This ontology serves as the basis to represent technical standards in a machine readable way. It provides elements to define publications, their provisions, their dependencies and possible constraints, among other constructs. This ontology is based on three technical standards, namely the IEC 62443 4-2, ETSI 303645 and the more general NIST Framework for Improving Critical Infrastructure Cybersecurity. Therefore, besides providing the schematic elements, it also considers system related concepts to describe system solutions, their components, etc. Making it possible to define not only project or system specific information but also project independent information. This makes it more robust for engineering design tasks.
Technical Security Standards Ontology
January 2023
Gandalf Denk
Georg Buchgeher
Jose Illescas
Lisa Ehrlinger
Peter Panholzer
Thomas Brandstetter
tsso
abbr
achieves
addressed By
addresses
addresses Concern
affects
applicable To
applies
associated To Sub Category
belongs To
channel Used By
composed Of
composes
configuration Of
connects
connects Destination
connects Source
considers Asset
considers Provision
considers Risk
considers Threat
considers Vulnerability
consist Of Framework Element
contained By
contains
demands Capability
Association between a constraint to a specific provision. Implying that the item holding the constraint depends on the referenced provision, making this provision a requirement.
depends On
describes Solution
developed By
develops
enhancement Of
exposed By
exposes
handled By
handles
has Architecture
has Capability
has Category
has Configuration
has Constraint
Capability that is not native to the item, but can be used by it. Certain components may not be able to provide a capability but can work within a system or component which provides it.
has Delegated Capability
has Device Physical Limitation
has Domain
has Enhancement
has FW
has Function
has HMI
has Interface
has Lighter Version
has Main Category
has More General Domain
has More General Problem
has More General Version
has More Secure Version
has OS
has Policy
has Predecessor
has Profile
has Property
has Requirement
has Scope
has Solution Structure
has Status
has Sub Category
has Sub Domain
has Sub Problem
has Sub Version
has Successor
has Supplemental Guidance
has Tier
has Tolerance
has Type
improves QA
interested In
is Affected By
is Asset Of
is Delegated Capability Of
is Destination Of
is Device Physical Limitation Of
is Domain Of
is Source Of
is Supplemental Guidance Of
manufactures
owner Of
owns Asset
part Of Component Solution
part Of Deployment Solution
part Of Solution
promoted By
protocol Supported By
protocol Used By
provides Function
provides Functionality
provides Service
published
published By
references Architecture
refers To
related To
Used to define possible chain of problems.
related To Problem
requires Functionality
requires Service
runs On
service Provided By
service Required By
service Used By
solution Of
solution Of Architecture
suggests Counter Measure
supplies
supports Protocol
uses
uses Algorithm
uses Channel
uses Encryption
uses Protocol
vulnerable To
applies Cryptography
date Of Adoption
date Of Publication
date Of Withdrawal
is Authenticated
is Critical
Physical interface used by the manufacturer to communicate with the device during development or to perform triage of issues with the device and that is not used as part of the consumer-facing functionality
is Debug Interface
is Disclosed
is Embedded
is Encrypted
is Essential
is External
is Hard
is Internal
is International
is Mandatory
is Normative
is Online
Indicates physical port or air interface (such as radio, audio or optical) used to communicate with the device at the physical layer
is Physical
is Public
is Real Time
Intended to be accessible from outside the local network
is Remote
This attribute may indicate if the item can be accessed via role protection. MAy be modelled differently, via Component's property.
is Role Protected
is SW
is Smart
is Solved
is Special Purpose
is Transportable
Flag which indiates if the item can be updated.
is Updatable
Based on algorithm catalogs, this flag indicates if it is vulnerable in general without explicitely knowing the actual vulnerability.
is Vulnerable
is Wireless
pages
priority
probability
receives Data
security Level
sends Data
Associates a cuantitave value to evaluated the degree of severity to a problem or threat.
severity
size
Application Program Interface, defines the methods and behaviour required and expected for communication
API
There are mulitple kinds such as REST, ROA, RMC, RMI
API Kind
Security safeguard designed to detect and deny unauthorized access and permit authorized access to an information system or physical facility.
