Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Create OSCAL Implementation Layer and a POC Use Case #74

Closed
akarmel opened this issue Nov 30, 2017 · 10 comments
Closed

Create OSCAL Implementation Layer and a POC Use Case #74

akarmel opened this issue Nov 30, 2017 · 10 comments
Assignees
@wendellpiez @anweiss
Labels
LoE: Large User Story
Milestone
OSCAL 1.0 Milesto...

Comments

@akarmel
Copy link
Contributor

akarmel commented Nov 30, 2017

Goals:

  • Create POC Implementation Schema using OpenControl YAML as an example

Dependencies:

  • OpenControl YAML schema and example(s) - ANDREW WILL ADD ISSUE TAGS

Assessment Criteria:
-Demonstrate POC of how to implement the OSCAL Implementation Schema leveraging XML and JSON in a Docker container runtime (catalog, profile, implementation)
@anweiss
Copy link
Contributor

anweiss commented Nov 30, 2017 •
edited
Loading

Ref #72, #69 #68

@anweiss
Copy link
Contributor

anweiss commented Nov 30, 2017

Some additional details:

  • OpenControl schema files based on the antiquated Kwalify format can be found at https://github.com/opencontrol/schemas/tree/master/kwalify
  • The OpenControl component schema which can be closely mapped to the OSCAL implementation layer can be found at https://github.com/opencontrol/schemas/blob/master/kwalify/component/v3.1.0.yaml
    • the satisfies type is what actually connects a component of the system to the corresponding control
    • the parameters type can be mapped to OSCAL profile parameters
    • the implementation_status type denotes one or more states of a particular component of the system in reference to a particular control (i.e. "complete", "partial", "planned" or "none")
    • the control_origins type defines who/what is responsible for satisfying a particular component of a system
    • the covered_by type can be mapped to the OSCAL assessment results and mechanism layers and represents the notion of "behavior-driven" validation prose
      • 18F attempted this a while back in an example here ... where "BDD-like" tests (they used the Python "behave" BDD framework) define how the system should be validated (aka OSCAL mechanism) in order to satisfy the controls and that which are output back to the original components (aka OSCAL assessment results)
  • the OpenControl compliance-masonry tooling connects all of the pieces together to generate an SSP (aka OSCAL assessment)

@anweiss
Copy link
Contributor

anweiss commented Nov 30, 2017

@david-waltermire-nist @akarmel per our sprint 6 discussion, any idea if it would be possible for us to gain access to the CIS Benchmark sources in XML format so we can proceed with an applicability POC? ... namely in need of the XML sources for the CIS Docker Benchmark v1.1.0 and the CIS Kubernetes Benchmark v1.2.0 ... if not, I could also just extrapolate the pieces I need from the Benchmark PDFs by hand for the purposes of the POC

@gregelin
Copy link

gregelin commented Dec 1, 2017

@anweiss @david-waltermire-nist I would like to be added to this issue, please.

@gregelin
Copy link

gregelin commented Dec 1, 2017

OpenControl's satisfies text describes how a component of the IT system provides or contributes to the identified control requirement if the component is correctly configured and operating.

This is best thought of as an 'assertion' or 'attestation' that still needs verification.

This was referenced Dec 2, 2017
Closed
Closed
@akarmel
Copy link
Contributor Author

akarmel commented Dec 5, 2017 •
edited
Loading

Sprint 6 Progress Notes

@akarmel akarmel mentioned this issue Dec 5, 2017
Closed
@anweiss anweiss mentioned this issue Dec 5, 2017
Closed
@akarmel
Copy link
Contributor Author

akarmel commented Dec 12, 2017 •
edited
Loading

Sprint 6 Progress Notes

  • OpenControl schema has laid the early framework for the implementation. Andrew has done the mapping to OSCAL and generated an example in PR [do not merge] Implementation layer JSON schema and examples #81
  • OSCALkit tooling supports OpenControl YAML conversion to OSCAL formatted JSON
  • Docker applicability POC: Scaffolding created for a Docker plugin to parse OSCAL formatted JSON (implementation layer)

@akarmel
Copy link
Contributor Author

akarmel commented Dec 19, 2017

Sprint 6 Progress Notes

  • Wendell and Andrew created an XML model based on existing, developed OSCAL layers
    • Working on identifying gaps (e.g. ID reconciliation issue) and upgrading the OSCALkit tooling to support the same
  • Working plugin created for Docker POC, working on a visual demo showing applicability to the user
    • Dependency: Mapping between catalogs (e.g. cross-catalog mapping across ISO 27000 and NIST 800.53) OSCAL's role in mappings between standards #87
      • MECHANISM: Potentially create a mapping model to map between catalogs, at which layer does it exist and how are mappings created? Rudimentary framework mapping model has been created in OSCAL. EXAMPLE: OCIL - could be used as a way to collect data (assessment results layer)
      • MAPPING RESPONSIBILITY: Need to identify the party creating the mapping and whether or not they an authoritative source to create said mappings
        - Link to a Mapping Framework: https://awarenessandtraining.com/wp-content/uploads/2017/03/mapping.png

