From 10da2570907017f2638e210ae30a176c26d8564e Mon Sep 17 00:00:00 2001 From: Randy Woods Date: Tue, 23 Jan 2024 16:58:26 -0700 Subject: [PATCH 1/4] Fixed some async errors with SAL labels --- .../CSETWebCore.Helpers/TranslationOverlay.cs | 13 +++++++ .../sals/sal-gen/sal-gen.component.html | 10 +++--- .../prepare/sals/sal-gen/sal-gen.component.ts | 16 ++++----- .../prepare/sals/sals.component.html | 36 ++++++++++--------- .../assessment/prepare/sals/sals.component.ts | 20 +++++++---- CSETWebNg/src/assets/i18n/en.json | 34 +++++++++--------- CSETWebNg/src/assets/i18n/es.json | 34 +++++++++--------- CSETWebNg/src/assets/i18n/uk.json | 34 +++++++++--------- 8 files changed, 112 insertions(+), 85 deletions(-) diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Helpers/TranslationOverlay.cs b/CSETWebApi/CSETWeb_Api/CSETWebCore.Helpers/TranslationOverlay.cs index fe4b0cd02b..0d77898efa 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWebCore.Helpers/TranslationOverlay.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Helpers/TranslationOverlay.cs @@ -87,6 +87,13 @@ public Model.Question.KeyValuePair GetCat(string category, string lang) var rh = new ResourceHelper(); var json = rh.GetCopiedResource(System.IO.Path.Combine("app_data", "LanguagePacks", lang, "CATEGORIES.json")); + // safety in case the language pack doesn't exist + if (json == null) + { + return null; + } + + langPack = Newtonsoft.Json.JsonConvert.DeserializeObject(json); dCat.Add(lang, langPack); @@ -118,6 +125,12 @@ public RequirementTranslation GetReq(int requirementId, string lang) var rh = new ResourceHelper(); var json = rh.GetCopiedResource(System.IO.Path.Combine("app_data", "LanguagePacks", lang, "NEW_REQUIREMENT.json")); + // safety in case the language pack doesn't exist + if (json == null) + { + return null; + } + langPack = Newtonsoft.Json.JsonConvert.DeserializeObject(json); dReq.Add(lang, langPack); diff --git a/CSETWebNg/src/app/assessment/prepare/sals/sal-gen/sal-gen.component.html b/CSETWebNg/src/app/assessment/prepare/sals/sal-gen/sal-gen.component.html index bbef0b10ba..6f2ea39f5b 100644 --- a/CSETWebNg/src/app/assessment/prepare/sals/sal-gen/sal-gen.component.html +++ b/CSETWebNg/src/app/assessment/prepare/sals/sal-gen/sal-gen.component.html @@ -37,7 +37,7 @@

{{t('titles.sal.overall sal')}}

- {{ t('titles.sal.gen sal text1') }} + {{ t('titles.sal.gen sal.text1') }}
@@ -46,16 +46,16 @@
{{ slider.onSite.postfix | titlecase }}
-
{{t('titles.sal.gen sal on site')}} {{slider?.offSite?.values[0]}}
-
{{t('titles.sal.gen sal on site')}} {{slider?.offSite?.values[slider?.offSite?.values?.length - 1]}} +
{{t('titles.sal.gen sal.on site')}} {{slider?.offSite?.values[0]}}
+
{{t('titles.sal.gen sal.on site')}} {{slider?.offSite?.values[slider?.offSite?.values?.length - 1]}}
-
{{t('titles.sal.gen sal off site')}} {{slider?.onSite?.values[0]}}
-
{{t('titles.sal.gen sal off site')}} {{slider?.onSite?.values[slider?.offSite?.values?.length - 1]}} +
{{t('titles.sal.gen sal.off site')}} {{slider?.onSite?.values[0]}}
+
{{t('titles.sal.gen sal.off site')}} {{slider?.onSite?.values[slider?.offSite?.values?.length - 1]}}
x.trim() == 'None'); if (onsiteNone >= 0) { - s.onSite.values[onsiteNone] = this.tSvc.translate('titles.sal.gen sal none'); + s.onSite.values[onsiteNone] = this.tSvc.translate('titles.sal.gen sal.none'); } s.offSite.options = { @@ -92,12 +92,12 @@ export class SalGenComponent implements OnInit { }; // translate display text - s.offSite.sal_Description = this.tSvc.translate('titles.sal.gen sal ' + s.offSite.postfix.toLowerCase() + ' desc'); - s.offSite.postfix = this.tSvc.translate('titles.sal.gen sal ' + s.offSite.postfix.toLowerCase()); - s.offSite.prefix = this.tSvc.translate('titles.sal.gen sal ' + s.offSite.prefix.toLowerCase()); + s.offSite.sal_Description = this.tSvc.translate('titles.sal.gen sal.' + s.offSite.postfix.toLowerCase() + ' desc'); + s.offSite.postfix = this.tSvc.translate('titles.sal.gen sal.' + s.offSite.postfix.toLowerCase()); + s.offSite.prefix = this.tSvc.translate('titles.sal.gen sal.' + s.offSite.prefix.toLowerCase()); let offsiteNone = s.offSite.values.findIndex(x => x.trim() == 'None'); if (offsiteNone >= 0) { - s.offSite.values[offsiteNone] = this.tSvc.translate('titles.sal.gen sal none'); + s.offSite.values[offsiteNone] = this.tSvc.translate('titles.sal.gen sal.none'); } }); diff --git a/CSETWebNg/src/app/assessment/prepare/sals/sals.component.html b/CSETWebNg/src/app/assessment/prepare/sals/sals.component.html index b76a36132e..0c4a8799ff 100644 --- a/CSETWebNg/src/app/assessment/prepare/sals/sals.component.html +++ b/CSETWebNg/src/app/assessment/prepare/sals/sals.component.html @@ -34,34 +34,36 @@

{{t('titles.sal.security assurance level (sal)')}}

{{t('titles.sal.current level')}} -
+
{{t('titles.sal.overall')}}
- {{ - t('titles.sal.' + this.salsSvc.selectedSAL.selected_Sal_Level?.toLowerCase()) }}
+ {{ salsSvc.selectedSAL?.selected_Sal_Level != null ? t('titles.sal.' + salsSvc.selectedSAL?.selected_Sal_Level.toLowerCase()) : '' }} +
-
+
+
{{t('titles.sal.confidentiality')}}
-
{{ - t('titles.sal.' + this.salsSvc.selectedSAL.cLevel?.toLowerCase()) }}
+
+ {{ salsSvc.selectedSAL?.cLevel != null ? t('titles.sal.' + salsSvc.selectedSAL.cLevel.toLowerCase()) : '' }}
{{t('titles.sal.integrity')}}
-
{{ - t('titles.sal.' + this.salsSvc.selectedSAL.iLevel?.toLowerCase()) }}
+
+ {{ salsSvc.selectedSAL?.iLevel != null ? t('titles.sal.' + salsSvc.selectedSAL.iLevel.toLowerCase()) : '' }}
{{t('titles.sal.availability')}}
-
{{ - t('titles.sal.' + this.salsSvc.selectedSAL.aLevel?.toLowerCase()) }}
+
+ {{ salsSvc.selectedSAL?.aLevel != null ? t('titles.sal.' + salsSvc.selectedSAL.aLevel.toLowerCase()) : '' }}
+
@@ -70,27 +72,27 @@

