Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fix for #3 #59

Merged
merged 3 commits into from
Nov 3, 2020
Merged

Fix for #3 #59

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
22b71fb
First attempt at allowing for sector-specific impact scenarios
ahouseholder Oct 29, 2020
92bb7ac
Update 045_treesForVulMgmt_3.md
j--- Oct 30, 2020
367149e
add mention of vul databases too
ahouseholder Oct 30, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
9 changes: 9 additions & 0 deletions doc/version_1/045_treesForVulMgmt_3.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -231,6 +231,15 @@ Because of this higher sensitivity to safety concerns, we chose to retain a four
| Hazardous | High | High | Very High |
| Catastrophic | Very High | Very High | Very High |

#### Adapting Situated Safety / Mission Impact for Sector-Specific Scenarios

We expect to encounter diversity in both safety and mission impacts across different organizations. However, we also anticipate a degree of commonality of impacts to arise across organizations within a given industry sector. For example, different industry sectors may have different use cases for the same software.
Therefore, vulnerability information providers -- that is, vulnerability databases, Information Sharing and Analysis Organizations (ISAOs), or Information Sharing and Analysis Centers (ISACs) -- may provide SSVC information tailored as appropriate to their constituency's safety and mission concerns.
For considerations on how organizations might communicate SSVC information to their constituents, see [#pilot-results].
<!-- The xref to where information communication is discussed will need to be updated later, but this is the correct v1 xref-->
<!-- Are vul threat intel feed providers ISAOs? If not, they are also in the "vul info providers" being referred to here -->


### System Exposure (Deployer)
> The Accessible Attack Surface of the Affected System or Service

Expand Down