Skip to content

deployer.md

Latest commit

 

History

History
executable file
·
427 lines (392 loc) · 17.4 KB

deployer.md

File metadata and controls

executable file
·
427 lines (392 loc) · 17.4 KB
generated true
source methodologies/deployer.yaml
generator scripts/generate_plugins.py
lastGenerated 2025-08-29 17:35:05 -0700
generatedFiles
python
path checksum
src/ssvc/plugins/deployer.py
c1a0e84e3a5abe334d6766e1ff793fff0c4cd3d9

Deployer Decision Model

CERT/CC Deployer Decision Model

Version: 1.0
Reference: https://certcc.github.io/SSVC/howto/deployer_tree/

Decision Tree

flowchart LR
    ExploitationStatus_1{ExploitationStatus}
    SystemExposureLevel_2{SystemExposureLevel}
    ExploitationStatus_1 -->|none| SystemExposureLevel_2
    UtilityLevel_3{UtilityLevel}
    SystemExposureLevel_2 -->|small| UtilityLevel_3
    HumanImpactLevel_4{HumanImpactLevel}
    UtilityLevel_3 -->|laborious| HumanImpactLevel_4
    Action_defer_5[defer]
    HumanImpactLevel_4 -->|low| Action_defer_5
    Action_defer_6[defer]
    HumanImpactLevel_4 -->|medium| Action_defer_6
    Action_scheduled_7[scheduled]
    HumanImpactLevel_4 -->|high| Action_scheduled_7
    Action_scheduled_8[scheduled]
    HumanImpactLevel_4 -->|very_high| Action_scheduled_8
    HumanImpactLevel_9{HumanImpactLevel}
    UtilityLevel_3 -->|efficient| HumanImpactLevel_9
    Action_defer_10[defer]
    HumanImpactLevel_9 -->|low| Action_defer_10
    Action_defer_11[defer]
    HumanImpactLevel_9 -->|medium| Action_defer_11
    Action_scheduled_12[scheduled]
    HumanImpactLevel_9 -->|high| Action_scheduled_12
    Action_scheduled_13[scheduled]
    HumanImpactLevel_9 -->|very_high| Action_scheduled_13
    HumanImpactLevel_14{HumanImpactLevel}
    UtilityLevel_3 -->|super_effective| HumanImpactLevel_14
    Action_defer_15[defer]
    HumanImpactLevel_14 -->|low| Action_defer_15
    Action_scheduled_16[scheduled]
    HumanImpactLevel_14 -->|medium| Action_scheduled_16
    Action_scheduled_17[scheduled]
    HumanImpactLevel_14 -->|high| Action_scheduled_17
    Action_out_of_cycle_18[out_of_cycle]
    HumanImpactLevel_14 -->|very_high| Action_out_of_cycle_18
    UtilityLevel_19{UtilityLevel}
    SystemExposureLevel_2 -->|controlled| UtilityLevel_19
    HumanImpactLevel_20{HumanImpactLevel}
    UtilityLevel_19 -->|laborious| HumanImpactLevel_20
    Action_defer_21[defer]
    HumanImpactLevel_20 -->|low| Action_defer_21
    Action_defer_22[defer]
    HumanImpactLevel_20 -->|medium| Action_defer_22
    Action_scheduled_23[scheduled]
    HumanImpactLevel_20 -->|high| Action_scheduled_23
    Action_scheduled_24[scheduled]
    HumanImpactLevel_20 -->|very_high| Action_scheduled_24
    HumanImpactLevel_25{HumanImpactLevel}
    UtilityLevel_19 -->|efficient| HumanImpactLevel_25
    Action_defer_26[defer]
    HumanImpactLevel_25 -->|low| Action_defer_26
    Action_scheduled_27[scheduled]
    HumanImpactLevel_25 -->|medium| Action_scheduled_27
    Action_scheduled_28[scheduled]
    HumanImpactLevel_25 -->|high| Action_scheduled_28
    Action_out_of_cycle_29[out_of_cycle]
    HumanImpactLevel_25 -->|very_high| Action_out_of_cycle_29
    HumanImpactLevel_30{HumanImpactLevel}
    UtilityLevel_19 -->|super_effective| HumanImpactLevel_30
    Action_defer_31[defer]
    HumanImpactLevel_30 -->|low| Action_defer_31
    Action_scheduled_32[scheduled]
    HumanImpactLevel_30 -->|medium| Action_scheduled_32
    Action_out_of_cycle_33[out_of_cycle]
    HumanImpactLevel_30 -->|high| Action_out_of_cycle_33
    Action_out_of_cycle_34[out_of_cycle]
    HumanImpactLevel_30 -->|very_high| Action_out_of_cycle_34
    UtilityLevel_35{UtilityLevel}
