Limits system CSG effectiveness level to be at most the coverage level (

#215).
Spyderisk · Nov 5, 2024 · 22f43ee · 22f43ee
1 parent 9ed4e8a
commit 22f43ee
Showing 1 changed file with 4 additions and 5 deletions.
diff --git a/src/main/java/uk/ac/soton/itinnovation/security/modelvalidator/RiskCalculator.java b/src/main/java/uk/ac/soton/itinnovation/security/modelvalidator/RiskCalculator.java
@@ -1358,13 +1358,12 @@ else if(cs.getMinOf() != null) {
                 if(csg.isEnabled() && csg.getOptionalCS().isEmpty()){
                     ControlStrategyDB domainCSG = dcsgs.get(csg.getParent());
                     Integer domainCsgLevel = twLevels.get(domainCSG.getBlockingEffect()).getLevelValue();
-                    Integer csgCoverageLevel = twLevels.get(csg.getCoverageLevel()).getLevelValue();
-                    if (domainCsgLevel > maxCsgLevel) {
-                        maxCsgLevel = domainCsgLevel;
-                    }
+                    Integer csgCoverageLevel = twLevels.get(csg.getCoverageLevel()).getLevelValue();  // coverage level of mandatory controls
+                    Integer systemCsgLevel = Math.min(domainCsgLevel, csgCoverageLevel);  // system CSG TW is limited by the coverage level
+                    maxCsgLevel = Math.max(maxCsgLevel, systemCsgLevel);  // keep track of the most TW CSG
                 }
             }
-            maxLevel = maxLevel > maxCsgLevel ? maxLevel : maxCsgLevel;
+            maxLevel = Math.max(maxLevel, maxCsgLevel);
 
             // Convert to likelihood, and impose threat frequency limit if still above that limit
             LevelDB likelihood =  invertToLikelihood(trustworthinessLevels.get(maxLevel));