@akarmel
Copy link
Contributor Author

akarmel commented Jan 11, 2018

Sprint 6 Acceptance

  • Wendell and Andrew have completed their work and will have a conversation to ensure alignment and closure of this issue.
    • ID reconciliation issue is still and issue and will require a Gap Analysis / Process change. Profiles need to be generated that are correct from the start without the need to improvise IDs.

@akarmel
Copy link
Contributor Author

akarmel commented Jan 17, 2018

Sprint 7 Planning

  • Wendell and Andrew are happy where this stands. Data was mapped into OSCAL successfully.
  • Need to review the mapping with the team, what do we do with the data that doesn't map, and what do we do with the model moving forward?
  • ACTION: Create new issue to mature the Implementation model and clean up the data Improve identifer usage and references in FedRamp profiles #89

@akarmel akarmel closed this as completed Jan 17, 2018
@akarmel akarmel mentioned this issue Jan 17, 2018
Closed
david-waltermire added a commit that referenced this issue Apr 3, 2018
@david-waltermire
# This is a combination of 29 commits.
5b13d9d 
# The first commit's message is:

# This is a combination of 54 commits.
# The first commit's message is:

# This is a combination of 4 commits.
# The first commit's message is:

# This is a combination of 2 commits.
# The first commit's message is:

# This is a combination of 2 commits.
# The first commit's message is:

# This is a combination of 6 commits.
# The first commit's message is:

# This is a combination of 3 commits.
# The first commit's message is:

# This is a combination of 111 commits.
# The first commit's message is:

Initial commit of docs branch.

# This is the commit message #2:

Create CONTRIBUTING.md
# This is the commit message #3:

Create ROADMAP.md
# This is the commit message #4:

Update README.md
# This is the commit message #5:

Create README.md
# This is the commit message #6:

Update README.md
# This is the commit message #7:

Update README.md
# This is the commit message #8:

Create OSCAL-PRODUCERS.md
# This is the commit message #9:

Create OSCAL-CONSUMERS.md
# This is the commit message #10:

Update and rename OSCAL-CONSUMERS.md to USERS.md
# This is the commit message #11:

Update and rename OSCAL-PRODUCERS.md to IMPLEMENTERS.md
# This is the commit message #12:

Rename CONTRIBUTING.md to CONTRIBUTORS.md
# This is the commit message #13:

Update README.md
# This is the commit message #14:

Update README.md
# This is the commit message #15:

Update USERS.md
# This is the commit message #16:

Update README.md
# This is the commit message #17:

Update IMPLEMENTERS.md
# This is the commit message #18:

Update README.md
# This is the commit message #19:

Update ROADMAP.md
# This is the commit message #20:

Update USERS.md
# This is the commit message #21:

Update CONTRIBUTORS.md
# This is the commit message #22:

Update README.md
# This is the commit message #23:

Update README.md
# This is the commit message #24:

Update IMPLEMENTERS.md
# This is the commit message #25:

Update IMPLEMENTERS.md
# This is the commit message #26:

Rename CONTRIBUTORS.md to CONTRIBUTING.md
# This is the commit message #27:

Create control.md
# This is the commit message #28:

Update control.md
# This is the commit message #29:

Update control.md
# This is the commit message #30:

Update control.md
# This is the commit message #31:

Update control.md
# This is the commit message #32:

Add files via upload
# This is the commit message #33:

Update control.md
# This is the commit message #34:

Create temp.md
# This is the commit message #35:

Delete NIST-SP-800-53-Rev4-AC1.png
# This is the commit message #36:

Add files via upload
# This is the commit message #37:

Delete temp.md
# This is the commit message #38:

Add files via upload
# This is the commit message #39:

Update control.md
# This is the commit message #40:

Add files via upload
# This is the commit message #41:

Add files via upload
# This is the commit message #42:

Update control.md
# This is the commit message #43:

Update CONTRIBUTING.md
# This is the commit message #44:

Update CONTRIBUTING.md
# This is the commit message #45:

Update USERS.md
# This is the commit message #46:

Update CONTRIBUTING.md
# This is the commit message #47:

Delete CONTRIBUTING.md
# This is the commit message #48:

