Commit 2a689d20 authored by Valerie Aurora (Bow Shock)'s avatar Valerie Aurora (Bow Shock)
Browse files

Add columns for new risk factors to UC table, delete some UC

parent 3605f4bf
Loading
Loading
Loading
Loading
+27 −40
Original line number Diff line number Diff line
@@ -567,14 +567,6 @@ _The following use cases are provided to assist manufacturers in selecting risk
  * connections are proxied by a trusted device, such as a mobile phone
  * is not exposed to a public network

* **UC-ST-1** Stateless multi-user terminal
  * effectively a keyboard, mouse, and display connected to remote server
  * multiple users, one user at a time
  * no local data or session storage
  * connects to trusted local network protected by firewall
  * potentially available to public
  * professional administration

* **UC-PC-1** A personal computer in a fixed and generally safe location
  * hardware, software and operating system may be configured and modified by the end-user
  * the user may not be either highly skilled or an authorized representative of the manufacturer
@@ -1788,8 +1780,6 @@ The overall risk related to each use case should be considered as a result of co
* NUSR-2: foreseeable use is primarily a single user account for an end-user authenticating, but supports multiple user accounts for end-users
* NUSR-3: foreseeable use of the operating system is multiple user accounts for end-users

> FIXME: add the separate concept of users apart from accounts

#### C.2.1.x User Account Concurrency

**[RF-CUSR]:** The number of user accounts expected to use the system concurrently, including administrator accounts if they are configurable or accessible by end-users.
@@ -2295,31 +2285,29 @@ Mitigations for Likelihood:

> FIXME: Need to update with current set of risk factors and fix the totals.

