From 5d67bea04939407f02572e14834fb8ac511bea0f Mon Sep 17 00:00:00 2001 From: Alexander Stein Date: Wed, 1 Jun 2022 18:04:07 -0400 Subject: [PATCH 1/3] [WIP] Add rules model and refs into component-definition model. --- src/metaschema/examples/rules-component.xml | 73 ++++++++++++ src/metaschema/oscal_component_metaschema.xml | 19 ++++ .../oscal_rules-common_metaschema.xml | 105 ++++++++++++++++++ 3 files changed, 197 insertions(+) create mode 100644 src/metaschema/examples/rules-component.xml create mode 100644 src/metaschema/oscal_rules-common_metaschema.xml diff --git a/src/metaschema/examples/rules-component.xml b/src/metaschema/examples/rules-component.xml new file mode 100644 index 0000000000..0184e6b15f --- /dev/null +++ b/src/metaschema/examples/rules-component.xml @@ -0,0 +1,73 @@ + + + + + + + + + + + Important Rule 1 + This is a description of Important Rule 1. + + + Test A for Rule 1 + This is Test A, it can be executed to demonstrate a system meets requirements for Rule 1. + + + Test B for Rule 1 + This is Test B, it can be executed to demonstrate a system meets requirements for Rule 1. + + + Test C for Rule 1 + This is Test C, it can be optionally executed to demonstrate a system meets requirements for Rule 1. + + + Test D for Rule 1 + This is Test C, it can be optionally executed to demonstrate a system meets requirements for Rule 1. + + + + + + + + + + + + + + + + + + + + + + + + Example Rule & Test Component 1 + A Sample Component with Rule and Test Integration + + Rule Implementation for Testing Scenario Usage Pattern 1. + + + Rule Implementation for Testing Scenario Usage Pattern 2. + + + Rule Implementation for Testing Scenario Usage Pattern 3. + + + + \ No newline at end of file diff --git a/src/metaschema/oscal_component_metaschema.xml b/src/metaschema/oscal_component_metaschema.xml index c757be4c80..a74385fb18 100644 --- a/src/metaschema/oscal_component_metaschema.xml +++ b/src/metaschema/oscal_component_metaschema.xml @@ -26,6 +26,7 @@ + Component Definition @@ -41,6 +42,17 @@ + + rule + + + + test + + + + + component @@ -118,6 +130,7 @@ + - - + + + + - + - + - - + + - + diff --git a/src/metaschema/oscal_rules-common_metaschema.xml b/src/metaschema/oscal_rules-common_metaschema.xml index 87f5299748..a948111db6 100644 --- a/src/metaschema/oscal_rules-common_metaschema.xml +++ b/src/metaschema/oscal_rules-common_metaschema.xml @@ -16,6 +16,31 @@ Rule Definition Universally Unique Identifier TODO + + + Rule Title + A name given to the rule, which may be used by a tool for display and navigation. + + + Rule Description + A summary of the rule, including the requirement(s) to be met when evaluating the rule against a target that the rule applies to. + + + + + + + + + + + + A string that identifies the revision of the rule. + + + A pointer to the resource that this rule is derived from. + + Test Definition @@ -24,58 +49,144 @@ Test Definition Universally Unique Identifier TODO + + + Test Title + A name given to the test, which may be used by a tool for display and navigation. + + + Test Description + A summary of the test, including implementation details of how its use examines an aspect or trait of a system. + + + + + + + + + + + + + A string that identifies the revision of the test. + + + A pointer to the resource that this test is derived from. + + Rule Testing Scenario A rule testing scenario - scenario Testing Scenario Universally Unique Identifier TODO + + Testing Scenario Rule Universally Unique Identifier Reference + TODO + - - condition + + + + + + + + condition + + + + + + Test Reference + TODO + + + Test Universally Unique Identifier Reference + A test UUID reference + + Rule Condition A rule implementation condition - + + Rule Condition Negation Flag + TODO + +

+

Negate Truth Table

+

true -> false, false -> true, error -> error, not-applicable -> not-applicable

+

+ + + Rule Condition Operator TODO and or - not + +

+

Operator Truth Table

+

+

+

What is eager evaluation and why does it matter?

+

How do prerequisites work in the processing of condition operators and precedence.

