break# First empty field indicates no more metrics
break# First empty field indicates no more metrics
returnmetricList# Returns metric found in the dynamic component
returnlistOfMetrics# Returns metric found in the dynamic component
"""_summary_
Function will use a local metric list and insert the local metrics into a global metric list
containing all the metrics in the threat landscape
"""
defjoinMetrcs(localMetrics,globalMetrics):
duplicateMetrics=0# Counter for duplicate metrics per function run
foriinrange(globalMetrics):
forjinrange(localMetrics):
ifglobalMetrics[i].name==localMetrics[j].name:# Local metric already exists in the global metric list
duplicateMetrics+=1
break# Check next entry
else:
globalMetrics.append(localMetrics[j])# Add the local metric to the global metric list
log.info("New local metric added to global metric list, metric: ",localMetrics[j].name)
log.info("Added all metrics in local list \n, number of duplicate metrics: ",duplicateMetrics,"\n Number of new metrics: ",len(localMetrics)-duplicateMetrics)
3. Må koble dynamic komponenter til trusselkomponent
# Thesis problem description
Problem description:
The thesis aims to innovate in risk modeling through the use of bowtie diagrams and the identification and documentation of dynamic indicators of software supply chain risk.
The goal of the thesis is to research the possibilities of graphical linkage between bow tie risk models and entity relationship diagrams and to develop a method for this linkage.
This is all in an effort to facilitate dynamic risk management for software supply chains.
The thesis proposes a method for linking bow tie risk diagrams and entity relationship diagrams through dynamic indicators.
The method will use new annotations on bow tie risk models and matrices containing indicators which can be observed for both ER architecture diagrams and bow tie risk models.
To analyze the modeled diagrams and matrices, a analysis tool will be developed to facilitate the analysis and scoring of the modeled risk image.
The scoring will be based on amount of indicators observed for critical components and their status.
Method formulation and scorecard developement is being done using Technology research. This methodology splits the research into problem definition where a literature mapping was leveraged to understand state of the art.
The next step is innovation where the method and prototype is developed.
For evaluation the method and tool will be tested on two cases provided by partners.
Preceeding the evaluation a new iteration of technology research will be started to improve the method and tool according to the evaluation.
The focus of the annotation will be on risks and aspects related to software supply chains.
The method will use specialized Entity relationship components to annotate the bow tie risk models and architecture diagram, this annotation will facilitate linkage between an entity relationship diagram of a software supply chain and the bow tie risk models associated with it.
All resulting in a method which can help in determine which metrics one should observe to pick up on changes in the risk landscape of the software supply chain facilitating dynamic risk management.
