Addressable Register Configuration as an Asset Family

[anupam]

Hello,

     This is in reference to the IPSA Standard Whitepaper. 

(1)     Are the addressable register configuration for an IP covered in any of the listed Asset Family Enumeration, or should there be a new one created for them?

        I feel there should be a separate type of its own.

(2)   Why is it mentioned that for the condition attribute of an Asset a scope is required, when the Asset already has a separate "instance scope" attribute?

(3)   Page numbers on this whitepaper will be helpful in discussion.

Best regards,

Anupam

 

[brentms]

Hi Anupam - Thank you for the feedback.  Responses below:

#1 - It seems the addressable register configuration is better categorized as an asset or part of the attack surface, not a type of IP Family.  If this doesn't address your concern, please let me know.

#2 - The scope is in reference to the Condition which may be different from the Asset's scope (e.g. the Condition could be located in another module).  In the next release, we will clarify this.  Thank you for bringing this to our attention.

#3 - Oversight.  Will include in the next release.

Thanks,

Brent