From 23d6128a78e3c598596a571db922a03965d1e70a Mon Sep 17 00:00:00 2001 From: pritchyspritch Date: Tue, 21 May 2024 16:37:50 +0100 Subject: [PATCH] Give data assets via ssphp yaml --- Dockerfile | 3 +- dfe_threagile.py | 73 ++++++++++-- output/report.pdf | Bin 1100671 -> 1100662 bytes output/risks.json | 2 +- output/risks.xlsx | Bin 12077 -> 12077 bytes output/tags.xlsx | Bin 9342 -> 9342 bytes requirements.txt | 3 +- yaml-templates/dfe-threagile-final.yaml | 146 ++++++++++++------------ yaml-templates/ssphp_test.yaml | 20 ++++ 9 files changed, 164 insertions(+), 83 deletions(-) create mode 100644 yaml-templates/ssphp_test.yaml diff --git a/Dockerfile b/Dockerfile index 2f715d0..d1f992a 100644 --- a/Dockerfile +++ b/Dockerfile @@ -6,6 +6,7 @@ WORKDIR /app RUN mkdir /app/yaml-templates && chown 1000:1000 /app/yaml-templates +COPY --chown=1000:1000 requirements.txt /app/ COPY --chown=1000:1000 build_data_assets.py /app/ COPY --chown=1000:1000 build_tech_assets.py /app/ COPY --chown=1000:1000 dfe_threagile.py /app/ @@ -22,6 +23,6 @@ RUN python3 -m ensurepip RUN pip3 install --no-cache --upgrade pip setuptools -RUN pip3 install jinja2 +RUN pip3 install -r requirements.txt USER 1000:1000 diff --git a/dfe_threagile.py b/dfe_threagile.py index ffdde78..96ee57e 100644 --- a/dfe_threagile.py +++ b/dfe_threagile.py @@ -2,6 +2,7 @@ import argparse import os import sys +import yaml from jinja2 import Template @@ -122,6 +123,52 @@ def produce_assets() -> list: return yaml_list, all_tech_tags +def data_assets_ssphp_yaml(file: str) -> list: + dicts = [] + with open(file, "r") as yaml_file: + file_contents = yaml_file.read() + data_assets_yaml = yaml.load(file_contents, Loader=yaml.Loader) + + if "teacher_pii" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["teacher_pii"]: + print(data_assets_yaml["data_types"]["teacher_pii"]) + dicts.append(dict(name="teacher-pii", present=data_assets_yaml["data_types"]["teacher_pii"])) + + if "student_pii" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["student_pii"]: + dicts.append(dict(name="student-pii", present=data_assets_yaml["data_types"]["student_pii"])) + + if "client_app_code" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["client_app_code"]: + dicts.append(dict(name="client-application-code", present=data_assets_yaml["data_types"]["client_app_code"])) + + if "server_app_code" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["server_app_code"]: + dicts.append(dict(name="server-application-code", present=data_assets_yaml["data_types"]["server_app_code"])) + + if "vulnerable_children_data" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["vulnerable_children_data"]: + dicts.append(dict(name="vulnerable-children-data", present=data_assets_yaml["data_types"]["vulnerable_children_data"])) + + if "job_information" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["job_information"]: + dicts.append(dict(name="job-information", present=data_assets_yaml["data_types"]["job_information"])) + + if "school_data" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["school_data"]: + dicts.append(dict(name="school-data", present=data_assets_yaml["data_types"]["school_data"])) + + if "payment_details" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["payment_details"]: + dicts.append(dict(name="payment-details", present=data_assets_yaml["data_types"]["payment_details"])) + + if "secrets_and_keys" in data_assets_yaml["data_types"]: + if data_assets_yaml["data_types"]["secrets_and_keys"]: + dicts.append(dict(name="secrets-and-api-keys", present=data_assets_yaml["data_types"]["secrets_and_keys"])) + + return dicts + + def data_assets() -> list: answers = ["y", "n"] dicts = [] @@ -253,7 +300,7 @@ def template_inject( ) -> str: with open("yaml-templates/threagile-example-model-template.yaml") as template_file: template_str = template_file.read() - tech_asset_template = Template(template_str, autoescape=True) + tech_asset_template = Template(template_str, autoescape=autoescape) final_yaml = tech_asset_template.render( yaml_list=yaml_list, data_list=data_list, all_tags=all_tags, risks=risks @@ -327,10 +374,13 @@ def produce_data_assets(chosen_data_asset_dicts: list) -> list: return built_data_assets, all_data_tags -def produce_asset_lists() -> tuple: +def produce_asset_lists(ssphp_yaml=None) -> tuple: yaml_list, all_tech_tags = produce_assets() - chosen_data_assets_dicts = data_assets() + if ssphp_yaml is not None: + chosen_data_assets_dicts = data_assets_ssphp_yaml(ssphp_yaml) + else: + chosen_data_assets_dicts = data_assets() data_list, all_data_tags = produce_data_assets(chosen_data_assets_dicts) @@ -355,7 +405,13 @@ def produce_asset_lists() -> tuple: "--risks-json", nargs="?", default="output/risks.json", - help="The file path for you risks json file.", + help="The file path for your risks json file.", + ) + parser.add_argument( + "--ssphp-yaml", + nargs="?", + default="yaml-templates/ssphp_test.yaml", + help="The file path for the Continuous Assurance yaml file.", ) args = parser.parse_args() @@ -367,10 +423,13 @@ def produce_asset_lists() -> tuple: else: # Writes initial threat model and produces risks.json + if args.ssphp_yaml: + ssphp_yaml = args.ssphp_yaml + yaml_list, data_list, all_tags = produce_asset_lists(ssphp_yaml) + else: + yaml_list, data_list, all_tags = produce_asset_lists() - yaml_list, data_list, all_tags = produce_asset_lists() - - final_yaml = template_inject(yaml_list, data_list, all_tags) + final_yaml = template_inject(yaml_list, data_list, all_tags, autoescape=False) print(final_yaml) diff --git a/output/report.pdf b/output/report.pdf index c3fdea673f455916572ca86352ff370d70ace28d..b0f484c3181441bb827eb4cc9b734d7a75d251b3 100644 GIT binary patch delta 16344 zcmai4cU)8F*Ox>gH}__!fGi>4Km_Ej}jeGpGbub>Qb)(i< ztRuy}>Rz>Vqk^NhYMpgdrM&04A&}hk^LhCPIC)R{El`S@N><~I4XBe`H*MDB@R0nMXl zsM=0{GpN~&d83%%#1_kv0uz3kaiX^By&-iPeM(tiXj`kgWrk<{wlk{Ntocp7(j5Pg zJ|z$DKSfV>oqPDP=lor2?tH_XKj-Gfl~_6_e<;e?mG)EP+{A$JcgdlPQhiSbh~}RI zJiiTHS&h}V_+uj9v7}vay;&FcrPMcTpKtv;WyQKJb+-JH_fPd>gi5&e?