Access Control Mechanism
a device that causes a machine or other device to operate
Actuator
Process or set of rules to be followed in calculations or other problem-solving operations, especially by a computer.
Algorithm
Conceptual model that defines the structure, behavior, and more views of a system.
Architecture
An item owned by a person or company, regarded as having value or being useful.
Asset
Method used to prove the authenticity of an entity
Authentication Mechanism
Represents a boolean constraint also interpreted as condition.
Boolean Constraint
The people or organizations that consume a given product or service.
Buyer
A delegated capability is not native to the component,however, the component is considered to posses it as it is inherited from a surrounding system component.
Capability
General concept to define possible categories and divivsions of elements.
Category
Communication channels are mediums through which you can send information.
Logical or physocal link between assets.
Channel
A part or element of a larger wholesuch as a system. It can be seen as a buillding block.
Component
A requirement targeting components that build up a system
Component Requirement
Component Solution
Components may bring their own set of components, which makes it a composition of existing components
Composite
Concern
Arrangement or set-up of the hardware and software that make up a computer system.
Configuration
Object that is used as communication channel between components. This connection can be attributed and configured.
Connection
Device which has physical limitations in either the ability to process data, the ability to communicate data, the ability to store data or the ability to interact with the user, due to restrictions that arise from its intended use
Constrained Device
Limitation or restriction. Requirements may have constraints imposed.
Constraint
Set of cybersecurity activities, desired outcomes, and applicable references that are common across critical infrastructure sectors. The Framework Core provides a set of activities to achieve specific cybersecurity outcomes, and references examples of guidance to achieve those outcomes
Core
Reduces a threat, vulnerability or the result of an attack. It may be able to discover it and report it so that proper action can be taken.
Measure used to avoid/ mitigate a theat or problem, solve a vulnerability
Counter Measure
Customer
A node that is a part of a deployment solution. Commonly referring a device with an IP address.
Deployment Node
Deployment node
Deployment Solution
Detection Mechanism
Developer
Device is a kind of component. It is a discrete physical asset that provides a set of capabilitites
Device
Physical limitations can be due to power supply, battery life, processing power, physical access, limited functionality, limited memory or limited network bandwidth.
Device Physical Limitation
Domain
Something that creates and fuels activity, or gives force or impetus regarding the goals of an organization.
Driver
Embedded Device
Permanent software programmed into a read-only memory.
Firmware
Concept that represents real or conceptual structure intended to serve as a support or guide for the building of something that expands the structure into something useful
Framework
Concept used to define building elements of a framework.
Framework Element
Components provide set of relatedfunctions with a specific task
Function
A requisite demanded to define a system or its component
Functional Requirement
Components provide also functionalities which can trigger special events; be targets of threats; could be part or associated to capabilities
Functionality
Items have properties. Properties can describe characteristic something. Devices may have specific attributes that may be exposed to different threats, while others may reduce the risk of other threats appareances.
Generic Property
General rule, principle, or piece of advice
Guideline
Kind of interface, intended for human use
HUI
HW Solution
A kind of general purpose device with an OS
Host Device
A piece of equipment used to provide data and control signals to an information processing system.
Input Device
Components have interfaces such as buttons, keyboards, internet ports, hmdi and other interfaces. Those determine interaction points.
Interface
A group of things which share similar characteristics
Kind
Manufacturer
The process, way, or system used to produce a particular result.
Mechanism
Memory Access Control
A kind of device which can be moved/transported
Mobile Device
Subdivisions of a Function into groups of cybersecurity outcomes closely tied to programmatic needs and particular activities
NIST Category
One of the main components of the Framework. Functions provide the highest level of structure for organizing basic cybersecurity activities into Categories and Subcategories.
NIST Function
Specific outcomes of technical and/or management activities. They provide a set of results that help support achievement of the outcomes in each Category. Division of categories into more concrete technical activities.
