A few tests suggestions to see if I'm on the right track

[shoffman-percona]

Lori Larusso mentioned you were looking for help building out the criteria for the CCC project. We happen to have pretty deep expertise in the DB realm so I can certainly contribute more items along these lines but before I went to far I figured I'd do just a few to get feedback.

If there's a particular area you'd like focus on, please just let me know!

[linux-foundation-easycla]

• ✅ login: shoffman-percona / name: Steve Hoffman (37c50fa, 7844e79, 8c999e1, d4d06a6, 6895943, 9fe7cb0, b93da14, 28fb51d, 74548ae, bf1e0bd, c86d862, f36a191, e765fd1, bb5b742, de2b523, 661ae73, 2e6d523)
• ❌ The email address for the commit (4b4ae6c, 4c88a4a, 40fec45) is not linked to the GitHub account, preventing the EasyCLA check. Consult this Help Article and GitHub Help to resolve. (To view the commit's email address, add .patch at the end of this PR page's URL.) For further assistance with EasyCLA, please submit a support request ticket.

[eddie-knight]

Hey @shoffman-percona, thanks for this PR!

Damien and Michael are approvers for this domain, but I'd like to help from a steering perspective. It occurred to me while reviewing your changes that the best place to invest time may be the threat or control definitions themselves. The current progress on the RDMS entry is iterative, and I expect it needs strong revisions before we can create accurate behaviors/steps.

Would you like to contribute to the RDMS threat or control definition refinement?

I don't mind spending a cycle to help create runway here, if you're interested in picking it up!

[shoffman-percona]

@eddie-knight, Absolutely...I just started where Lori pointed me but let me comb through the threats materials. I assume this is where you'd want some help building out?

It may end up being a 1:x mapping of threats to controls so likely will end up coming up with them together.

[eddie-knight]

Yes! Although the RDMS iteration is in need of an update to match the finalized guidelines (yaml).

Feel free to drop me an email ([email protected]) or message me on the FINOS slack if I can help with implementation details.

[damienjburks]

For our controls, we try to keep them as abstract as possible. we should remove the mysql.user where ssl_type='' from this statement.

[shoffman-percona]

Makes sense! If I'm otherwise on track, I'll push a few more over in addition to threats/controls.

[eddie-knight]

Also remember to keep an eye on the new ID format. Most notably the Ts... threats are now TH00, Test requirements are TR00 and Tests are TE00

[eddie-knight]

Also remember to keep an eye on the new ID format. Most notably the Ts... threats are now TH00, Test requirements are TR00 and Tests are TE00

[shoffman-percona]

Ok, accepted proposed changes, reworked the one that was too technology specific and also converted threats.md to threats.yaml. hopefully this is in acceptable form (just let me know if it's not) and I'll start adding threats and converting controls.md @eddie-knight @damienjburks

[eddie-knight]

Added some comments that I hope help accelerate your progress.

Happy to help contribute to the gherkin writing, perhaps in something like google docs so that we can have faster iterations— these things are hard to get right!

[eddie-knight]

I think this file may be following an older schema. The latest guidance on this topic can be found in the project governance directory.

ref:

• https://github.com/finos/common-cloud-controls/blob/main/docs/governance/community-guidelines/content-standards-and-practices/threat-definitions.md
• https://github.com/finos/common-cloud-controls/blob/main/docs/governance/community-guidelines/templates/threats.yaml

[shoffman-percona]

Updated to the new schema although I left description at the highest level as it made sense to keep to me. No worries if it gets dropped.

[shoffman-percona]

Google would be easier to co-edit but staying in the repo is helping me learn where all the relevant docs are located. I was guessing a bit earlier but now and seeing how to find definitions and templates and such.