Feature to map / gap analyse two standards

[robvanderveer]

The mapping between two standards (say SAMM and NIST SSDF) can be done using the following algorithm.
Take SAMM
Go by every entry.
See if an SSDF entry is linked directly: output that
If not: walk upwards through parents until maybe an SSDF entry is linked directly to that: if so: report that and stop going upward
If nothing found: again, walk upwards and from the parent walk down to other children and report SSDF links with those, if any.
In addition: go to linked topics and report any SSDF entry linked to that, and add that it is through a linked topic.
With every SSDF entry, report the graph-steps that were taken to reach it.

Examples:
SAMM Training and awareness ->

Linked through Technical application security training ->
SSDF : PO.2.2 : Provide role-based training for all personnel with responsibilities that etc.

SAMM Architecture design ->

Linked through 'Architecture/design processes' through child ->
Describe high-level system architecture and perform threat modeling on it every critical change and regularly ->
SSDF : PW.1.1 : Use forms of risk modeling – such as threat modeling, etc. etc.

Linked to related 'Setup and maintain a secure software development process' ->
SSDF : PO.1.1 : Identify and document all security requirements etc.
SSDF : PO.3.1 : Specify which tools or tool types must or should be included..
SSDF : PO.3.2 : Follow recommended security practices to deploy, operate, and maintain tools etc.
SSDF : PO.5.1 : Separate and protect each environment involved in software development.
SSDF : PO.5.2 : Secure and harden development endpoints etc.

SAMM Technology management ->

Linked through 'Security requirements' to->
NIST SSDF : PO.1.2 : Identify and document all security requirements for developed software etc.

Linked to related 'Setup and maintain a secure software development process' ->
SSDF : PO.1.1 : Identify and document all security requirements etc.
SSDF : PO.3.1 : Specify which tools or tool types must or should be included..
SSDF : PO.3.2 : Follow recommended security practices to deploy, operate, and maintain tools etc.
SSDF : PO.5.1 : Separate and protect each environment involved in software development.
SSDF : PO.5.2 : Secure and harden development endpoints etc.

[john681611]

Plan: Use Neo4j (Docker for local, aura for hosted (free possible))
Modify CRE_Graph (db.py 159, CRE_Graph) to create nodes and edges in the. neo4j DB.
Use this query concept for gap analysis :D https://neo4j.com/developer/kb/all-shortest-paths-between-set-of-nodes/

[robvanderveer]

Nice