Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Patching control info at arbitrary granularity / addressability of control contents #70

Closed
wendellpiez opened this issue Nov 29, 2017 · 11 comments
Closed

Patching control info at arbitrary granularity / addressability of control contents #70

wendellpiez opened this issue Nov 29, 2017 · 11 comments
Assignees
@wendellpiez @brian-ruf
Labels
LoE: Large Scope: Modeling Issues targeted at development of OSCAL formats User Story
Milestone
OSCAL 1.0 Milesto...

Comments

@wendellpiez
Copy link
Contributor

wendellpiez commented Nov 29, 2017 •
edited
Loading

At time of writing, we can patch at the "statement" level by specifying the deletion of control contents (parts, properties) and by augmenting controls (and subcontrols) with arbitrary contents (including new parts and properties to replace or supplement the old ones). But we do not have the capability to patch at finer levels of granularity -- for example, by removing or adding a single item to an 'objective' hierarchy (see //part[@class='objective'] in SP800-53).

Goals

Extend the addressing capabilities of alter elements in profiles so elements at arbitrary levels of granularity can be patched (contents edited/overwritten) in catalogs or (resolved) profiles being called. Demonstrate the capability in profile resolution (and display) logic.

Dependency

Examples demonstrating use cases in scope. Patching a single item inside an 'objective' hierarchy could be one. A pathological example might have to be created for very narrow patches such as a single list item inside a list.

NB that when deleting ol/li, the remaining ol/li in a list will be renumbered in (dynamic) display, so no "hole" ("missing list item") is visible. Entire statements (part elements) with labels, when removed, will however show jumps in numbering (where numbers are actually properties of the OSCAL statements, not display-time). Examples should illustrate this distinction.

Acceptance Criteria

  • New examples(s) are added to the mini-testing library demonstrating these capabilities. They are commented and documented appropriately.
  • Both removal/deletion of (granular) elements from controls, and augmentation/adding (at the point of address) are demonstrated.
  • The solution including any syntax rules is documented for implementors. This includes discussion of when "holes will be visible" (as when statements with labels or visible names are removed) or not, as described above.

Notes

It is tempting to think about a little addressing language (I have notes), and somewhat daunting to think about its implementation. (Even if here we need to address within the scope of a single control/subcontrol, not arbitrarily in document or global scope.)

A consideration is that for deletion, selecting multiple elements (contents) at once is a feature, but for augmenting -- can a single patch affect multiple locations? Evidently, we need to be able to address specific elements, i.e. things like item[2] or item[2] description. A bare-bones version could permit addressing by ID (#id) or index (item[2]). XPath 1.0 could also offer an escape hatch (albeit with a new dependency).
david-waltermire added a commit that referenced this issue Apr 3, 2018
@david-waltermire
# This is a combination of 29 commits.
5b13d9d 
# The first commit's message is:

# This is a combination of 54 commits.
# The first commit's message is:

# This is a combination of 4 commits.
# The first commit's message is:

# This is a combination of 2 commits.
# The first commit's message is:

# This is a combination of 2 commits.
# The first commit's message is:

# This is a combination of 6 commits.
# The first commit's message is:

# This is a combination of 3 commits.
# The first commit's message is:

# This is a combination of 111 commits.
# The first commit's message is:

Initial commit of docs branch.

# This is the commit message #2:

Create CONTRIBUTING.md
# This is the commit message #3:

Create ROADMAP.md
# This is the commit message #4:

Update README.md
# This is the commit message #5:

Create README.md
# This is the commit message #6:

Update README.md
# This is the commit message #7:

Update README.md
# This is the commit message #8:

Create OSCAL-PRODUCERS.md
# This is the commit message #9:

Create OSCAL-CONSUMERS.md
# This is the commit message #10:

Update and rename OSCAL-CONSUMERS.md to USERS.md
# This is the commit message #11:

Update and rename OSCAL-PRODUCERS.md to IMPLEMENTERS.md
# This is the commit message #12:

Rename CONTRIBUTING.md to CONTRIBUTORS.md
# This is the commit message #13:

Update README.md
# This is the commit message #14:

Update README.md
# This is the commit message #15:

Update USERS.md
# This is the commit message #16:

Update README.md
# This is the commit message #17:

Update IMPLEMENTERS.md
# This is the commit message #18:

Update README.md
# This is the commit message #19:

Update ROADMAP.md
# This is the commit message #20:

Update USERS.md
# This is the commit message #21:

Update CONTRIBUTORS.md
# This is the commit message #22:

Update README.md
# This is the commit message #23:

Update README.md
# This is the commit message #24:

Update IMPLEMENTERS.md
# This is the commit message #25:

Update IMPLEMENTERS.md
# This is the commit message #26:

Rename CONTRIBUTORS.md to CONTRIBUTING.md
# This is the commit message #27:

Create control.md
# This is the commit message #28:

Update control.md
# This is the commit message #29:

Update control.md
# This is the commit message #30:

Update control.md
# This is the commit message #31:

Update control.md
# This is the commit message #32:

Add files via upload
# This is the commit message #33:

Update control.md
# This is the commit message #34:

Create temp.md
# This is the commit message #35:

Delete NIST-SP-800-53-Rev4-AC1.png
# This is the commit message #36:

Add files via upload
# This is the commit message #37:

Delete temp.md
# This is the commit message #38:

Add files via upload
# This is the commit message #39:

Update control.md
# This is the commit message #40:

Add files via upload
# This is the commit message #41:

Add files via upload
# This is the commit message #42:

Update control.md
# This is the commit message #43:

Update CONTRIBUTING.md
# This is the commit message #44:

Update CONTRIBUTING.md
# This is the commit message #45:

Update USERS.md
# This is the commit message #46:

Update CONTRIBUTING.md
# This is the commit message #47:

Delete CONTRIBUTING.md
# This is the commit message #48:

Delete USERS.md
# This is the commit message #49:

Add files via upload
# This is the commit message #50:

Delete CSA-CCM-IAM02.png
# This is the commit message #51:

Update control.md
# This is the commit message #52:

Update control.md
# This is the commit message #53:

Update control.md
# This is the commit message #54:

Update control.md
# This is the commit message #55:

Update control.md
# This is the commit message #56:

Update control.md
# This is the commit message #57:

Update control.md
# This is the commit message #58:

Update control.md
# This is the commit message #59:

Update control.md
# This is the commit message #60:

Update control.md
# This is the commit message #61:

Delete NIST-SP-800-53-AC1-in-OSCAL-XML.png
# This is the commit message #62:

Update README.md
# This is the commit message #63:

Update control.md
# This is the commit message #64:

Update control.md
# This is the commit message #65:

Add files via upload
# This is the commit message #66:

Delete ISO-27001-Control-A9.png
# This is the commit message #67:

Update control.md
# This is the commit message #68:

Add files via upload
# This is the commit message #69:

Add files via upload
# This is the commit message #70:

Delete ISO-27002-Control-9.1.1-part1.png
# This is the commit message #71:

Delete ISO-27002-Control-9.1.1-part2.png
# This is the commit message #72:

Update control.md
# This is the commit message #73:

Update control.md
# This is the commit message #74:

Update control.md
# This is the commit message #75:

Update control.md
# This is the commit message #76:

Update control.md
# This is the commit message #77:

Update README.md
# This is the commit message #78:

Update IMPLEMENTERS.md
# This is the commit message #79:

Add files via upload
# This is the commit message #80:

Delete oscal-layers.png
# This is the commit message #81:

Add files via upload
# This is the commit message #82:

Delete oscal-layers.png
# This is the commit message #83:

Add files via upload
# This is the commit message #84:

Update IMPLEMENTERS.md
# This is the commit message #85:

Update control.md
# This is the commit message #86:

Update IMPLEMENTERS.md
# This is the commit message #87:

Update control.md
# This is the commit message #88:

Rename IMPLEMENTERS.md to docs/prose/IMPLEMENTERS.md
# This is the commit message #89:

Rename IMPLEMENTERS.md to implementers.md
# This is the commit message #90:

Rearranged and outlined catalog documentation based on the conversation with karen and Wendell.

# This is the commit message #91:

Create catalog-xml.md
# This is the commit message #92:

Rename control.md to catalog.md
# This is the commit message #93:

Update catalog.md
# This is the commit message #94:

Update catalog.md
# This is the commit message #95:

Update catalog.md
# This is the commit message #96:

Update catalog-xml.md
# This is the commit message #97:

Update catalog-xml.md
# This is the commit message #98:

Update catalog-xml.md
# This is the commit message #99:

Update catalog-xml.md
# This is the commit message #100:

Update catalog-xml.md
# This is the commit message #101:

Update catalog-xml.md
# This is the commit message #102:

Update catalog-xml.md
# This is the commit message #103:

Update catalog-xml.md
# This is the commit message #104:

Update catalog-xml.md
# This is the commit message #105:

Update catalog-xml.md
# This is the commit message #106:

Docset migration to Slate

# This is the commit message #107:

Removing unused file.