@-;6;s>$c zPX64@jFzsgV1Ao`6IkEW>UD=Z( z>kAHro*v$|yl~jX^#|e__U)B<<5t|Pk&RAg5<|i>{O-gq`tn`jZ1&Qm4*|6v?w)L! zzx;NW9f9lq?RRzZtW;y;?)i&eHm~z7ae{vt>K&X zB{4U1N+&KHKJDfuuM>aOJu~`c5j*?hO}=+t)ZgQ#O)VM_nmsFf?u{&uJ;TJgvrL8G zHumlAR(?CZXT8A#xrd*UPmG?_0&OgvP_}eq;HEm3b6ZB{4voIs_uBStfrs)Q9crKd zbiOz&V`Y5fzFWE-zOg;9cVyAXxK??ecE5G&lX-Ff?lYsd{`Kb3pRcZ-HSN3HYsL8N zHWNR0&l}Kx_GRyT`{!q0-PSa_^&yhGeBn~lqE}Jgt&CfjTN@e&7~_}BJHGd;>tE$< z*U+t_e>xq*_4`lpW(q-$R z4FivPxc%_uq@D9(_8%x+__p5TtdbWq`#l=BGP3;JVV)a}Tc7Pf_n!Y`&ANK@+`#1{ zE)8A09_{+K{HSoDQ~UkhAGJ+8ai^9~?l0S)9$L2Y$OXM7Bqt`bPw3nq^Zko0VPw~@ z(yr`{O6k$@@r)I{o?k1S^kmJot_$9NN{>9XVExEP?XK4xIg8Gob$#XgjNw1c{ypIM z@*Phb|MgwVT`fNrm&Im!DNj`!xwXcF&ry3)@)!R4=*QyXHy8FlI{fRi@x#xIG^`u> zF=zks?lbRg`L2EO%Uh$bAOGLGPpPOl{Kn=xNFjaP=0^uFM`Hnzo=i{4bULZ#h5z*kVhY=;xn5xwX8RoWG;N%2Y-5sSn>@dojgx_PtJx zCY#sRA5z$~DCOwux{oI0|GIlXjVlEmwlr>cqT}*Y%T9jRwcot&x_D*~5h1z9w#?aj z)j~ALO&)J)Mr`mjg{DnEmUX1R&ht>U+3yq5m1)y!o^7O5d-|+h$gY`{+%CP#;@p$w zdD{FJ&0KYIJ*_zS9uaq_H1p`mpyy?YjZU`FUyy<2*1{ObIe{JaLI9yZ+azh#da z4DQmh{rO=_3LDLwSF2s{!#@VpVCrp~7W?|>u`M%xO|o1WS^DdamSmQ{XP<2)ziWGZ zop@+T+ZG+}sd$q&z zs#?y{79+HpnqLn%`Nc6yt&=H#M=$xEnZL_pNx!n$10EOj_`xT$$I{ptz6TbW)($<9 z;Ler_6N>99b{-rd_CCrL*8xoYnxVE;uc*QG3DL;`SZT4)n(byW~(gq zyn7|LUN$;^Q5@c89kEko9I^X!n@EO&Ir2S0xQAk}kd@A)BH&*l#7xAX6*{Z{R{ z_6?Q4Gxy;?i@%wF^x7uxnu>+Ol!h%QeS96h_!~=Czv;d=av0OXkJayr*KeogpBosY z-#k;9GrHN8fU_qSU6`?S;f%!ZEz8qxj@X~J&9E-a682z1;F@dh(V6O?jpA0SFW$W_Q;im4_}ej zg42mJuZ#LT-IZ2ix#gDC=b*KOr~Xmy*!Xak=cbmOmeN;>=e3IV963b)?uyZ{vc|~B zXfpYqkU0ac7MoVxE2^O_k12mJ?)!`do!iblwr89nFE8(huw!o@c}*|>ySH25wPW>k zua~v>v-6<7Gl!2#jy~0@G?TnGy8Gy^(_g(lO}+kN%GtCq$R?u;9~ zHtqkV&9%$^yT32~Nd0uQwYH$a+Mi3N`8@KzH)``X{{uxRKltnF7mp`(8XJ6m=;u2( zZcQ3_YVl6R_Bku&9A9)fXI5_F`?gnKq@Lc8)O`Dtw*|M(*Sotu(dSOUpVuy(OZxst z4=#4ETX@@mvA2u#KQ?%S}y-z8C3JA~G4%WY`=)rm!I$QVQ9t;Zo3 zX1@My!f(slKJjXooLhgv+*+1?Q}!J?;McW|YVpp6Eq*EfqxaQY*^@gn=*s_k+`hAO z^s0SL7q#);_(!en^pEdbude=WL{r_MM%lCb7hdlXomszk%IbCvZuNZ>{=zTU-EZje ztV7c`&3SzCjAc3L;VxX+S6aAi(TCtdzJag*y4A^d?@qsbcJyXL{d>*At*7qxZd2n{ z!lj?{vqpWeKEC#R&*o?TV)-adr>rhFg{}hwF5kbOa7%G;Zu0mI_ve4wG0t!A_#yYI zMJJwIpY(`}u2tS(V!MeS8jAfpj=jEW!dHv*W6wX>{bl#Kyq#GS5-qit&RP56#L8|f zLdj^~?S28Rzbc%gp42TbZsFmU85?q}SMD4=ovm%TzMy2);fUy@pKe^6xpjTZpX&y_ z$u7PA&*jZKE$P)y`u$lX^j@Rxna(brn|cishhw~ z96vSS^Xs|Uah?1cm;UpsF8c1e*G;M9-B%~^3%s*-YF^Fgwx{&kw|5LLFYbzA2R`D~e7Y#)9reyC`cfBm`q-f*>t00@o%gwGMg=SO z6c@*-r{yioogVV`Vr2HgLM8E{+o`;?0FTbRq4)f=;qAId?(x-svvl+vx70gFdu(~a zq^w%ZUS73hie+t=KfEp5y^qiAKV{4A-k<*|O?$d)ZJYFot?FOzKV;{@mNC-_m8EavGnGetfGW_LG6$BDKA#*uf&hAZk>y?!3|*Iy>xaaxIT9{TtL? z{7=HvPBzj83Zu$MvkAQS(sYk7CGZw+Vqu>PJj_F}bVzv>MeWU#olU zYTALPeP+Emlyz`yPVbeolP)GUDL=8QypPBF6Q9g=h7_pcxY#uTvtA5aU3mTE(d`d^ zJwEJpNxwCl%bVq%Z=(26vVTqgA%!0mJ;OhYe_dV;a|qvSpKnMU!Y5223_(xL%8l05 zpOoZgq%2b~=ypN%bxOu8%$>HOx^>!y8eNy8BD0c3w+gD)w}vIS=eeU(AL0L(t=#cA z^W41F?$*549;?F9_XX7@d422rF&=knp{q^ZX)CN>d;}e8<<8=*Hdtfkdi-WV#xWi= zN?NQaP_i^^*vN@7>-B% zJygEvbTOfIqfyNul{r}C4YVQI&{v%?a!}TQVQMu?iy*;&GDgls8_+!ul^5FTtI{F8 zL8V6#iFzN@u?OXeI;RlL+!+&|j}lBePX%v6iR<)1=xKqTK#{Se;Kt^RY8Z@0`4A~6 zA(9eN0!yh-K`9vqhY`@_QqrvCI2LIYS{lW>YduiOIYLl#0zN{rAwC}ca+Zj)E^0!B zD12CksW_Ox8Y)lAuxPYDDWKrKsyem<_ED2HQK6TLhNZc@1j-N5`=|&7LnEe@&JUm3 z%d6+mLD^pz7}jKnYLhW^$QRiLhNG>%x#TtX5SHQW`*4mMVMSrJ#Kxkc)s#PKm_)^( z4o?UI39WRV$nb=SKs%IL0_FFh^vK~9j0x!iwEkEP8Z zAw|^JL#49KN4wHg^>bGA2|$HvvLTw+lM1nxU>a%%o=!2V-Fog=A6|8E#so8KpYb|YEN zt|TM6*@p<%Iq8aLrEO7KDiMt?7myxkO)B9jfrElK+CDqhj}Y+zD~xq`ICyZcK@^Q{ zGZc|miwZ|;?vWJ%fCCG~1rQCdQ{SyRH8InZRwzl+EX_aog{URgK?`Mf{ z^umV-RRI)87e=E?$#8r(4|KJZ8$?>y01L4jM_>~As~(DO4yb2Q@;QA=TD zq=PGrtmHZ1R5mDaz&9gjb3sy#XC4(|DqnBM2(L zOhckoeN{Z#5kLeejC?*rd3v+Ps^G2g3SM+_E1@cE72r>aEY(nQ6A0{}B&xZ>B;a88 zMVV0$$)86MDSZ&LngVSL0uJ#2B?I1HdP&{H=4NaBw2U+sjSr%N(Vz&@Uttu`T3^6( z376sUDzw^98ar1A>TdLdl|NuopLnuhK+@JEmQv|lP9 zGSe@sz0v23FmAj*NuyDI+B#@WnZ_Oc(NgD)H6qzpFI_{yi72tJ$`7Z4+O~tmpCL#D zz7G~J)A#|n+A)M-STkQ0q$WF#bG+anmE6%A9lJybde$VR6??#$P(ojoe`VJ3vO%dm z@>B{4XesgRh$PhLND9HAZz4&5bhsF<0!ffT_h`L`#=!>w3NTJ6S=MZGf}j+lZsiTV zC5ZTs+gV}l_li2w;Uw&FKt`~qv?LFJjs1$KfFF~HxklXbA;08N_DA2k{OXz}1;80y0_80A*EgGvFTVyMciZ_XZLxvXZ zG=nn=4jEG9E09aT2;-CnL}Sj9J`HiEZIBm75oqo+LWkkY$L1lUE~!1MfDC;OAhjs9 zE;$&{YQShI4%!8&YDJ26EkRs5Zfxg$v9Xm}Fp6kNIT?lG6~JreJ%e-yex<|ICsrYv zs|Xdw{VLAGpv8>|59_-O{q(wMq(5m!i~V7K&MPtwt@^BKpyk1IRePW%YQPMPwUVN( zpy>Ssy`sS}Y8$sy=S66IkX zzm^)|reMuEZf>E7UJLkZc}A$vPnXqxHjaWu2g2DdhJ$t_>ND{Ns-+rbg~OhhA~!MH z6~%*ZR~gi7R}}ByWo9$@sVdM$1DpH;SiC0#h;lcR&I>KU$a(y;CJh<_XM``h z9!Y9cU9&SX+ZaS6>a>FN)&kp%N*psVV`R2LfN;LJ0w7}aMRjeeWBT|C!U|NzvV!D2 zZLSg3HamU9(1D2~hm6QD04KSq4n#gH$Y9jyk~+wbqwU@Z2JMhBa!B?U45qvg)4_hK z<{q3`;#=0ich%Wp+1ZgaqtFdHLSwt}Fb(@V+5n7lFQ zVkzkeupBKhO%pQoRS{ND?m-HG1&F4AhL0c!E7;%wrR0E>;saoR?q|q`yacp-KM0ZOTBC*7@tHv800KP?w&RXnlH|JVE(ZGIZd%j?37SqsU<$ zcstZGJY&LS0s^ffZ%Xu_4HSQ9aDcWRqPBF)1C=wj^5N%-G zaj;G*))=I#p(XNK1D62m(jE2guL^Qb5_x(m5^@Z04cI`=tPXLHy-C6H)}5Et$0;9< zv$G9{a)krph4n>2ky!!4P`#}lsPnO&YfM~oLqUy+QD~vBO4TT;<;a0qgNBYAVu#xcwwvr0%JQBo;qf4z=0pv=Vz4^-Zha7QJdftp?} z(=<_l>o_EP;ETh9C=PkQCIc`%lPaP3NPwa_&j6jFs-$cfY$v!C{wP#HT_b=PqYIe;}+k;y~_&7)FUU#BwUBnpntR_2DvJ3;yUe1MKa;f;wvG-QCT zH7Zmj;_sMSHpdSs-vRO;bgFqhy9b{$UrpIq=N#G=Bh{zCg;&bU1G0_{?0BiFMoltwQlWi_QUG*g zSM=kc9Imjs;E;Yfs937Vywp7a#+c~ALFR!wp}PrsUld_bk*HH&mBxX=Nvu07Q9lzf zi$h6+sAzPiFr zq;{CSRDq6wRI0FXWRO%0D~u+oqk(IxAk-3w6FOW30hk(7!Q)Y_B+#Bm0Aa#@1!)sd zUrHI!C9DW0!PbMrDHa8-hXA2FQ%7o`$j_Qus7o__U39q#(Zn5c1Dw&C*-W1hf?~@w z>V^#CfH;uoZ82jOpjl8E-B3FL$O&kaLhE6*UREE(8Z)C`mH;NVcLU0a>sWbsnv z+yJRkRs9vfO(fKOngF{?fPjM!*EvcS`fEGOHJrl40|fY5zc#1>Vzssylz!o%eYQtioLQ1@-uInT7b6eDasnDn8WL-`3^idVgE&y;(TR}n&^U$hPwy5C^s62-9 z@dGMR5o1t9L?znehzFc4jHUdwlBV!kL;=tlU1+3Bv<@p%{|qTmu)8{RkScWq?F5WF zxOE~YTbSttfx;YI2@^!VlAH73#F9E#K|(|cK6 zTN91>r1V5%f}ohityl$T%4-TeQ{0I~x-gvz-6((t1?D<)a|5*2+yLD>GD_;QNowZU zszQmYtg1M{;a&h?wtE3f!DdBCcYxfVPNF2&bw_DU2xz&MX*9Sv(xbV!KMdqC5M7HT z{BU$aQ%(eWhpUR?6q?>u2fb(r!Gm3O?a+<^I**X5!j7vfnc$B~%|aP(k4>p} zyS>R4rciQbyON=>lIX;<44qVWHb4*6&@qG7UINtnB{Y;ewwAj?JJnzvL6XlDD1z3j z(U~GD3hpYP!VHKyKr$UFhdLI;dT7;Xa}#)@z`g;^v7JHC>5-KIuM_lM*n--;{o26_ zvyGoZYrv`x)19E|nC*VgJ1|U02{!)#Zh>JHdYU$V=4UH>u%8JcWIek*d0J|ri0Fq5 zy$5>l3;njf5dOB;15*WKkenYHPd-`(5{uoK0G!Y)XlQGLL35u#{YuEM{Q1fX%*dFa zEU4Ov#i3|`{*2W72(?v>BveLHO>f6z@CaxC#-I~-q1j9{(`y`_VeIbQAo^?axX2OBbrK)Tms;)eM3B6L2Mzj(tM)a80*TnhL z9k33w9NcUGPA`G6HIt=y0)4euU;6(!t_rnMXd8QSw%RH_J}MW-tv3J!fRHueE z45*%f65K)bZxaB$K&3XElp4~u6};pX+28i42u{mu;SsE2Q;vq<9=<`}SbFMIvjBWHrh}Gm z(04!