+ + + + + + + - pre-condition + prerequisite + condition - - Test Reference - TODO - - Test Reference Universally Unique Identifier - TODO - - - Test Universally Unique Identifier Reference - A test UUID reference - - + + + + + Testing Scenario Universally Unique Identifier Reference + A testing scenario UUID reference + + + Testing Scenario Universally Unique Identifier + A testing scenari UUID reference + + + Testing Scenario Reference + A reference to a testing scenario. + + Testing Scenario Universally Unique Identifier Reference + TODO + + + + Rule Implementation TODO @@ -83,23 +194,19 @@ Rule Implementation Universally Unique Identifier TODO + + Rule Implementation Description + A summary of the rule implementation. + - - Testing Scenario Reference - A reference to a testing scenario. - - Rule Reference Universally Unique Identifier - TODO - - - Rule Universally Unique Identifier Reference - A rule UUID reference - - - Rule Universally Unique Identifier Reference - A rule UUID reference - - + + + + + + + + - \ No newline at end of file + From 095f0a627aae71da06f7539a801b58e772d9c12f Mon Sep 17 00:00:00 2001 From: Alexander Stein Date: Tue, 23 Aug 2022 09:11:32 -0400 Subject: [PATCH 3/3] Schema touch-ups and updated example. Signed-off-by: Alexander Stein --- src/metaschema/examples/rules-component.xml | 134 ++++++++++++------ src/metaschema/oscal_component_metaschema.xml | 10 +- .../oscal_rules-common_metaschema.xml | 70 +++++---- 3 files changed, 136 insertions(+), 78 deletions(-) diff --git a/src/metaschema/examples/rules-component.xml b/src/metaschema/examples/rules-component.xml index 45b14ea7e3..1bc5007f26 100644 --- a/src/metaschema/examples/rules-component.xml +++ b/src/metaschema/examples/rules-component.xml @@ -4,82 +4,126 @@ xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://csrc.nist.gov/ns/oscal/1.0 ../../../xml/schema/oscal_complete_schema.xsd" uuid="3559d200-4849-41ac-a420-28b2ffa22c52"> - Example Component Definition with Rules and Tests Linked to Component - 2022-08-22T00:00:00.000000000-04:00 + Example Component Definition for Openshift Container Platform v4, Rules, and Tests + 2022-08-23T00:00:00.000000000-04:00 0.0.1-alpha 1.2.0 - Important Rule 1 + Disable Anonymous Unauthenticated Access to Components -

is a description of Important Rule 1.

+

Anonymous (i.e. unauthenticated) access to any OCP4 sub-system documented in the components below must prevent anonymous, unauthenticated access.

 - Test A for Rule 1 + Disable Anonymous Authentication to the Kubelet - Iac Analysis -

This is Test A, it can be executed to demonstrate a system meets requirements for Rule 1.

+

This test will analyze Infrastructure-as-Code (IaC) written in Ansible to provision OCP4 cluster(s). If the necessary configuration in /etc/kubernetes/kubelet.conf disables anonymous authentication with the appropriate setting (authentication.anonymous.enabled: false), this test will return a passing value. It will be one example of an aspect of OCP4 cluster(s) configured to meet CM-6 requirements.

 - Test B for Rule 1 + Disable Anonymous Authentication to the Kubelet - Runtime Analysis with OCP4 Compliance Operator -

This is Test B, it can be executed to demonstrate a system meets requirements for Rule 1.

+

+ This test will analyze running OCP4 cluster(s) with its configured Compliance Operator to perform the necessary configuration management scans. If operator conducts scans of node kubelets and the necessary configuration in /etc/kubernetes/kubelet.conf disables anonymous authentication with the appropriate setting (authentication.anonymous.enabled: false), this test will return a passing value. It will be one example of an aspect of OCP4 cluster(s) configured to meet CM-6 requirements.

 + + + + - Test C for Rule 1 + Disable Anonymous Authentication to the Kubelet - Runtime Analysis with CSP API for Managed OCP4 Control Plane -

This is Test C, it can be optionally executed to demonstrate a system meets requirements for Rule 1.

+

This test will analyze running OCP4 cluster(s) with a managed service from a cloud service provider (CSP). The CSP has a managed service that provisions OCP4 cluster(s) for customers. A REST API for this managed service can be queried. If the API confirms the setting is appropriately set, this test will return a passing value. It will be one example of an aspect of OCP4 cluster(s) configured to meet CM-6 requirements.