{{t('titles.sal.security assurance level (sal)')}}

-
+
diff --git a/CSETWebNg/src/app/assessment/prepare/sals/sals.component.ts b/CSETWebNg/src/app/assessment/prepare/sals/sals.component.ts index 73cb8ee901..be0d80a6cf 100644 --- a/CSETWebNg/src/app/assessment/prepare/sals/sals.component.ts +++ b/CSETWebNg/src/app/assessment/prepare/sals/sals.component.ts @@ -35,11 +35,14 @@ import { LayoutService } from '../../../services/layout.service'; }) export class SalsComponent implements OnInit { - selectedSal = 'Simple'; + selectedMethodology = 'Simple'; sal_Levels: Sal; + /** + * + */ constructor( public salsSvc: SalService, public navSvc: NavigationService, @@ -49,10 +52,12 @@ export class SalsComponent implements OnInit { ngOnInit() { this.salsSvc.selectedSAL = new Sal(); + this.salsSvc.getSalSelection().subscribe( (data: Sal) => { this.salsSvc.selectedSAL = data; this.sal_Levels = data; + if (data.methodology.toLowerCase() === 'simple') { data.methodology = 'Simple'; } @@ -60,7 +65,7 @@ export class SalsComponent implements OnInit { data.methodology = 'Simple'; } - this.selectedSal = data.methodology; + this.selectedMethodology = data.methodology; }, error => { console.log('Error Getting all standards: ' + (error).name + (error).message); @@ -70,11 +75,12 @@ export class SalsComponent implements OnInit { continue() { } - changeState(newType: string) { - this.selectedSal = newType; - this.salsSvc.saveSALType(newType).subscribe( - () => { - }, + /** + * + */ + changeMethodology(newType: string) { + this.selectedMethodology = newType; + this.salsSvc.saveSALType(newType).subscribe((data) => { }, error => { console.log('Error posting change: ' + (error).name + (error).message); console.log('Error posting change: ' + (error).stack); diff --git a/CSETWebNg/src/assets/i18n/en.json b/CSETWebNg/src/assets/i18n/en.json index 73963450e9..f75156f92c 100644 --- a/CSETWebNg/src/assets/i18n/en.json +++ b/CSETWebNg/src/assets/i18n/en.json @@ -91,22 +91,24 @@ "availability text": "This value relates to the importance of information being readily available. The more important it is to have your information available for use the higher your SAL level.", "simple": "Simple", "general risk based": "General Risk Based", - "gen sal text1": "Answer the following questions to help determine the SAL for your assessment by selecting the potential impacts on people and/or economic factors in the event your system is compromised.", - "gen sal injuries": "Injuries", - "gen sal injuries desc": "If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries not requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal hospitalizations": "Hospitalizations", - "gen sal hospitalizations desc": "If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal deaths": "Deaths", - "gen sal deaths desc": "If control systems are maliciously accessed and manipulated to cause harm, how many people could be killed in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal capital loss": "Capital Loss", - "gen sal capital loss desc": "For a worst-case scenario, estimate the potential cost of losing capital assets or the overall economic impact. (Consider the cost of site buildings, facilities, equipment, etc.)", - "gen sal economic impact": "Economic Impact", - "gen sal economic impact desc": "For a worst-case scenario, estimate the potential cost in terms of economic impact to both the site and surrounding communities. (Consider any losses to community structures and use and any costs associated with displacement.)", - "gen sal environmental": "Environmental", - "gen sal environmental desc": "For a worst-case scenario, estimate the potential cost of environmental cleanup to the site and surrounding communities. (Consider the cost for cleanup, fines, litigation, long-term monitoring, etc.)", - "gen sal none": "None", - "gen sal on site": "On Site", - "gen sal off site": "Off Site", + "gen sal": { + "text1": "Answer the following questions to help determine the SAL for your assessment by selecting the potential impacts on people and/or economic factors in the event your system is compromised.", + "injuries": "Injuries", + "injuries desc": "If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries not requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", + "hospitalizations": "Hospitalizations", + "hospitalizations desc": "If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", + "deaths": "Deaths", + "deaths desc": "If control systems are maliciously accessed and manipulated to cause harm, how many people could be killed in a worst-case scenario? (Consider injuries caused due to any reason.)", + "capital loss": "Capital Loss", + "capital loss desc": "For a worst-case scenario, estimate the potential cost of losing capital assets or the overall economic impact. (Consider the cost of site buildings, facilities, equipment, etc.)", + "economic impact": "Economic Impact", + "economic impact desc": "For a worst-case scenario, estimate the potential cost in terms of economic impact to both the site and surrounding communities. (Consider any losses to community structures and use and any costs associated with displacement.)", + "environmental": "Environmental", + "environmental desc": "For a worst-case scenario, estimate the potential cost of environmental cleanup to the site and surrounding communities. (Consider the cost for cleanup, fines, litigation, long-term monitoring, etc.)", + "none": "None", + "on site": "On Site", + "off site": "Off Site" + }, "nist 60 fips 199": "NIST-60 / FIPS-199", "low": "Low", "moderate": "Moderate", diff --git a/CSETWebNg/src/assets/i18n/es.json b/CSETWebNg/src/assets/i18n/es.json index 99593897ad..33e28b9cf9 100644 --- a/CSETWebNg/src/assets/i18n/es.json +++ b/CSETWebNg/src/assets/i18n/es.json @@ -136,22 +136,24 @@ "availability text": "[ES]This value relates to the importance of information being readily available. The more important it is to have your information available for use the higher your SAL level.", "simple": "Sencillo", "general risk based": "Basado en riesgos generales", - "gen sal text1": "[ES]Answer the following questions to help determine the SAL for your assessment by selecting the potential impacts on people and/or economic factors in the event your system is compromised.", - "gen sal injuries": "[ES]Injuries", - "gen sal injuries desc": "[ES]If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries not requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal hospitalizations": "[ES]Hospitalizations", - "gen sal hospitalizations desc": "[ES]If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal deaths": "[ES]Deaths", - "gen sal deaths desc": "[ES]If control systems are maliciously accessed and manipulated to cause harm, how many people could be killed in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal capital loss": "[ES]Capital Loss", - "gen sal capital loss desc": "[ES]For a worst-case scenario, estimate the potential cost of losing capital assets or the overall economic impact. (Consider the cost of site buildings, facilities, equipment, etc.)", - "gen sal economic impact": "[ES]Economic Impact", - "gen sal economic impact desc": "[ES]For a worst-case scenario, estimate the potential cost in terms of economic impact to both the site and surrounding communities. (Consider any losses to community structures and use and any costs associated with displacement.)", - "gen sal environmental": "[ES]Environmental", - "gen sal environmental desc": "[ES]For a worst-case scenario, estimate the potential cost of environmental cleanup to the site and surrounding communities. (Consider the cost for cleanup, fines, litigation, long-term monitoring, etc.)", - "gen sal none": "Ninguno", - "gen sal on site": "En el sitio", - "gen sal off site": "Fuera de sitio", + "gen sal": { + "text1": "[ES]Answer the following questions to help determine the SAL for your assessment by selecting the potential impacts on people and/or economic factors in the event your system is compromised.", + "injuries": "[ES]Injuries", + "injuries desc": "[ES]If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries not requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", + "hospitalizations": "[ES]Hospitalizations", + "hospitalizations desc": "[ES]If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", + "deaths": "[ES]Deaths", + "deaths desc": "[ES]If control systems are maliciously accessed and manipulated to cause harm, how many people could be killed in a worst-case scenario? (Consider injuries caused due to any reason.)", + "capital loss": "[ES]Capital Loss", + "capital loss desc": "[ES]For a worst-case scenario, estimate the potential cost of losing capital assets or the overall economic impact. (Consider the cost of site buildings, facilities, equipment, etc.)", + "economic impact": "[ES]Economic Impact", + "economic impact desc": "[ES]For a worst-case scenario, estimate the potential cost in terms of economic impact to both the site and surrounding communities. (Consider any losses to community structures and use and any costs associated with displacement.)", + "environmental": "[ES]Environmental", + "environmental desc": "[ES]For a worst-case scenario, estimate the potential cost of environmental cleanup to the site and surrounding communities. (Consider the cost for cleanup, fines, litigation, long-term monitoring, etc.)", + "none": "Ninguno", + "on site": "En el sitio", + "off site": "Fuera de sitio" + }, "nist 60 fips 199": "NIST-60 / FIPS-199", "low": "Bajo", "moderate": "Moderado", diff --git a/CSETWebNg/src/assets/i18n/uk.json b/CSETWebNg/src/assets/i18n/uk.json index d58a1704f8..8b379ce492 100644 --- a/CSETWebNg/src/assets/i18n/uk.json +++ b/CSETWebNg/src/assets/i18n/uk.json @@ -85,22 +85,24 @@ "availability text": "[UK]This value relates to the importance of information being readily available. The more important it is to have your information available for use the higher your SAL level.", "simple": "просто", "general risk based": "Загальний ризик", - "gen sal text1": "[UK]Answer the following questions to help determine the SAL for your assessment by selecting the potential impacts on people and/or economic factors in the event your system is compromised.", - "gen sal injuries": "[UK] Injuries", - "gen sal injuries desc": "[UK]If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries not requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal hospitalizations": "[UK] Hospitalizations", - "gen sal hospitalizations desc": "[UK]If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal deaths": "[UK] Deaths", - "gen sal deaths desc": "[UK]If control systems are maliciously accessed and manipulated to cause harm, how many people could be killed in a worst-case scenario? (Consider injuries caused due to any reason.)", - "gen sal capital loss": "[UK] Capital Loss", - "gen sal capital loss desc": "[UK]For a worst-case scenario, estimate the potential cost of losing capital assets or the overall economic impact. (Consider the cost of site buildings, facilities, equipment, etc.)", - "gen sal economic impact": "[UK] Economic Impact", - "gen sal economic impact desc": "[UK]For a worst-case scenario, estimate the potential cost in terms of economic impact to both the site and surrounding communities. (Consider any losses to community structures and use and any costs associated with displacement.)", - "gen sal environmental": "[UK] Environmental", - "gen sal environmental desc": "[UK]For a worst-case scenario, estimate the potential cost of environmental cleanup to the site and surrounding communities. (Consider the cost for cleanup, fines, litigation, long-term monitoring, etc.)", - "gen sal none": "Жодного", - "gen sal on site": "На сайті", - "gen sal off site": "Поза сайтом", + "gen sal": { + "text1": "[UK]Answer the following questions to help determine the SAL for your assessment by selecting the potential impacts on people and/or economic factors in the event your system is compromised.", + "injuries": "[UK] Injuries", + "injuries desc": "[UK]If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries not requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", + "hospitalizations": "[UK] Hospitalizations", + "hospitalizations desc": "[UK]If control systems were maliciously accessed and manipulated to cause harm, how many people could sustain injuries requiring hospital stay in a worst-case scenario? (Consider injuries caused due to any reason.)", + "deaths": "[UK] Deaths", + "deaths desc": "[UK]If control systems are maliciously accessed and manipulated to cause harm, how many people could be killed in a worst-case scenario? (Consider injuries caused due to any reason.)", + "capital loss": "[UK] Capital Loss", + "capital loss desc": "[UK]For a worst-case scenario, estimate the potential cost of losing capital assets or the overall economic impact. (Consider the cost of site buildings, facilities, equipment, etc.)", + "economic impact": "[UK] Economic Impact", + "economic impact desc": "[UK]For a worst-case scenario, estimate the potential cost in terms of economic impact to both the site and surrounding communities. (Consider any losses to community structures and use and any costs associated with displacement.)", + "environmental": "[UK] Environmental", + "environmental desc": "[UK]For