# This is the commit message #108:

Update README.md

Corrected a typo
# This is the commit message #109:

Add files via upload

Graphical representation of OSCAL schemas aligned with Risk Management Framework steps and tasks.
# This is the commit message #110:

Create CONTRIBUTING.md
# This is the commit message #111:

Create ROADMAP.md
# This is the commit message #2:

Create README.md
# This is the commit message #3:

Update README.md
# This is the commit message #2:

Create OSCAL-PRODUCERS.md
# This is the commit message #3:

Create OSCAL-CONSUMERS.md
# This is the commit message #4:

Update and rename OSCAL-CONSUMERS.md to USERS.md
# This is the commit message #5:

Update and rename OSCAL-PRODUCERS.md to IMPLEMENTERS.md
# This is the commit message #6:

Rename CONTRIBUTING.md to CONTRIBUTORS.md
# This is the commit message #2:

Update USERS.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #2:

Update ROADMAP.md
# This is the commit message #3:

Update USERS.md
# This is the commit message #4:

Update CONTRIBUTORS.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #3:

Update IMPLEMENTERS.md
# This is the commit message #4:

Rename CONTRIBUTORS.md to CONTRIBUTING.md
# This is the commit message #5:

Create control.md
# This is the commit message #6:

Update control.md
# This is the commit message #7:

Update control.md
# This is the commit message #8:

Update control.md
# This is the commit message #9:

Update control.md
# This is the commit message #10:

Add files via upload
# This is the commit message #11:

Update control.md
# This is the commit message #12:

Create temp.md
# This is the commit message #13:

Delete NIST-SP-800-53-Rev4-AC1.png
# This is the commit message #14:

Add files via upload
# This is the commit message #15:

Delete temp.md
# This is the commit message #16:

Add files via upload
# This is the commit message #17:

Update control.md
# This is the commit message #18:

Add files via upload
# This is the commit message #19:

Add files via upload
# This is the commit message #20:

Update control.md
# This is the commit message #21:

Update CONTRIBUTING.md
# This is the commit message #22:

Update CONTRIBUTING.md
# This is the commit message #23:

Update USERS.md
# This is the commit message #24:

Update CONTRIBUTING.md
# This is the commit message #25:

Delete CONTRIBUTING.md
# This is the commit message #26:

Delete USERS.md
# This is the commit message #27:

Add files via upload
# This is the commit message #28:

Delete CSA-CCM-IAM02.png
# This is the commit message #29:

Update control.md
# This is the commit message #30:

Update control.md
# This is the commit message #31:

Update control.md
# This is the commit message #32:

Update control.md
# This is the commit message #33:

Update control.md
# This is the commit message #34:

Update control.md
# This is the commit message #35:

Update control.md
# This is the commit message #36:

Update control.md
# This is the commit message #37:

Update control.md
# This is the commit message #38:

Update control.md
# This is the commit message #39:

Delete NIST-SP-800-53-AC1-in-OSCAL-XML.png
# This is the commit message #40:

Update README.md
# This is the commit message #41:

Update control.md
# This is the commit message #42:

Update control.md
# This is the commit message #43:

Add files via upload
# This is the commit message #44:

Delete ISO-27001-Control-A9.png
# This is the commit message #45:

Update control.md
# This is the commit message #46:

Add files via upload
# This is the commit message #47:

Add files via upload
# This is the commit message #48:

Delete ISO-27002-Control-9.1.1-part1.png
# This is the commit message #49:

Delete ISO-27002-Control-9.1.1-part2.png
# This is the commit message #50:

Update control.md
# This is the commit message #51:

Update control.md
# This is the commit message #52:

Update control.md
# This is the commit message #53:

Update control.md
# This is the commit message #54:

Update control.md
# This is the commit message #2:

Update IMPLEMENTERS.md
# This is the commit message #3:

Add files via upload
# This is the commit message #4:

Delete oscal-layers.png
# This is the commit message #5:

Add files via upload
# This is the commit message #6:

Delete oscal-layers.png
# This is the commit message #7:

Add files via upload
# This is the commit message #8:

Update IMPLEMENTERS.md
# This is the commit message #9:

Update control.md
# This is the commit message #10:

Update IMPLEMENTERS.md
# This is the commit message #11:

Update control.md
# This is the commit message #12:

Rename IMPLEMENTERS.md to docs/prose/IMPLEMENTERS.md
# This is the commit message #13:

Rename IMPLEMENTERS.md to implementers.md
# This is the commit message #14:

Rearranged and outlined catalog documentation based on the conversation with karen and Wendell.

