931 Connection Security for Network Component

[kyhu65867]

… work because I am still figuring out oscal syntax

Committer Notes

This is a draft. I may need some help tomorrow figuring out if there is a connection security property or if it should be "interconnection security"
Addresses issue #931

All Submissions:

• Have you selected the correct base branch per Contributing guidance?
• Have you set "Allow edits and access to secrets by maintainers"?
• Have you checked to ensure there aren't other open Pull Requests for the same update/change?
• Have you squashed any non-relevant commits and commit messages? [instructions]
• If applicable, have all FedRAMP Documents Related to OSCAL Adoption affected by the changes in this issue have been updated.?
• If applicable, does this PR reference the issue it addresses and explain how it addresses the issue?

By submitting a pull request, you are agreeing to provide this contribution under the CC0 1.0 Universal public domain dedication.

[Gabeblis]

Just some small changes to get the tests passing so we can open this for review 😄

[Gabeblis]

Looks great! Just a couple suggestions for improvement.

[Gabeblis]

Looks good 😄 I'd just make sure the necessary documentation gets added.

[aj-stein-gsa]

Wait, woops, just kidding (I am sorry to reverse course quickly): it seems I missed some changes, should @name="interconnection-security" not be @name="connection-security" per the requirements in #931?

[aj-stein-gsa]

Wait, woops, just kidding (I am sorry to reverse course quickly): it seems I missed some changes, should @name="interconnection-security" not be @name="connection-security" per the requirements in #931?

@brian-ruf, I know the old way was prop[@name="interconnection-security"] (per https://github.com/GSA/fedramp-automation/blob/fedramp-2.0.0-oscal-1.0.4/dist/content/rev5/resources/xml/FedRAMP_extensions.xml#L445-L461) but the point of the newer requirements is we will obsolete interconnection-security as a name that is more specific than the broaded intent we discussed in Google Chat:

Rene summed it up well. Most technical components are "networked", but only for communication within the authorization boundary.

The point of these issues is communication that crosses the authorization boundary. I wanted the issue titles to be clear that they are all focusing on components whose communication crosses the boundary.

[kyhu65867]

@GSA/fedramp-oscal-contributors should I add remarks to this constraint to describe that nuance of communication across the boundary?

[aj-stein-gsa]

Updated PR title, relevant documentation PR has been merged.