@shiftleftpt/sbd-toe-mcp 0.10.2 → 0.10.3
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/consumed-bundle.json +11 -11
- package/data/entities/proportionality.json +3 -3
- package/data/entities/sdlc_integration.json +3 -3
- package/data/publish/indexes/bundle_catalog.jsonl +1 -1
- package/data/publish/indexes/canonical_chunks.jsonl +4903 -4902
- package/data/publish/indexes/chunk_entity_mentions.jsonl +9 -25
- package/data/publish/indexes/mcp_chunks.jsonl +125 -124
- package/data/publish/indexes/publication_manifest.json +8 -8
- package/data/publish/overlay/framework_overlay_index.json +18 -0
- package/data/publish/overlay/overlay_mappings.jsonl +120 -45
- package/data/publish/runtime/controls.json +27 -25
- package/data/publish/runtime/deterministic_manifest.json +1 -1
- package/data/publish/runtime/evidence_patterns.json +24 -24
- package/data/publish/runtime/requirement_control_links.json +334 -162
- package/data/publish/runtime/v1/manual_maturity_progression.jsonl +336 -336
- package/data/publish/runtime/v1/manual_rastreabilidade.jsonl +1105 -1105
- package/data/publish/runtime/v1/manual_threat_mitigation.jsonl +523 -523
- package/data/publish/runtime/v1/v1_manifest.json +5 -5
- package/data/reports/run_manifest.json +8 -8
- package/dist/index.js +4 -4
- package/dist/index.js.map +1 -1
- package/dist/tools/plan-repo-governance.d.ts +1 -2
- package/dist/tools/plan-repo-governance.js +19 -49
- package/dist/tools/plan-repo-governance.js.map +1 -1
- package/dist/tools/structured-tools.d.ts +4 -5
- package/dist/tools/structured-tools.js +87 -122
- package/dist/tools/structured-tools.js.map +1 -1
- package/package.json +3 -2
|
@@ -1,523 +1,523 @@
|
|
|
1
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
2
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
3
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
4
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
5
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
6
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
7
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
8
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
9
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
10
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
11
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
12
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
13
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
14
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
15
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
16
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
17
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
18
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
19
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
20
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
21
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
22
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
23
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de aplicação de controlos mínimos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
24
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Overengineering e fricção excessiva", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
25
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos com mesmo risco", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
26
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança opcional em produtos low-risk", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
27
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem reclassificação", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
28
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Integração com APIs ou terceiros ignorada", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
29
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy com risco alterado não revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
30
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Versões diferentes com classificações divergentes", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
31
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação informal de riscos críticos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
32
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de auditoria posterior", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
33
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite por responsáveis inapropriados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
34
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de explicabilidade regulatória", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
35
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas mal avaliadas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
36
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sensíveis não reconhecidos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
37
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Assunção de ambientes seguros por defeito", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
38
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ignorar dependências críticas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
39
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco residual nunca revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
40
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de eventos de reavaliação planeados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
41
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reclassificação dependente de exceções", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
42
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões de risco sem feedback do negócio", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
43
|
-
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
44
|
-
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "
|
|
45
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
46
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
47
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
48
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
49
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
50
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
51
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
52
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
53
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
54
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
55
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
56
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
57
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
58
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
59
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
60
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
61
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
62
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
63
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de requisitos de segurança", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
64
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Definição ambígua ou não testável", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
65
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos genéricos não específicos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
66
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de requisitos em sistemas legados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
67
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não alinhados com risco", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
68
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos mas nunca verificados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
69
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações inconsistentes entre projetos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
70
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreio entre requisito e teste", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
71
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não verificados em CI/CD", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
72
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite sem validação documental", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
73
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções a requisitos não documentadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
74
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança omitida por “não ser funcional”", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
75
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação de exceções sem aprovação", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
76
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não reverificadas no tempo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
77
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não saber se requisitos foram aplicados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
78
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos aplicados mas não testados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
79
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças de requisitos não propagadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
80
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade entre requisito e controlo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "
|
|
81
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
82
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
83
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
84
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
85
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
86
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
87
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
88
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
89
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
90
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
91
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
92
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
93
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
94
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
95
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
96
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
97
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
98
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
99
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças desconhecidas e não tratadas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
100
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Prioridades de segurança mal definidas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
101
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos sem base em ameaças", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
102
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças a privacidade ignoradas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
103
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cobertura de ameaças não técnicas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