# This is the commit message #15:

Create catalog-xml.md
# This is the commit message #16:

Rename control.md to catalog.md
# This is the commit message #17:

Update catalog.md
# This is the commit message #18:

Update catalog.md
# This is the commit message #19:

Update catalog.md
# This is the commit message #20:

Update catalog-xml.md
# This is the commit message #21:

Update catalog-xml.md
# This is the commit message #22:

Update catalog-xml.md
# This is the commit message #23:

Update catalog-xml.md
# This is the commit message #24:

Update catalog-xml.md
# This is the commit message #25:

Update catalog-xml.md
# This is the commit message #26:

Update catalog-xml.md
# This is the commit message #27:

Update catalog-xml.md
# This is the commit message #28:

Update catalog-xml.md
# This is the commit message #29:

Fixed typos, updated repo documentation, and migrated documentation for use in Slate.

Corrected a typo (+4 squashed commit)

Squashed commit:

[6ada57f] Removing unused file.

[503ad71] Docset migration to Slate

[351257e] Update catalog-xml.md

[aae1e8b] Add files via upload

Graphical representation of OSCAL schemas aligned with Risk Management Framework steps and tasks.
@david-waltermire david-waltermire added this to the OSCAL 1.0 M1 milestone Apr 6, 2018
@david-waltermire david-waltermire added the Scope: Modeling Issues targeted at development of OSCAL formats label May 9, 2019
@wendellpiez
Copy link
Contributor Author

Suggest postponing this as not essential for Milestone 1, pending further development of requirements. It is likely this issue will come up again as we test and develop support for tailoring in the profile model.

@david-waltermire
Copy link
Contributor

@wendellpiez Can you summarize what still needs to be done on this issue?

@wendellpiez
Copy link
Contributor Author

wendellpiez commented Jun 19, 2019 •
edited
Loading

@david-waltermire-nist : this issue captures a what-if scenario, which we have not actually seen. It describes a hypothetical requirement given the present opacity of arbitrary-content-floating-in-prose. Eventually such requirements are likely to arise in the real world. But we do not know when, maybe not soon. Also there are workarounds.

Also, the design shortcoming this Issue addresses will only become an issue once we have profile resolution running dependably (it was in prototype when the Issue was composed), and can demonstrate and test patching, period.

In other words, this Issue has a dependency on another, namely "demonstrate profile resolution to show results of applying a profile to a catalog", which we could put in front of it.

@david-waltermire
Copy link
Contributor

We should identify a new set of issues to complete to address this.

@wendellpiez
Copy link
Contributor Author

Sprint 23 Progress Sep 3

We need to return to requirements definition for this, preferably with real-world examples or use cases in mind.

Looking at how well FedRAMP requirements are being met could be also be a start.

@wendellpiez
Copy link
Contributor Author

Also note that addressing this implies we have catalog resolution working in which to test it ...

@brian-ruf
Copy link
Contributor

Real-world example: AC-2 in FedRAMP Tailored for Low Impact (LI) SaaS (found [HERE] (https://www.fedramp.gov/assets/resources/templates/APPENDIX-B-FedRAMP-Tailored-LI-SaaS-Template.docx) in Section 14.1), which reads as follows:

The organization:
	(a)	Identifies and selects the following types of information system accounts to support organizational missions/business functions: [Assignment: organization-defined information system account types];
	(b)	[Excluded from FedRAMP Tailored for LI-SaaS]
	(c)	[Excluded from FedRAMP Tailored for LI-SaaS]
	(d)	[Excluded from FedRAMP Tailored for LI-SaaS]
	(e)	[Excluded from FedRAMP Tailored for LI-SaaS]
	(f)	Creates, enables, modifies, disables, and removes information system accounts in accordance with [Assignment: organization-defined procedures or conditions];
	(g)	Monitors the use of information system accounts; and
	(h)	Notifies account managers:
		(1)	When accounts are no longer required;
		(2)	When users are terminated or transferred; and
		(3)	When individual information system usage or need-to-know changes
	(i)	[Excluded from FedRAMP Tailored for LI-SaaS]
	(j)	[Excluded from FedRAMP Tailored for LI-SaaS]
	(k)	[Excluded from FedRAMP Tailored for LI-SaaS]

