Add cost decomposition, discovery gating, and maturity grading to patchCost - #606
Merged
Merged
Conversation
…aturity grading patchCost's non-negativity rule now unpacks its CurrencyMeasure via MeasureFn/UnitOfCurrency rather than measure, whose domain is Physical and never matches an Abstract-branch quantity. PatchManagementMaturityAttribute grades an organization's patch management capability on CMMC 2.0's three-level structure (Foundational, Advanced, Expert), chained by successorAttribute. A comparative rule ties higher maturity to lower or equal patchCost for the same vulnerability, holding the currency unit fixed across both organizations.
patchDevelopmentCost, patchTestingCost, patchDeploymentCost, and operationalDisruptionCost each price one phase of remediating a vulnerability: writing the fix, verifying it, rolling it out, and the lost or degraded operations incurred along the way. Each carries its own non-negativity rule. A summation rule ties patchCost to the sum of all four once an agent has all four sub-costs recorded, unified to a shared currency unit throughout.
Replaces the unconditional knows rule with two discovery-gated rules, one per side: an agent knows the patch cost only once it knows the vulnerability is present on the system, using the same discovery predicate Vulnerability's own latent-until-discovered claim already uses. Doc string updated to match.
defenderLossCost prices the defender's expected loss from a successful exploitation, distinct from exploitCost (the attacker's cost to carry it out). A new rule ties patching to being the likely, cost-minimizing choice exactly when patchCost is less than defenderLossCost for the same vulnerability and defender -- operationalDisruptionCost already prices patching's own disruption, so no separate opportunity-cost term is needed on the other side of the comparison.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds patchDevelopmentCost, patchTestingCost, patchDeploymentCost, and operationalDisruptionCost as the four components that sum into patchCost, along with a PatchManagementMaturityAttribute grading an organization's patch management capability on CMMC 2.0's three-level structure (Foundational, Advanced, Expert) and a rule tying higher maturity to lower or equal patch cost for the same vulnerability. Reworks patchCost's common-knowledge claim so each side, attacker or defender, knows the patch cost only once it knows the vulnerability exists, mirroring exploitCost's own discovery-gating fix. Adds defenderLossCost, pricing the defender's expected loss from a successful exploitation as distinct from exploitCost's attacker-side price, and a rule tying patching to being the likely, cost-minimizing choice exactly when patchCost is less than defenderLossCost. Rewrites patchCost's non-negativity rule to unpack its CurrencyMeasure via MeasureFn and UnitOfCurrency rather than measure, whose domain is Physical and never matches an Abstract-branch quantity.