Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add the inter-boundary-component-has-class-attribute constraint #1067

Merged
Show file tree
Hide file tree
Changes from 3 commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions features/fedramp_extensions.feature
Original file line number Diff line number Diff line change
Expand Up @@ -121,6 +121,7 @@ Examples:
| information-type-has-integrity-impact |
| information-type-system |
| inter-boundary-component-has-information-type |
| inter-boundary-component-information-type-has-class-attribute |
| interconnection-direction |
| interconnection-security |
| inventory-item-allows-authenticated-scan |
Expand Down Expand Up @@ -386,6 +387,8 @@ Examples:
| information-type-system-PASS.yaml |
| inter-boundary-component-has-information-type-FAIL.yaml |
| inter-boundary-component-has-information-type-PASS.yaml |
| inter-boundary-component-information-type-has-class-attribute-FAIL.yaml |
| inter-boundary-component-information-type-has-class-attribute-PASS.yaml |
| interconnection-direction-FAIL.yaml |
| interconnection-direction-PASS.yaml |
| interconnection-security-FAIL.yaml |
Expand Down
Original file line number Diff line number Diff line change
Expand Up @@ -1857,10 +1857,8 @@ compliance (e.g., Module in Process).</p>
<prop name="implementation-point" value="external"/>
<prop name="direction" value="incoming" ns="http://fedramp.gov/ns/oscal"/>
<prop name="direction" value="outgoing" ns="http://fedramp.gov/ns/oscal"/>

<prop ns="http://fedramp.gov/ns/oscal" name="information-type" class="incoming" value="C.3.5.1"/>
<prop ns="http://fedramp.gov/ns/oscal" name="information-type" class="outgoing" value="C.3.5.8"/>

<prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
<remarks>
<p>If 'yes', describe the authentication method.</p>
Expand Down Expand Up @@ -2286,10 +2284,8 @@ approved.</p>
<prop name="implementation-point" value="external"/>
<prop name="direction" value="incoming" ns="http://fedramp.gov/ns/oscal"/>
<prop name="direction" value="outgoing" ns="http://fedramp.gov/ns/oscal"/>

<prop ns="http://fedramp.gov/ns/oscal" name="information-type" class="incoming" value="C.3.5.1"/>
<prop ns="http://fedramp.gov/ns/oscal" name="information-type" class="outgoing" value="C.3.5.8"/>

<prop ns="http://fedramp.gov/ns/oscal" name="authentication-method" value="yes">
<remarks>
<p>If 'yes', describe the authentication method.</p>
Expand Down Expand Up @@ -2643,7 +2639,7 @@ SSP authors must add implmentations for all required controls.
</description>
<link href="#11111111-2222-4000-8000-001000000005" rel="policy"/>
<link href="#11111111-2222-4000-8000-001000000023" rel="procedure"/>
<implementation-status state="operational"/>
<implementation-status state="implemented"/>
<responsible-role role-id="system-admin">
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
</responsible-role>
Expand All @@ -2658,7 +2654,7 @@ SSP authors must add implmentations for all required controls.
<p>Component approach. This links to a component representing the Identity Management and Access Control Policy.</p>
<p>That component contains a link to the policy, so it does not have to be linked here too.</p>
</description>
<implementation-status state="operational"/>
<implementation-status state="implemented"/>
<responsible-role role-id="system-admin">
<party-uuid>11111111-0000-4000-9000-000000000001</party-uuid>
</responsible-role>
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,38 @@
<?xml version="1.0" encoding="UTF-8"?>
<?xml-model href="https://github.com/usnistgov/OSCAL/releases/download/v1.1.3/oscal_ssp_schema.xsd" schematypens="http://www.w3.org/2001/XMLSchema" title="OSCAL complete schema"?>
<system-security-plan xmlns="http://csrc.nist.gov/ns/oscal/1.0" uuid="df903c4c-6bb5-4b78-8a71-c5baa06a9f2e">
<system-implementation>