Delete USERS.md
# This is the commit message #49:

Add files via upload
# This is the commit message #50:

Delete CSA-CCM-IAM02.png
# This is the commit message #51:

Update control.md
# This is the commit message #52:

Update control.md
# This is the commit message #53:

Update control.md
# This is the commit message #54:

Update control.md
# This is the commit message #55:

Update control.md
# This is the commit message #56:

Update control.md
# This is the commit message #57:

Update control.md
# This is the commit message #58:

Update control.md
# This is the commit message #59:

Update control.md
# This is the commit message #60:

Update control.md
# This is the commit message #61:

Delete NIST-SP-800-53-AC1-in-OSCAL-XML.png
# This is the commit message #62:

Update README.md
# This is the commit message #63:

Update control.md
# This is the commit message #64:

Update control.md
# This is the commit message #65:

Add files via upload
# This is the commit message #66:

Delete ISO-27001-Control-A9.png
# This is the commit message #67:

Update control.md
# This is the commit message #68:

Add files via upload
# This is the commit message #69:

Add files via upload
# This is the commit message #70:

Delete ISO-27002-Control-9.1.1-part1.png
# This is the commit message #71:

Delete ISO-27002-Control-9.1.1-part2.png
# This is the commit message #72:

Update control.md
# This is the commit message #73:

Update control.md
# This is the commit message #74:

Update control.md
# This is the commit message #75:

Update control.md
# This is the commit message #76:

Update control.md
# This is the commit message #77:

Update README.md
# This is the commit message #78:

Update IMPLEMENTERS.md
# This is the commit message #79:

Add files via upload
# This is the commit message #80:

Delete oscal-layers.png
# This is the commit message #81:

Add files via upload
# This is the commit message #82:

Delete oscal-layers.png
# This is the commit message #83:

Add files via upload
# This is the commit message #84:

Update IMPLEMENTERS.md
# This is the commit message #85:

Update control.md
# This is the commit message #86:

Update IMPLEMENTERS.md
# This is the commit message #87:

Update control.md
# This is the commit message #88:

Rename IMPLEMENTERS.md to docs/prose/IMPLEMENTERS.md
# This is the commit message #89:

Rename IMPLEMENTERS.md to implementers.md
# This is the commit message #90:

Rearranged and outlined catalog documentation based on the conversation with karen and Wendell.

# This is the commit message #91:

Create catalog-xml.md
# This is the commit message #92:

Rename control.md to catalog.md
# This is the commit message #93:

Update catalog.md
# This is the commit message #94:

Update catalog.md
# This is the commit message #95:

Update catalog.md
# This is the commit message #96:

Update catalog-xml.md
# This is the commit message #97:

Update catalog-xml.md
# This is the commit message #98:

Update catalog-xml.md
# This is the commit message #99:

Update catalog-xml.md
# This is the commit message #100:

Update catalog-xml.md
# This is the commit message #101:

Update catalog-xml.md
# This is the commit message #102:

Update catalog-xml.md
# This is the commit message #103:

Update catalog-xml.md
# This is the commit message #104:

Update catalog-xml.md
# This is the commit message #105:

Update catalog-xml.md
# This is the commit message #106:

Docset migration to Slate

# This is the commit message #107:

Removing unused file.

# This is the commit message #108:

Update README.md

Corrected a typo
# This is the commit message #109:

Add files via upload

Graphical representation of OSCAL schemas aligned with Risk Management Framework steps and tasks.
# This is the commit message #110:

Create CONTRIBUTING.md
# This is the commit message #111:

Create ROADMAP.md
# This is the commit message #2:

Create README.md
# This is the commit message #3:

Update README.md
# This is the commit message #2:

Create OSCAL-PRODUCERS.md
# This is the commit message #3:

Create OSCAL-CONSUMERS.md
# This is the commit message #4:

Update and rename OSCAL-CONSUMERS.md to USERS.md
# This is the commit message #5:

Update and rename OSCAL-PRODUCERS.md to IMPLEMENTERS.md
# This is the commit message #6:

Rename CONTRIBUTING.md to CONTRIBUTORS.md
# This is the commit message #2:

Update USERS.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #2:

Update ROADMAP.md
# This is the commit message #3:

Update USERS.md
# This is the commit message #4:

Update CONTRIBUTORS.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #3:

Update IMPLEMENTERS.md
# This is the commit message #4:

Rename CONTRIBUTORS.md to CONTRIBUTING.md
# This is the commit message #5:

Create control.md
# This is the commit message #6:

Update control.md
# This is the commit message #7:

Update control.md
# This is the commit message #8:

Update control.md
# This is the commit message #9:

