Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add system-characteristics 'information-type' constraints #685

Merged
merged 9 commits into from
Oct 30, 2024
Merged

Add system-characteristics 'information-type' constraints #685

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
597699a
Add system-characteristics information-type constrains & tests
Gabeblis Sep 10, 2024
925c0b3
target cleanup
Gabeblis Sep 27, 2024
9196d8d
Added separate invalid test data files
Gabeblis Sep 24, 2024
a0cefbd
Add more detailed test descriptions
Gabeblis Sep 26, 2024
8638a83
add help-url props
Gabeblis Oct 29, 2024
c9f431f
caps lock hello?
Gabeblis Oct 29, 2024
3769058
fix message
Gabeblis Oct 29, 2024
858f9f8
add n
Gabeblis Oct 29, 2024
3a7fbd2
fix feature order
Gabeblis Oct 30, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions features/fedramp_extensions.feature
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -113,6 +113,12 @@ Examples:
| import-profile-has-href-attribute-PASS.yaml |
| import-profile-has-valid-content-FAIL.yaml |
| import-profile-has-valid-content-PASS.yaml |
| information-type-has-availability-impact-FAIL.yaml |
| information-type-has-availability-impact-PASS.yaml |
| information-type-has-confidentiality-impact-FAIL.yaml |
| information-type-has-confidentiality-impact-PASS.yaml |
| information-type-has-integrity-impact-FAIL.yaml |
| information-type-has-integrity-impact-PASS.yaml |
| information-type-id-FAIL.yaml |
| information-type-id-PASS.yaml |
| information-type-system-FAIL.yaml |
Expand Down Expand Up @@ -218,6 +224,9 @@ Examples:
| import-profile-has-href-attribute |
| import-profile-has-valid-content |
| information-type-800-60-v2r1 |
| information-type-has-availability-impact |
| information-type-has-confidentiality-impact |
| information-type-has-integrity-impact |
| information-type-system |
| interconnection-direction |
| interconnection-security |
Expand Down
2 changes: 1 addition & 1 deletion src/validations/constraints/content/ssp-has-network-architecture-INVALID.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,4 +5,4 @@
uuid="12345678-1234-4321-8765-123456789012">
<system-characteristics>
</system-characteristics>
</system-security-plan>
</system-security-plan>
12 changes: 12 additions & 0 deletions src/validations/constraints/content/ssp-information-type-has-availability-impact-INVALID.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
uuid="12345678-1234-4321-8765-123456789012">
<system-characteristics>
<system-information>
<information-type uuid="33333333-0000-4000-9000-000000000003">
</information-type>
</system-information>
</system-characteristics>
</system-security-plan>
12 changes: 12 additions & 0 deletions ...lidations/constraints/content/ssp-information-type-has-confidentiality-impact-INVALID.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
uuid="12345678-1234-4321-8765-123456789012">
<system-characteristics>
<system-information>
<information-type uuid="33333333-0000-4000-9000-000000000003">
</information-type>
</system-information>
</system-characteristics>
</system-security-plan>
12 changes: 12 additions & 0 deletions src/validations/constraints/content/ssp-information-type-has-integrity-impact-INVALID.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,12 @@
<?xml version="1.0" encoding="UTF-8"?>
<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 https://github.com/usnistgov/OSCAL/releases/download/v1.1.2/oscal_ssp_schema.xsd"
uuid="12345678-1234-4321-8765-123456789012">
<system-characteristics>
<system-information>
<information-type uuid="33333333-0000-4000-9000-000000000003">
</information-type>
</system-information>
</system-characteristics>
</system-security-plan>
12 changes: 12 additions & 0 deletions src/validations/constraints/fedramp-external-constraints.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -174,6 +174,18 @@
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/3-working-with-oscal-files/#importing-the-fedramp-baseline"/>
<message>A FedRAMP SSP MUST import a profile or catalog of security controls to reference implemented requirements against those control(s).</message>
</expect>
<expect id="information-type-has-confidentiality-impact" target="system-characteristics/system-information/information-type" test="confidentiality-impact" level="ERROR">
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#system-information-and-information-types"/>
Gabeblis marked this conversation as resolved.
Show resolved Hide resolved
<message>A FedRAMP SSP information type MUST have a confidentiality impact.</message>
</expect>
<expect id="information-type-has-integrity-impact" target="system-characteristics/system-information/information-type" test="integrity-impact" level="ERROR">
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#system-information-and-information-types"/>
Gabeblis marked this conversation as resolved.
Show resolved Hide resolved
<message>A FedRAMP SSP information type MUST have an integrity impact.</message>
</expect>
<expect id="information-type-has-availability-impact" target="system-characteristics/system-information/information-type" test="availability-impact" level="ERROR">
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#system-information-and-information-types"/>
Gabeblis marked this conversation as resolved.
Show resolved Hide resolved
<message>A FedRAMP SSP information type MUST have an availability impact.</message>
</expect>
</constraints>
</context>
<context>
Expand Down
7 changes: 7 additions & 0 deletions src/validations/constraints/unit-tests/information-type-has-availability-impact-FAIL.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Negative Test for information-type-has-availability-impact
description: Test that an SSP system-characteristics system-information information-type element does not have an availability-impact element.
content: ../content/ssp-information-type-has-availability-impact-INVALID.xml
expectations:
- constraint-id: information-type-has-availability-impact
result: fail
7 changes: 7 additions & 0 deletions src/validations/constraints/unit-tests/information-type-has-availability-impact-PASS.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Positive Test for information-type-has-availability-impact
description: Test that an SSP system-characteristics system-information information-type element has an availability-impact element.
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: information-type-has-availability-impact
result: pass
7 changes: 7 additions & 0 deletions src/validations/constraints/unit-tests/information-type-has-confidentiality-impact-FAIL.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Negative Test for information-type-has-confidentiality-impact
description: Test that an SSP system-characteristics system-information information-type element does not have a confidentiality-impact element.
content: ../content/ssp-information-type-has-confidentiality-impact-INVALID.xml
expectations:
- constraint-id: information-type-has-confidentiality-impact
result: fail
7 changes: 7 additions & 0 deletions src/validations/constraints/unit-tests/information-type-has-confidentiality-impact-PASS.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Positive Test for information-type-has-confidentiality-impact
description: Test that an SSP system-characteristics system-information information-type element has a confidentiality-impact element.
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: information-type-has-confidentiality-impact
result: pass
7 changes: 7 additions & 0 deletions src/validations/constraints/unit-tests/information-type-has-integrity-impact-FAIL.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Negative Test for information-type-has-integrity-impact
description: Test that an SSP system-characteristics system-information information-type element does not have an integrity-impact element.
content: ../content/ssp-information-type-has-integrity-impact-INVALID.xml
expectations:
- constraint-id: information-type-has-integrity-impact
result: fail
7 changes: 7 additions & 0 deletions src/validations/constraints/unit-tests/information-type-has-integrity-impact-PASS.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,7 @@
test-case:
name: Positive Test for information-type-has-integrity-impact
description: Test that an SSP system-characteristics system-information information-type element has an integrity-impact element.
content: ../content/ssp-all-VALID.xml
expectations:
- constraint-id: information-type-has-integrity-impact
result: pass
Loading