a worst-case scenario, estimate the potential cost of environmental cleanup to the site and surrounding communities. (Consider the cost for cleanup, fines, litigation, long-term monitoring, etc.)", + "none": "Жодного", + "on site": "На сайті", + "off site": "Поза сайтом" + }, "nist 60 fips 199": "NIST-60 / FIPS-199", "low": "Низький", "moderate": "Помірний", From 175e8207ad9e0539b74fed19182d95453a92fb81 Mon Sep 17 00:00:00 2001 From: Randy Woods Date: Wed, 24 Jan 2024 17:45:55 -0700 Subject: [PATCH 2/4] More translation work on NIST SAL --- .../UK/NIST_SAL_INFO_TYPES_DEFAULTS.json | 312 ++++++++++++++++ .../LanguagePacks/UK/NIST_SAL_QUESTIONS.json | 36 ++ .../CSETWebCore.Business.csproj | 6 + .../Reports/ReportsDataBusiness.cs | 2 +- .../Sal/NistSalBusiness.cs | 75 +++- .../Model/NIST_SAL_INFO_TYPES_DEFAULTS.cs | 2 + .../CSETWebCore.Helpers/TranslationOverlay.cs | 46 ++- .../Controllers/SalController.cs | 8 +- .../sals/sal-nist/sal-nist.component.html | 334 +++++++++--------- .../sals/sal-nist/sal-nist.component.ts | 1 + CSETWebNg/src/assets/i18n/en.json | 17 + CSETWebNg/src/assets/i18n/es.json | 17 + CSETWebNg/src/assets/i18n/uk.json | 17 + 13 files changed, 696 insertions(+), 177 deletions(-) create mode 100644 CSETWebApi/CSETWeb_Api/CSETWebCore.Business/App_Data/LanguagePacks/UK/NIST_SAL_INFO_TYPES_DEFAULTS.json create mode 100644 CSETWebApi/CSETWeb_Api/CSETWebCore.Business/App_Data/LanguagePacks/UK/NIST_SAL_QUESTIONS.json diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/App_Data/LanguagePacks/UK/NIST_SAL_INFO_TYPES_DEFAULTS.json b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/App_Data/LanguagePacks/UK/NIST_SAL_INFO_TYPES_DEFAULTS.json new file mode 100644 index 0000000000..9903205366 --- /dev/null +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/App_Data/LanguagePacks/UK/NIST_SAL_INFO_TYPES_DEFAULTS.json @@ -0,0 +1,312 @@ +[ + { + "typeId": "1", + "typeValue": "[UK]Air Transportation", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of information (e.g., investigations, maintenance) that has not been adequately researched, coordinated, or edited can result in serious economic harm to individuals and to corporations. Loss in public confidence is a further potential consequence. Additionally, some information associated with air transportation functions is proprietary to corporations or subject to privacy laws. In such cases, the confidentiality impact resulting from unauthorized disclosure can be moderate. The sensitivity of air transportation information (e.g., aircraft positioning data)can be time or event-driven. For example, passenger lists are not releasable to the general public before a flight takes off, but are placed in the public domain in the event of a crash. In such cases, the confidentiality impact resulting from unauthorized disclosure can be moderate.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: Some air transportation functions are time-critical (e.g., air traffic control instructions, position reports, situational awareness, separation, weather reports for the terminal area, microburst tracking, maintenance trouble reports). Communications management (e.g., frequency management) information also needs to be included in air transportation integrity impact considerations. There may be circumstances under which erroneous frequency assignment information can result in a loss of communications with aircraft that are affected by hazardous conditions (e.g., loss of communications with an aircraft in a crowded air space.) Unauthorized modification or destruction of time-critical information necessary to these functions can result in large-scale property loss and in loss of human lives. The Wide Area Augmentation System (WAAS) supplements the availability and integrity of position information available from the DoD's Global Positioning Systems (GPS). Because of the potential system-wide impacts from a loss of integrity of this system, a high integrity impact level is recommended.", + "specialFactorA": "[UK]Special Factors Affecting Availability Impact Determination: Some air transportation functions are time-critical (e.g., air traffic control instructions, position reports, situational awareness, separation, weather reports for the terminal area, microburst tracking, maintenance trouble reports). Loss of availability of time-critical information necessary to these functions can result in large-scale property loss and in loss of human lives. Timing plays a large part in the availability impact of air transportation information. For example, the time criticality of weather information may be measured in minutes or hours in the case of pre-flight and mid-flight operations. However, on final landing approach, up to the second availability may be required (e.g., detection of microbursts in the terminal area). Air operations are not tolerant of information loss. The Wide Area Augmentation System (WAAS) supplements the availability of information available from the Department of Defense's Global Positioning Systems (GPS). Because of the potential system-wide impacts from a loss of availability of this system, it would be appropriately categorized as having a high availability impact." + }, + { + "typeId": "2", + "typeValue": "[UK]Asset and Liability Management" + }, + { + "typeId": "3", + "typeValue": "[UK]Budget Execution" + }, + { + "typeId": "4", + "typeValue": "[UK]Budget Formulation" + }, + { + "typeId": "5", + "typeValue": "[UK]Budgeting & Performance Integration" + }, + { + "typeId": "6", + "typeValue": "[UK]Capital Planning" + }, + { + "typeId": "7", + "typeValue": "[UK]Collections & Receivables" + }, + { + "typeId": "8", + "typeValue": "[UK]Contingency Planning" + }, + { + "typeId": "9", + "typeValue": "[UK]Continuity of Operations" + }, + { + "typeId": "10", + "typeValue": "[UK]Cost Accounting/Performance Measurement" + }, + { + "typeId": "11", + "typeValue": "[UK]Customer Services" + }, + { + "typeId": "12", + "typeValue": "[UK]Disaster Preparedness & Planning", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: The consequences of unauthorized disclosure of some disaster preparedness and planning information may include revealing weak or sensitive critical infrastructure characteristics or inadequate security of U.S. targets to terrorists or other adversaries. Such information may reveal to an enemy the most effective technique(s) to use in attacking a target, and/or information regarding the capabilities, intent, and plans of our adversaries. Where unauthorized disclosure of disaster preparedness and planning information associated with critical infrastructures, large groups of people, or key national assets is expected to be of direct use to terrorists, the confidentiality impact level is recommended to be high.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and/or public confidence in the agency, but the damage to the mission will usually be limited. The consequences of unauthorized modification or destruction of information can be very serious or catastrophic if the data is time-critical operational information. In such cases, the impact level assigned would be moderate or high.", + "specialFactorA": "[UK]Special Factors Affecting Availability Impact Determination: If emergency responders and those responsible for repair and restoration activities are unable to access preparedness and planning information in the event of an actual emergency the consequences may include confusion and delays. In such cases, the availability impact level can be moderate or high." + }, + { + "typeId": "13", + "typeValue": "[UK]Emergency Response", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: In cases where an attack is underway, unauthorized disclosure of emergency response information can provide information that might permit terrorists or other adversaries to target emergency response assets, thus jeopardizing emergency response resources and missions and public safety. Given the criticality that much emergency response information has in terms of potential loss of human life and major property damage, where unauthorized release of information can reasonably be expected to facilitate interference with emergency response missions, the confidentiality impact level may be moderate or high. The unauthorized disclosure of one agency’s emergency response by another agency could result in negative impacts on cross-jurisdictional coordination within the critical emergency services infrastructure and the general effectiveness of organizations tasked with emergency response missions.", + "specialFactorI": "[UK]Recommended Integrity Impact Level: The provisional integrity impact level recommended for emergency response information is normally high.", + "specialFactorA": "[UK]Recommended Availability Impact Level: The provisional availability impact level recommended for emergency response information is high." + }, + { + "typeId": "14", + "typeValue": "[UK]Energy Conservation & Preparedness", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: In some cases, unauthorized disclosure of preliminary findings or policies under consideration regarding proposed conservation measures or the distribution of energy in the event of an emergency may result in mobilization of special interests. These groups may successfully oppose necessary conservation measures and be given an unfair advantage for specific commercial interests. Also, the unauthorized disclosure may cause domestic or international loss of confidence in the Federal government. In such cases, serious damage may result for energy conservation and preparedness operations. Therefore, the confidentiality impact level may be moderate. In other cases, unauthorized disclosure of information regarding measures taken to ensure the provision of energy in the event of an emergency may facilitate malicious activities of terrorists. Here, there is a potential for loss of human life resulting from extended outages, so the confidentiality impact level may be high.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction of information necessary to mission-critical procedures ensuring the provision of energy in the event of an emergency can result in extended outages. There is some potential for a consequent threat to critical energy infrastructure and to human life. In such cases, the integrity impact level may be high.", + "specialFactorA": "[UK]Special Factors Affecting Availability Impact Determination: Unavailability of information necessary to mission-critical procedures ensuring the provision of energy in the event of an emergency may result in extended outages. There is some potential for a consequent threat to critical energy infrastructure and to human life. In such cases, the availability impact level may be high." + }, + { + "typeId": "15", + "typeValue": "[UK]Energy Production", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of some energy production information can result in major financial consequences. In some cases, premature disclosure of this information can impact financial markets. Unauthorized disclosure to a single institution could damage faith in government institutions, result in adverse financial events, and have a serious adverse effect on public confidence in the agency. Therefore, the confidentiality impact should be at least moderate for this energy production information.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: If the energy production information is time-critical or very sensitive, the integrity impact level may be moderate or high.", + "specialFactorA": "[UK]Recommended Availability Impact Level: The provisional availability impact level recommended for energy production information is low." + }, + { + "typeId": "16", + "typeValue": "[UK]Energy Resource Management" + }, + { + "typeId": "17", + "typeValue": "[UK]Energy Supply", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: The consequences of unauthorized disclosure of energy supply information can have a serious economic impact with respect to competitive advantages and financial and commodity market dynamics. Also, the unauthorized disclosure of supply information may assist terrorists in the theft of energy products or disruption of energy distribution channels. Facilitation of theft of nuclear materials is a particularly catastrophic potential result of unauthorized disclosure of specific types of energy supply information. In these cases, the confidentiality impact must be considered to be high.", + "specialFactorI": "[UK]Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for most energy supply information is low.", + "specialFactorA": "[UK]Special Factors Affecting Integrity Impact Determination: Mission-critical systems: Unauthorized modification of mission-critical information or information systems (e.g., electrical power distribution, petroleum or gas pipelines) can result in severe impacts to the environment, service, major assets and/or human safety. Consequently, the integrity impact level associated with these types of mission-critical processes/systems may be high. Non mission-critical systems: For information or information systems that do not directly impact mission-critical functions, the integrity impact level may be downgraded to low." + }, + { + "typeId": "18", + "typeValue": "[UK]Enterprise Architecture" + }, + { + "typeId": "19", + "typeValue": "[UK]Environmental Monitoring & Forecasting", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: The most serious adverse effects are likely to involve exposure of information that is proprietary to an organization or result in damaging publicity for an organization. [Unauthorized disclosure of some information can have serious economic impact on both individual companies and the broader market place. The consequences of such unauthorized disclosures may have an adverse effect on public confidence in the agency.] In such cases, the potential confidentiality impacts may be at least moderate.