[IDEA] Add OWASP Threat Model Library parity - #1034
Conversation
| "description": "Descriptor for an element identified by the attribute 'bom-ref' in the same BOM document.\nIn contrast to `bomLinkElementType`.", | ||
| "$ref": "#/$defs/refType" | ||
| }, | ||
| "modelScope": { |
There was a problem hiding this comment.
why would the model scope live here, and not in cyclonedx-ai-modelcard-2.0.schema.json ?
There was a problem hiding this comment.
modelScope is intentionally a common definition because it is reused by metadata.scope and blueprint.scope. It describes analysis/model boundaries generally, not AI-model-card-specific scope. Keeping it in the common schema avoids duplicating the same structure and allows threat models beyond AI systems to use it.
This comes from the need of having a threat modelling scope very well defined - i.e. if you are threat modelling a feature - but have a full system diagram it is important to define the scope boundaries of the threat model, especially if something is out of scope but for completeness still mentioned in the dataflows etc (i.e. if modelling a new feature, perhaps authentication is out of scope, but for completeness of the diagram it is still mentioned)
There was a problem hiding this comment.
I see. so this "model" is actually some threat model?
or behavior?
For me this all looks unintuitive, anyway. see #1034 (comment)
| "$ref": "cyclonedx-component-2.0.schema.json#/$defs/component" | ||
| }, | ||
| "scope": { | ||
| "description": "The scope of the analysis represented by this BOM, including what is in and out of scope.", |
There was a problem hiding this comment.
CycloneDX is about system transparency, not BOM.
therefore, i would not put this here.
| "description": "The scope of the analysis represented by this BOM, including what is in and out of scope.", | ||
| "$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope" | ||
| }, | ||
| "modelLifecycle": { |
There was a problem hiding this comment.
too specific for a metadata. shall go somewhere else
| } | ||
| } | ||
| }, | ||
| "modelLifecycle": { |
There was a problem hiding this comment.
why put this here, and not in the existing threat or blueprint or behaviour space?
|
re: #1034 (comment) the scope of this PR seams off - at least to me. this adds features all over the place, without considering the CycloneDX 2.0 philosophy or architecture. Lets take this PR as a basis for further discussions. |
|
I'd recommend opening a new discussion, if you want to get community feedback on your general ideas. discussing the exact proposed implementation may happen in this PR< still. |
jkowalleck
changed the title
There was a problem hiding this comment.
not sure if this file shall stay here.
it might belong to some docs space (that we don't have yet) or to some taxonomy living in the OWASP Threat Model Library space.
|
I opened a Discussion to gather architectural feedback before continuing implementation: #1039 |
3 participants
Summary
Validation