Tutorial 4: Modeling Security Controls & Compliance

In this tutorial, you will model PCI-DSS compliance policies, preventive encryption controls, and STRIDE threats protecting sensitive cardholder data.

workspace security_governance "Security Architecture Model" {

    layer "Data Layer" {
        data_object data_credit_card "Cardholder Payment Data" {
            classification "Restricted"
            pii true
            security {
                confidentiality Critical
                integrity Critical
                availability High
            }
        }
    }

    layer "Governance Layer" {
        policy pol_pci "PCI DSS 4.0 Standard" {
            policy_type "Security"
            enforcement "Mandatory"
            priority "Critical"
        }

        control ctrl_aes256 "AES-GCM-256 Vault Encryption" {
            control_type "Preventive"
            control_category "Cryptography"
            effectiveness "High"

            relationships {
                this governed_by pol_pci "Enforces compliance"
                this protects data_credit_card "Safeguards PAN records with AES-256"
            }
        }
    }
}