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations and public confidence in the agency, but also the agency mission. In some cases, unauthorized modification or destruction of information can result in loss of human life - a high-impact potential.", + "specialFactorA": "[UK]Recommended Availability Impact Level: The provisional availability impact level recommended for environmental monitoring and forecasting information is low." + }, + { + "typeId": "20", + "typeValue": "[UK]Environmental Remediation" + }, + { + "typeId": "21", + "typeValue": "[UK]Facilities Fleet & Equipment Management", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: Information associated with maintenance, administration, and operation of many Federal government office buildings, transportation fleets, and operational facilities can be of material use to criminals seeking to gain access to Federal facilities in order to facilitate or perpetrate fraud, theft, or some other criminal enterprise (e.g., extract inmates from Federal detention facilities). In this case, unauthorized disclosure of information can have a serious adverse effect on agency operations, agency assets, or individuals. The consequent confidentiality impact would be at least moderate.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: Exceptions may include emergency response aspects of disaster management or leadership protection. In such cases, the integrity impact level associated with unauthorized modification or destruction of facilities, fleet, and equipment management information can be high.", + "specialFactorA": "[UK]Special Factors Affecting Availability Impact Determination: Exceptions may include emergency response aspects of disaster management or leadership protection. In such cases, delays measured in seconds can cost lives and major property damage. Consequently, the availability impact level associated with unauthorized modification or destruction of facilities, fleet, and equipment management information needed to respond to emergencies will be high." + }, + { + "typeId": "22", + "typeValue": "[UK]General Purpose Data & Statistics", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: Unauthorized premature disclosure of much economic (e.g., agricultural commodity, economic indicators) data and statistics information can result in major financial consequences. In some cases, premature disclosure of this information can impact major financial markets and damage national banking and finance infrastructures. Unauthorized and premature disclosure to a single institution (e.g., a major commodity brokerage house), could damage faith in general-purpose data and statistics gathering and development institutions, result in even more market disruption, and have a severe or catastrophic adverse effect on public confidence in the agency. Even when the consequences are limited to giving an unfair market advantage to a single financial or commercial institution, unauthorized disclosure can have a serious adverse effect on public confidence in the agency and its staff. This can result in assignment of a moderate impact level to such information.", + "specialFactorI": "[UK]Recommended Integrity Impact Level: The provisional integrity impact level recommended for general-purpose data and statistics information is low.", + "specialFactorA": "[UK]Recommended Availability Impact Level: The provisional availability impact level recommended for general-purpose data and statistics information is low." + }, + { + "typeId": "23", + "typeValue": "[UK]Goods Acquisition" + }, + { + "typeId": "24", + "typeValue": "[UK]Ground Transportation", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: Some regulatory and tariff enforcement functions associated with the safe passage of passengers and goods over land involve relatively sensitive information. These are included in Law Enforcement. Unauthorized disclosure of accident investigation information that has not yet been adequately researched, coordinated, or edited can result in serious economic harm to individuals and to corporations. Loss in public confidence is a further potential consequence. Additionally, some information associated with ground transportation functions is proprietary to corporations or subject to privacy laws (e.g., the Privacy Act of 1974). (The Privacy Act Information provisional impact levels are documented in the Personal Identity and Authentication information type.) In such cases, the confidentiality impact resulting from unauthorized disclosure may be moderate.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: Some ground transportation functions are time-critical (e.g., track switching functions associated with rail travel). Unauthorized modification or destruction of time-critical information necessary to these functions can result in large-scale property loss and in loss of human lives. Such information will have a high integrity impact level.", + "specialFactorA": "[UK]Special Factors Affecting Availability Impact Determination: Some ground transportation functions are time-critical (e.g., track switching functions associated with rail travel). Loss of availability of time-critical information necessary to these functions can result in large-scale property loss and in loss of human lives. Such information will have a high integrity impact level." + }, + { + "typeId": "25", + "typeValue": "[UK]Help Desk Services" + }, + { + "typeId": "26", + "typeValue": "[UK]Information Infrastructure Management" + }, + { + "typeId": "27", + "typeValue": "[UK]Information Management" + }, + { + "typeId": "28", + "typeValue": "[UK]Information Security" + }, + { + "typeId": "29", + "typeValue": "[UK]Information Sharing" + }, + { + "typeId": "30", + "typeValue": "[UK]Intellectual Property Protection" + }, + { + "typeId": "31", + "typeValue": "[UK]Inventory Control" + }, + { + "typeId": "32", + "typeValue": "[UK]Key Asset & Critical Infrastructure Protection", + "specialFactorC": "[UK]Recommended Confidentiality Impact Level: The provisional confidentiality impact level recommended for critical infrastructure protection information is high.", + "specialFactorI": "[UK]Recommended Integrity Impact Level: The provisional integrity impact level recommended for critical infrastructure protection information is high.", + "specialFactorA": "[UK]Recommended Availability Impact Level: The provisional availability impact level recommended for critical infrastructure protection information is high." + }, + { + "typeId": "33", + "typeValue": "[UK]Labor Rights Management" + }, + { + "typeId": "34", + "typeValue": "[UK]Lifecycle/Change Management" + }, + { + "typeId": "35", + "typeValue": "[UK]Logistics Management" + }, + { + "typeId": "36", + "typeValue": "[UK]Management Improvement" + }, + { + "typeId": "37", + "typeValue": "[UK]Manufacturing" + }, + { + "typeId": "38", + "typeValue": "[UK]Other Financial" + }, + { + "typeId": "39", + "typeValue": "[UK]Other Information Management" + }, + { + "typeId": "40", + "typeValue": "[UK]Other Management" + }, + { + "typeId": "41", + "typeValue": "[UK]Other Operations" + }, + { + "typeId": "42", + "typeValue": "[UK]Other Research & Development" + }, + { + "typeId": "43", + "typeValue": "[UK]Other Security" + }, + { + "typeId": "44", + "typeValue": "[UK]Other Support Functions" + }, + { + "typeId": "45", + "typeValue": "[UK]Payments" + }, + { + "typeId": "46", + "typeValue": "[UK]Percentage Infrastructure Maintenance" + }, + { + "typeId": "47", + "typeValue": "[UK]Permits & Licensing" + }, + { + "typeId": "48", + "typeValue": "[UK]Pollution Prevention & Control" + }, + { + "typeId": "49", + "typeValue": "[UK]Product Outreach" + }, + { + "typeId": "50", + "typeValue": "[UK]Property Protection", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: Where critical infrastructure facilities or key national assets are being protected, the consequences of unauthorized disclosure of property protection information might reveal vulnerabilities in protection measures to terrorists or other adversaries. Where unauthorized disclosure of property protection information associated with critical infrastructures, large groups of people, or key national assets is expected to be of direct use to terrorists, the confidentiality impact level is high.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: Unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) may adversely affect operations or public confidence in the agency. However, the potential damage to the protection mission will usually be of greater concern. If the modified or destroyed information is tactical i.e., time-critical, there is a greater potential for actions being taken based on incomplete or false information. This can have serious adverse effects on protection operation. This can result in assignment of a moderate impact level to such information.", + "specialFactorA": "[UK]Special Factors Affecting Availability Impact Determination: The consequences of inability of guard forces and other emergency responders to receive property protection information in a timely manner may result in catastrophic consequences for properties that could include critical infrastructures and key national assets. In general, the availability impact level assigned to property protection information is dependent on what is being protected. This can result in assignment of a moderate or high impact level to such information." + }, + { + "typeId": "51", + "typeValue": "[UK]Public Relations" + }, + { + "typeId": "52", + "typeValue": "[UK]Records Retention" + }, + { + "typeId": "53", + "typeValue": "[UK]Reporting Information" + }, + { + "typeId": "54", + "typeValue": "[UK]Research & Development" + }, + { + "typeId": "55", + "typeValue": "[UK]Scientific & Technological Research & Innovation" + }, + { + "typeId": "56", + "typeValue": "[UK]Security Management" + }, + { + "typeId": "57", + "typeValue": "[UK]Service Recovery" + }, + { + "typeId": "58", + "typeValue": "[UK]Services Acquisition" + }, + { + "typeId": "59", + "typeValue": "[UK]System & Networking Monitoring", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: Where the system and network monitoring information collected can be expected to have a high confidentiality impact level, then the system and network monitoring information must be assigned a high confidentiality impact level. When the system and network monitoring data being collected supports information types described in this guideline, agency personnel should consider a confidentiality impact assignment of the highest impact information type processed by the system. Depending on the agency and the mission being supported, the sensitivity of the information can range from low to high. (National security information and national security systems are outside the scope of this guideline.)", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: The loss of integrity for some system and network monitoring information can be very serious for agency network and security operations, as well as, the functionality of the information system. Additionally, a loss of integrity can have severe consequences for the agency’s mission and critical business functions. The integrity impact level recommended for system and network monitoring information associated with highly critical information is high.", + "specialFactorA": "[UK]Recommended Availability Impact Level: The provisional availability impact level recommended for system and network monitoring information is low." + }, + { + "typeId": "60", + "typeValue": "[UK]System Development" + }, + { + "typeId": "61", + "typeValue": "[UK]System Maintenance" + }, + { + "typeId": "62", + "typeValue": "[UK]Training & Employment" + }, + { + "typeId": "63", + "typeValue": "[UK]Water Resource Management" + }, + { + "typeId": "64", + "typeValue": "[UK]Water Transportation", + "specialFactorC": "[UK]Special Factors Affecting Confidentiality Impact Determination: Unauthorized disclosure of accident investigation information that has not been adequately researched, coordinated, or edited can result in serious economic harm to individuals and to corporations. Loss in public confidence is a further potential consequence. Additionally, some information associated with water transportation functions is proprietary to corporations or subject to privacy laws. In such cases, the confidentiality impact resulting from unauthorized disclosure can be moderate.", + "specialFactorI": "[UK]Special Factors Affecting Integrity Impact Determination: Some water and sea transportation functions are time-critical (e.g., distress signals, docking