Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Pattern Hum-iSH-LnS+LnS should be in package#Network #188

Open
mike1813 opened this issue Dec 24, 2024 · 1 comment
Open

Pattern Hum-iSH-LnS+LnS should be in package#Network #188

mike1813 opened this issue Dec 24, 2024 · 1 comment

Comments

@mike1813
Copy link
Member

Construction pattern Hum-iSH-LnS+LnS adds a LoginService controlling any ShellHost that is managed by a Human who does not interactWith the ShellHost, i.e., they can't use a physical terminal to login and administer the ShellHost.

This should be a package#Network inference, but the pattern contains a prohibited isPod link, and isPod is a package#CloudManagement feature, so that dependency forces Hum-iSH-LnS+LnS to also be in package#CloudManagement.

Possible solutions could be:

  1. Make isPod a package#Network feature, though this would be odd as it indicates a Host is a Pod, and Pod should be in package#CloudManagement.
  2. Remove the Pod class from the list of subclasses of a SimpleHost, so it is no longer considered a ShellHost.

The second option seems like the best one, but SimpleHost is used in other construction patterns and threats. It would be necessary to review these, and create extra patterns or threats for Pod class assets where previously they were included in the SimpleHost versions.

@mike1813
Copy link
Member Author

mike1813 commented Jan 7, 2025

The same issue arises in VH-LnS+LnS, which should be package#Virtualisation not package#CloudManagement. The solution here could be to replace VH-LnS+LnS by others patterns specific to the types of virtual host that have remote login (the approach used for physical hosts in PC-LnS+LnS, Rr-LnS+LnS and Sv-LnS+LnS).

Also in subsequent patterns Pc-hSHLnS+c and Hum-iHRAS+i, which should also be package#Network. In both cases it should be OK just to delete the isPod link because both are triggered only if there is a remote access service on the Host. There is a case for creating a modelling error that a Pod can't host a RemoteAccessService, just in case a user asserts this.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant