redteam-project / sckg

Security Control Knowledge Graph
GNU General Public License v3.0
39 stars 16 forks source link

DoD SRG mappings to sectional controls are broken #14

Closed jason-callaway closed 3 years ago

jason-callaway commented 4 years ago

DoD Cloud Computing Security Requirements sectional controls should map to impact levels, but don't.

Reference: https://github.com/redteam-project/sckg/blob/bba5ec77bdf3ce731a072b78a9f2bbf4a18d245b/data/regimes/dod_srg.tsv#L62

match (r:regime {name: 'DoD SRG'})-[:HAS]->(b:baseline) with r, b match p = (b)-[:HAS*]->(c:control) return r, b, p
Screen Shot 2019-12-12 at 10 52 27 AM

Note lack of relationships from IL4, 5, and 6 nodes. For example, given the referenced source line above, 4, 5, and 6 should map to section 5.2.1.