Skip to content

Fix a few bugs around Human Impact decision point and decision table #870

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
ahouseholder merged 13 commits into from
Aug 13, 2025
Merged

Fix a few bugs around Human Impact decision point and decision table #870

ahouseholder merged 13 commits into from
Aug 13, 2025

Conversation

@ahouseholder
Copy link
Contributor

@ahouseholder ahouseholder commented Aug 12, 2025 •
edited
Loading

Copilot Summary

This pull request updates several decision point and decision table JSON files to improve consistency, clarify definitions, and update key mappings for vulnerability assessment frameworks (CISA, CVSS, SSVC). The changes include key renaming for clarity, updates to value descriptions, introduction of new or revised decision points, and adjustments to mappings in decision tables.

Key changes:

CISA Decision Points and Tables:

  • Renamed the keys for "Attend" and "Act" from "A" to "AT" and "AC" respectively in both cisa_levels_1_0_0.json and cisa_coordinator_2_0_3.json to avoid ambiguity and improve clarity. [1] [2]
  • Updated the decision table mappings in cisa_coordinator_2_0_3.json to use the new "AT" and "AC" keys and switched from referencing ssvc:HI:2.0.1 to ssvc:MWI:1.0.0 ("Mission and Well-Being Impact") for impact assessment. [1] [2]

SSVC Decision Points:

  • Updated the key for the "Material" value from "M" to "MA" in public_well_being_impact_1_0_0.json for better distinction.
  • Added a new decision point definition for HI ("Human Impact") version 2.0.2 in human_impact_2_0_2.json, refining the descriptions and logic for impact levels.
  • Updated the deployer patch application priority table to reference the new ssvc:HI:2.0.2 and adjusted value descriptions to match the new definition.

CVSS Decision Points and Tables:

  • Introduced a new decision point E_NoX ("Exploit Maturity (without Not Defined)") in exploit_maturity_without_not_defined__2_0_0.json and updated the equivalence set table to reference this, removing the "Not Defined" (X) value for greater precision. [1] [2] [3] [4]

These updates help ensure that the decision frameworks are more precise, less ambiguous, and better aligned with their intended use.

@ahouseholder ahouseholder linked an issue Aug 12, 2025 that may be closed by this pull request
Missing Combination in Human Impact v2.0.1 Calculation #803
Closed
@ahouseholder ahouseholder self-assigned this Aug 12, 2025
@ahouseholder
Copy link
Contributor Author

ahouseholder commented Aug 12, 2025

The only thing this doesn't currently do is regenerate a new CSV file to replace https://github.com/CERTCC/SSVC/blob/main/data/csvs/child_trees/human-impact.csv

I have been holding off on those because I wasn't sure what depends on them yet.

@ahouseholder ahouseholder mentioned this pull request Aug 12, 2025
Closed
@ahouseholder ahouseholder added this to the 2025-09 milestone Aug 12, 2025
@ahouseholder ahouseholder marked this pull request as ready for review August 12, 2025 21:08
@ahouseholder
fix redundancies in human impact table
dbfc495
@ahouseholder
add validator to detect duplicate mapping rows
2518e9d 
- log warning on benign duplicates (same inputs, same outcome)
- throw exception on conflicts (same inputs, different outcome)
@ahouseholder
Copy link
Contributor Author

ahouseholder commented Aug 13, 2025 •
edited
Loading

The conversion to Safety Impact v2.0.0 left us with duplicate rows that don't make sense. I fixed that in dbfc495 and added a validator to check for duplicates/conflicts in 2518e9d

#875

@ahouseholder
add a validator that guarantees full coverage of decision point value…
d2b1799 
… combinations in DecisionTable

Fix cvss eq5 as a result.
Also noticed that cisa uses mission and well being 1, not human impact 2.x
@ahouseholder
Copy link
Contributor Author

ahouseholder commented Aug 13, 2025 •
edited
Loading

When I added the new validator in d2b1799 that requires full coverage of all input value combinations, I found that CVSS EQ5 and CISA Coordinate were lacking full coverage.

  • In the case of EQ5 it was because Exploit Code Maturity has a Not Defined (X) value. So I applied the same no_x() transformation that we used for the other EQ sets.
  • For the CISA model, I observed that CISA's published docs only refer to Mission and Well Being, not Human Impact. We modeled these as versions 1 and 2. The difference is that MWB has values [L,M,H] whereas HI has [L,M,H,VH]. So I switched the CISA DecisionTable object to use MWB to match their published docs.

#876

@ahouseholder
Copy link
Contributor Author

ahouseholder commented Aug 13, 2025 •
edited
Loading

Discovered that the CISA model also was not discriminating between "Attend" and "Act" because both values had the key "A". Fixed that, and then added a validator to DecisionPoint that throws a ValueError when duplicate value keys are detected in a single DecisionPoint object. Turns out we had a couple of those, now fixed in d10bcc0.

#878, #874, #879

sei-vsarvepalli
sei-vsarvepalli approved these changes Aug 13, 2025
View reviewed changes
Copy link
Contributor

@sei-vsarvepalli sei-vsarvepalli left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wow - a lot of good bug finds.

@ahouseholder ahouseholder merged commit 6f4c356 into main Aug 13, 2025
4 checks passed
@ahouseholder ahouseholder deleted the 803-missing-combination-in-human-impact-v201-calculation branch August 13, 2025 18:17
@ahouseholder ahouseholder mentioned this pull request Aug 13, 2025
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@sei-vsarvepalli sei-vsarvepalli sei-vsarvepalli approved these changes

Assignees

@ahouseholder ahouseholder

Labels

None yet

Projects

None yet

Milestone

2025-09

3 participants

@ahouseholder @sei-vsarvepalli