Skip to content

Updates to SSF and CAEP spec to represent agent, workload as subject, principal #362

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
appsdesh wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Updates to SSF and CAEP spec to represent agent, workload as subject, principal #362

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions openid-caep-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -906,7 +906,7 @@ Event Type URI:
`https://schemas.openid.net/secevent/caep/event-type/risk-level-change`

A vendor may deploy mechanisms to gather and analyze various signals associated
with subjects such as users, devices, etc. These signals, which can originate
with subjects such as users, devices, agents, workloads, etc. These signals, which can originate
from diverse channels and methods beyond the scope of this event description,
are processed to derive an abstracted risk level representing the subject's
current threat status.
Expand All @@ -921,6 +921,10 @@ destination, password compromise, addition of strong authenticator or other
reasons.
* Device's risk has changed due to installation of unapproved software,
connection to insecure peripheral device, encryption of data or other reasons.
* Agent's risk has changed due to anomalous task execution, compromise of its
credentials, or other reasons.
* Workload's risk has changed due to a misconfiguration, compromised
dependency, or other reasons.
* Any other subject's risk changes due to variety of reasons.

### Event Specific Claims {#risk-level-change-event-specific-claims}
Expand All @@ -935,7 +939,7 @@ principal
> REQUIRED, JSON string: representing the principal entity involved in the
observed risk event, as identified by the Transmitter. The subject principal can
be one of the following entities USER, DEVICE, SESSION, TENANT, ORG_UNIT, GROUP,
or any other entity as defined in Section 2 of {{SSF}}. This claim identifies
AGENT, WORKLOAD, or any other entity as defined in Section 2 of {{SSF}}. This claim identifies
the primary subject associated with the event, and helps to contextualize the
risk relative to the entity involved.

Expand Down
8 changes: 8 additions & 0 deletions openid-sharedsignals-framework-1_0.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -267,6 +267,14 @@ device

> OPTIONAL. A Subject Identifier that identifies a device.

agent

> OPTIONAL. A Subject Identifier that identifies an agent.

workload

> OPTIONAL. A Subject Identifier that identifies a workload.

session

> OPTIONAL. A Subject Identifier that identifies a session.
Expand Down
Loading