104
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura insegura não identificada", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
105
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação superficial em design reviews", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
106
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Controles aplicados sem base em arquitetura", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
107
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de revisão em interfaces críticas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
108
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças descobertas demasiado tarde", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
109
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem nova modelação", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
110
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Descontinuidade entre equipas e fases", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
111
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças não visíveis na pipeline CI/CD", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
112
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conhecimento de ameaças não acumulado", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
113
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos e equipas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
114
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas desconectadas do ciclo", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "
|
|
115
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
116
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
117
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
118
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
119
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
120
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
121
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
122
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
123
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
124
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
125
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
126
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
127
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
128
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
129
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
130
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
131
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
132
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
133
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
134
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
135
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
136
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
137
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas sem isolamento", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
138
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mistura de dados e controlo na mesma zona", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
139
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso lateral não controlado entre módulos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
140
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de isolamento entre utilizadores", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
141
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura inexistente ou desatualizada", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
142
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão sobre localização de controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
143
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade sobre fronteiras e zonas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
144
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura não revê mecanismos de fallback", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
145
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura nunca revista", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
146
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações estruturais sem revalidação", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
147
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Design informal ou ad hoc", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
148
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções de arquitetura sem rasto", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
149
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos de arquitetura não definidos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
150
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de mapear decisões a controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
151
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Diagrama não reflete controlos implementados", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
152
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicações L1 tratadas como críticas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
153
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Sobredimensionamento de segurança da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
154
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes de execução não refletidos no design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "
|
|
155
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
156
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
157
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
158
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
159
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
160
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
161
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
162
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
163
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
164
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
165
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
166
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
167
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
168
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
169
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
170
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
171
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
172
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
173
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
174
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
175
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas com CVEs ativos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
176
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependências desatualizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
177
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de registo de versões", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
178
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas não auditadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
179
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desconhecimento de bibliotecas utilizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
180
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de associação entre vulnerabilidade e artefacto", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
181
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de histórico de introdução de pacotes", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
182
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de pacotes de repositórios maliciosos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
183
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependência transitiva com componente inseguro", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
184
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Pipeline injeta versão não autenticada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
185
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "CVEs ignoradas sem justificação", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
186
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mitigações aplicadas sem rastreio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
187
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ciclo de revisão de exceções", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
188
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso arbitrário de bibliotecas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
189
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bibliotecas proibidas são usadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
190
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de política de substituição", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
191
|
-
{"associated_controls": "SBOM boundary, revisão de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Introdução de dependência vulnerável não declarada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
192
|
-
{"associated_controls": "SCA, validação de origem", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
193
|
-
{"associated_controls": "Governance de tooling", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Backdoor via ferramenta de build", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
194
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Drift de composição entre builds", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "
|
|
195
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
196
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
197
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
198
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
199
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
200
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
201
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
202
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
203
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
204
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
205
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
206
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
207
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
208
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
209
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
210
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
211
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
212
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
213
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de padrões inseguros por hábito", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
214
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de funções descontinuadas ou perigosas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
215
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de código sem escape adequado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
216
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código inseguro sem deteção", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
