Security Requirements
- Created on .
Finally got the Client module uploaded tonight after messing around all evening with it. There are so many controls that it takes ages to be sure that you have them correctly assigned to the roles, labelled and hyperlinked. If you are using IE I really encourage you to try with Firefox, Safari or Opera which support SVG graphics. That way you get the links to controls on the diagram itself, along with tooltips.
I ended up going with the ITIL roles for the actors and I started to get quite happy with these towards the end. I think that many of them will remain unused apart from esoteric patterns, but I like the fact that they cover the lifecycle in depth and will be familiar to most IT people who are used to working in large structured (or often unstructured!) organisations. For those users who don't fall into this space, you can still use the control definitions and ignore the extra information that the roles bring you.
Therefore my vote is to standardise on ITILv3 roles, and map against other standards as needed.
I'm working at the moment on the Client and Server modules. These form the foundations of the OSA pattern library as they will be used and referenced many times. It's taking time to get these modules rights which is slowing progress.
Why are they hard to build?
I hope to have more to report by the end of the week, with finalised patterns posted.