RISK-WP-0001 T01-T06,T08: the four instruments, the index, and the first grading
Severity (impact x likelihood, fidelity modifier for controls that lie, headline-vs-constraint, build-mode double grade, the floor), disclosure (publish/embargoed/restricted, and the build-mode deferral re-taken and narrowed with RISK-F-0001 in hand), escalation (the five INTENT triggers settled plus an ordering-hazard trigger the RISK-F-0002 case forced; proposed, awaiting the custodian), review (intervals, what a review is, what missing one produces, the production re-score). Then applied: RISK-F-0001 critical/embargoed/escalated, RISK-F-0002 medium with a high constraint on RISK-F-0001's remediation, filed as a peer and escalated only on the ordering, RISK-F-0003 high/embargoed/no escalation. No unset field remains. REGISTER.md is generated; make check reports overdue, stalled, ungraded and unanswered escalations without changing anything. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This commit is contained in:
parent
e268259f94
commit
d5a3953f2e
15 changed files with 1334 additions and 14 deletions
169
docs/method/severity.md
Normal file
169
docs/method/severity.md
Normal file
|
|
@ -0,0 +1,169 @@
|
|||
---
|
||||
id: RISK-METHOD-SEVERITY
|
||||
type: method
|
||||
title: "Severity: how bad, how likely, and what is not a risk at all"
|
||||
status: adopted
|
||||
owner: risk-nexus
|
||||
adopted: "2026-08-19"
|
||||
workplan: RISK-WP-0001-T01
|
||||
review_interval: 180d
|
||||
---
|
||||
|
||||
# Severity
|
||||
|
||||
This is `risk-nexus`'s judgement instrument. It is not canon, it is not a
|
||||
standard, and it binds nobody else. It exists so that two findings graded a
|
||||
month apart are graded the same way, and so that a grade can be argued with.
|
||||
|
||||
It was written against three real findings (`RISK-F-0001`, `RISK-F-0002`,
|
||||
`RISK-F-0003`) and it must keep grading those three sensibly or it is wrong.
|
||||
|
||||
## The two axes
|
||||
|
||||
### Impact — what happens if it goes wrong once
|
||||
|
||||
| Band | Name | Test |
|
||||
| --- | --- | --- |
|
||||
| `I1` | negligible | Confined to one component. No data leaves it, no record is falsified, no recovery is lost. |
|
||||
| `I2` | limited | One system's data or availability. Recoverable. Confined to a single tenant, actor or lane. |
|
||||
| `I3` | serious | Crosses a boundary — tenant, system, or trust — or removes recoverability for one system. |
|
||||
| `I4` | severe | Crosses the estate. What is compromised here propagates to everything that trusts it, or the data loss is unbounded. |
|
||||
|
||||
Impact is scored at **one occurrence**, not at the worst imaginable campaign.
|
||||
"An attacker who already owns the cluster could do this too" is not an impact
|
||||
argument.
|
||||
|
||||
### Likelihood — how far anyone has to reach
|
||||
|
||||
| Band | Name | Test |
|
||||
| --- | --- | --- |
|
||||
| `L1` | remote | Requires access nobody currently holds and no ordinary process grants. |
|
||||
| `L2` | possible | Requires a foothold the estate does grant somewhere — an in-cluster workload, an agent session, a scoped token. |
|
||||
| `L3` | likely | Reachable from inside the normal working set with no additional step. |
|
||||
| `L4` | present | No barrier at all, or it is already happening. |
|
||||
|
||||
Likelihood is about **reach**, not about intent or about whether anyone has
|
||||
bothered. `risk-nexus` does not model attackers; it models what the system
|
||||
permits.
|
||||
|
||||
Where the reporter has not established exposure, the finding says so and the
|
||||
grade uses the band the *stated* facts support — not the worst case, and not
|
||||
zero. `RISK-F-0001` explicitly declines to assume a default-deny NetworkPolicy
|
||||
exists; the grade must decline with it, and the unverified fact becomes a
|
||||
review item rather than a silent assumption in either direction.
|
||||
|
||||
## The grid
|
||||
|
||||
| | `L1` | `L2` | `L3` | `L4` |
|
||||
| --- | --- | --- | --- | --- |
|
||||
| `I4` | medium | high | **critical** | **critical** |
|
||||
| `I3` | low | medium | high | **critical** |
|
||||
| `I2` | low | low | medium | high |
|
||||
| `I1` | note | low | low | medium |
|
||||
|
||||
Four severities: `low`, `medium`, `high`, `critical`. `note` is not a
|
||||
severity; see the floor.
|
||||
|
||||
## The fidelity modifier
|
||||
|
||||
**A control that lies is one impact band worse than the same control absent.**
|
||||
|
||||
Apply `+1` impact band (capped at `I4`) when the failure mode produces a
|
||||
*false record* rather than *no record*: an attestation that a check passed
|
||||
when nothing checked, an audit line asserting an authorization that was never
|
||||
made, a green signal derived from an unreachable test.
