mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 08:30:20 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
3.2 KiB
3.2 KiB
Standards and References - SSVC Vulnerability Triage
Primary Standards
CISA SSVC Framework
- Source: Cybersecurity and Infrastructure Security Agency (CISA)
- URL: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
- Version: SSVC v2.0 (2022 revision by CISA with SEI)
- Purpose: Provides a decision-tree methodology for vulnerability prioritization based on five decision points specific to the stakeholder's context
CERT/CC SSVC Original Research
- Source: Carnegie Mellon University Software Engineering Institute
- URL: https://certcc.github.io/SSVC/
- Publication: "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization" (2019)
- Authors: Jonathan Spring, Eric Hatleback, Allen Householder, Art Manion, Deana Shick
- DOI: https://doi.org/10.1184/R1/12124386
CVSS v3.1 and v4.0
- Source: Forum of Incident Response and Security Teams (FIRST)
- URL: https://www.first.org/cvss/
- CVSS v3.1 Specification: https://www.first.org/cvss/v3.1/specification-document
- CVSS v4.0 Specification: https://www.first.org/cvss/v4.0/specification-document
- Relevance: SSVC complements CVSS by adding contextual decision points beyond base score severity
EPSS - Exploit Prediction Scoring System
- Source: FIRST EPSS Special Interest Group
- URL: https://www.first.org/epss/
- API Endpoint: https://api.first.org/data/v1/epss
- Model Documentation: https://www.first.org/epss/model
- Relevance: EPSS probability scores inform the exploitation status decision point in SSVC
Regulatory and Compliance Context
CISA Binding Operational Directive 22-01
- Title: Reducing the Significant Risk of Known Exploited Vulnerabilities
- URL: https://www.cisa.gov/binding-operational-directive-22-01
- Relevance: Mandates federal agencies to remediate KEV-listed vulnerabilities within specified timeframes; SSVC aligns remediation priorities with BOD 22-01 requirements
NIST SP 800-40 Rev 4
- Title: Guide to Enterprise Patch Management Planning
- URL: https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final
- Relevance: Provides organizational context for patch management decisions that SSVC informs
NIST Cybersecurity Framework (CSF) 2.0
- Function: IDENTIFY (ID.RA - Risk Assessment)
- URL: https://www.nist.gov/cyberframework
- Relevance: SSVC directly supports the risk assessment category for vulnerability prioritization
Data Sources
CISA Known Exploited Vulnerabilities (KEV) Catalog
- URL: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
- JSON Feed: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
- Update Frequency: Updated as new exploited vulnerabilities are confirmed
National Vulnerability Database (NVD)
- URL: https://nvd.nist.gov/
- API v2: https://services.nvd.nist.gov/rest/json/cves/2.0
- Relevance: Provides CVSS scores and vulnerability details used in SSVC decision points
MITRE CVE Program
- URL: https://cve.mitre.org/
- CVE List: https://www.cve.org/
- Relevance: CVE identifiers are the primary key for linking vulnerability data across SSVC decision points