The Model Made Me Do It! A Cautionary Tale From a Security Control Baseline Tool Developer
Joshua Lubell · Balisage series on markup technologies · 2021
Even the best written specifications can be complicated documents to read and understand. Normative prose is often supported by tables and diagrams intended to clarify the specification. What happens when a tool developer interprets those clarifying features as a different model than the prose intends? What does this say about relying on derived data models in tools that support the specification? A cautionary tale involving security control baselines from National Institute of Standards and Technology Special Publication 800-53 provides some answers — and insights.