1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
|
@startuml
!include <archimate/Archimate>
left to right direction
skinparam linetype polyline
Title RSO Page 9: Fig. 20: Risk and Security Overlay
' grouping
Grouping(riskex, "Risk Experience"){
Motivation_Assessment(hazard_ass, "Hazard Assessment")
' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' STRATEGY
' together{
Strategy_Resource(threat_enabler, "Threat Enabler")
Strategy_Resource(asset, "Asset at Risk")
Strategy_Capability(vuln, "Vulnerability\nCapability")
' }
' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' business
' together{
Business_Actor(threat_agent, "ThreatAgent\nBusiness Actor")
Business_Event(threat_event, "Business Threat Event")
Business_Event(loss_event, "Business Loss Event")
' }
Business_Service(control, "Implemented Control Measure")
' grouping
}
' '''''''''''''''''''''''''''''''''''''''''''''''''''''''''
' Motivation
together{
Motivation_Goal(global_goal, "Goal")
Motivation_Assessment(risk_assessment, "Risk Assessment")
Motivation_Goal(goal, "<<ControlObjective>>\nGoal")
Motivation_Driver(risk_driver, "»Risk«\nDriver")
Motivation_Stakeholder(risk_assessor, "Risk\nAssessor")
Motivation_Stakeholder(risk_subj, "Risk\nSubject")
Motivation_Requirement(sec_req, "Security\nRequirement")
Motivation_Requirement(control_req, "ControlMeasure\nRequirement")
Motivation_Principle(sec_princ, "Security_Principle")
}
' Beziehungen
Rel_Association(hazard_ass, threat_event)
Rel_Association(vuln, threat_event)
Rel_Association(vuln, threat_enabler)
Rel_Association(vuln, loss_event)
Rel_Association(vuln, asset)
Rel_Association(control, threat_enabler)
Rel_Association(control, asset)
Rel_Association(threat_event, threat_enabler)
Rel_Association(loss_event, asset)
Rel_Association(riskex, risk_driver)
Rel_Association(risk_subj,global_goal)
Rel_Association(risk_assessment,risk_driver)
Rel_Association(risk_assessment,risk_assessor)
Rel_Association(risk_assessment,goal)
' Rel_Association(, )
Rel_Realization(sec_req,goal,Realise)
Rel_Realization(sec_princ,goal,Realise)
Rel_Realization(control_req,sec_princ,Realise)
' Rel_Realization(control,sec_princ,Realise)
Rel_Realization(control,control_req,Realise)
Rel_Flow(loss_event,global_goal,Flow)
Rel_Assignment(threat_agent,threat_event,Assign)
@enduml
|