217
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreabilidade entre problemas e decisões", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
218
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação apenas reativa (ex: testes QA)", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
219
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança removida por “incompatibilidade”", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
220
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não revistas ou revalidadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
221
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desvios não rastreados entre guideline e prática", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
222
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Geração de código inseguro via IA", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
223
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de vulnerabilidades conhecidas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
224
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de accountability sobre código gerado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
225
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas descontinuadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
226
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de justificação para uso de dependência insegura", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
227
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Componente vulnerável mantido no build final", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
228
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre equipas e projetos", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
229
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inexistência de baseline de segurança", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
230
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Fraca responsabilização pela segurança do código", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "
|
|
231
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
232
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
233
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
234
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
235
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
236
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
237
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
238
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
239
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
240
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
241
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
242
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
243
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
244
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
245
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
246
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
247
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
248
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
249
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
250
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
251
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
252
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
253
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
254
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
255
|
-
{"associated_controls": "Design seguro de pipelines; isolamento de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não autorizado em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
256
|
-
{"associated_controls": "Isolamento e efemeridade de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Comprometimento do ambiente de build", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
257
|
-
{"associated_controls": "Hardening de pipelines", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Elevação de privilégios no pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
258
|
-
{"associated_controls": "Gestão segura de código-fonte", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Push não autorizado para branches protegidas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
259
|
-
{"associated_controls": "Políticas de execução", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não auditado", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
260
|
-
{"associated_controls": "Rastreabilidade e assinaturas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição silenciosa de código legítimo", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
261
|
-
{"associated_controls": "Integridade e proveniência", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Build forjado fora da pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
262
|
-
{"associated_controls": "Segurança do código de pipeline", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de lógica dinâmica em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
263
|
-
{"associated_controls": "Controlo de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de componentes externos inseguros", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
264
|
-
{"associated_controls": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Vazamento de segredos via logs", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
265
|
-
{"associated_controls": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
266
|
-
{"associated_controls": "Lifecycle de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de segredos", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
267
|
-
{"associated_controls": "Políticas de gates", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de gates de segurança", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
268
|
-
{"associated_controls": "Validações integradas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não executadas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
269
|
-
{"associated_controls": "Rastreabilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
270
|
-
{"associated_controls": "Gestão de exceções", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bypass de controlos sem rasto", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
271
|
-
{"associated_controls": "Governação contínua", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações críticas sem visibilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
272
|
-
{"associated_controls": "Gates e governação", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoções sem responsável humano", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
273
|
-
{"associated_controls": "Evidência empírica", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Evidência plausível sem execução", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
274
|
-
{"associated_controls": "Reprodutibilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não-determinismo do pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
275
|
-
{"associated_controls": "Controlo de integrações", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exfiltração de contexto sensível", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
276
|
-
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "
|
|
277
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
278
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
279
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
280
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
281
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
282
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
283
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
284
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
285
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
286
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
287
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
288
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
289
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
290
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
291
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
292
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
293
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
294
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
295
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
296
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
297
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
298
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
299
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
300
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
301
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
302
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
303
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
304
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
305
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Defaults inseguros ou permissivos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
306
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
307
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Campos críticos deixados em branco ou default", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
308
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inconsistentes entre execuções", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
309
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de módulos inseguros ou sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
310
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Hardcoded de parâmetros críticos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
311
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inseguros provisionados por erro", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
312
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Provisionamento com permissões excessivas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
313
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de tags de classificação de dados", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
314
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de dados reais em ambientes de teste", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
315
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded ou mal geridos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
316
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações aplicadas sem revisão", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
317
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de owner e accountability", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
318
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de módulos sem tracking", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
319
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicação de alterações inseguras por bypass", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
320
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Justificações informais ou inexistentes", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
321