    SystemExposureLevel_2 -->|open| UtilityLevel_35
    HumanImpactLevel_36{HumanImpactLevel}
    UtilityLevel_35 -->|laborious| HumanImpactLevel_36
    Action_defer_37[defer]
    HumanImpactLevel_36 -->|low| Action_defer_37
    Action_scheduled_38[scheduled]
    HumanImpactLevel_36 -->|medium| Action_scheduled_38
    Action_scheduled_39[scheduled]
    HumanImpactLevel_36 -->|high| Action_scheduled_39
    Action_out_of_cycle_40[out_of_cycle]
    HumanImpactLevel_36 -->|very_high| Action_out_of_cycle_40
    HumanImpactLevel_41{HumanImpactLevel}
    UtilityLevel_35 -->|efficient| HumanImpactLevel_41
    Action_scheduled_42[scheduled]
    HumanImpactLevel_41 -->|low| Action_scheduled_42
    Action_scheduled_43[scheduled]
    HumanImpactLevel_41 -->|medium| Action_scheduled_43
    Action_out_of_cycle_44[out_of_cycle]
    HumanImpactLevel_41 -->|high| Action_out_of_cycle_44
    Action_out_of_cycle_45[out_of_cycle]
    HumanImpactLevel_41 -->|very_high| Action_out_of_cycle_45
    HumanImpactLevel_46{HumanImpactLevel}
    UtilityLevel_35 -->|super_effective| HumanImpactLevel_46
    Action_scheduled_47[scheduled]
    HumanImpactLevel_46 -->|low| Action_scheduled_47
    Action_out_of_cycle_48[out_of_cycle]
    HumanImpactLevel_46 -->|medium| Action_out_of_cycle_48
    Action_out_of_cycle_49[out_of_cycle]
    HumanImpactLevel_46 -->|high| Action_out_of_cycle_49
    Action_immediate_50[immediate]
    HumanImpactLevel_46 -->|very_high| Action_immediate_50
    SystemExposureLevel_51{SystemExposureLevel}
    ExploitationStatus_1 -->|public_poc| SystemExposureLevel_51
    UtilityLevel_52{UtilityLevel}
    SystemExposureLevel_51 -->|small| UtilityLevel_52
    HumanImpactLevel_53{HumanImpactLevel}
    UtilityLevel_52 -->|laborious| HumanImpactLevel_53
    Action_defer_54[defer]
    HumanImpactLevel_53 -->|low| Action_defer_54
    Action_scheduled_55[scheduled]
    HumanImpactLevel_53 -->|medium| Action_scheduled_55
    Action_scheduled_56[scheduled]
    HumanImpactLevel_53 -->|high| Action_scheduled_56
    Action_out_of_cycle_57[out_of_cycle]
    HumanImpactLevel_53 -->|very_high| Action_out_of_cycle_57
    HumanImpactLevel_58{HumanImpactLevel}
    UtilityLevel_52 -->|efficient| HumanImpactLevel_58
    Action_scheduled_59[scheduled]
    HumanImpactLevel_58 -->|low| Action_scheduled_59
    Action_scheduled_60[scheduled]
    HumanImpactLevel_58 -->|medium| Action_scheduled_60
    Action_out_of_cycle_61[out_of_cycle]
    HumanImpactLevel_58 -->|high| Action_out_of_cycle_61
    Action_out_of_cycle_62[out_of_cycle]
    HumanImpactLevel_58 -->|very_high| Action_out_of_cycle_62
    HumanImpactLevel_63{HumanImpactLevel}
    UtilityLevel_52 -->|super_effective| HumanImpactLevel_63
    Action_scheduled_64[scheduled]
    HumanImpactLevel_63 -->|low| Action_scheduled_64
    Action_out_of_cycle_65[out_of_cycle]
    HumanImpactLevel_63 -->|medium| Action_out_of_cycle_65
    Action_out_of_cycle_66[out_of_cycle]
    HumanImpactLevel_63 -->|high| Action_out_of_cycle_66
    Action_immediate_67[immediate]
    HumanImpactLevel_63 -->|very_high| Action_immediate_67
    UtilityLevel_68{UtilityLevel}
    SystemExposureLevel_51 -->|controlled| UtilityLevel_68
    HumanImpactLevel_69{HumanImpactLevel}
    UtilityLevel_68 -->|laborious| HumanImpactLevel_69
    Action_scheduled_70[scheduled]
    HumanImpactLevel_69 -->|low| Action_scheduled_70
    Action_scheduled_71[scheduled]
    HumanImpactLevel_69 -->|medium| Action_scheduled_71
    Action_out_of_cycle_72[out_of_cycle]
    HumanImpactLevel_69 -->|high| Action_out_of_cycle_72
    Action_out_of_cycle_73[out_of_cycle]
    HumanImpactLevel_69 -->|very_high| Action_out_of_cycle_73