NIST Sub Category
A kind of device which deals with data flow and data flow restriction
Network Device
A network type might be usefull to determine the type of connection security
Network Type
A system attribute demanded. They serve as constraints or restrictions on the design of the system
Non Functional Requirement
Operating system that can run on a device. It supports a device's basic functions, such as controlling peripherals and interfaces.
Operating System
Organization
Result or a conclusion reached through a process of logical thinking or motivated by a driver.
Outcome
A policy is a set of rules or guidelines to follow in or to achieve compliance. Components consider policies, policies are addressed or demanded by requirements.
Policy
A port is a virtual point where network connections start and end. They are associated to services provided by components.
Port
Procedures that are accepted or prescribed as being correct or most effective
Practice
General concept that defines a probllem that may affect any kind of asset.
Problem
Product
Component of the framework. It represents the alignment of the Functions, Categories, and Subcategories with the business requirements, risk tolerance, and resources of the organization. A Profile enables organizations to establish a roadmap for reducing cybersecurity risk that is well aligned with organizational and sector goals, considers legal/regulatory requirements and industry best practices, and reflects risk management priorities
Profile
Protocol
Protocol Property
Provision
Document developed by an organization that is published
Publication
Publication Constraint
Quality Attribute
A provision that is not mandatory but is proposed as to the best course of action
Recommendation
Reference Architecture
A requisite demanded for quality reasons
Requirement
Requirement Dependency Constraint
A measure of the extent to which an entity is threatened by a potential circumstance or event, and typically a function of: (i) the adverse impacts that would arise if the circumstance or event occurs; and (ii) the likelihood of occurrence.
Risk
Association object between assets and risk. It can be attributed e.g. priority, effect, likelihood
Risk Assesement
SW Application
SW Solution
Extent of the area or subject matter that something deals with or to which it is relevant
Scope
Mechanism that verifies the integrity of every code being loaded, before it's allowed to execute
Secure Boot Mechanism
Sensor
Components provide services, which are units of funtionality that can run independently.
Service
Generic concept that represents solution structures for systems.
Solution Structure
Person with an interest or concern in something
Stakeholder
A standard is a document that provides rules or guidelines to achieve order in a given context.
Standard
Status
Mechanism that enables a computer or system to retain data, either temporarily or permanently
Storage Mechanism
Generic class for extra informative content
Supplemental Guidance
Product and service providers used for an organization’s internal purposes (e.g., IT infrastructure) or integrated into the products of services provided to that organization’s Buyers.
Certain suppliers are expected to provide documentation, and other kinds of information regarding their products, also safety related points
Person or organization that provides a product or service
Supplier
System for which components will be defined
System
Statement that identifies the functionality and characteristics of a system to satisfy the stakeholder’s requirements/needs/concerns
System Requirement
Entity part of an organization in charge of developing standard
Technical Committee
Application of scientific knowledge for practical purposes
Technology
Something that can harm a system,component. A requirement can mitigate such threats. Multipple concepts such as System, components, technologies can be target of threats; while requirements and techonologies, and other items can mitigate them.
Threat
Tiers describe the degree to which an organization’s cybersecurity risk management practices exhibit the characteristics defined in the Framework (e.g., risk and threat aware, repeatable, and adaptive)
Tier
Value that describes the tolerance of a risk accepted by an organization
Tolerance
A thing or technology used to help perform a job, e.g. SW that carries out a particular function, typically creating or modifying another program.
Tool
Type is used to define a category of things having common characteristics Items can have types, devices also.
Type
Update Mechanism
User
Vulnerability
Creative Commons Attribution 4.0 International
IEC
Security for industrial automation and control systems - Part 4-2: Technical security requirements for IACS components
IEC _ TC _65
Industrial-process measurement, control and automation
ISO
International Organization for Standarization
MIT _ License
NIST
National Institute Of Standards and Technology
Status _ Published
Status _ Withdrawn
Type _ NIST