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes provisionados com exceções acumuladas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
322
|
-
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "
|
|
323
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
324
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
325
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
326
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
327
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
328
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
329
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
330
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
331
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
332
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
333
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
334
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
335
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
336
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
337
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
338
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
339
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
340
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
341
|
-
{"associated_controls": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens base vulneráveis/obsoletas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
342
|
-
{"associated_controls": "*Checklist 3–4*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de dependências inseguras no build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
343
|
-
{"associated_controls": "*Policies: Construção Segura de Imagens*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdo inesperado no _context_ de build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
344
|
-
{"associated_controls": "*Checklist 6*, *Policies: Construção Segura*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações inseguras no Dockerfile", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
345
|
-
{"associated_controls": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens não assinadas / sem verificação", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
346
|
-
{"associated_controls": "*Policies: Repositórios*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição maliciosa em registo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
347
|
-
{"associated_controls": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de trilho de auditoria (quem construiu o quê)", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
348
|
-
{"associated_controls": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução como root / capabilities excessivas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
349
|
-
{"associated_controls": "*Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Montagens e volumes inseguros", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
350
|
-
{"associated_controls": "*Policies: Runtime*, *Checklist 8*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de políticas de rede", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
351
|
-
{"associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Admission_ permissivo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
352
|
-
{"associated_controls": "*Policies: Segredos*, *Checklist 3 & 5*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos embebidos em imagem", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
353
|
-
{"associated_controls": "*Policies: Segredos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exposição em variáveis de ambiente", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
354
|
-
{"associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Manifestos inseguros aprovados", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
355
|
-
{"associated_controls": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desalinhamento imagem↔manifesto", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
356
|
-
{"associated_controls": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de deploys", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
357
|
-
{"associated_controls": "*Rastreabilidade: DSOMM*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Shadow containers_ fora do pipeline", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
358
|
-
{"associated_controls": "*Policies: Runtime*, Cap. 08 (IaC)", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Drift_ de configuração", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
359
|
-
{"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "
|
|
360
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
361
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
362
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
363
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
364
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
365
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
366
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
367
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
368
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
369
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
370
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
371
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
372
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
373
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
374
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
375
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeções (SQLi, OS Command, etc.)", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
376
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas de controlo de acesso", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
377
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Lógicas de negócio exploráveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
378
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão de segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
379
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Baixa cobertura dos testes", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
380
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas conhecidas não testadas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
381
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas detetadas mas não resolvidas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
382
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipa sem feedback técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
383
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não repetíveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
384
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes manuais não escaláveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
385
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de testes antes de go-live", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
386
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisão de qualidade feita sem base", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
387
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Classes novas não detetadas por SAST/DAST", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
388
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes superficiais sem contexto técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
389
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas não calibradas por contexto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "
|
|
390
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
391
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
392
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
393
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
394
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
395
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
396
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
397
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
398
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
399
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
400
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
401
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
402
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
403
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
404
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
405
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código em produção sem validação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
406
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ativação funcional sem controlo", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
407
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoção manual fora do CI/CD", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
408
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy falhado sem rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
409
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature irreversível", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
410
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falha sem reação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
411
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release conjunta sem segmentação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
412
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature exposta a todos os utilizadores", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
413
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de validação operacional", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
414
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas pós-deploy não detetadas", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
415
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação tardia a problemas críticos", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
416
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos ignorados", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
417
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Toggle ativado inadvertidamente", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
418
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release sem segmentação geográfica ou lógica", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
419
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de função crítica não validada", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "
|
|
420
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
421
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
422
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
423
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
424
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
425
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
426
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
427
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
428
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
429
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
430
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
431
