mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
65 lines
3.2 KiB
Markdown
65 lines
3.2 KiB
Markdown
# Standards and References - SSVC Vulnerability Triage
|
|
|
|
## Primary Standards
|
|
|
|
### CISA SSVC Framework
|
|
- **Source**: Cybersecurity and Infrastructure Security Agency (CISA)
|
|
- **URL**: https://www.cisa.gov/stakeholder-specific-vulnerability-categorization-ssvc
|
|
- **Version**: SSVC v2.0 (2022 revision by CISA with SEI)
|
|
- **Purpose**: Provides a decision-tree methodology for vulnerability prioritization based on five decision points specific to the stakeholder's context
|
|
|
|
### CERT/CC SSVC Original Research
|
|
- **Source**: Carnegie Mellon University Software Engineering Institute
|
|
- **URL**: https://certcc.github.io/SSVC/
|
|
- **Publication**: "Prioritizing Vulnerability Response: A Stakeholder-Specific Vulnerability Categorization" (2019)
|
|
- **Authors**: Jonathan Spring, Eric Hatleback, Allen Householder, Art Manion, Deana Shick
|
|
- **DOI**: https://doi.org/10.1184/R1/12124386
|
|
|
|
### CVSS v3.1 and v4.0
|
|
- **Source**: Forum of Incident Response and Security Teams (FIRST)
|
|
- **URL**: https://www.first.org/cvss/
|
|
- **CVSS v3.1 Specification**: https://www.first.org/cvss/v3.1/specification-document
|
|
- **CVSS v4.0 Specification**: https://www.first.org/cvss/v4.0/specification-document
|
|
- **Relevance**: SSVC complements CVSS by adding contextual decision points beyond base score severity
|
|
|
|
### EPSS - Exploit Prediction Scoring System
|
|
- **Source**: FIRST EPSS Special Interest Group
|
|
- **URL**: https://www.first.org/epss/
|
|
- **API Endpoint**: https://api.first.org/data/v1/epss
|
|
- **Model Documentation**: https://www.first.org/epss/model
|
|
- **Relevance**: EPSS probability scores inform the exploitation status decision point in SSVC
|
|
|
|
## Regulatory and Compliance Context
|
|
|
|
### CISA Binding Operational Directive 22-01
|
|
- **Title**: Reducing the Significant Risk of Known Exploited Vulnerabilities
|
|
- **URL**: https://www.cisa.gov/binding-operational-directive-22-01
|
|
- **Relevance**: Mandates federal agencies to remediate KEV-listed vulnerabilities within specified timeframes; SSVC aligns remediation priorities with BOD 22-01 requirements
|
|
|
|
### NIST SP 800-40 Rev 4
|
|
- **Title**: Guide to Enterprise Patch Management Planning
|
|
- **URL**: https://csrc.nist.gov/publications/detail/sp/800-40/rev-4/final
|
|
- **Relevance**: Provides organizational context for patch management decisions that SSVC informs
|
|
|
|
### NIST Cybersecurity Framework (CSF) 2.0
|
|
- **Function**: IDENTIFY (ID.RA - Risk Assessment)
|
|
- **URL**: https://www.nist.gov/cyberframework
|
|
- **Relevance**: SSVC directly supports the risk assessment category for vulnerability prioritization
|
|
|
|
## Data Sources
|
|
|
|
### CISA Known Exploited Vulnerabilities (KEV) Catalog
|
|
- **URL**: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
|
|
- **JSON Feed**: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
|
|
- **Update Frequency**: Updated as new exploited vulnerabilities are confirmed
|
|
|
|
### National Vulnerability Database (NVD)
|
|
- **URL**: https://nvd.nist.gov/
|
|
- **API v2**: https://services.nvd.nist.gov/rest/json/cves/2.0
|
|
- **Relevance**: Provides CVSS scores and vulnerability details used in SSVC decision points
|
|
|
|
### MITRE CVE Program
|
|
- **URL**: https://cve.mitre.org/
|
|
- **CVE List**: https://www.cve.org/
|
|
- **Relevance**: CVE identifiers are the primary key for linking vulnerability data across SSVC decision points
|