| Risk Factor  | NUSR   | CUSR   | DATA   | SNDS   | PHYS   | LOSS   | HWMD   | SWMD   | DVCS   | TNET   | FNET   | CONF   | _TOTAL_   |
|--------------|--------|--------|--------|--------|--------|--------|--------|--------|--------|--------|--------|--------|-----------|
| **Use Case** | ------ | ------ | ------ | ------ | ------ | ------ | ------ | ------ | ------ | ------ | ------ | ------ | --------- |
| **UC-LR**    | 0      | 0      | 0      | 0      | 0      | 0      | 0      | 0      | 0      | 0      | 0      | 0      | 0         |
| **UC-IoT-1** | 0      | 0      | 0      | 0      | 1      | 0      | 0      | 0      | 0      | 0      | 0      | 0      | 1         |
| **UC-IoT-2** | 0      | 0      | 1      | 1      | 1      | 0      | 0      | 0      | 0      | 1      | 0      | 1      | 4         |
| **UC-IoT-3** | 0      | 0      | 1      | 1      | 1      | 0      | 1      | 0      | 0      | 1      | 0      | 1      | 5         |
| **UC-OT-1**  | 0      | 0      | 1      | 1      | 1      | 0      | 0      | 0      | 0      | 2      | 2      | 2      | 8         |
| **UC-OT-2**  | 0      | 0      | 0      | 1      | 2      | 0      | 0      | 0      | 0      | 1      | 1      | 1      | 6         |
| **UC-MOB-1** | 1      | 1      | 2      | 3      | 1      | 3      | 0      | 3      | 2      | 2      | 2      | 2      | 22        |
| **UC-MOB-2** |        |        |        |        |        |        |        |        |        |        |        |        | --        |
| **UC-WE-1**  | 1      | 1      | 1      | 2      | 1      | 2      | 0      | 0      | 0      | 1      | 1      | 0      | 10        |
| **UC-ST-1**  |        |        |        |        |        |        |        |        |        |        |        |        | --        |
| **UC-PC-1**  | 1      | 2      | 2      | 2      | 0      | 0      | 2      | 2      | 1      | 2      | 1      | 2      | 15        |
| **UC-PC-2**  | 1      | 2      | 2      | 2      | 0      | 0      | 2      | 2      | 1      | 2      | 1      | 1      | 14        |
| **UC-LA-1**  | 1      | 2      | 2      | 2      | 1      | 1      | 1      | 2      | 2      | 2      | 2      | 2      | 19        |
| **UC-LA-2**  | 1      | 2      | 2      | 2      | 1      | 1      | 1      | 2      | 2      | 2      | 2      | 1      | 18        |
| **UC-SE-1**  | 0      | 0      | 2      | 2      | 0      | 0      | 1      | 2      | 1      | 1      | 1      | 0      | 11        |
| **UC-SE-2**  | 1      | 1      | 2      | 2      | 0      | 0      | 1      | 2      | 1      | 1      | 1      | 0      | 13        |
| **UC-SE-3**  | 2      | 3      | 2      | 2      | 0      | 0      | 1      | 2      | 1      | 1      | 1      | 0      | 15        |
| **UC-IF-1**  | 0      | 0      | 1      | 2      | 0      | 0      | 1      | 0      | 0      | 1      | 0      | 2      | 7         |
| **UC-IF-2**  | 0      | 0      | 1      | 2      | 0      | 0      | 1      | 0      | 0      | 2      | 1      | 2      | 8         |
| **UC-IF-3**  | 0      | 0      | 1      | 2      | 0      | 0      | 1      | 0      | 0      | 3      | 2      | 2      | 11        |
| **UC-FI-1**  | 0      | 0      | 1      | 2      | 0      | 0      | 1      | 0      | 0      | 3      | 1      | 2      | 10        |
| **UC-FI-2**  | 0      | 0      | 1      | 2      | 0      | 0      | 1      | 0      | 0      | 3      | 1      | 2      | 10        |
| Risk Factor  | NUSR | CUSR | DATA | SNDS | SNDT | SNFN | PHYS | UEIN | LOSS | HWMD | SWMD | DVCS | TNET | FNET | CONF | ADMN | SUPP | TOTAL |
|--------------|------|------|------|------|------|------|------|------|------|------|------|------|------|------|------|------|------|-------|
| **Use Case** | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ---- | ----- |
| **UC-LR**    | 0    | 0    | 0    | 0    | X    | X    | 0    | X    | 0    | 0    | 0    | 0    | 0    | 0    | 0    | X    | X    | 0     |
| **UC-IoT-1** | 0    | 0    | 0    | 0    | X    | X    | 1    | X    | 0    | 0    | 0    | 0    | 0    | 0    | 0    | X    | X    | 1     |
| **UC-IoT-2** | 0    | 0    | 1    | 1    | X    | X    | 1    | X    | 0    | 0    | 0    | 0    | 1    | 0    | 1    | X    | X    | 4     |
| **UC-IoT-3** | 0    | 0    | 1    | 1    | X    | X    | 1    | X    | 0    | 1    | 0    | 0    | 1    | 0    | 1    | X    | X    | 5     |
| **UC-OT-1**  | 0    | 0    | 1    | 1    | X    | X    | 1    | X    | 0    | 0    | 0    | 0    | 2    | 2    | 2    | X    | X    | 8     |
| **UC-OT-2**  | 0    | 0    | 0    | 1    | X    | X    | 2    | X    | 0    | 0    | 0    | 0    | 1    | 1    | 1    | X    | X    | 6     |
| **UC-MOB-1** | 1    | 1    | 2    | 3    | X    | X    | 1    | X    | 3    | 0    | 3    | 2    | 2    | 2    | 2    | X    | X    | 22    |
| **UC-WE-1**  | 1    | 1    | 1    | 2    | X    | X    | 1    | X    | 2    | 0    | 0    | 0    | 1    | 1    | 0    | X    | X    | 10    |
| **UC-PC-1**  | 1    | 2    | 2    | 2    | X    | X    | 0    | X    | 0    | 2    | 2    | 1    | 2    | 1    | 2    | X    | X    | 15    |
| **UC-PC-2**  | 1    | 2    | 2    | 2    | X    | X    | 0    | X    | 0    | 2    | 2    | 1    | 2    | 1    | 1    | X    | X    | 14    |
| **UC-LA-1**  | 1    | 2    | 2    | 2    | X    | X    | 1    | X    | 1    | 1    | 2    | 2    | 2    | 2    | 2    | X    | X    | 19    |
| **UC-LA-2**  | 1    | 2    | 2    | 2    | X    | X    | 1    | X    | 1    | 1    | 2    | 2    | 2    | 2    | 1    | X    | X    | 18    |
| **UC-SE-1**  | 0    | 0    | 2    | 2    | X    | X    | 0    | X    | 0    | 1    | 2    | 1    | 1    | 1    | 0    | X    | X    | 11    |
| **UC-SE-2**  | 1    | 1    | 2    | 2    | X    | X    | 0    | X    | 0    | 1    | 2    | 1    | 1    | 1    | 0    | X    | X    | 13    |
| **UC-SE-3**  | 2    | 3    | 2    | 2    | X    | X    | 0    | X    | 0    | 1    | 2    | 1    | 1    | 1    | 0    | X    | X    | 15    |
| **UC-IF-1**  | 0    | 0    | 1    | 2    | X    | X    | 0    | X    | 0    | 1    | 0    | 0    | 1    | 0    | 2    | X    | X    | 7     |
| **UC-IF-2**  | 0    | 0    | 1    | 2    | X    | X    | 0    | X    | 0    | 1    | 0    | 0    | 2    | 1    | 2    | X    | X    | 8     |
| **UC-IF-3**  | 0    | 0    | 1    | 2    | X    | X    | 0    | X    | 0    | 1    | 0    | 0    | 3    | 2    | 2    | X    | X    | 11    |
| **UC-FI-1**  | 0    | 0    | 1    | 2    | X    | X    | 0    | X    | 0    | 1    | 0    | 0    | 3    | 1    | 2    | X    | X    | 10    |
| **UC-FI-2**  | 0    | 0    | 1    | 2    | X    | X    | 0    | X    | 0    | 1    | 0    | 0    | 3    | 1    | 2    | X    | X    | 10    |

## C.6 Risk Tolerance

@@ -2404,7 +2392,7 @@ Description: A consumer-grade home wireless router
Description: A business-grade remote door locking system
|**UC-OT-2**    |    0 |    0 |    0 |    0 |    2 |    0 |    0 |    0 |    0 |    1 |    1 |    1 |       6 |

#### C.7.2.6 SP-MOB-1 & SP-MOB-2 :: RT-MEDIUM
#### C.7.2.6 SP-MOB-1 :: RT-MEDIUM

Description: A personal mobile device

@@ -2425,11 +2413,10 @@ Description: A personal mobile device
#### C.7.2.7 SP-WE-1 :: RT-????

Description: A wearable health tracker, such as a smart watch
|**UC-WE-1**    |    1 |    1 |    1 |    2 |    1 |    2 |    0 |    0 |    0 |    1 |    1 |    0 |      10 |

#### C.7.2.8 SP-ST-1 :: RT-????

Description: Stateless multi-user terminal
| Use Case | NUSR | CUSR | DATA | SNDS | PHYS | LOSS | HWMD | SWMD | DVCS | TNET | FNET | CONF | _TOTAL_ |
|----------|------|------|------|------|------|------|------|------|------|------|------|------|---------|
| UC-WE-1  | 1    | 1    | 1    | 2    | 1    | 2    | 0    | 0    | 0    | 1    | 1    | 0    | 10      |

#### C.7.2.9 SP-PC-1  ::  RT-LOW