 - Test D for Rule 1 + OCP4 Cluster Properly Configured and Deployed with Compliance Operator -

This is Test D, it can be optionally executed to demonstrate a system meets requirements for Rule 1.

+

This is a test that provides automated evaluation to confirm that an OCP4 cluster has the Compliance Operator properly installed and configured.

 + + + + - - - - - - + + + + + + + - - + + + + + + - - - - + + - - + + - - + + + + + + + + + + + + + + + + + - Example Rule & Test Component 1 - A Sample Component with Rule and Test Integration - - Rule Implementation for Testing Scenario Usage Pattern 1. - - - Rule Implementation for Testing Scenario Usage Pattern 2. - - - Rule Implementation for Testing Scenario Usage Pattern 3. - + RedHit Openshift Container Platform v4 + +

This component documents the usage of RedHat's OpenShift Container Platform v4 (OCP4) in a system.

+

For many OpenShift Container Platform customers, regulatory readiness, or compliance, on some level is required before any systems can be put into production. That regulatory readiness can be imposed by national standards, industry standards, or the organization's corporate governance framework.

+

This component documents a system's use of OCP4 and its regulatory readiness in relation to NIST's Special Publication 800-37 information security and risk management framework. Implemented requirements are documented through security and privacy controls from NIST's Special Publication 800-53 Revision 5 Catalog.

+

Many of the implemented requirements provide supporting evidence of already implemented requirements with OCP4 cluster(s) as-is or recommendations for customers to configure cluster(s) accordingly in their own environment when it is their responsibility, on a control-by-control basis. Where applicable, OSCAL and its rules provide machine-readable instructions for recommended security tools to evaluate security and privacy control requirements are met and provide machine-readable evidence of such requirements.

+ + + + + +

Control implementations and their documented requirements for OCP4 from the NIST 800-53 Revision 5 Catalog (sourced from NIST ITL CSD's official OSCAL catalog).

+ + + +

+ OCP4 implements requirements to support NIST 800-53 Revision 5 control CM-6: Configuration Settings. +

+ + + common secure configurations from official RedHat or community OpenSCAP sources + + + + +

Configuration managers can use the product's functionality to establish and document configuration settings for OCP4 cluster(s) employed within the system. When not using system defaults, configuration managers can use that reflect the most restrictive mode consistent with operational requirements.

+ + + + + + + + \ No newline at end of file diff --git a/src/metaschema/oscal_component_metaschema.xml b/src/metaschema/oscal_component_metaschema.xml index a74385fb18..794cc88c32 100644 --- a/src/metaschema/oscal_component_metaschema.xml +++ b/src/metaschema/oscal_component_metaschema.xml @@ -388,8 +388,11 @@ - - condition + + + +

Multiple rule implementations can be provided to describe alternative approaches for using rules to evaluate the implementation and effectiveness of the containing control.

+ @@ -447,6 +450,9 @@ + +

Multiple rule implementations can be provided to describe alternative rule-based implementations used to evaluate the implementation and effectiveness of the containing control statement.

+ diff --git a/src/metaschema/oscal_rules-common_metaschema.xml b/src/metaschema/oscal_rules-common_metaschema.xml index a948111db6..8175a3f440 100644 --- a/src/metaschema/oscal_rules-common_metaschema.xml +++ b/src/metaschema/oscal_rules-common_metaschema.xml @@ -31,7 +31,7 @@ - + @@ -42,6 +42,11 @@ + + Rule Universally Unique Identifier Reference + A rule UUID reference + + Test Definition TODO @@ -65,7 +70,7 @@ - + @@ -100,10 +105,10 @@ - + - + Test Reference TODO - + condition + + + + + + + - - - + - - Testing Scenario Universally Unique Identifier Reference - A testing scenario UUID reference - - + Testing Scenario Universally Unique Identifier - A testing scenari UUID reference + A testing scenario UUID reference Testing Scenario Reference A reference to a testing scenario. - + Testing Scenario Universally Unique Identifier Reference - TODO + A testing scenario UUID reference - @@ -194,19 +194,27 @@ Rule Implementation Universally Unique Identifier TODO - - Rule Implementation Description - A summary of the rule implementation. - + + Rule Implementation Description + A summary of the rule implementation. + - - + + + condition + + + Provides a placeholder for cases where a rule can be identified, but the specific tests to evaluate the rule cannot be identified. + + + +