLSA Level 1 to SLSA Level 4, which will include Reproducible Builds and an immutable linked list of hashes in concatenated Merkle trees.
== Archimate Diagrams
[cols="~a,5%,~a",options="header",width="100%",frame=none,grid=none]
|===
| Example from Paper | | Applied to the NetBSD download
| image::6-3a.svg[] | | image::6-3c.svg[]
| image::8-7a-Trust-Composition.svg[] | | image::8-7-GnuPG-Trust-Composition.svg[]
| image::RSO9-10-RiskSecurityOverlay.svg[] | | image::RSO9-10-GnuPG-RiskSecurityOverlay.svg[]
| image::9-9-RiskAssessmentPattern.svg[] | | image::9-9-GnuPG-RiskAssessmentPattern.svg[]
|===
|