operations, collision avoidance, warnings of hazardous weather or sea conditions). Unauthorized modification or destruction of time-critical information necessary to these functions can result in large-scale property loss and in loss of human lives. Such information would have a high integrity impact level. Communications management (e.g., frequency management) information also needs to be included in water transportation integrity impact considerations. There may be circumstances when errors in frequency assignment information can result in an inability for Federal government agencies to communicate with state or local government activities. The subsequent loss of communications capabilities can result in life-threatening situations. Such information would have a high integrity impact level.", + "specialFactorA": "[UK]Special Factors Affecting Availability Impact Determination: Some water and sea transportation functions are time-critical (e.g., distress signals, docking operations, collision avoidance, warnings of hazardous weather or sea conditions). Loss of availability of time-critical information necessary to these functions can result in large-scale property loss and in loss of human lives. Such information would have a high integrity impact level." + }, + { + "typeId": "65", + "typeValue": "[UK]Worker Safety" + }, + { + "typeId": "66", + "typeValue": "[UK]Work-Force Planning" + }, + { + "typeId": "67", + "typeValue": "[UK]Workplace Policy Development & Management" + } + ] diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/App_Data/LanguagePacks/UK/NIST_SAL_QUESTIONS.json b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/App_Data/LanguagePacks/UK/NIST_SAL_QUESTIONS.json new file mode 100644 index 0000000000..b43715dc6d --- /dev/null +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/App_Data/LanguagePacks/UK/NIST_SAL_QUESTIONS.json @@ -0,0 +1,36 @@ +{ + "pairs": [ + { + "key": "16338", + "value": "[UK]Does aggregation of information on this system reveal sensitive patterns and plans, or facilitate access to sensitive or critical systems?" + }, + { + "key": "16342", + "value": "[UK]Does/could access to this system result in some form of access to other more sensitive or critical systems (e.g., over a network)?" + }, + { + "key": "16346", + "value": "[UK]Are there extenuating circumstances such as: The system provides critical process flow or security capability, the public visibility of the system, the sheer number of other systems reliant on its operation, or the overall cost of the systems replacement?" + }, + { + "key": "16350", + "value": "[UK]Would unauthorized modification or destruction of information affecting external communications (e.g., web pages, electronic mail) adversely affect operations or seriously damage mission function and/or public confidence?" + }, + { + "key": "16354", + "value": "[UK]Would either physical or logical destruction of the system result in very large expenditures to restore the system and/or require a long period of time for recovery?" + }, + { + "key": "16358", + "value": "[UK]Does the mission served by the system, or the information that the system processes, affect the security of critical infrastructures and key resources?" + }, + { + "key": "16362", + "value": "[UK]Does the system store, communicate, or process any privacy act information?" + }, + { + "key": "16366", + "value": "[UK]Does the systems store, communicate, or process any trade secrets information?" + } + ] +} diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/CSETWebCore.Business.csproj b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/CSETWebCore.Business.csproj index c2633daecd..5eee2d3cbb 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/CSETWebCore.Business.csproj +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/CSETWebCore.Business.csproj @@ -153,6 +153,12 @@ Always + + Always + + + Always + Always diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Reports/ReportsDataBusiness.cs b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Reports/ReportsDataBusiness.cs index b744243283..8ac60d77ec 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Reports/ReportsDataBusiness.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Reports/ReportsDataBusiness.cs @@ -1265,7 +1265,7 @@ public List GetDocumentLibrary() public BasicReportData.OverallSALTable GetNistSals() { - var manager = new NistSalBusiness(_context, _assessmentUtil); + var manager = new NistSalBusiness(_context, _assessmentUtil, _tokenManager); var sals = manager.CalculatedNist(_assessmentId); List list = new List(); var infos = _context.CNSS_CIA_JUSTIFICATIONS.Where(x => x.Assessment_Id == _assessmentId).ToList(); diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSalBusiness.cs b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSalBusiness.cs index 42bb3344fc..75d978cff4 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSalBusiness.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSalBusiness.cs @@ -14,6 +14,7 @@ using CSETWebCore.Interfaces.Helpers; using CSETWebCore.Model.Sal; using Microsoft.EntityFrameworkCore; +using DocumentFormat.OpenXml.Office.CoverPageProps; namespace CSETWebCore.Business.Sal { @@ -21,14 +22,19 @@ public class NistSalBusiness { private CSETContext _context; private readonly IAssessmentUtil _assessmentUtil; + private readonly ITokenManager _tokenManager; + private readonly TranslationOverlay _overlay; /// /// /// - public NistSalBusiness(CSETContext context, IAssessmentUtil assessmentUtil) + public NistSalBusiness(CSETContext context, IAssessmentUtil assessmentUtil, ITokenManager tokenManager) { _context = context; _assessmentUtil = assessmentUtil; + _tokenManager = tokenManager; + + _overlay = new TranslationOverlay(); } @@ -71,16 +77,52 @@ internal void CreateInitialList(object assessmentId) new SqlParameter("@Id", assessmentId)); } + + /// + /// + /// public List GetInformationTypes(int assessmentId) { TinyMapper.Bind(); CreateInitialList(assessmentId); - List rlist = new List(); - foreach (NIST_SAL_INFO_TYPES t in _context.NIST_SAL_INFO_TYPES.Where(x => x.Assessment_Id == assessmentId)) + + List list = new List(); + + var q = from n1 in _context.NIST_SAL_INFO_TYPES + join n2 in _context.NIST_SAL_INFO_TYPES_DEFAULTS on n1.Type_Value equals n2.Type_Value + where n1.Assessment_Id == assessmentId + select new { n1, n2 }; + + var qqq = q.ToList(); + + + foreach (var t in qqq) + { + var j = TinyMapper.Map(t.n1); + j.Type_Id = t.n2.Type_Id; + + list.Add(j); + } + + + // overlay question text for language + var lang = _tokenManager.GetCurrentLanguage(); + if (lang != "en") { - rlist.Add(TinyMapper.Map(t)); + list.ForEach(x => + { + var val = _overlay.GetJObject("NIST_SAL_INFO_TYPES_DEFAULTS", "typeId", x.Type_Id.ToString(), lang); + if (val != null) + { + x.Type_Value = val.Value("typeValue"); + x.Confidentiality_Special_Factor = val.Value("specialFactorC"); + x.Integrity_Special_Factor = val.Value("specialFactorI"); + x.Availability_Special_Factor = val.Value("specialFactorA"); + } + }); } - return rlist; + + return list; } public Sals UpdateSalValue(NistSalModel updateValue, int assessmentid) @@ -125,12 +167,30 @@ public List GetNistQuestions(int assessmentId) _context.SaveChanges(); } - var rlist = from a in _context.NIST_SAL_QUESTIONS + var qList = from a in _context.NIST_SAL_QUESTIONS join b in _context.NIST_SAL_QUESTION_ANSWERS on a.Question_Id equals b.Question_Id where b.Assessment_Id == assessmentId orderby a.Question_Number select new NistQuestionsAnswers() { Assessment_Id = b.Assessment_Id, Question_Id = b.Question_Id, Question_Answer = b.Question_Answer, Question_Number = a.Question_Number, Question_Text = a.Question_Text }; - return rlist.ToList(); + + var list = qList.ToList(); + + + // overlay question text for language + var lang = _tokenManager.GetCurrentLanguage(); + if (lang != "en") + { + list.ForEach(x => + { + var val = _overlay.GetValue("NIST_SAL_QUESTIONS", x.Question_Id.ToString(), lang)?.Value; + if (val != null) + { + x.Question_Text = val; + } + }); + } + + return list; } @@ -240,6 +300,7 @@ public class NistQuestionsAnswers public class NistSalModel { public int Assessment_Id { get; set; } + public int Type_Id { get; set; } public string Type_Value { get; set; } public bool Selected { get; set; } public string Confidentiality_Value { get; set; } diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.DataLayer/Model/NIST_SAL_INFO_TYPES_DEFAULTS.cs b/CSETWebApi/CSETWeb_Api/CSETWebCore.DataLayer/Model/NIST_SAL_INFO_TYPES_DEFAULTS.cs index 390ca6da00..5745512c06 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWebCore.DataLayer/Model/NIST_SAL_INFO_TYPES_DEFAULTS.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.DataLayer/Model/NIST_SAL_INFO_TYPES_DEFAULTS.cs @@ -13,6 +13,8 @@ namespace CSETWebCore.DataLayer.Model; /// public partial class NIST_SAL_INFO_TYPES_DEFAULTS { + public int Type_Id { get; set; } + [Key] [StringLength(50)] public string Type_Value { get; set; } diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Helpers/TranslationOverlay.cs b/CSETWebApi/CSETWeb_Api/CSETWebCore.Helpers/TranslationOverlay.cs index 0d77898efa..f2db32e760 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWebCore.Helpers/TranslationOverlay.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Helpers/TranslationOverlay.cs @@ -3,6 +3,7 @@ using CSETWebCore.Model.Question; using CSETWebCore.Model.Set; using Microsoft.EntityFrameworkCore; +using Newtonsoft.Json.Linq; using Org.BouncyCastle.Asn1.Pkcs; using System; using System.Collections.Generic; @@ -18,12 +19,55 @@ namespace CSETWebCore.Helpers /// public class TranslationOverlay { + private Dictionary dict = new Dictionary(); private Dictionary dReq = new Dictionary(); private Dictionary dCat = new Dictionary(); - private Dictionary dKVP = new Dictionary(); + /// + /// Intended to return a JObject so that it is very generic. + /// The caller supplies the key field name and the key value. A JObject or null is returned. + /// + public JObject GetJObject(string collection, string keyFieldName, string key, string lang) + { + JArray langPack = null; + + if (lang == "en") + { + return null; + } + + lang = lang.ToLower(); + collection = collection.ToLower(); + + var kvpKey = $"{lang}|{collection}"; + + if (!dict.ContainsKey(kvpKey)) + { + var rh = new ResourceHelper(); + var json = rh.GetCopiedResource(System.IO.Path.Combine("app_data", "LanguagePacks", lang, $"{collection}.json")); + + if (json == null) + { + return null; + } + + langPack = Newtonsoft.Json.JsonConvert.DeserializeObject(json); + + dict.Add(kvpKey, langPack); + } + else + { + langPack = dict[kvpKey]; + } + + var target = langPack.Children().FirstOrDefault(x => x.SelectToken(keyFieldName).Value().Equals(key, StringComparison.InvariantCultureIgnoreCase)); + + return (JObject)target; + } + + /// /// Generically gets a value for the specified key and collection. /// Collection indicates the name of the JSON file. diff --git a/CSETWebApi/CSETWeb_Api/CSETWeb_ApiCore/Controllers/SalController.cs b/CSETWebApi/CSETWeb_Api/CSETWeb_ApiCore/Controllers/SalController.cs index 3730039c3a..7083811b19 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWeb_ApiCore/Controllers/SalController.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWeb_ApiCore/Controllers/SalController.cs @@ -206,7 +206,7 @@ public async Task PostSTANDARD_SELECTION(STANDARD_SELECTION sTAND public NistModel GetNistData() { int assessmentId = _token.AssessmentForUser(); - NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil); + NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil, _token); NistModel rvalue = new NistModel() { models = nistSal.GetInformationTypes(assessmentId), @@ -222,7 +222,7 @@ public NistModel GetNistData() public Sals PostNistData([FromBody] NistSalModel updateValue) { int assessmentId = _token.AssessmentForUser(); - NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil); + NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil, _token); return nistSal.UpdateSalValue(updateValue, assessmentId); @@ -233,7 +233,7 @@ public Sals PostNistData([FromBody] NistSalModel updateValue) public Sals PostNistDataQuestions([FromBody] NistQuestionsAnswers updateValue) { int assessmentId = _token.AssessmentForUser(); - NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil); + NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil, _token); return nistSal.SaveNistQuestions(assessmentId, updateValue); } @@ -242,7 +242,7 @@ public Sals PostNistDataQuestions([FromBody] NistQuestionsAnswers updateValue) public Sals PostNistDataSpecialFactor([FromBody] NistSpecialFactor updateValue) { int assessmentId = _token.AssessmentForUser(); - NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil); + NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil, _token); return nistSal.SaveNistSpecialFactor(assessmentId, updateValue); } diff --git a/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.html b/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.html index 6a94ead2f2..6e05ef5c29 100644 --- a/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.html +++ b/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.html @@ -20,189 +20,195 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. --------------------------> + - - - -
-
-

{{t('titles.sal.overall sal')}}

-
- - - -
-
- -
-
-

{{t('titles.sal.confidentiality')}}

-
- {{t('titles.sal.confidentiality text')}} -
-
+
+
+

{{t('titles.sal.overall sal')}}

+
-
-
-
-
-

{{t('titles.sal.integrity')}}

-
- {{t('titles.sal.integrity text')}} -
-
- - - +
+
+

{{t('titles.sal.confidentiality')}}

+
+ {{t('titles.sal.confidentiality text')}} +
+
+ + + +
-
-
-
-

{{t('titles.sal.availability')}}

-
- {{t('titles.sal.availability text')}} +
+
+

{{t('titles.sal.integrity')}}

+
+ {{t('titles.sal.integrity text')}} +
+
+ + + +
-
- - - +
+ +
+
+

{{t('titles.sal.availability')}}

+
+ {{t('titles.sal.availability text')}} +
+
+ + + +
-
-
-

The FIPS 199 guide below will help you learn how to determine the overall security categorization of the system - under - assessment. If you are unfamiliar with the FIPS 199 SAL Determination screen, please read the guide before - proceeding.

-
- -  FIPS 199 SAL Selection Guidance -
-

Other Guides:

-
- -  FIPS 199 - -  NIST SP800-60 Vol I - -  NIST SP800-60 Vol II +
+

+ {{t('titles.sal.nist.fips guide text')}} +

+
+ +  FIPS 199 SAL Selection Guidance +
+

{{t('titles.sal.nist.fips other guides')}}

+
+ +  FIPS 199 + +  NIST SP800-60 Vol I + +  NIST SP800-60 Vol II +
-
-
-

CIA Values Based on Selected Information Types

-
-

Check applicable information types.

- - - - - - - - - - - - - - - -
TypeCIA
- - - - - - {{salsSvc.getDisplayLevel(model.confidentiality_Value)}} - - {{salsSvc.getDisplayLevel(model.confidentiality_Value)}} - - - {{salsSvc.getDisplayLevel(model.integrity_Value)}} - - {{salsSvc.getDisplayLevel(model.integrity_Value)}} - - {{salsSvc.getDisplayLevel(model.availability_Value)}} - - {{salsSvc.getDisplayLevel(model.availability_Value)}} - -
-
-
-

Answer Questions

- - - - - -
{{question.question_Text}} -
- - -
-
-
+

{{t('titles.sal.nist.selected information types')}}

+
+

{{t('titles.sal.nist.check applicable')}}

+ + + + + + + + + + + + + + + +
{{t('type')}}CIA
+ + + + + + {{salsSvc.getDisplayLevel(model.confidentiality_Value)}} + + {{salsSvc.getDisplayLevel(model.confidentiality_Value)}} + + + {{salsSvc.getDisplayLevel(model.integrity_Value)}} + + {{salsSvc.getDisplayLevel(model.integrity_Value)}} + + {{salsSvc.getDisplayLevel(model.availability_Value)}} + + {{salsSvc.getDisplayLevel(model.availability_Value)}} + +
+
-
-

Determine Special Factors

-
- - - - - - +
+

{{t('titles.sal.nist.answer questions')}}

+ + + + + +
{{question.question_Text}} +
+ + +
+
-
\ No newline at end of file + + +
+

Determine Special Factors

+
+ + + + + + +
+
+
+ \ No newline at end of file diff --git a/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.ts b/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.ts index e99eb25470..e24907f567 100644 --- a/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.ts +++ b/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.ts @@ -58,6 +58,7 @@ export class SalNistComponent implements OnInit { console.log('Error Getting all standards: ' + (error).name + (error).message); console.log('Error Getting all standards: ' + (error).stack); }); + this.salsSvc.getInformationTypes().subscribe( (data: NistModel) => { this.topModel = data; diff --git a/CSETWebNg/src/assets/i18n/en.json b/CSETWebNg/src/assets/i18n/en.json index f75156f92c..077c78ed82 100644 --- a/CSETWebNg/src/assets/i18n/en.json +++ b/CSETWebNg/src/assets/i18n/en.json @@ -25,6 +25,7 @@ "state province region": "State/Province/Region", "state, province, or region": "State, Province, or Region", "assessment type": "Assessment Type", + "type": "Type", "demographics": "Demographics", "select type": "Select Type", "sector": "Sector", @@ -110,6 +111,22 @@ "off site": "Off Site" }, "nist 60 fips 199": "NIST-60 / FIPS-199", + "nist": { + "fips guide text": "The FIPS 199 guide below will help you learn how to determine the overall security categorization of the system under assessment. If you are unfamiliar with the FIPS 199 SAL Determination screen, please read the guide before proceeding.", + "fips other guides": "Other Guides:", + "selected information types": "CIA Values Based on Selected Information Types", + "check applicable": "Check applicable information types.", + "tooltip c": "Clicking this will overwrite the Confidentiality Special Factor", + "tooltip i": "Clicking this will overwrite the Integrity Special Factor", + "tooltip a": "Clicking this will overwrite the Availabilty Special Factor", + "low": "LOW", + "mod": "MOD", + "high": "HIGH", + "none": "NONE", + "answer questions": "Answer Questions", + "yes": "Yes", + "no": "No" + }, "low": "Low", "moderate": "Moderate", "high": "High", diff --git a/CSETWebNg/src/assets/i18n/es.json b/CSETWebNg/src/assets/i18n/es.json index 33e28b9cf9..7d2ab1190f 100644 --- a/CSETWebNg/src/assets/i18n/es.json +++ b/CSETWebNg/src/assets/i18n/es.json @@ -22,6 +22,7 @@ "state province region": "Estado/provincia/región", "state, province, or region": "Estado, provincia, o región", "assessment type": "Tipo de evaluación", + "type": "Tipo", "demographics": "Demografía", "select type": "Selecctionar tipo", "sector": "Sector", @@ -155,6 +156,22 @@ "off site": "Fuera de sitio" }, "nist 60 fips 199": "NIST-60 / FIPS-199", + "nist": { + "fips guide text": "[ES]The FIPS 199 guide below will help you learn how to determine the overall security categorization of the system under assessment. If you are unfamiliar with the FIPS 199 SAL Determination screen, please read the guide before proceeding.", + "fips other guides": "[ES]Other Guides:", + "selected information types": "[ES]CIA Values Based on Selected Information Types", + "check applicable": "[ES]Check applicable information types.", + "tooltip c": "[ES]Clicking this will overwrite the Confidentiality Special Factor", + "tooltip i": "[ES]Clicking this will overwrite the Integrity Special Factor", + "tooltip a": "[ES]Clicking this will overwrite the Availabilty Special Factor", + "low": "BAJO", + "mod": "MOD", + "high": "ALT", + "none": "NO", + "answer questions": "Preguntas", + "yes": "Sí", + "no": "No" + }, "low": "Bajo", "moderate": "Moderado", "high": "Alto", diff --git a/CSETWebNg/src/assets/i18n/uk.json b/CSETWebNg/src/assets/i18n/uk.json index 8b379ce492..c001e2ff80 100644 --- a/CSETWebNg/src/assets/i18n/uk.json +++ b/CSETWebNg/src/assets/i18n/uk.json @@ -24,6 +24,7 @@ "city or site name": "Назва міста або сайту", "state province region": "Штат / Провінція / Регіон", "assessment type": "Тип оцінки", + "type": "Тип", "demographics": "Демографія", "select type": "Виберіть тип", "sector": "Сектор", @@ -104,6 +105,22 @@ "off site": "Поза сайтом" }, "nist 60 fips 199": "NIST-60 / FIPS-199", + "nist": { + "fips guide text": "[UK]The FIPS 199 guide below will help you learn how to determine the overall security categorization of the system under assessment. If you are unfamiliar with the FIPS 199 SAL Determination screen, please read the guide before proceeding.", + "fips other guides": "[UK]Other Guides:", + "selected information types": "[UK]CIA Values Based on Selected Information Types", + "check applicable": "[UK]Check applicable information types.", + "tooltip c": "[UK]Clicking this will overwrite the Confidentiality Special Factor", + "tooltip i": "[UK]Clicking this will overwrite the Integrity Special Factor", + "tooltip a": "[UK]Clicking this will overwrite the Availabilty Special Factor", + "low": "LLL", + "mod": "MMM", + "high": "HHH", + "none": "NONE!", + "answer questions": "[UK]Answer Questions", + "yes": "Так", + "no": "Ні" + }, "low": "Низький", "moderate": "Помірний", "high": "Високий", From 7692ba4651513bcb7ad07d3fdd8dc1f1cac05805 Mon Sep 17 00:00:00 2001 From: Randy Woods Date: Thu, 25 Jan 2024 09:28:27 -0700 Subject: [PATCH 3/4] More NIST SAL translations --- .../sals/sal-nist/sal-nist.component.html | 12 ++++++------ .../prepare/sals/sal-nist/sal-nist.component.ts | 15 ++++++++++----- CSETWebNg/src/app/services/sal.service.ts | 13 ++++++++++--- CSETWebNg/src/assets/i18n/en.json | 1 + CSETWebNg/src/assets/i18n/es.json | 1 + CSETWebNg/src/assets/i18n/uk.json | 17 ++++++++++++----- 6 files changed, 40 insertions(+), 19 deletions(-) diff --git a/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.html b/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.html index 6e05ef5c29..42a35ed675 100644 --- a/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.html +++ b/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.html @@ -125,9 +125,9 @@