    HumanImpactLevel_74{HumanImpactLevel}
    UtilityLevel_68 -->|efficient| HumanImpactLevel_74
    Action_scheduled_75[scheduled]
    HumanImpactLevel_74 -->|low| Action_scheduled_75
    Action_out_of_cycle_76[out_of_cycle]
    HumanImpactLevel_74 -->|medium| Action_out_of_cycle_76
    Action_out_of_cycle_77[out_of_cycle]
    HumanImpactLevel_74 -->|high| Action_out_of_cycle_77
    Action_immediate_78[immediate]
    HumanImpactLevel_74 -->|very_high| Action_immediate_78
    HumanImpactLevel_79{HumanImpactLevel}
    UtilityLevel_68 -->|super_effective| HumanImpactLevel_79
    Action_out_of_cycle_80[out_of_cycle]
    HumanImpactLevel_79 -->|low| Action_out_of_cycle_80
    Action_out_of_cycle_81[out_of_cycle]
    HumanImpactLevel_79 -->|medium| Action_out_of_cycle_81
    Action_immediate_82[immediate]
    HumanImpactLevel_79 -->|high| Action_immediate_82
    Action_immediate_83[immediate]
    HumanImpactLevel_79 -->|very_high| Action_immediate_83
    UtilityLevel_84{UtilityLevel}
    SystemExposureLevel_51 -->|open| UtilityLevel_84
    HumanImpactLevel_85{HumanImpactLevel}
    UtilityLevel_84 -->|laborious| HumanImpactLevel_85
    Action_scheduled_86[scheduled]
    HumanImpactLevel_85 -->|low| Action_scheduled_86
    Action_out_of_cycle_87[out_of_cycle]
    HumanImpactLevel_85 -->|medium| Action_out_of_cycle_87
    Action_out_of_cycle_88[out_of_cycle]
    HumanImpactLevel_85 -->|high| Action_out_of_cycle_88
    Action_immediate_89[immediate]
    HumanImpactLevel_85 -->|very_high| Action_immediate_89
    HumanImpactLevel_90{HumanImpactLevel}
    UtilityLevel_84 -->|efficient| HumanImpactLevel_90
    Action_out_of_cycle_91[out_of_cycle]
    HumanImpactLevel_90 -->|low| Action_out_of_cycle_91
    Action_out_of_cycle_92[out_of_cycle]
    HumanImpactLevel_90 -->|medium| Action_out_of_cycle_92
    Action_immediate_93[immediate]
    HumanImpactLevel_90 -->|high| Action_immediate_93
    Action_immediate_94[immediate]
    HumanImpactLevel_90 -->|very_high| Action_immediate_94
    HumanImpactLevel_95{HumanImpactLevel}
    UtilityLevel_84 -->|super_effective| HumanImpactLevel_95
    Action_out_of_cycle_96[out_of_cycle]
    HumanImpactLevel_95 -->|low| Action_out_of_cycle_96
    Action_immediate_97[immediate]
    HumanImpactLevel_95 -->|medium| Action_immediate_97
    Action_immediate_98[immediate]
    HumanImpactLevel_95 -->|high| Action_immediate_98
    Action_immediate_99[immediate]
    HumanImpactLevel_95 -->|very_high| Action_immediate_99
    SystemExposureLevel_100{SystemExposureLevel}
    ExploitationStatus_1 -->|active| SystemExposureLevel_100
    UtilityLevel_101{UtilityLevel}
    SystemExposureLevel_100 -->|small| UtilityLevel_101
    HumanImpactLevel_102{HumanImpactLevel}
    UtilityLevel_101 -->|laborious| HumanImpactLevel_102
    Action_scheduled_103[scheduled]
    HumanImpactLevel_102 -->|low| Action_scheduled_103
    Action_scheduled_104[scheduled]
    HumanImpactLevel_102 -->|medium| Action_scheduled_104
    Action_out_of_cycle_105[out_of_cycle]
    HumanImpactLevel_102 -->|high| Action_out_of_cycle_105
    Action_immediate_106[immediate]
    HumanImpactLevel_102 -->|very_high| Action_immediate_106
    HumanImpactLevel_107{HumanImpactLevel}
    UtilityLevel_101 -->|efficient| HumanImpactLevel_107
    Action_scheduled_108[scheduled]
    HumanImpactLevel_107 -->|low| Action_scheduled_108
    Action_out_of_cycle_109[out_of_cycle]
    HumanImpactLevel_107 -->|medium| Action_out_of_cycle_109
    Action_out_of_cycle_110[out_of_cycle]
    HumanImpactLevel_107 -->|high| Action_out_of_cycle_110
    Action_immediate_111[immediate]
    HumanImpactLevel_107 -->|very_high| Action_immediate_111