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
432
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
433
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
434
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
435
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
436
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
437
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
438
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
439
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
440
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
441
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
442
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
443
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
444
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
445
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos não registados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
446
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Logs voláteis ou truncados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
447
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de execução", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
448
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem alerta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
449
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alertas ignorados por ruído", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
450
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de correlação de alertas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
451
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem owner definido", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
452
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação ad-hoc ou tardia", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
453
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos sem acionamento de ação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
454
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de métricas de postura", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
455
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de priorizar riscos", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
456
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sem granularidade ou visão", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
457
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Novos sistemas sem monitorização", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
458
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipas ignoram alertas operacionais", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
459
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados não usados para melhoria contínua", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
460
|
-
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "
|
|
461
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
462
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
463
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
464
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
465
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
466
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
467
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
468
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
469
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
470
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
471
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
472
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
473
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
474
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
475
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
476
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
477
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configuração insegura por desconhecimento", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
478
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização indevida de segredos ou tokens", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
479
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso técnico concedido sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
480
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de terceiros sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
481
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ownership sobre segurança", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
482
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão comportamental / cultura frágil", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
483
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação não rastreável", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
484
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação desigual entre equipas ou funções", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
485
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação teórica sem impacto prático", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
486
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdos desatualizados ou não aplicáveis", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
487
|
-
{"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
488
|
-
{"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "
|
|
489
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
490
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
491
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
492
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
493
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
494
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
495
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
496
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
497
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
498
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
499
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
500
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
501
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
502
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
503
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
504
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
505
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
506
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
507
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
508
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
509
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
510
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
511
|
-
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
512
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Adoção de fornecedor sem avaliação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
513
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cláusulas contratuais", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
514
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de serviços sem rastreio", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
515
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Iniciativas paralelas sem coordenação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
516
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de continuidade organizacional", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
517
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco de decisões legadas sem controlo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
518
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões não revistas com mudança de contexto", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
519
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de governança em decisões históricas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
520
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de conhecimento sobre o estado de segurança", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
521
|
-
{"associated_controls": "30, 90", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Estratégia de segurança desarticulada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
522
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança definida mas não aplicada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
523
|
-
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Políticas de segurança não institucionalizadas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "
|
|
1
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-001", "manual_v2_entity_label": "Falta de aplicação de controlos mínimos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
2
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-002", "manual_v2_entity_label": "Overengineering e fricção excessiva", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
3
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-003", "manual_v2_entity_label": "Inconsistência entre projetos com mesmo risco", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
4
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-004", "manual_v2_entity_label": "Segurança opcional em produtos low-risk", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
5
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-005", "manual_v2_entity_label": "Mudanças críticas sem reclassificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
6
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-006", "manual_v2_entity_label": "Integração com APIs ou terceiros ignorada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
7
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-007", "manual_v2_entity_label": "Deploy com risco alterado não revisto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
8
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-008", "manual_v2_entity_label": "Versões diferentes com classificações divergentes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
9
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-009", "manual_v2_entity_label": "Aceitação informal de riscos críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
10
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-010", "manual_v2_entity_label": "Impossibilidade de auditoria posterior", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
11
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-011", "manual_v2_entity_label": "Risco aceite por responsáveis inapropriados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
12
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-012", "manual_v2_entity_label": "Falta de explicabilidade regulatória", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
13
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-013", "manual_v2_entity_label": "Interfaces expostas mal avaliadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
14
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-014", "manual_v2_entity_label": "Dados sensíveis não reconhecidos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
15
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-015", "manual_v2_entity_label": "Assunção de ambientes seguros por defeito", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