`HtGkVha2>RQQ<~?G(4pN!P=;2fd?2i>1hwP0%8ws)B}Zt59e%x4~?h@|1zOx zFs3PEBUpiRfE8DEk_r|Oc{}@IZ)bNX;&9vEMwr<{{Z%kTnMtAs-hBpDo$#R*Q$C=Z4oLRv2 zn3D{eGCU~ASq3xN*(fgF$988Vq*bXkxWaEv&QGtxjV zckb2Kw#d)UnShVUhYL~;c3wg-;a4DMnaIGSf?Os!uWX#zes4>K=HZTJ9`^~H2Ewgz z16L*!A=AiYpbPoNJSQ0C2jq=%ompsxH@Yf~7mWBN-g#pI8iR6~+2~>f-YmKp!N`a> z9XYLMWN8y;kqbFkQ7+@9Cs^mnMzf3C8BMH<+ZhEjhC=7LqV#|!$t*Uw=(unMsVSU~)Z-S&+k*5xNH0bdvt<7+{31xk+XxBOFhTUm(Mb&iQsAb2%WCS0od&I9+6N)H6bHDE9>{lY6=mJO%mWTO0VNQiBj+zz|$yxMS)#&IHMf$K$a6?US((9>Zh-al_ySq--EB_kI}18|60!nTw4;VIc3K8Xh{;u9HPMDS^47JRg9}EKfRE23;LzEr1O0UoPY!>AT2q zOGq}E=Uq1eAC%7p%yZF}krnMQU&;SW00Fof!#|ZK0Y+nz;XD9<(JVI!kQWzUfV?Kp z8zvLLjI-%1G#0wp4rDGSF##&eqr_w~{)bGYtzqLTam+Yv+F^k#XT`fUC3%jDpN%K@kct*~U;E05CWo z5X({GT8@>DLu*Wqxtrb06|{s;G^<&Go*6_wXo2rpT3{}8b+$kzjzoRo+nur)jm>))<^(M(HU ze|2;kkQwEL3CK+H!USY4sTY#53nw(w(7JW-56S*mD2GRo0TXk+v6+TMS!Fv(3s@%i z1u#1+M^Q6;9~Zs=X1BX-F3ZFIG5|3{5iL(dAd|l0;;0!jR66o*5SF0M%zc|%K*ab28FBQ0o@^>?I!vU(58Ag9U>2r_uQ-+5MF iJItAzz;NJLa-{)az!OZ^IeiB;V>YTAG-#RBO8tMOOZdkC delta 16524 zcmaKTc|a3a_jVJI%p@~7AUiHW*;JIwlFWof#eD}ia97+A>w^1EM6_C4MJsZx6>Z&> zx{Fb(f?&0-b*b7aDsEM4-EFm6%kSJt0?F`xAAeLhxp(H?bI*C6=bW4Vo!6=&uhpD= zs#h;8Jm0LDcH*Q7!&Ap-r>XWO-|T*`ZLK43d#v8J^N+?`=6=_%;`)&iU8jVwKGf-( zx4ztv7g#^%%eJ2_-JIBGPs*!2L-P(}H(uVH`1Z}}x+PcUWi$`*>KNB$6WR6XSK92Q z|MqX&dElQ94&EESwcepWf9SYu(VislwDHtqqJC(N^UF!HzNO^HdG21R&8B~HN9&!a zFU!tQmDH}ebZ%$|hUmUDl=N=hT3RwMaqPm;SgFMcW2$X`AwUEy5C^FB|z`L44~8Ij@JkdfDT*VPATAf8Kt7prwayf4ijV z1NRn={;spHg!(HrHt*DzFKzkF}L%#g{788k5!@lAEz!!SO4rk zc8)%G?!U=p4}RNRYH}O#>B~zwtsl{<=6@Bq<$U#ijecj?$D7;CIj{a+Ica!d>Zfll z%%Sh}*09yvbJHiijywHZso&|i=XWNyUwZjf*r>7X4$fHk{?lHsy(V1Q(z8#qlElSQ z$%GYoF*lay^iQ}+%qsY+|2G%EjDPgKWcm7R&fI##5-%t=&HkvCbG-c>mB} z0ll7GzN#5rXnuYvymb5iXteocO5+=kTBeP;dokqk%amS=vV2?i`}a}!rCxjgyHMw! zre|A-6)9glcvx}pWtwiiWmT_p{niKV4qn^-c}i7jF}GzWU*OUPWi4_VTJ;Q?8vE_qObY_@w+Vw#)v9!cP~^^r@&Q|6#=DjW;ca zUTuiJJJyRj{U~|LptD`eM=bPMb}E1W_HSDCIYU3ooxk-^bovedsDe!sOU^}2ZTvER za?+E6AK%lv^X~oF%{pb{6GChm5L5Ex{D(cpn=L0UN$qlN@`@?X*8Nt0_Or}2`xj*m z{lt1@?)d*U_l@dw;_-w&W1qeM{pqXc=~E6D4ilMflKAn|fOFf9?d)|vZ0xkBhn}Ri z`7nD&r)R!@{_-sLyNtssuZ-=#f0|RrmVyAmoc@hyWgnl zM_DA+C53zU8+SwU%lvt#ltU(6-mv59;jk{(PYoVn?Q%GKKykD%dD!l}_A55rJ5@9& zDYwakOI^R|Fi`E@?EcgpxBrRM7Ud_so6xeu`N5V6yXXC*IsH0nbNVU2_RH%xJQL~l zM95(mn>Wu2nb5YIPmNs*leA~FJ1lt-xk(-G+#|zsyZ^d+Rt;^DDmy;uo!Y0FdOkg? zM%&2sRAkcNdEDta-W?mx|84FD;e5hAL&dx2HP<%XiPmPOWo*5}&uV5qIBj>@pgVNj z)=OL?cKeVud%usA!k=vEe>^JM@I}YIgOfj>*Cw!aZjv^noqwl=fvLKm8q|x5>Lgi? zESsVefADB>cxSiKyXXBCAN6VWtOmhx*$?~=^nJfRI_m7tEA~w*fBNsqd#h{ztIa(g zl|@r3|D`>C4?e4zMbZDY9=b8PXmyj>3t#;6U`MkS!}h)CU90`zdEW1t-xuiKeJtM7 zrt78q-3I%|{+7Edw@KfVH=bQ_>#X(O-B4&PEDBt2Av*;Oy?CSbs*|DT>$aKkm;a*t z<$aH&?(38AiU@zv?E1V-QE9@dd*UKf6Qc3^krfxhOfM2lTc&-nb71G@fj;5W3=ap0 zw?EyRfBW_Rug#->_$+qc>pdl3#~Mn%|7wwV{F}pFjx5i;F!HOcK?k>|PM-1M$@JV2 z1$$ExTjwrcSmN&Y$`aaURrv1W$zNR>vMhIQlitZY3MTt?^SZo{_X~?#XC4sc{aKrR z125N49q+4av~I!l=@&pESOZ1D8_@&wsoVx)I-6W@{3dVKdjJ#+Z-r%_;7*|#S9ul`&7kl(vS+pniy z*}3p);_9B?Ox05p{FCo~xZeIrXi7%oQSs9cTYM z=DRLq;mEjl9a?5>3_Nu&<@;78-d{cFVNFgevJ@A(-4bSuJC^?FwWj~#Q)I)g{^kxP z?I$)E^*HH3e!{PvQnDxc9VmPh)&9X30gHN#?>95^p`Y~c^M7-0fAikhJ`DD z-uEUwG^1|jggtcXl6%iTyLxM4?7T0-Mqau7OTEmwYeF{=hZ47qeb}<;?4U+Z3nH$J z2zptUE-C-Lg*9_vX3G`vtL}V9_fELG>&E%{OT!wS3_j2%^}?~|KUu8nZ!~9n*2x_6|d&?&yCIzJ{`D7pilRB*zMEsttpYG*6I6{p?6cJPn;^jlPTb|1k7k+*C{5Wl^0khV@My_AsZJj_Z5t?_rUXJ|Dd6a&pX=(7wI% zJBF3!i`VY^LKUZ!}f3R&< z)1kLtTjqv`(yhjq=J)(2O&1f?zp*c#>zE?HkJ1 z6h*}(9{9EAk%H_tr|Q&uHR;Z^>9@D;wxqhB2zqpo@B3|G@4wS#TL({H_`T)n#}_w7 z#B@0M-Qvruqgq;u-hP~M?8p7TTyI|(nEzqHaVDZ+!;+yT{^KnB|634nxy73F-BMpB z=<0cE!_*=B?vGipe9qb*zS>>7!cwZPb*AR^PbPFLyBnKt3k{>$1G*(U>^ z&pg|*u~_Ifc0-$AuT9&qd3Tp}^+SZX)(0o{AARxH{|2t_XE`1Hb-OJef0-HhKoB04 zC%ND5otbwq!|&>H-xz90?!$Q&kGX|~f5t>5G}=6SP+shvlc;$5PHm(0Hxe4n+4(~uDNICKdlZ0h0`lu{QFo_=XugU^=34@{wRJ`pX{l>&YPC7 z?R3VIvpf7_pU?PxrWPHa=W%^?$v-7Oo!C5K@~GjBgU8O=|F^N`y7HoC+j0u`d-lEc zr{&;C-2>!=CPft@HKnH-Q%hJo)DI;OwdW z51#ZHmO7|Yx0(6wkpmWc9AL8gUVWRW9$ceAn{V46naB?~H#)H-_R53@{wGyF^uo65 zUM=drV&a$?^VSbrJ@}K9x4Twso2AW**g)*t-1zpOkv@kkeb%?B(D%-7w0(pn^Zm6y zzK`y{a*gWLm0$ages*EWw+pfp*2K?$J*0VY2j5*sdj#Yqb)R>#+=_lY{%Bm@{0rOu z7{2oU;z0pNw;u5izE=_KcXn5US*6E<>Mea~;G!1Q+|YMoFH`1{71159J(^kZ^Oo?q z;7PRqqYp!yPP@0ZpQ`2cla?{BggyeSzQ^|8KQ8^CJ96e|`vu33lr%m4x-@0w+k~QT zvvgy(}=Ng*|$gesyA-?olQF$$srZ z2ew$#E|k=jpJ=}7=*KRBpN#kM$4}*`LAN)^^9eFSQ zxnH5eI^z1-4>@RAu-eDUG*p|?Q08e(7%Cc|vAD5jlQm(WMmHM$Wp?AOmeZQ~aY%o~ zokMMxsyA6bukB$fM!GV0&I*6;-iqcD9tIQ<;y;8$(5=H2x8 z#X<>sgMQqQQCij{=}~(P(bA1K8qi`55g2CV^uxyv!yjrngJ>ToiM-j#ETLnawGzqV z$8^^Z(4v|I;fts@WD~U@SwkjMB@~Jx2`xGhPkO3Z7VVBFebp?7iY}53(Q^+ULSjsW}m4g)u=W;}WU2Zs|;_-Bc{P zQ$m_agTb+c1YcOfsf%PyG{&FMsCfxLqLmxZn{0ELtE4ZQeao!Ku~l1UO?IYz1|o<3;T-=xkObCdRp z3*cC@{h1~w_j3kx%!8_nDtDwdvPg9Rwr40NJ=}QFfD#BI2ql%0w%53EW+~5~X^5m= zq+s0@LGDzcaE1yB=3tAqK#(|m*p&y*akeAlczk3*XrdR@7=KeW-_(VkR&p~jW5zOPbv{-hjGl34_{fu>KrNo>8IFzJwm77wDo@0vcRK`=bgkN{6}<1dX1D zlQD?yOopS9LhvYTEJ@8tsJu60LR~NGNb92?b%!Z8jx*y>6}6m*Jt@bkr5^;!p&Ydq zxxLj5cjH78`t+?X1Wm6&1z79eLCY8KN3d6G2=9I`%Wpg$pR$$&m~AqcBE zi4F^grHiO(DOn$d6qCN5f+*>u+Ye7q8#zhO8&N_Y9k*PsB2dy=I!q02gM9O|9n^C~ z*R#%vAdjd~)(>QGecq8Yyis&YH$WRZKyhe8JlWWbHS#7yReTDZ>^Rg+L)1dA=a6 zbPF%R7AW=<79I>m$05r;;DP_;wj^6ygg zs4GeI#_5%YbE%vpqP-!xo3S%W)vQEcibVM4gx-z1T4l)sqPG@9v1c2x?AAQ(I zlIW+-T9)AOEXWL`+7GFRP3V3P(z}Vt;SZB!l$@rTu;(y)iB3F*ybvt`#o4*ZjWY={ zzWJLR%ZF31T&T%}!)6HD?#B?;(9h{*R1jx!ES@z0>s1W}Cd5z-s2GI`d;#TU0011; zpowYPNE-&avt z3(VMdbZXi}JQQ8LRMq_QbU&53$dmad^UXItUsbhvC{ac++NRLUw$F$eOHlte) zpEz_lgmM$$34L^e?GI5zbd;7u`Cb%Bb(oYoI(=xu*tF5Z_2}z3I>OHh$3@2hLMr?* z9jI#d8#3IDHJT7xMjL9#_-muhjG0Ub`nizQA^TJz){j=(#I3s&8ZEVXp8E)aguy2qV-ac=W!r9$z&5(a;!CvWa4FR&;YE$qPnBFK1={|&tf=K z^N~)2QZDNnqw_Stxo2PIojRD49PSZJ5>RE;IwZ7+(T+eD-s%Wz{RCnOm4|n2i1f6F zI`0XL0YvPtW)0}}3OWo2Sg6c9nCY}=c^=K8=6}O)vKTb8cw-`}{kan^`lBhoke+DI ze$X)UHh@s6N|u~UkSyQ)LMCD{h^ZV+b<_ID;xB}A=+DaKnjIj;vK;)5`qtAXxCsWc zO_QoY4H&$r5OnYuNvS~?!qG>g)%CP?gx2a4pYh>yAW)s~)Qol? z)cGNHhzhV{EgcRzS3j8wu{N4TFQGgQj=YEMv3hj9leRB98cJyBs<7fgJA-5k#41>a zS`kD5f`Ilxvl8h9NLr(f;#*9mDU@6YYlZ!FapMiPU}9vz>8^K>AFxRoEuac3C>uFs zx)kUL^jR3=i!$Gk^=wKWGvi(|!b!Z2@}{_6XiI0U9-X)dJC+4G%Okck>0=X%mN14u z*Jz?SdXP=ksZz4&+r{vKZvZF`SR$!1SqFF$S3Quni%48jfD+IMD*G8>DtX!apcBn}+ zV5?