<component uuid="67ecaba6-e5be-4c92-9731-e55825689e8f" type="service">
<title>Service A</title>
<description>
<p>An non-authorized service provided by the Awesome Cloud leveraged authorization.</p>
<p>Describe the service and what it is used for.</p>
</description>
<prop name="implementation-point" value="external"/>
<prop name="connection-security" value="non-fedramp-value" ns="https://fedramp.gov/ns/oscal"/>
<prop name="provider" value="self" ns="http://fedramp.gov/ns/oscal"/>
<prop ns="http://fedramp.gov/ns/oscal" name="still-supported" value="yes"/>

<!-- The information-type prop does not have a @class attribute. -->
<prop name="information-type" value="C.3.5.1" ns="http://fedramp.gov/ns/oscal"/>

<prop name="authentication-method" value="yes" ns="http://fedramp.gov/ns/oscal">
<remarks>
<p>If 'yes', describe the authentication method.</p>
<p>If 'no', explain why no authentication is used.</p>
<p>If 'not-applicable', attest explain why authentication is not applicable in the remarks.</p>
</remarks>
</prop>
<status state="operational"/>
<responsible-role role-id="admin"/>
<responsible-role role-id="provider">
<party-uuid>33333333-2222-4000-8000-004000000001</party-uuid>
</responsible-role>
<remarks>
<p>Each non-authorized leveraged service must be expressed as a "service" component.</p>
</remarks>
</component>

</system-implementation>
</system-security-plan>
Original file line number Diff line number Diff line change
Expand Up @@ -622,6 +622,11 @@
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#system-information-and-information-types"/>
<message>An inter-boundary communication component {@uuid} ({path(.)}) MUST have at least one information-type property.</message>
</expect>
<expect id="inter-boundary-component-information-type-has-class-attribute" target="$inter-boundary-component" test="prop[@name='information-type' and @ns='http://fedramp.gov/ns/oscal']/@class => exists()" level="ERROR">
<formal-name>Inter-Boundary Component's Information Type Has @class Attribute</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/4-ssp-template-to-oscal-mapping/#external-systems-and-services-not-having-fedramp-authorization"/>
<message>In a FedRAMP SSP, the information-type property of the inter-boundary communication component MUST have the @class attribute. The @class attribute MUST NOT be empty, and it MUST contain a valid value (incoming or outgoing).</message>
Gabeblis marked this conversation as resolved.
Show resolved Hide resolved
</expect>
<expect id="inventory-item-and-component-has-public" target="(inventory-item | component[@type='service' and prop[@name='implementation-point' and @value='internal']])" test="count(prop[@name='public']) = 1" level="ERROR">
<formal-name>Inventory Item and Component Has Public</formal-name>
<prop namespace="https://docs.oasis-open.org/sarif/sarif/v2.1.0" name="help-url" value="https://automate.fedramp.gov/documentation/ssp/5-attachments/#system-inventory-approach"/>
Expand Down
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Driver for the invalid inter-boundary-component-information-type-has-class-attribute constraint unit test.
test-case:
name: The invalid inter-boundary-component-information-type-has-class-attribute constraint unit test.
description: Test that the FedRAMP SSP inter-boundary communication component's information-type property does not have the @class attribute.
content: ../content/ssp-inter-boundary-component-information-type-has-class-attribute-INVALID.xml
expectations:
- constraint-id: inter-boundary-component-information-type-has-class-attribute
result: fail
Original file line number Diff line number Diff line change
@@ -0,0 +1,8 @@
# Driver for the valid inter-boundary-component-information-type-has-class-attribute constraint unit test.
test-case:
name: The valid inter-boundary-component-information-type-has-class-attribute constraint unit test.
description: Test that the FedRAMP SSP inter-boundary communication component's information-type property has the @class attribute.
content: ../../../content/rev5/examples/ssp/xml/fedramp-ssp-example.oscal.xml
expectations:
- constraint-id: inter-boundary-component-information-type-has-class-attribute
result: pass
Loading