Update control.md
# This is the commit message #10:

Add files via upload
# This is the commit message #11:

Update control.md
# This is the commit message #12:

Create temp.md
# This is the commit message #13:

Delete NIST-SP-800-53-Rev4-AC1.png
# This is the commit message #14:

Add files via upload
# This is the commit message #15:

Delete temp.md
# This is the commit message #16:

Add files via upload
# This is the commit message #17:

Update control.md
# This is the commit message #18:

Add files via upload
# This is the commit message #19:

Add files via upload
# This is the commit message #20:

Update control.md
# This is the commit message #21:

Update CONTRIBUTING.md
# This is the commit message #22:

Update CONTRIBUTING.md
# This is the commit message #23:

Update USERS.md
# This is the commit message #24:

Update CONTRIBUTING.md
# This is the commit message #25:

Delete CONTRIBUTING.md
# This is the commit message #26:

Delete USERS.md
# This is the commit message #27:

Add files via upload
# This is the commit message #28:

Delete CSA-CCM-IAM02.png
# This is the commit message #29:

Update control.md
# This is the commit message #30:

Update control.md
# This is the commit message #31:

Update control.md
# This is the commit message #32:

Update control.md
# This is the commit message #33:

Update control.md
# This is the commit message #34:

Update control.md
# This is the commit message #35:

Update control.md
# This is the commit message #36:

Update control.md
# This is the commit message #37:

Update control.md
# This is the commit message #38:

Update control.md
# This is the commit message #39:

Delete NIST-SP-800-53-AC1-in-OSCAL-XML.png
# This is the commit message #40:

Update README.md
# This is the commit message #41:

Update control.md
# This is the commit message #42:

Update control.md
# This is the commit message #43:

Add files via upload
# This is the commit message #44:

Delete ISO-27001-Control-A9.png
# This is the commit message #45:

Update control.md
# This is the commit message #46:

Add files via upload
# This is the commit message #47:

Add files via upload
# This is the commit message #48:

Delete ISO-27002-Control-9.1.1-part1.png
# This is the commit message #49:

Delete ISO-27002-Control-9.1.1-part2.png
# This is the commit message #50:

Update control.md
# This is the commit message #51:

Update control.md
# This is the commit message #52:

Update control.md
# This is the commit message #53:

Update control.md
# This is the commit message #54:

Update control.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #3:

Add files via upload
# This is the commit message #4:

Delete oscal-layers.png
# This is the commit message #5:

Add files via upload
# This is the commit message #6:

Delete oscal-layers.png
# This is the commit message #7:

Add files via upload
# This is the commit message #8:

Update IMPLEMENTERS.md
# This is the commit message #9:

Update control.md
# This is the commit message #10:

Update IMPLEMENTERS.md
# This is the commit message #11:

Update control.md
# This is the commit message #12:

Rename IMPLEMENTERS.md to docs/prose/IMPLEMENTERS.md
# This is the commit message #13:

Rename IMPLEMENTERS.md to implementers.md
# This is the commit message #14:

Rearranged and outlined catalog documentation based on the conversation with karen and Wendell.

# This is the commit message #15:

Create catalog-xml.md
# This is the commit message #16:

Rename control.md to catalog.md
# This is the commit message #17:

Update catalog.md
# This is the commit message #18:

Update catalog.md
# This is the commit message #19:

Update catalog.md
# This is the commit message #20:

Update catalog-xml.md
# This is the commit message #21:

Update catalog-xml.md
# This is the commit message #22:

Update catalog-xml.md
# This is the commit message #23:

Update catalog-xml.md
# This is the commit message #24:

Update catalog-xml.md
# This is the commit message #25:

Update catalog-xml.md
# This is the commit message #26:

Update catalog-xml.md
# This is the commit message #27:

Update catalog-xml.md
# This is the commit message #28:

Update catalog-xml.md
# This is the commit message #29:

Fixed typos, updated repo documentation, and migrated documentation for use in Slate.

Corrected a typo (+4 squashed commit)

Squashed commit:

[6ada57f] Removing unused file.

[503ad71] Docset migration to Slate

[351257e] Update catalog-xml.md

[aae1e8b] Add files via upload

Graphical representation of OSCAL schemas aligned with Risk Management Framework steps and tasks.
@david-waltermire david-waltermire added this to the OSCAL 1.0 M1 milestone Apr 6, 2018
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@wendellpiez wendellpiez

@anweiss anweiss

Labels
LoE: Large User Story
Projects
None yet
Milestone
OSCAL 1.0 Milestone 1
Development

No branches or pull requests
5 participants
@gregelin @wendellpiez @anweiss @david-waltermire @akarmel