+5!p|lr>%`H7HRYZz(>;LY?TE$!qdSs}hpI-FRYheqiTUv>O3gYrf|FCN6f8E4 zWxf5Q?gSMGKD85>iLK%>p0%NihGTJHcejRY*R7;z=XY^v7nF`}JSW43ly?AJ?2y+c z8Fx_m4949-Xhs3*oO)>4Os1!bU;b@M2-Ze4nxC$%g=MrKx>p8hRMrXNS&qI>_khm8 zg_+tYXGRDLpTT6p>-go%`qirxR&w1E>rhv6>GHoymeVSjDPX`%^RTfn-cb$}z&T_F zRJK)qMo2y{S0)y9P|hGPu}GS}`f{CEdLiIUOz z`7)NMp{%OXq_|*kH#Ur_Z+(Z)6|Mv_~rJ60$61~-O?JrZt;w**; zb;3v};qBolImu2Q4gy5HPXJ$8eh5zP6bxugCo)!TgrXjoR&x1`{pp1jF&3$geFL#z zqyrZALFFU0QRo&)R22dK*1K5@PsZ|~c5JHvk5%d!pp;gr8FmMX9Q340-+{2;i@c)Alx|>XYKhl{bP+V!68Zo&Z$(e z9i@$!L0+KSX_T)6TmVR6@l9=FUq6x}D~U>jw+SRDZ^hS!ImMBl6#7_7cEElrrYK(( z)K-A^c?m>)oIdL*+_r&;it*-*_L|edV{+Tb2XVM@0PqHdxIYmqgJ4zU;gTIypvnFOVkd<( zi8PJ==*>i7o#cQg2FY@7b|UTLW2YqOdO5-#&K+8AZ9uXBh_prLa-erH!;hGb22P>1 zHARTa%0M#OG7TM^38l5fBgk_-0*#}yx_N0+0Y*&#S|IkCa3&e(oH`?XW#wmNO@OkM z&xHB~w|^k(MQhX{-AtWa^`Y8c6oJAgQ?b@t^|WoYC~~E3V@=TDeo(pi1P~0?8XB3X zv;2t!P(x;?43`O{;s=s+69C(BThhZQSJ4X!(zVutbX|M`3S3KjqZhrIaFjEPAsz8z zD}^GkR0?xr@njtOj`AWF9X>{Dk>o|yvh@NV_(2D7XCVa90Do8$W@@za3h@jWdigJs0DmPe4$Dir!R84UgsvFeM)ZB5Z~x3T3B^6SF^d5maO4r9PA>A1zP z4!0bJlWVB2mom|4^kPPb%*&Wangd1YSc*x07`oL5@{w80G^9AW<10VczD;=Cm?aF0 zGI33OVJQ=Z)+_<%A5EkQyi411aG^8~UP|$D!6?sXQ9?H|QVkRnvxG4~rgLa@4#Q%E z04g(~BVRCPXX>+lT*i#?LY)FVwdi4Q#^51$1iB+!k*fh@ApzS!*B59Ww}s`39)yJs zS@x2?c@bo!?c8VYBS)yAk=JcMX@;zo$AY+mra(3&ph1arU97PDP%K%~3pWcTtTuHE zytFl~URvgF9exweQn)Cv0T|o_EDiF64C3WZ3&=odu40IDg9b*GoJFfH>w?gYMxg0& zvl1oVvsD$XDuJe^_0P*X##1edc?CL%H2K0oY{bb_;N08b<-V?5MZ-~5Vu7@Le0YRh zKzW#LrG1A&vaVcvsG$OtQPfev)RfT`{YO*K?Fk@E6f`9r%nW65)iWzQOV9{O@Pj_~ z;}VkfF*~+iHBfFY`Jh3e3~U^_NvlJdjwpH=qj5%D5PbzY5%*DSDuEw_oDC4cJwiTM>VJb9-fu5JP2GtqW zn@nk(+AKVPN96>$kIdjykc$f(O3F?##wv(BC_{qfn;>*!fO9V!LRGGCbk^hjiCw2) zJ2uz)@n$DYP$`ydegW|s<|Y6DhG;0b{}Ifx)^$9JLJsc)A-D;dfD&gjL4mv+CD{1@ z{!-PML$|j;CqWpZZhnB>_-Y0f7wBH8;qn3;CZQK*(o4<5E8dVIda8kj3Q)}vDnO7g zrtkwzRT5G#*mSgtm+Kh07K6g(X-`rQ%Y%Ty&4b@o()Rv?gDFA~l#bm|-)t&K)=XHV zVyJ+$l{9v2L!oPFdw*!*T3V&j0E2*n zfkIgL#eOf4QA`rhF_V=}IEubWQ`SXS$;owKQMO73a7&i#aQo-`1#`z4u&Q10RB3g& z^NdEVXSB5F>?>To_^O2E8R2p(Bnkd7WIvezYEexD& zEc94q?sBqmdR}C$-M28As!&#hS`@TlLv3`Ial=}tP8zO{Y#jr)$Pgip&(NE#Or9TZ zed8bfSiKhhVGU-3S(L2bZetqh;Jb1z9~xLFE+E{TCxFc?KnGW86LHmqf9wx7u)IOS z(#qAwLa$3{gIiiqEAV4+n#>7MEh#3$t#);ri0=sSPt}VB5yQBv&1k?%)754&VBo2; zS->B>Np7-M8Lg!#`ComJ9~hm%v;JXj(DO z1jEdhYDTV_`%SD=Es#tci?h?^#U@^?mN_Qi5to32m@x@PXiM1UT5LIqjZ(GqG>Jw* zd7dWGgbQES7mFgkuv6HiYFT0u&G^2|d7K5nO2T~%XCrj;cxAqGCWC}A%6S~1GDuWc z8}#ap_)gJz8~{DfDaT0?2i}7GgCED)31%KHbX+GJ;muf-IFADxi~Dm*oAT&j9Gp|N zaU2xX_PG`r5)Ckr$1P0P2b$qTtJ~nxpxQV|xj^0^;#R!N^8g){M`yG^W3<}tpnAYx zS8<&Tm5d_#jX)69yZ~W@wY_$J8F75BIU`7I?Sj`KNo<{ub8T&wa9JaaQx4~cndcy4&*Kt5&igSl?a7&^b zX8~w%J8E_^6?mm^{pl6}nF~~KgG6rE_u8bLn{u4nuR(l}Wl+p|Yxk-uX z*oJ#gE-?c}rJxZ-&<2We7BC9cQU|`PR4sKRU|Gdv5mdF30l_BW_LR$FK#Eqw0I&gJ z$^26Z!6F!O$J%AG8Gu1~#%3rLm97RG?ku~`{U0d{wQm&$*!7=ima4BB$_;!=>-s>+ ztb|dhJOMJ5}W=%$=$^jeH zU9Jl>v+yl+{0{7Yhx@^Zza;3g6R^RutJ{<`i^nMu(+mKoEaSlDLTvK+o6UeTik!tZ zr4E45mlToC!fJsmT^1 t2Dxpjpj6qWzzW%>03WbHOIEo#GoUDZr$B#(=?oWef;KFyO=4T^{{b~PF_ZuR diff --git a/output/risks.json b/output/risks.json index 3f3cd5d..c8e51d8 100644 --- a/output/risks.json +++ b/output/risks.json @@ -1 +1 @@ -[{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003eclient-application-code\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@client-application-code","most_relevant_data_asset":"client-application-code","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["client-application-code"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003ejob-information\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@job-information","most_relevant_data_asset":"job-information","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["job-information"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003epayment-details\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@payment-details","most_relevant_data_asset":"payment-details","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["payment-details"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003eschool-data\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@school-data","most_relevant_data_asset":"school-data","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["school-data"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003esecrets-and-api-keys\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@secrets-and-api-keys","most_relevant_data_asset":"secrets-and-api-keys","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["secrets-and-api-keys"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003eserver-application-code\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@server-application-code","most_relevant_data_asset":"server-application-code","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["server-application-code"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003estudent-pii\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@student-pii","most_relevant_data_asset":"student-pii","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["student-pii"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003eteacher-pii\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@teacher-pii","most_relevant_data_asset":"teacher-pii","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["teacher-pii"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003evulnerable-children-data\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@vulnerable-children-data","most_relevant_data_asset":"vulnerable-children-data","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["vulnerable-children-data"]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app-worker\u003c/b\u003e","synthetic_id":"cross-site-scripting@s184d01-comp-complete-app-worker","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app-worker","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["s184d01-comp-complete-app-worker"]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e","synthetic_id":"cross-site-scripting@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"missing-cloud-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"high","title":"\u003cb\u003eMissing Cloud Hardening (Azure)\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e: \u003cu\u003eCIS Benchmark for Microsoft Azure\u003c/u\u003e","synthetic_id":"missing-cloud-hardening@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e","synthetic_id":"missing-hardening@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003essphp-metrics\u003c/b\u003e","synthetic_id":"missing-hardening@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app-worker\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@s184d01-comp-complete-app-worker","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app-worker","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["s184d01-comp-complete-app-worker"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-complete-app-worker\u003c/b\u003e","synthetic_id":"unencrypted-asset@s184d01-comp-complete-app-worker","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app-worker","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-complete-app-worker"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e","synthetic_id":"unencrypted-asset@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e","synthetic_id":"unencrypted-asset@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-compdefault\u003c/b\u003e","synthetic_id":"unencrypted-asset@s184d01-compdefault","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-compdefault","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-compdefault"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003essphp-metrics-rust-p3sha\u003c/b\u003e","synthetic_id":"unencrypted-asset@ssphp-metrics-rust-p3sha","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics-rust-p3sha","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics-rust-p3sha"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003essphp-metrics\u003c/b\u003e","synthetic_id":"unencrypted-asset@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003etfstatel95cd\u003c/b\u003e","synthetic_id":"unencrypted-asset@tfstatel95cd","most_relevant_data_asset":"","most_relevant_technical_asset":"tfstatel95cd","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["tfstatel95cd"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003etfstatep3sha\u003c/b\u003e","synthetic_id":"unencrypted-asset@tfstatep3sha","most_relevant_data_asset":"","most_relevant_technical_asset":"tfstatep3sha","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["tfstatep3sha"]},{"category":"missing-network-segmentation","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Network Segmentation\u003c/b\u003e to further encapsulate and protect \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e against unrelated lower protected assets in the same network segment, which might be easier to compromise by attackers","synthetic_id":"missing-network-segmentation@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"missing-network-segmentation","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Network Segmentation\u003c/b\u003e to further encapsulate and protect \u003cb\u003essphp-metrics\u003c/b\u003e against unrelated lower protected assets in the same network segment, which might be easier to compromise by attackers","synthetic_id":"missing-network-segmentation@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-complete-app-worker\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@s184d01-comp-complete-app-worker","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app-worker","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-complete-app-worker"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-compdefault\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@s184d01-compdefault","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-compdefault","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-compdefault"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003essphp-metrics-rust-p3sha\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@ssphp-metrics-rust-p3sha","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics-rust-p3sha","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics-rust-p3sha"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003essphp-metrics\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003etfstatel95cd\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@tfstatel95cd","most_relevant_data_asset":"","most_relevant_technical_asset":"tfstatel95cd","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["tfstatel95cd"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003etfstatep3sha\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@tfstatep3sha","most_relevant_data_asset":"","most_relevant_technical_asset":"tfstatep3sha","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["tfstatep3sha"]},{"category":"missing-vault-isolation","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault Isolation\u003c/b\u003e to further encapsulate and protect vault-related asset \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e against unrelated lower protected assets \u003cb\u003ein the same network segment\u003c/b\u003e, which might be easier to compromise by attackers","synthetic_id":"missing-vault-isolation@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"missing-vault-isolation","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault Isolation\u003c/b\u003e to further encapsulate and protect vault-related asset \u003cb\u003essphp-metrics\u003c/b\u003e against unrelated lower protected assets \u003cb\u003ein the same network segment\u003c/b\u003e, which might be easier to compromise by attackers","synthetic_id":"missing-vault-isolation@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]}] \ No newline at end of file +[{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-complete-app-worker\u003c/b\u003e","synthetic_id":"unencrypted-asset@s184d01-comp-complete-app-worker","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app-worker","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-complete-app-worker"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e","synthetic_id":"unencrypted-asset@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e","synthetic_id":"unencrypted-asset@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-compdefault\u003c/b\u003e","synthetic_id":"unencrypted-asset@s184d01-compdefault","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-compdefault","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-compdefault"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003essphp-metrics-rust-p3sha\u003c/b\u003e","synthetic_id":"unencrypted-asset@ssphp-metrics-rust-p3sha","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics-rust-p3sha","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics-rust-p3sha"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003essphp-metrics\u003c/b\u003e","synthetic_id":"unencrypted-asset@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003etfstatel95cd\u003c/b\u003e","synthetic_id":"unencrypted-asset@tfstatel95cd","most_relevant_data_asset":"","most_relevant_technical_asset":"tfstatel95cd","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["tfstatel95cd"]},{"category":"unencrypted-asset","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eUnencrypted Technical Asset\u003c/b\u003e named \u003cb\u003etfstatep3sha\u003c/b\u003e","synthetic_id":"unencrypted-asset@tfstatep3sha","most_relevant_data_asset":"","most_relevant_technical_asset":"tfstatep3sha","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["tfstatep3sha"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-complete-app-worker\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@s184d01-comp-complete-app-worker","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app-worker","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-complete-app-worker"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003es184d01-compdefault\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@s184d01-compdefault","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-compdefault","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-compdefault"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003essphp-metrics-rust-p3sha\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@ssphp-metrics-rust-p3sha","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics-rust-p3sha","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics-rust-p3sha"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003essphp-metrics\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003etfstatel95cd\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@tfstatel95cd","most_relevant_data_asset":"","most_relevant_technical_asset":"tfstatel95cd","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["tfstatel95cd"]},{"category":"unnecessary-technical-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Technical Asset\u003c/b\u003e named \u003cb\u003etfstatep3sha\u003c/b\u003e","synthetic_id":"unnecessary-technical-asset@tfstatep3sha","most_relevant_data_asset":"","most_relevant_technical_asset":"tfstatep3sha","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["tfstatep3sha"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003eclient-application-code\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@client-application-code","most_relevant_data_asset":"client-application-code","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["client-application-code"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003ejob-information\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@job-information","most_relevant_data_asset":"job-information","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["job-information"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003epayment-details\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@payment-details","most_relevant_data_asset":"payment-details","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["payment-details"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003eschool-data\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@school-data","most_relevant_data_asset":"school-data","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["school-data"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003esecrets-and-api-keys\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@secrets-and-api-keys","most_relevant_data_asset":"secrets-and-api-keys","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["secrets-and-api-keys"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003eserver-application-code\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@server-application-code","most_relevant_data_asset":"server-application-code","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["server-application-code"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003estudent-pii\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@student-pii","most_relevant_data_asset":"student-pii","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["student-pii"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003eteacher-pii\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@teacher-pii","most_relevant_data_asset":"teacher-pii","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["teacher-pii"]},{"category":"unnecessary-data-asset","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eUnnecessary Data Asset\u003c/b\u003e named \u003cb\u003evulnerable-children-data\u003c/b\u003e","synthetic_id":"unnecessary-data-asset@vulnerable-children-data","most_relevant_data_asset":"vulnerable-children-data","most_relevant_technical_asset":"","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["vulnerable-children-data"]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app-worker\u003c/b\u003e","synthetic_id":"cross-site-scripting@s184d01-comp-complete-app-worker","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app-worker","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["s184d01-comp-complete-app-worker"]},{"category":"cross-site-scripting","risk_status":"unchecked","severity":"elevated","exploitation_likelihood":"likely","exploitation_impact":"medium","title":"\u003cb\u003eCross-Site Scripting (XSS)\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e","synthetic_id":"cross-site-scripting@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"possible","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"missing-cloud-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"high","title":"\u003cb\u003eMissing Cloud Hardening (Azure)\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e: \u003cu\u003eCIS Benchmark for Microsoft Azure\u003c/u\u003e","synthetic_id":"missing-cloud-hardening@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e","synthetic_id":"missing-hardening@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"missing-hardening","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"likely","exploitation_impact":"low","title":"\u003cb\u003eMissing Hardening\u003c/b\u003e risk at \u003cb\u003essphp-metrics\u003c/b\u003e","synthetic_id":"missing-hardening@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app-worker\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@s184d01-comp-complete-app-worker","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app-worker","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["s184d01-comp-complete-app-worker"]},{"category":"container-baseimage-backdooring","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eContainer Base Image Backdooring\u003c/b\u003e risk at \u003cb\u003es184d01-comp-complete-app\u003c/b\u003e","synthetic_id":"container-baseimage-backdooring@s184d01-comp-complete-app","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-complete-app","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"probable","data_breach_technical_assets":["s184d01-comp-complete-app"]},{"category":"missing-vault-isolation","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault Isolation\u003c/b\u003e to further encapsulate and protect vault-related asset \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e against unrelated lower protected assets \u003cb\u003ein the same network segment\u003c/b\u003e, which might be easier to compromise by attackers","synthetic_id":"missing-vault-isolation@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"missing-vault-isolation","risk_status":"unchecked","severity":"medium","exploitation_likelihood":"unlikely","exploitation_impact":"medium","title":"\u003cb\u003eMissing Vault Isolation\u003c/b\u003e to further encapsulate and protect vault-related asset \u003cb\u003essphp-metrics\u003c/b\u003e against unrelated lower protected assets \u003cb\u003ein the same network segment\u003c/b\u003e, which might be easier to compromise by attackers","synthetic_id":"missing-vault-isolation@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]},{"category":"missing-network-segmentation","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Network Segmentation\u003c/b\u003e to further encapsulate and protect \u003cb\u003es184d01-comp-tfvars\u003c/b\u003e against unrelated lower protected assets in the same network segment, which might be easier to compromise by attackers","synthetic_id":"missing-network-segmentation@s184d01-comp-tfvars","most_relevant_data_asset":"","most_relevant_technical_asset":"s184d01-comp-tfvars","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["s184d01-comp-tfvars"]},{"category":"missing-network-segmentation","risk_status":"unchecked","severity":"low","exploitation_likelihood":"unlikely","exploitation_impact":"low","title":"\u003cb\u003eMissing Network Segmentation\u003c/b\u003e to further encapsulate and protect \u003cb\u003essphp-metrics\u003c/b\u003e against unrelated lower protected assets in the same network segment, which might be easier to compromise by attackers","synthetic_id":"missing-network-segmentation@ssphp-metrics","most_relevant_data_asset":"","most_relevant_technical_asset":"ssphp-metrics","most_relevant_trust_boundary":"","most_relevant_shared_runtime":"","most_relevant_communication_link":"","data_breach_probability":"improbable","data_breach_technical_assets":["ssphp-metrics"]}] \ No newline at end of file diff --git a/output/risks.xlsx b/output/risks.xlsx index 282bedc57061cc99e8cdd900e493d8cda38bc870..26785fd37adacc14cb0d1244fec6991b663df545 100755 GIT binary patch delta 182 zcmZ1*w>EBq+~$*vsr;MkwWSy*Cu>SPe}VYcnv! c7p3MD>+6BY0B=?{1|Z-9!Umwd({(^R0Ne~V`~Uy| delta 185 zcmZ1*w>EBq+~!xB%NaLHW%6$pm-^1Td8w(D0b9J?tay2HO)U{zs)SS$& fr#x8;s5e!6vYW1)2rC-{5O4uu1JLT}Iv^eZ2JSTC diff --git a/output/tags.xlsx b/output/tags.xlsx index 1581a269212105dc937964e3bb8499b6eea70f43..8de5d11e30f58a025731f9d2051d2d62433650ac 100755 GIT binary patch delta 212 zcmez8@y}y|)aEVhs~I;+-C&%|r+8?dac_>6_|3T4T3mr~bC{G7 zo@5=9ZeQuPiXR0w^-WNjr4CI*Jdp-PIAzbZ>H-C&$7sG>UghoThIEcVGFN~)91RHQ^) zIT;u#a`cNc5{pt(f=h}r^U{kaD=Ldjey=3ORL?z`TUl#ziLw-<;^cm1xyhzLa~vfm z2P!L1UJGQ}NKHPetTTBFP-&j@ - Job information is important but is public information in it&#39;s nature. + Job information is important but is public information in it's nature. school-data: name: school-data @@ -913,256 +913,256 @@ individual_risk_categories: # used for adding custom manually identified risks risk_tracking: - container-baseimage-backdooring@s184d01-comp-complete-app-worker: # wildcards "*" between the @ characters are possible + missing-cloud-hardening@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - container-baseimage-backdooring@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible + container-baseimage-backdooring@s184d01-comp-complete-app-worker: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - missing-vault-isolation@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible + container-baseimage-backdooring@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - missing-vault-isolation@ssphp-metrics: # wildcards "*" between the @ characters are possible + unencrypted-asset@s184d01-comp-complete-app-worker: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unencrypted-asset@s184d01-comp-complete-app-worker: # wildcards "*" between the @ characters are possible + unencrypted-asset@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unencrypted-asset@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible + unencrypted-asset@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unencrypted-asset@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible + unencrypted-asset@s184d01-compdefault: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unencrypted-asset@s184d01-compdefault: # wildcards "*" between the @ characters are possible + unencrypted-asset@ssphp-metrics-rust-p3sha: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unencrypted-asset@ssphp-metrics-rust-p3sha: # wildcards "*" between the @ characters are possible + unencrypted-asset@ssphp-metrics: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unencrypted-asset@ssphp-metrics: # wildcards "*" between the @ characters are possible + unencrypted-asset@tfstatel95cd: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unencrypted-asset@tfstatel95cd: # wildcards "*" between the @ characters are possible + unencrypted-asset@tfstatep3sha: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unencrypted-asset@tfstatep3sha: # wildcards "*" between the @ characters are possible + missing-network-segmentation@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - missing-cloud-hardening@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible + missing-network-segmentation@ssphp-metrics: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@client-application-code: # wildcards "*" between the @ characters are possible + cross-site-scripting@s184d01-comp-complete-app-worker: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@job-information: # wildcards "*" between the @ characters are possible + cross-site-scripting@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@payment-details: # wildcards "*" between the @ characters are possible + missing-vault-isolation@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@school-data: # wildcards "*" between the @ characters are possible + missing-vault-isolation@ssphp-metrics: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@secrets-and-api-keys: # wildcards "*" between the @ characters are possible + unnecessary-technical-asset@s184d01-comp-complete-app-worker: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@server-application-code: # wildcards "*" between the @ characters are possible + unnecessary-technical-asset@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@student-pii: # wildcards "*" between the @ characters are possible + unnecessary-technical-asset@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@teacher-pii: # wildcards "*" between the @ characters are possible + unnecessary-technical-asset@s184d01-compdefault: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-data-asset@vulnerable-children-data: # wildcards "*" between the @ characters are possible + unnecessary-technical-asset@ssphp-metrics-rust-p3sha: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - cross-site-scripting@s184d01-comp-complete-app-worker: # wildcards "*" between the @ characters are possible + unnecessary-technical-asset@ssphp-metrics: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - cross-site-scripting@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible + unnecessary-technical-asset@tfstatel95cd: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - missing-hardening@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible + unnecessary-technical-asset@tfstatep3sha: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - missing-hardening@ssphp-metrics: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@client-application-code: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - missing-network-segmentation@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@job-information: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - missing-network-segmentation@ssphp-metrics: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@payment-details: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-technical-asset@s184d01-comp-complete-app-worker: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@school-data: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-technical-asset@s184d01-comp-complete-app: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@secrets-and-api-keys: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-technical-asset@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@server-application-code: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-technical-asset@s184d01-compdefault: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@student-pii: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-technical-asset@ssphp-metrics-rust-p3sha: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@teacher-pii: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-technical-asset@ssphp-metrics: # wildcards "*" between the @ characters are possible + unnecessary-data-asset@vulnerable-children-data: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-technical-asset@tfstatel95cd: # wildcards "*" between the @ characters are possible + missing-hardening@s184d01-comp-tfvars: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. - unnecessary-technical-asset@tfstatep3sha: # wildcards "*" between the @ characters are possible + missing-hardening@ssphp-metrics: # wildcards "*" between the @ characters are possible status: unchecked # values: unchecked, in-discussion, accepted, in-progress, mitigated, false-positive justification: Enter justification here. ticket: Enter ticket number relating to your risk and mitigations here. - date: 2024-05-17 + date: 2024-05-21 checked_by: Enter name of owner/ reviewer here. diff --git a/yaml-templates/ssphp_test.yaml b/yaml-templates/ssphp_test.yaml new file mode 100644 index 0000000..00cf680 --- /dev/null +++ b/yaml-templates/ssphp_test.yaml @@ -0,0 +1,20 @@ +--- +service: + id: S194 + name: S194_CISO_Continuous_Assurance + display_name: CISO Continuous Assurance + group: Digital and Technology + division: CISD + portfolio: Protective Monitoring + risk_profile: 30 + +data_types: + teacher_pii: true + student_pii: true + client_app_code: true + server_app_code: true + vulnerable_children_data: true + job_information: true + school_data: true + payment_details: true + secrets_and_keys: true \ No newline at end of file