{{t('titles.sal.nist.selected information types')}}

{{t('type')}} - C - I - A + C + I + A @@ -138,7 +138,7 @@

{{t('titles.sal.nist.selected information types')}}

- + {{t('titles.sal.nist.selected information types')}} {{salsSvc.getDisplayLevel(model.confidentiality_Value)}} - + {{t('titles.sal.nist.selected information types')}} {{salsSvc.getDisplayLevel(model.integrity_Value)}} - + { if (result) { @@ -158,10 +161,12 @@ export class SalNistComponent implements OnInit { salName: this.salsSvc.selectedSAL.iLevel, salValue: 0 }; + this.topModel.specialFactors.availability_Value = { salName: this.salsSvc.selectedSAL.aLevel, salValue: 0 }; + this.salsSvc.updateNistSpecialFactors(this.topModel.specialFactors) .subscribe(response => { this.salsSvc.selectedSAL = response; diff --git a/CSETWebNg/src/app/services/sal.service.ts b/CSETWebNg/src/app/services/sal.service.ts index cf615c9c47..b4e322298f 100644 --- a/CSETWebNg/src/app/services/sal.service.ts +++ b/CSETWebNg/src/app/services/sal.service.ts @@ -26,6 +26,7 @@ import { Injectable } from '@angular/core'; import { NistSpecialFactor } from '../assessment/prepare/sals/sal-nist/nist-sal.models'; import { Sal } from '../models/sal.model'; import { ConfigService } from './config.service'; +import { TranslocoService } from '@ngneat/transloco'; const headers = { headers: new HttpHeaders() @@ -53,7 +54,11 @@ export class SalService { { value: 'Very High', imagepath: 'M6.422 36.273C6.478 19.778 19.865 6.419 36.374 6.419 52.883 6.419 66.27 19.778 66.326 36.273L72.748 36.273C72.691 16.232 56.429 0 36.374 0 16.319 0 0.056 16.232 0 36.273zM36.294 41.026C32.884 40.992 30.147 38.2 30.182 34.789 30.216 31.379 33.008 28.64 36.418 28.676 37.641 28.686 38.775 29.06 39.728 29.682L55.472 35.042 39.623 40.085C38.657 40.691 37.518 41.039 36.294 41.026' } ]; - constructor(private http: HttpClient, private configSvc: ConfigService) { + constructor( + private http: HttpClient, + private configSvc: ConfigService, + public tSvc: TranslocoService + ) { this.apiUrl = this.configSvc.apiUrl + 'SAL'; this.apiUrlGenSal = this.configSvc.apiUrl + 'GeneralSal'; } @@ -148,14 +153,16 @@ export class SalService { /** * Primarily used to shorten the word MODERATE on NIST SAL grid * because it is too wide to display well on a phone. + * + * Also translates to non-English if needed * @param level */ getDisplayLevel(level: string): string { if (level === 'MODERATE') { - return 'MOD'; + level = 'MOD'; } - return level; + return this.tSvc.translate('titles.sal.nist.' + level.toLowerCase()); } } diff --git a/CSETWebNg/src/assets/i18n/en.json b/CSETWebNg/src/assets/i18n/en.json index 077c78ed82..23a4a69015 100644 --- a/CSETWebNg/src/assets/i18n/en.json +++ b/CSETWebNg/src/assets/i18n/en.json @@ -119,6 +119,7 @@ "tooltip c": "Clicking this will overwrite the Confidentiality Special Factor", "tooltip i": "Clicking this will overwrite the Integrity Special Factor", "tooltip a": "Clicking this will overwrite the Availabilty Special Factor", + "confirmation": "This will overwrite the current {cia} special factor text. Do you want to continue?", "low": "LOW", "mod": "MOD", "high": "HIGH", diff --git a/CSETWebNg/src/assets/i18n/es.json b/CSETWebNg/src/assets/i18n/es.json index 7d2ab1190f..6be1b31eba 100644 --- a/CSETWebNg/src/assets/i18n/es.json +++ b/CSETWebNg/src/assets/i18n/es.json @@ -164,6 +164,7 @@ "tooltip c": "[ES]Clicking this will overwrite the Confidentiality Special Factor", "tooltip i": "[ES]Clicking this will overwrite the Integrity Special Factor", "tooltip a": "[ES]Clicking this will overwrite the Availabilty Special Factor", + "confirmation": "[ES]This will overwrite the current {cia} special factor text. Do you want to continue?", "low": "BAJO", "mod": "MOD", "high": "ALT", diff --git a/CSETWebNg/src/assets/i18n/uk.json b/CSETWebNg/src/assets/i18n/uk.json index c001e2ff80..aea9f0f3cc 100644 --- a/CSETWebNg/src/assets/i18n/uk.json +++ b/CSETWebNg/src/assets/i18n/uk.json @@ -113,11 +113,12 @@ "tooltip c": "[UK]Clicking this will overwrite the Confidentiality Special Factor", "tooltip i": "[UK]Clicking this will overwrite the Integrity Special Factor", "tooltip a": "[UK]Clicking this will overwrite the Availabilty Special Factor", - "low": "LLL", - "mod": "MMM", - "high": "HHH", - "none": "NONE!", - "answer questions": "[UK]Answer Questions", + "confirmation": "Це перезапише поточний текст особливого фактора {cia}. Бажаєте продовжити?", + "low": "НИЗЬК", + "mod": "СЕР", + "high": "ВИЩ", + "none": "ВІДСУТ", + "answer questions": "Питання", "yes": "Так", "no": "Ні" }, @@ -329,6 +330,12 @@ "mil-4": "MIL-4", "mil-5": "MIL-5" }, + "dialogs": { + "please confirm": "Підтвердження", + "remove contact": "Are you sure you want to remove {{firstName}} {{lastName}} from this assessment?", + "remove assessment": "Are you sure you want to remove {{assessmentName}}?", + "confirm create new assessment": "Are you sure you want to create a new assessment?" + }, "reports": { "standard": "Стандартний", "category": "Категорія", From 294823e9017a936c13726ed7c0ac310b74303f9b Mon Sep 17 00:00:00 2001 From: Randy Woods Date: Tue, 30 Jan 2024 10:49:24 -0700 Subject: [PATCH 4/4] Updated NIST SAL info type persistence --- .../Sal/NistSalBusiness.cs | 25 +++++++++++---- .../Sal/NistSpecialFactor.cs | 31 +++++++------------ .../Controllers/SalController.cs | 10 ++++-- .../sals/sal-nist/sal-nist.component.ts | 2 +- CSETWebNg/src/app/services/sal.service.ts | 14 +-------- CSETWebNg/src/assets/i18n/uk.json | 14 ++++----- 6 files changed, 47 insertions(+), 49 deletions(-) diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSalBusiness.cs b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSalBusiness.cs index 75d978cff4..6c9bc86567 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSalBusiness.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSalBusiness.cs @@ -14,7 +14,7 @@ using CSETWebCore.Interfaces.Helpers; using CSETWebCore.Model.Sal; using Microsoft.EntityFrameworkCore; -using DocumentFormat.OpenXml.Office.CoverPageProps; + namespace CSETWebCore.Business.Sal { @@ -125,17 +125,30 @@ join n2 in _context.NIST_SAL_INFO_TYPES_DEFAULTS on n1.Type_Value equals n2.Type return list; } - public Sals UpdateSalValue(NistSalModel updateValue, int assessmentid) + + public Sals UpdateSalValue(NistSalModel updateValue, int assessmentId) { TinyMapper.Bind(config => { config.Ignore(x => x.Assessment_Id); + config.Ignore(x => x.Type_Value); + config.Ignore(x => x.Confidentiality_Special_Factor); + config.Ignore(x => x.Integrity_Special_Factor); + config.Ignore(x => x.Availability_Special_Factor); }); - NIST_SAL_INFO_TYPES update = _context.NIST_SAL_INFO_TYPES.Where(x => x.Assessment_Id == assessmentid && x.Type_Value == updateValue.Type_Value).FirstOrDefault(); - TinyMapper.Map(updateValue, update); - _context.SaveChanges(); - return CalculateOveralls(assessmentid); + var dbInfoDefault = _context.NIST_SAL_INFO_TYPES_DEFAULTS.Where(x => x.Type_Id == updateValue.Type_Id).FirstOrDefault(); + if (dbInfoDefault != null) + { + var dbInfoType = _context.NIST_SAL_INFO_TYPES.Where(x => x.Assessment_Id == assessmentId + && x.Type_Value == dbInfoDefault.Type_Value).FirstOrDefault(); + + TinyMapper.Map(updateValue, dbInfoType); + + _context.SaveChanges(); + } + + return CalculateOveralls(assessmentId); } diff --git a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSpecialFactor.cs b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSpecialFactor.cs index 9719e95bfd..e54d4eda23 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSpecialFactor.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWebCore.Business/Sal/NistSpecialFactor.cs @@ -81,34 +81,26 @@ public void SaveToDb(int id, CSETContext context, IAssessmentUtil assessmentUtil CNSS_CIA_JUSTIFICATIONS cnvalu; // Availability - if (!String.IsNullOrWhiteSpace(this.Availability_Special_Factor)) - { - cnvalu = getOrCreateNew("availability", id, dbValues, context); - cnvalu.Justification = this.Availability_Special_Factor == null ? String.Empty : this.Availability_Special_Factor; - cnvalu.DropDownValueLevel = this.Availability_Value.SALName; - } + cnvalu = GetOrCreateNew("availability", id, dbValues, context); + cnvalu.Justification = this.Availability_Special_Factor == null ? String.Empty : this.Availability_Special_Factor; + cnvalu.DropDownValueLevel = this.Availability_Value.SALName; // Confidentiality - if (!String.IsNullOrWhiteSpace(this.Confidentiality_Special_Factor)) - { - cnvalu = getOrCreateNew("confidentiality", id, dbValues, context); - cnvalu.Justification = this.Confidentiality_Special_Factor == null ? string.Empty : this.Confidentiality_Special_Factor; - cnvalu.DropDownValueLevel = this.Confidentiality_Value.SALName; - } + cnvalu = GetOrCreateNew("confidentiality", id, dbValues, context); + cnvalu.Justification = this.Confidentiality_Special_Factor == null ? string.Empty : this.Confidentiality_Special_Factor; + cnvalu.DropDownValueLevel = this.Confidentiality_Value.SALName; // Integrity - if (!String.IsNullOrWhiteSpace(this.Integrity_Special_Factor)) - { - cnvalu = getOrCreateNew("integrity", id, dbValues, context); - cnvalu.Justification = this.Integrity_Special_Factor == null ? String.Empty : this.Integrity_Special_Factor; - cnvalu.DropDownValueLevel = this.Integrity_Value.SALName; - } + cnvalu = GetOrCreateNew("integrity", id, dbValues, context); + cnvalu.Justification = this.Integrity_Special_Factor == null ? String.Empty : this.Integrity_Special_Factor; + cnvalu.DropDownValueLevel = this.Integrity_Value.SALName; context.SaveChanges(); assessmentUtils.TouchAssessment(id); } - private CNSS_CIA_JUSTIFICATIONS getOrCreateNew(String ciaType, int id, Dictionary dbValues, CSETContext context) + + private CNSS_CIA_JUSTIFICATIONS GetOrCreateNew(String ciaType, int id, Dictionary dbValues, CSETContext context) { CNSS_CIA_JUSTIFICATIONS cnvalu; if (dbValues.TryGetValue(ciaType, out cnvalu)) @@ -123,6 +115,7 @@ private CNSS_CIA_JUSTIFICATIONS getOrCreateNew(String ciaType, int id, Dictionar } } + /// /// Upper Case the First Letter (UCF) /// diff --git a/CSETWebApi/CSETWeb_Api/CSETWeb_ApiCore/Controllers/SalController.cs b/CSETWebApi/CSETWeb_Api/CSETWeb_ApiCore/Controllers/SalController.cs index 7083811b19..43d051fb6c 100644 --- a/CSETWebApi/CSETWeb_Api/CSETWeb_ApiCore/Controllers/SalController.cs +++ b/CSETWebApi/CSETWeb_Api/CSETWeb_ApiCore/Controllers/SalController.cs @@ -93,9 +93,9 @@ public async Task GetType(String newType) { return BadRequest(e); } - } + [HttpPost] [Route("api/SAL")] public IActionResult PostSAL(Sals tmpsal) @@ -168,6 +168,7 @@ public IActionResult PostSAL(Sals tmpsal) return NoContent(); } + // POST: api/SAL [HttpPost] [Route("api/Sal_what_is_this")] @@ -201,6 +202,7 @@ public async Task PostSTANDARD_SELECTION(STANDARD_SELECTION sTAND return CreatedAtRoute("DefaultApi", new { id = sTANDARD_SELECTION.Assessment_Id }, sTANDARD_SELECTION); } + [HttpGet] [Route("api/SAL/NistData")] public NistModel GetNistData() @@ -217,6 +219,7 @@ public NistModel GetNistData() return rvalue; } + [HttpPost] [Route("api/SAL/NistData")] public Sals PostNistData([FromBody] NistSalModel updateValue) @@ -224,10 +227,9 @@ public Sals PostNistData([FromBody] NistSalModel updateValue) int assessmentId = _token.AssessmentForUser(); NistSalBusiness nistSal = new NistSalBusiness(_context, _assessmentUtil, _token); return nistSal.UpdateSalValue(updateValue, assessmentId); - - } + [HttpPost] [Route("api/SAL/NistDataQuestions")] public Sals PostNistDataQuestions([FromBody] NistQuestionsAnswers updateValue) @@ -237,6 +239,7 @@ public Sals PostNistDataQuestions([FromBody] NistQuestionsAnswers updateValue) return nistSal.SaveNistQuestions(assessmentId, updateValue); } + [HttpPost] [Route("api/SAL/NistDataSpecialFactor")] public Sals PostNistDataSpecialFactor([FromBody] NistSpecialFactor updateValue) @@ -246,6 +249,7 @@ public Sals PostNistDataSpecialFactor([FromBody] NistSpecialFactor updateValue) return nistSal.SaveNistSpecialFactor(assessmentId, updateValue); } + private bool STANDARD_SELECTIONExists(int id) { return _context.STANDARD_SELECTION.Count(e => e.Assessment_Id == id) > 0; diff --git a/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.ts b/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.ts index 1572f1bdbe..0a363d25ca 100644 --- a/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.ts +++ b/CSETWebNg/src/app/assessment/prepare/sals/sal-nist/sal-nist.component.ts @@ -201,7 +201,7 @@ export class SalNistComponent implements OnInit { } } selectedSal.selected = e.target.checked; - this.salsSvc.updateSal(selectedSal) + this.salsSvc.updateNistSalSelection(selectedSal) .subscribe(response => { this.salsSvc.selectedSAL = response; }); diff --git a/CSETWebNg/src/app/services/sal.service.ts b/CSETWebNg/src/app/services/sal.service.ts index b4e322298f..734521ea6d 100644 --- a/CSETWebNg/src/app/services/sal.service.ts +++ b/CSETWebNg/src/app/services/sal.service.ts @@ -102,7 +102,7 @@ export class SalService { return this.http.get(this.apiUrl + '/NistData'); } - updateSal(updateSal: any): any { + updateNistSalSelection(updateSal: any): any { return this.http.post(this.apiUrl + '/NistData', updateSal, headers); } @@ -136,18 +136,6 @@ export class SalService { // for now, let's just try to fit the text return level; - - // switch (level.toLowerCase()) { - // case "low": - // return "L"; - // case "moderate": - // return "M"; - // case "high": - // return "H"; - // case "very high": - // return "VH"; - // } - // return ""; } /** diff --git a/CSETWebNg/src/assets/i18n/uk.json b/CSETWebNg/src/assets/i18n/uk.json index aea9f0f3cc..b8381d5ea8 100644 --- a/CSETWebNg/src/assets/i18n/uk.json +++ b/CSETWebNg/src/assets/i18n/uk.json @@ -106,13 +106,13 @@ }, "nist 60 fips 199": "NIST-60 / FIPS-199", "nist": { - "fips guide text": "[UK]The FIPS 199 guide below will help you learn how to determine the overall security categorization of the system under assessment. If you are unfamiliar with the FIPS 199 SAL Determination screen, please read the guide before proceeding.", - "fips other guides": "[UK]Other Guides:", - "selected information types": "[UK]CIA Values Based on Selected Information Types", - "check applicable": "[UK]Check applicable information types.", - "tooltip c": "[UK]Clicking this will overwrite the Confidentiality Special Factor", - "tooltip i": "[UK]Clicking this will overwrite the Integrity Special Factor", - "tooltip a": "[UK]Clicking this will overwrite the Availabilty Special Factor", + "fips guide text": "Нижче поданий посібник FIPS 199 допоможе вам вивчити, як визначити загальну категоризацію безпеки системи, яка перебуває на оцінці. Якщо вам невідомий екран визначення SAL за FIPS 199, будь ласка, прочитайте посібник перед продовженням.", + "fips other guides": "Інші посібники:", + "selected information types": "Цінності CIA на основі обраних типів інформації.", + "check applicable": "Перевірте застосовні типи інформації.", + "tooltip c": "Клацання цього призведе до перезапису Особливого фактора конфіденційності.", + "tooltip i": "Клацання цього призведе до перезапису Особливого фактора цілісності.", + "tooltip a": "Клацання цього призведе до перезапису Особливого фактора доступності.", "confirmation": "Це перезапише поточний текст особливого фактора {cia}. Бажаєте продовжити?", "low": "НИЗЬК", "mod": "СЕР",