From 37944fcea11efcfc3379638b5508a4a488ec07f6 Mon Sep 17 00:00:00 2001 From: Jeroen Date: Wed, 14 Jun 2023 22:16:25 +0200 Subject: [PATCH] Updating text to conform to Human Impact change (#236) * Updating text to conform to Human Impact change As per the suggestion of @j--- I'm suggesting this to resolve #235. * replace one more Well-being and Mission Impact with Human Impact --------- Co-authored-by: Allen D. Householder --- doc/md_src_files/040_stakeholders-scope.md | 4 ++-- doc/md_src_files/060_decision-trees.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/doc/md_src_files/040_stakeholders-scope.md b/doc/md_src_files/040_stakeholders-scope.md index cb2bd7bc..d3e0f301 100644 --- a/doc/md_src_files/040_stakeholders-scope.md +++ b/doc/md_src_files/040_stakeholders-scope.md @@ -150,9 +150,9 @@ The [*Mission Impact*](#mission-impact) could be increased when a disaster recov A mitigation that successfully changes the value of a decision point may shift the priority of further action to a reduced state. If applying a mitigation reduces the priority to *defer*, the deployer may not need to apply a remediation, if later, it becomes available. Table 3 displays the action priorities for the deployer, which are similar to the supplier case. In a later section, the different types of impacts are defined and then implemented in the decision trees as examples of how the various impacts affect the priority. -For now, assume the decision points are ordered as: [*Exploitation*](#exploitation); [*Exposure*](#exposure); [*Utility*](#utility); and Well-being and Mission Impact. +For now, assume the decision points are ordered as: [*Exploitation*](#exploitation); [*Exposure*](#exposure); [*Utility*](#utility); and *Human Impact*](#human-impact). In this order, an [_active_](#exploitation) state of [*Exploitation*](#exploitation) will never result in a *defer* priority. -A [_none_](#exploitation) state of [*Exploitation*](#exploitation) (no evidence of exploitation) will result in either *defer* or *scheduled* priority—unless the state of Well-being and Mission Impact is [_very high_](#combined-situated-safety-and-mission-impact), resulting in an *out-of-cycle* priority. +A [_none_](#exploitation) state of [*Exploitation*](#exploitation) (no evidence of exploitation) will result in either *defer* or *scheduled* priority—unless the state of [*Human Impact*](#human-impact) is [_very high_](#human-impact), resulting in an *out-of-cycle* priority. As opposed to mitigation, applying a remediation finishes an SSVC analysis of a deployed system. While specific vulnerabilities in specific systems can be remediated, the vulnerability cannot be 'disposed of' or eliminated from future consideration within an IT environment. diff --git a/doc/md_src_files/060_decision-trees.md b/doc/md_src_files/060_decision-trees.md index a6ecffe1..1827067c 100644 --- a/doc/md_src_files/060_decision-trees.md +++ b/doc/md_src_files/060_decision-trees.md @@ -6,7 +6,7 @@ The definition of choices can take a logical form, such as: - ([*Exploitation*](#exploitation) IS [PoC](#exploitation)) AND - ([*Exposure*](#exposure) IS [controlled](#exploitation)) AND - ([*Utility*](#utility) IS [laborious](#utility)) AND - - ([*Well-being and Mission Impact*](#situated-safety---mission-impact) IS [medium](#situated-safety---mission-impact)) + - ([*Human Impact*](#human-impact) IS [medium](#human-impact)) - THEN priority is *scheduled*. This logical statement is captured in line 50 of the deployer .csv file.