|
||||
|
||||
The reasoning is `RISK-F-0002`'s and the register adopts it: an absent control
|
||||
is a gap you can find by looking; a lying control is a gap that survives
|
||||
looking, because the evidence you would look at is the thing that is wrong.
|
||||
Only one of the two states misleads the person investigating afterwards.
|
||||
|
||||
The modifier applies to the state being scored. A finding that describes both
|
||||
states — control absent today, control lying if switched on in the wrong order —
|
||||
gets **two scores and one of them is the register's headline**; see
|
||||
"Which state is scored".
|
||||
|
||||
## Which state is scored
|
||||
|
||||
The headline `severity` is the state of the world **today**. A hazard that
|
||||
would be created by a *future* action is not the headline, because a register
|
||||
that scores hypotheticals stops describing the estate.
|
||||
|
||||
The hazard is not lost. It is recorded on the finding as a named
|
||||
**constraint** with its own grade, and it attaches to whatever action would
|
||||
trigger it — usually another finding's remediation. `RISK-F-0002` is the
|
||||
worked example: the gate being off is today (headline), the gate being
|
||||
switched on while the oracle is forgeable is a constraint on `RISK-F-0001`'s
|
||||
fix, graded separately and higher.
|
||||
|
||||
If the constraint's grade is higher than the headline, the finding says so in
|
||||
its ruling. A reader must not be able to come away with the low number and
|
||||
miss the high one.
|
||||
|
||||
## Build mode
|
||||
|
||||
Every finding is graded twice:
|
||||
|
||||
- `severity` — today, in build mode, with today's likelihood.
|
||||
- `severity_at_production` — the same impact, with likelihood re-read for a
|
||||
system carrying real users and real tenant data.
|
||||
|
||||
Build mode is a legitimate likelihood input. "No consumer holds real data
|
||||
here yet" genuinely lowers reach. It is *not* an impact input: what the defect
|
||||
would do on the day it is exercised does not change because the calendar has
|
||||
not reached production.
|
||||
|
||||
Where the two grades differ, the production transition is a mandatory
|
||||
re-score. `docs/method/review.md` binds the review date to it, so the re-score
|
||||
is a scheduled event and not somebody's memory.
|
||||
|
||||
## The floor
|
||||
|
||||
`INTENT.md`: if a finding would not change anyone's decision, it is a note,
|
||||
not a risk. Concretely, a register entry requires **both**:
|
||||
|
||||
1. **An owner who could act.** Some repo, or the operator, can do something
|
||||
about it. No actor, no entry.
|
||||
2. **A decision that changes.** Recording it alters what someone does, when
|
||||
they do it, or what they must not do first.
|
||||
|
||||
Fails either test → it is a note in `notes/`, not a finding in `findings/`.
|
||||
Notes are not graded, not reviewed, and not published. They exist so that
|
||||
"we saw it" survives without inflating the register.
|
||||
|
||||
An `I1`/`L1` cell is `note` in the grid for the same reason: something that
|
||||
is both negligible and unreachable is a thing we know, not a risk we carry.
|
||||
|
||||
Two things the floor does **not** exclude:
|
||||
|
||||
- **Known and deliberate.** `RISK-F-0002` is a decision somebody made on
|
||||
purpose. It still passes the floor, because it changes what may be switched
|
||||
on and in what order. Deliberate is not the same as tracked.
|
||||
- **Omission-shaped.** `RISK-F-0003` is a default that silently produces
|
||||
ungoverned lanes. The individual lane is small; the default is not.
|
||||
|
||||
## Provenance is a grading input
|
||||
|
||||
All four defects known to this register were found by repos reading their own
|
||||
code against a ladder, within days of each other. None was found by monitoring.
|
||||
|
||||
Where a finding's provenance is "we happened to look", the register does not
|
||||
get to assume that similar defects would have been caught. That raises
|
||||
likelihood for the class, not for the instance, and it belongs in the ruling's
|
||||
reasoning rather than in a modifier — the register grades what is filed, and
|
||||
notes when the filing was luck.
|
||||
|
||||
## Recording a grade
|
||||
|
||||
The finding's front-matter carries:
|
||||
|
||||
```yaml
|
||||
severity: critical # headline, today
|
||||
severity_at_production: critical
|
||||
impact: I4 # band, before modifiers
|
||||
likelihood: L3
|
||||
fidelity_modifier: false # true if +1 applied, with the reason in the ruling
|
||||
```
|
||||
|
||||
and the ruling section states impact, likelihood, any modifier, and the one
|
||||
sentence that would have to become false for the grade to change.
|
||||
Loading…
Add table
Add a link
Reference in a new issue