Capability
Capabilities are the features or elements of useful behaviour provided by a sensitive activity.
Role
Capabilities name what the activity can do for users and systems—useful behaviour that also creates attack surface and therefore needs governing.
Without naming capabilities, threat models and controls float free of the real activity.
Examples
Public source publication
The ability to publish source, configuration or build artefacts to publicly accessible FOSS platforms. That capability is what makes accidental disclosure and unreviewed release possible—and what publication controls must govern.
Source: Public Source Publication (public-source-publication) in FOSS Contribution Capability Catalog.
Contributor agreement acceptance
The ability to accept CLAs, Corporate CLAs or Developer Certificates of Origin on behalf of the company. Legal and IP controls exist because this capability creates lasting obligations.
Source: Contributor Agreement Acceptance (contributor-agreement-acceptance) in FOSS Contribution Capability Catalog.
Company infrastructure contribution
The ability to contribute from the company network or managed hardware using approved tooling. Infrastructure and scanning controls bind to this capability rather than to “the internet” in general.
Source: Company Infrastructure Contribution (company-infrastructure-contribution) in FOSS Contribution Capability Catalog.
Storage buckets
Object storage provides uniquely identifiable segmentations in which data elements may be stored. Buckets are the unit of organisation—and of many access, replication and lifecycle decisions that threats and controls must address.
Source: Storage Buckets (CCC.ObjStor.CP01) in FINOS CCC Object Storage.
Lifecycle policies
The ability to define policies that automate data management—especially cost and retention tasks. Useful behaviour that also creates a path for premature destruction or unintended exposure if misconfigured.
Source: Lifecycle Policies (CCC.ObjStor.CP08) in FINOS CCC Object Storage.
Object-level access control
The ability to control access to specific objects within the store—not only at bucket scope. Fine-grained permission surfaces are exactly what access-control threats and controls attach to.
Source: Object Level Access Control (CCC.ObjStor.CP10) in FINOS CCC Object Storage.
Links upstream
- Architecture inventories, platform feature lists, SCM/CI capabilities
Links downstream
- Threat lists enabling capabilities
Anti-patterns
Capabilities that are really controls
“Secret scanning” is a control (or a tool). “Public source publication” is the capability that creates the need for scanning.
Inventory of products instead of abilities
Listing GitHub, GitLab and Bitbucket as capabilities without saying what dangerous or governable ability each affords.