Skip to main content

Governance artifact

Gemara Layer 2

CapabilityCatalog

Capability

Purpose

Capabilities are the features or elements of useful behaviour provided by a sensitive activity.

Role

Capabilities name what the activity can do for users and systems—useful behaviour that also creates attack surface and therefore needs governing.

Without naming capabilities, threat models and controls float free of the real activity.

Examples

Public source publication

The ability to publish source, configuration or build artefacts to publicly accessible FOSS platforms. That capability is what makes accidental disclosure and unreviewed release possible—and what publication controls must govern.

Source: Public Source Publication (public-source-publication) in FOSS Contribution Capability Catalog.

Contributor agreement acceptance

The ability to accept CLAs, Corporate CLAs or Developer Certificates of Origin on behalf of the company. Legal and IP controls exist because this capability creates lasting obligations.

Source: Contributor Agreement Acceptance (contributor-agreement-acceptance) in FOSS Contribution Capability Catalog.

Company infrastructure contribution

The ability to contribute from the company network or managed hardware using approved tooling. Infrastructure and scanning controls bind to this capability rather than to “the internet” in general.

Source: Company Infrastructure Contribution (company-infrastructure-contribution) in FOSS Contribution Capability Catalog.

Storage buckets

Object storage provides uniquely identifiable segmentations in which data elements may be stored. Buckets are the unit of organisation—and of many access, replication and lifecycle decisions that threats and controls must address.

Source: Storage Buckets (CCC.ObjStor.CP01) in FINOS CCC Object Storage.

Lifecycle policies

The ability to define policies that automate data management—especially cost and retention tasks. Useful behaviour that also creates a path for premature destruction or unintended exposure if misconfigured.

Source: Lifecycle Policies (CCC.ObjStor.CP08) in FINOS CCC Object Storage.

Object-level access control

The ability to control access to specific objects within the store—not only at bucket scope. Fine-grained permission surfaces are exactly what access-control threats and controls attach to.

Source: Object Level Access Control (CCC.ObjStor.CP10) in FINOS CCC Object Storage.

Anti-patterns

Capabilities that are really controls

“Secret scanning” is a control (or a tool). “Public source publication” is the capability that creates the need for scanning.

Inventory of products instead of abilities

Listing GitHub, GitLab and Bitbucket as capabilities without saying what dangerous or governable ability each affords.

References