    HumanImpactLevel_112{HumanImpactLevel}
    UtilityLevel_101 -->|super_effective| HumanImpactLevel_112
    Action_out_of_cycle_113[out_of_cycle]
    HumanImpactLevel_112 -->|low| Action_out_of_cycle_113
    Action_out_of_cycle_114[out_of_cycle]
    HumanImpactLevel_112 -->|medium| Action_out_of_cycle_114
    Action_immediate_115[immediate]
    HumanImpactLevel_112 -->|high| Action_immediate_115
    Action_immediate_116[immediate]
    HumanImpactLevel_112 -->|very_high| Action_immediate_116
    UtilityLevel_117{UtilityLevel}
    SystemExposureLevel_100 -->|controlled| UtilityLevel_117
    HumanImpactLevel_118{HumanImpactLevel}
    UtilityLevel_117 -->|laborious| HumanImpactLevel_118
    Action_scheduled_119[scheduled]
    HumanImpactLevel_118 -->|low| Action_scheduled_119
    Action_out_of_cycle_120[out_of_cycle]
    HumanImpactLevel_118 -->|medium| Action_out_of_cycle_120
    Action_out_of_cycle_121[out_of_cycle]
    HumanImpactLevel_118 -->|high| Action_out_of_cycle_121
    Action_immediate_122[immediate]
    HumanImpactLevel_118 -->|very_high| Action_immediate_122
    HumanImpactLevel_123{HumanImpactLevel}
    UtilityLevel_117 -->|efficient| HumanImpactLevel_123
    Action_out_of_cycle_124[out_of_cycle]
    HumanImpactLevel_123 -->|low| Action_out_of_cycle_124
    Action_out_of_cycle_125[out_of_cycle]
    HumanImpactLevel_123 -->|medium| Action_out_of_cycle_125
    Action_immediate_126[immediate]
    HumanImpactLevel_123 -->|high| Action_immediate_126
    Action_immediate_127[immediate]
    HumanImpactLevel_123 -->|very_high| Action_immediate_127
    HumanImpactLevel_128{HumanImpactLevel}
    UtilityLevel_117 -->|super_effective| HumanImpactLevel_128
    Action_out_of_cycle_129[out_of_cycle]
    HumanImpactLevel_128 -->|low| Action_out_of_cycle_129
    Action_immediate_130[immediate]
    HumanImpactLevel_128 -->|medium| Action_immediate_130
    Action_immediate_131[immediate]
    HumanImpactLevel_128 -->|high| Action_immediate_131
    Action_immediate_132[immediate]
    HumanImpactLevel_128 -->|very_high| Action_immediate_132
    UtilityLevel_133{UtilityLevel}
    SystemExposureLevel_100 -->|open| UtilityLevel_133
    HumanImpactLevel_134{HumanImpactLevel}
    UtilityLevel_133 -->|laborious| HumanImpactLevel_134
    Action_out_of_cycle_135[out_of_cycle]
    HumanImpactLevel_134 -->|low| Action_out_of_cycle_135
    Action_out_of_cycle_136[out_of_cycle]
    HumanImpactLevel_134 -->|medium| Action_out_of_cycle_136
    Action_immediate_137[immediate]
    HumanImpactLevel_134 -->|high| Action_immediate_137
    Action_immediate_138[immediate]
    HumanImpactLevel_134 -->|very_high| Action_immediate_138
    HumanImpactLevel_139{HumanImpactLevel}
    UtilityLevel_133 -->|efficient| HumanImpactLevel_139
    Action_out_of_cycle_140[out_of_cycle]
    HumanImpactLevel_139 -->|low| Action_out_of_cycle_140
    Action_immediate_141[immediate]
    HumanImpactLevel_139 -->|medium| Action_immediate_141
    Action_immediate_142[immediate]
    HumanImpactLevel_139 -->|high| Action_immediate_142
    Action_immediate_143[immediate]
    HumanImpactLevel_139 -->|very_high| Action_immediate_143
    HumanImpactLevel_144{HumanImpactLevel}
    UtilityLevel_133 -->|super_effective| HumanImpactLevel_144
    Action_immediate_145[immediate]
    HumanImpactLevel_144 -->|low| Action_immediate_145
    Action_immediate_146[immediate]
    HumanImpactLevel_144 -->|medium| Action_immediate_146
    Action_immediate_147[immediate]
    HumanImpactLevel_144 -->|high| Action_immediate_147
    Action_immediate_148[immediate]
    HumanImpactLevel_144 -->|very_high| Action_immediate_148
Loading