We initially modeled it like this:

		<alter control-id="ac-2">
			<remove id-ref="ac-2_smt.b" />
			<remove id-ref="ac-2_smt.c" />
			<remove id-ref="ac-2_smt.d" />
			<remove id-ref="ac-2_smt.e" />
			<remove id-ref="ac-2_smt.i" />
			<remove id-ref="ac-2_smt.j" />
			<remove id-ref="ac-2_smt.k" />
			<add position="ending">
				<prop name='assess' class='tailored-designation' ns='fedramp' />
				<part id="ac-2_fr" name="item" ns="fedramp">
					<title>AC-2 Additional FedRAMP Requirements and Guidance</title>
					<part id="ac-2_fr_gdn.1" name="guidance">
						<prop name="label">Guidance:</prop>
						<p>Parts (b), (c), (d), (e), (i), (j), and (k) are excluded from FedRAMP Tailored for LI-SaaS.</p>
					</part>
				</part>
			</add>
		</alter>

This is likely "good enough"; however, I would have liked to have modified (b), (c), (d), (e), (i), (j), and (k) to each include the text "[Excluded from FedRAMP Tailored for LI-SaaS]".

The existing syntax would have allowed me to first remove the statement, then add back in the "[Excluded from FedRAMP Tailored for LI-SaaS]"; however, the presentation sequence would no longer be correct. I would have had to insert these at the begging or end, when I needed to insert some in between other statements.

It is possible that the sequencing syntax added as a result of Issue #463 could address this issue. Once it is fully approved/available, we can revisit its applicability to this presentation issue.

@wendellpiez
Copy link
Contributor Author

One option here would be to provide for a replace clause in addition to add and remove. I think replacement will not be an infrequent requirement.

Another could be to support a value of "replace" on add/@position. This overloads "position" slightly but not in a way that breaks it (I don't think). Its semantics might be harder to make sense of -- we would have to stipulate that anything inside replaces something with the same id (wouldn't we?).

However, I also like the "good enough" approach, assuming users actually think it is good enough.

Finally, I note that the desired rendition (listing the removed items explicitly in the display as 'removed') could indeed be produced automatically by a process that had the original control along with the profile's alteration of it. One way of treating this issue is as a display requirement for profiles: show the places where things are removed.

@david-waltermire
Copy link
Contributor

@wendellpiez Can you review this issue and note what work still needs to be done?

@wendellpiez
Copy link
Contributor Author

I'd like to hear from @brianrufgsa looking at the AC-2 example cited above.

Specifically, how about the following? It is literalistic, but it captures the information does it not?

Alternatively - apart from this example - can we restate the functional gap being identified here, and current capabilities?

<alter control-id="ac-2">
    <remove id-ref="ac-2_smt.b" />
    <remove id-ref="ac-2_smt.c" />
    <remove id-ref="ac-2_smt.d" />
    <remove id-ref="ac-2_smt.e" />
    <remove id-ref="ac-2_smt.i" />
    <remove id-ref="ac-2_smt.j" />
    <remove id-ref="ac-2_smt.k" />
    <add id-ref="ac-2-_smt.b">
        <part id="ac-2_smt.b" name="item">
            <prop name="label">b.</prop>
            <p>[Excluded from FedRAMP Tailored for LI-SaaS]</p>
        </part>
    </add>
    <add id-ref="ac-2-_smt.c">
        <part id="ac-2_smt.c" name="item">
            <prop name="label">c.</prop>
            <p>[Excluded from FedRAMP Tailored for LI-SaaS]</p>
        </part>
    </add>
[ Etc ...]
</alter>

-- This would achieve the intended rendition. OTOH I kind of like your solution, which is lighter-weight.

@david-waltermire
Copy link
Contributor

I think we should close this issue in favor of creating more specific issues that address specific, individual tailoring features that need to be added.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@wendellpiez wendellpiez

@brian-ruf brian-ruf

Labels
LoE: Large Scope: Modeling Issues targeted at development of OSCAL formats User Story
Projects
None yet
Milestone
OSCAL 1.0 Milestone 3
Development

No branches or pull requests
3 participants
@wendellpiez @david-waltermire @brian-ruf