AppSec Core ontology makes security guidance actionable
Original title: What Must Be Done Here? Using a Bounded Application-Security Ontology at the Point of Change
The AppSec Core ontology converts scattered security authorities into typed working sets for code changes and compliance duties.
Security guidance resides in frameworks, standards, and regulations like NIS2. Existing ontologies model attacks and risk but not engineering actions. AppSec Core creates actionable sets of control objectives, practices, mechanisms, and evidence traceable to sources. It supports forward from code changes and inverse from regulatory obligations.
- Typed working set addresses control objectives and practices
- Forward entry from code changes to obligations
- Inverse entry from NIS2 to concrete engineering tasks
- Suitable for human engineers and LLM assistants
- Traceable to source authorities
From the original article
1 min read at arxiv.orgThe security guidance that bears on code is real but scattered. It lives across secure-development frameworks, verification standards, controls catalogues, threat taxonomies, and, increasingly, normative regimes such as the EU's NIS2 -- and most of it is written for readers other than the engineer, or the AI assistant, at a point of change.
By Pedro Farinha · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.