From 53db537a31f17f53e3fad30e97196064824486b2 Mon Sep 17 00:00:00 2001 From: Alexander Stein Date: Fri, 2 Sep 2022 09:13:53 -0400 Subject: [PATCH 1/4] Updates to model and examples for usnistgov/OSCAL#1364. --- src/metaschema/examples/rules-component.xml | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/src/metaschema/examples/rules-component.xml b/src/metaschema/examples/rules-component.xml index 1bc5007f26..4116949ccf 100644 --- a/src/metaschema/examples/rules-component.xml +++ b/src/metaschema/examples/rules-component.xml @@ -1,11 +1,10 @@ - Example Component Definition for Openshift Container Platform v4, Rules, and Tests - 2022-08-23T00:00:00.000000000-04:00 + 2022-08-23T00:00:00.000000001-04:00 0.0.1-alpha 1.2.0 @@ -117,11 +116,15 @@

Configuration managers can use the product's functionality to establish and document configuration settings for OCP4 cluster(s) employed within the system. When not using system defaults, configuration managers can use that reflect the most restrictive mode consistent with operational requirements.

 + + +

This rule and test are evidence of how the use of properly configured OpenShift satisfies part of this requirement.

+ + + + + - - - - From 7948188d8ead3957b20f3dd6c728a4174412747f Mon Sep 17 00:00:00 2001 From: Alexander Stein Date: Fri, 2 Sep 2022 09:16:30 -0400 Subject: [PATCH 2/4] [WIP] Example SSP w/ rules for usnistgov/OSCAL#1364. --- src/metaschema/examples/rules-ssp.xml | 70 +++++++++++++++++++++++++++ 1 file changed, 70 insertions(+) create mode 100644 src/metaschema/examples/rules-ssp.xml diff --git a/src/metaschema/examples/rules-ssp.xml b/src/metaschema/examples/rules-ssp.xml new file mode 100644 index 0000000000..701e229ae2 --- /dev/null +++ b/src/metaschema/examples/rules-ssp.xml @@ -0,0 +1,70 @@ + + + + Example System Security Plan with Rules and Tests + 2022-08-23T00:00:00.000000001-04:00 + 0.0.1-alpha + 1.2.0 + + + + 103e77a8-ab96-4767-9625-19940fefde5f + Example System + +

This is an example system to demonstrate a system security plan with rules, tests, and relations to control implementation requirements as evidence.

+ + 2022-08-23 + fips-199-moderate + + + Summary of System Development Information in Example System + +

This application contains system development data.

+ + + fips-199-low + fips-199-low + + + fips-199-low + fips-199-low + + + fips-199-low + fips-199-low + + + + + fips-199-moderate + fips-199-moderate + fips-199-moderate + + + + + + + System Developer Privilege + add functionality + modify functionality + maintain deploy system in environment + + + + + + + + + + + + + + + + + \ No newline at end of file From 4357d171605d2dd0b07230d298389198f3714a0f Mon Sep 17 00:00:00 2001 From: Alexander Stein Date: Fri, 2 Sep 2022 12:10:48 -0400 Subject: [PATCH 3/4] Add missing assembly refs for rule-impl in c-i statement. --- src/metaschema/oscal_ssp_metaschema.xml | 12 ++++++++++++ 1 file changed, 12 insertions(+) diff --git a/src/metaschema/oscal_ssp_metaschema.xml b/src/metaschema/oscal_ssp_metaschema.xml index 494aac7589..3ee4e30663 100644 --- a/src/metaschema/oscal_ssp_metaschema.xml +++ b/src/metaschema/oscal_ssp_metaschema.xml @@ -801,6 +801,12 @@ + + + +

Multiple rule implementations can be provided to describe alternative rule-based implementations used to evaluate the implementation and effectiveness of the containing control statement.

+ + @@ -1031,6 +1037,12 @@ + + + +

Multiple rule implementations can be provided to describe alternative approaches for using rules to evaluate the implementation and effectiveness of the containing control.

+ + From cc16604352b71c7884b8a80a092fabcf7a983262 Mon Sep 17 00:00:00 2001 From: Alexander Stein Date: Fri, 2 Sep 2022 12:15:00 -0400 Subject: [PATCH 4/4] Add example meeting from 20220902 model meeting. --- src/metaschema/examples/rules-ssp.xml | 61 +++++++++++++++++++++++++-- 1 file changed, 57 insertions(+), 4 deletions(-) diff --git a/src/metaschema/examples/rules-ssp.xml b/src/metaschema/examples/rules-ssp.xml index 701e229ae2..e48bf5baf2 100644 --- a/src/metaschema/examples/rules-ssp.xml +++ b/src/metaschema/examples/rules-ssp.xml @@ -43,6 +43,14 @@ fips-199-moderate + + +

There is no authorization boundary for the application.

+ + +

This is a notional example that will be permenantely in a development state. No authorization boundary will be defined.

+ + @@ -53,14 +61,59 @@ maintain deploy system in environment - - - + + Monitoring System Logging for Indicators of Compromise Commands in Privileged Contacts + +

When threat actors want to confirm they have successfully performed privilege escalation, they will want to confirm they have elevated system privileges.

+

Responsible staff for a given role must monitor systems logs in a centralized logging system to confirm organizationally-recommended commands have not been run in a privileged context.

+
    +
  • whoami
    • +
  • id
    • +
  • groups
    • +
  • env
    • +
+ + + + + + + + +

This test documents which Splunk commands you will run to look for commands associated with indicators of compromise.

+ + +

The internal structure of structuring and passing parameters of the query is yet to be determined.

+ + + + + - + Example System Core Component + +

This component documents Example System, an information system under development that makes use of automated system evaluation with rules.

+ + + + +

This is an example system to demonstrate the use of rules for auditing requirements.

+ + +

Example System follows the Risk Management Framework as defined in SP 800-37 and 800-53 for risk management, privacy, and security guidance.

+ + + + +

This describes how Example System requires system operators to perform a full text analysis of logged privileged commands in a physically distinct component or subsystem of the system, or other system that is dedicated to that analysis.

+ + + + +