Trust Mapping

[mdoherty-axiom]

This first pull request partially addresses #197 by incorporating a high-level modeling technique Trust Mapping and 5 subtechniques (4 are mapping/relationship discovery techniques and 1 risk assessment technique).

• Agent Trust Mapping examples:

  • Security managers, organizations, developers, review teams, software license holders

• Decision Process Trust Mapping examples:

  • If certificate verification passed trust source, do not trust identity of user if only one factor of authentication occurred

• Information Source Trust Mapping examples:

  • In attribute-based access control decisions are made based on information about the data being accessed (the source and trustworthiness of this effect system security), audit records, heuristics, user-behavior analytics

• Software Source Mapping examples:

  • delivery methods (distribution networks), developers/organizations that made software, certificate creators, dependency repositories