manually merged pr Threagile#5: Infer CIA ratings of tech assets Thre…

…agile#19

.github/workflows/codeql-analysis.yml

@@ -28,7 +28,7 @@ jobs:
       uses: actions/checkout@v4
       with:
         # We must fetch at least the immediate parents so that if this is
-        # a pull request then we can checkout the head.
+        # a pull request then we can check out the head.
         fetch-depth: 2
 
     - name: Install Go
@@ -39,14 +39,14 @@ jobs:
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
 
     # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
     # If this step fails, then you should remove it and run the build manually (see below)
     - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
+      uses: github/codeql-action/autobuild@v3
 
     # ℹ️ Command-line programs to run using the OS shell.
     # 📚 https://git.io/JvXDl
@@ -60,4 +60,4 @@ jobs:
     #   make release
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

pkg/model/parse.go

@@ -354,6 +354,26 @@ func ParseModel(modelInput *input.Model, builtinRiskRules map[string]risks.RiskR
 		}
 	}
 
+	// If CIA is lower than that of its data assets, it is implicitly set to the highest CIA value of its data assets
+	for id, techAsset := range parsedModel.TechnicalAssets {
+		dataAssetConfidentiality := techAsset.HighestConfidentiality(&parsedModel)
+		if techAsset.Confidentiality < dataAssetConfidentiality {
+			techAsset.Confidentiality = dataAssetConfidentiality
+		}
+
+		dataAssetIntegrity := techAsset.HighestIntegrity(&parsedModel)
+		if techAsset.Integrity < dataAssetIntegrity {
+			techAsset.Integrity = dataAssetIntegrity
+		}
+
+		dataAssetAvailability := techAsset.HighestAvailability(&parsedModel)
+		if techAsset.Availability < dataAssetAvailability {
+			techAsset.Availability = dataAssetAvailability
+		}
+
+		parsedModel.TechnicalAssets[id] = techAsset
+	}
+
 	// A target of a communication link implicitly processes all data assets that are sent to or received by that target
 	for id, techAsset := range parsedModel.TechnicalAssets {
 		for _, commLink := range techAsset.CommunicationLinks {