Decision Points

  • ExploitationStatus: none, public_poc, active
  • SystemExposureLevel: small, controlled, open
  • UtilityLevel: laborious, efficient, super_effective
  • HumanImpactLevel: low, medium, high, very_high

Usage

from ssvc.plugins.deployer import DecisionDeployer

decision = DecisionDeployer(
    # Set decision point values here
)

outcome = decision.evaluate()
print(f"Action: {outcome.action}")
print(f"Priority: {outcome.priority}")

Vector String Support

This methodology supports SSVC vector strings for compact representation and interchange.

Parameter Abbreviations

Parameter Abbreviation Value Mappings
exploitation E none→N, public_poc→P, active→A
system_exposure SE small→S, controlled→C, open→O
utility U laborious→L, efficient→E, super_effective→S
human_impact HI low→L, medium→M, high→H, very_high→V

Vector String Format

DEPLOYERv1/[parameters]/[timestamp]/

Example Usage

# Generate vector string from decision
decision = DecisionDeployer(
    exploitation='none',
    system_exposure='small',
    utility='laborious',
    human_impact='low',
)

vector_string = decision.to_vector()
print(vector_string)
# Output: DEPLOYERv1/E:N/SE:S/U:L/HI:L/2024-07-23T20:34:21.000000/

# Parse vector string to create decision
parsed_decision = DecisionDeployer.from_vector("DEPLOYERv1/E:N/SE:S/U:L/HI:L/2024-07-23T20:34:21.000000/")
outcome = parsed_decision.evaluate()

File Integrity Verification

The generated files in this methodology have SHA1 checksums for verification:

Checksum Verification Commands

Verify the integrity of generated files using these commands:

# Verify Python plugin file
echo "c1a0e84e3a5abe334d6766e1ff793fff0c4cd3d9  src/ssvc/plugins/deployer.py" | sha1sum -c

# Verify all generated files using the justfile task
just verify-checksums

# Verify using actual file checksum  
sha1sum src/ssvc/plugins/deployer.py

Batch Verification

To verify all generated files at once:

# Verify all checksums from documentation metadata
just verify-checksums

# Alternative: Manual verification of all files
for doc in docs/*.md; do
    if [[ -f "$doc" ]]; then
        py_path=$(rg -N "path: src/ssvc/plugins/.*\.py" --only-matching "$doc" 2>/dev/null | head -1 | sed 's/path: //' || true)
        py_checksum=$(rg -N "checksum: [a-f0-9]+" --only-matching "$doc" 2>/dev/null | head -1 | sed 's/checksum: //' || true)
        if [[ -n "$py_path" ]] && [[ -n "$py_checksum" ]] && [[ -f "$py_path" ]]; then
            echo "$py_checksum  $py_path" | sha1sum -c
        fi
    fi
done

Why This Matters: Checksum verification ensures that generated files haven't been tampered with or corrupted. This is important for:

  • Security: Detecting unauthorized modifications to generated code
  • Integrity: Ensuring files match their expected content exactly
  • Trust: Providing cryptographic proof that files are authentic
  • Debugging: Confirming file corruption isn't causing unexpected behavior
  • Compliance: Meeting security requirements for code integrity verification

Always verify checksums before deploying or using generated files in production environments.