16
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-016", "manual_v2_entity_label": "Ignorar dependências críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
17
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-017", "manual_v2_entity_label": "Risco residual nunca revisto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
18
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-018", "manual_v2_entity_label": "Falta de eventos de reavaliação planeados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
19
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-019", "manual_v2_entity_label": "Reclassificação dependente de exceções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
20
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-020", "manual_v2_entity_label": "Decisões de risco sem feedback do negócio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
21
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:aceitacao-de-risco-invalida", "manual_v2_entity_label": "aceitação de risco inválida", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
22
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:alteracao-na-exposicao-dados-impacto-ou-forma-de-decisoes-e-validacoes", "manual_v2_entity_label": "alteração na exposição, dados, impacto ou forma de decisões e validações", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
23
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de aplicação de controlos mínimos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-001"}
|
|
24
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Overengineering e fricção excessiva", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-002"}
|
|
25
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos com mesmo risco", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-003"}
|
|
26
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança opcional em produtos low-risk", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-004"}
|
|
27
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem reclassificação", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-005"}
|
|
28
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Integração com APIs ou terceiros ignorada", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-006"}
|
|
29
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy com risco alterado não revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-007"}
|
|
30
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Versões diferentes com classificações divergentes", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-008"}
|
|
31
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação informal de riscos críticos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-009"}
|
|
32
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de auditoria posterior", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-010"}
|
|
33
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite por responsáveis inapropriados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-011"}
|
|
34
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de explicabilidade regulatória", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-012"}
|
|
35
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas mal avaliadas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-013"}
|
|
36
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sensíveis não reconhecidos", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-014"}
|
|
37
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Assunção de ambientes seguros por defeito", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-015"}
|
|
38
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ignorar dependências críticas", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-016"}
|
|
39
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco residual nunca revisto", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-017"}
|
|
40
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de eventos de reavaliação planeados", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-018"}
|
|
41
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reclassificação dependente de exceções", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-019"}
|
|
42
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões de risco sem feedback do negócio", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-020"}
|
|
43
|
+
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-009`", "0.70", "alias_match, bundle_grounding, risk_match"]}
|
|
44
|
+
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "01-classificacao-aplicacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`aceitacao-de-risco-invalida`", "`MT-020`", "0.76", "alias_match, bundle_grounding, how_it_arises_match"]}
|
|
45
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-021", "manual_v2_entity_label": "Ausência de requisitos de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
46
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-022", "manual_v2_entity_label": "Definição ambígua ou não testável", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
47
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-023", "manual_v2_entity_label": "Requisitos genéricos não específicos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
48
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-024", "manual_v2_entity_label": "Falta de requisitos em sistemas legados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
49
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-025", "manual_v2_entity_label": "Requisitos não alinhados com risco", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
50
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-026", "manual_v2_entity_label": "Requisitos definidos mas nunca verificados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
51
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-027", "manual_v2_entity_label": "Validações inconsistentes entre projetos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
52
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-028", "manual_v2_entity_label": "Ausência de rastreio entre requisito e teste", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
53
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-029", "manual_v2_entity_label": "Requisitos não verificados em CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
54
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-030", "manual_v2_entity_label": "Risco aceite sem validação documental", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
55
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-031", "manual_v2_entity_label": "Exceções a requisitos não documentadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
56
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-032", "manual_v2_entity_label": "Segurança omitida por “não ser funcional”", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
57
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-033", "manual_v2_entity_label": "Aceitação de exceções sem aprovação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
58
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-034", "manual_v2_entity_label": "Exceções não reverificadas no tempo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
59
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-035", "manual_v2_entity_label": "Não saber se requisitos foram aplicados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
60
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-036", "manual_v2_entity_label": "Requisitos aplicados mas não testados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
61
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-037", "manual_v2_entity_label": "Mudanças de requisitos não propagadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
62
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-038", "manual_v2_entity_label": "Ambiguidade entre requisito e controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
63
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de requisitos de segurança", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-021"}
|
|
64
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Definição ambígua ou não testável", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-022"}
|
|
65
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos genéricos não específicos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-023"}
|
|
66
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de requisitos em sistemas legados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-024"}
|
|
67
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não alinhados com risco", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-025"}
|
|
68
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos mas nunca verificados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-026"}
|
|
69
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações inconsistentes entre projetos", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-027"}
|
|
70
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreio entre requisito e teste", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-028"}
|
|
71
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos não verificados em CI/CD", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-029"}
|
|
72
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco aceite sem validação documental", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-030"}
|
|
73
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções a requisitos não documentadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-031"}
|
|
74
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança omitida por “não ser funcional”", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-032"}
|
|
75
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aceitação de exceções sem aprovação", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-033"}
|
|
76
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não reverificadas no tempo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-034"}
|
|
77
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não saber se requisitos foram aplicados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-035"}
|
|
78
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos aplicados mas não testados", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-036"}
|
|
79
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças de requisitos não propagadas", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-037"}
|
|
80
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade entre requisito e controlo", "iter_introduced": "run-2", "manual_chapter": "02-requisitos-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-038"}
|
|
81
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-039", "manual_v2_entity_label": "Ameaças desconhecidas e não tratadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
82
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-040", "manual_v2_entity_label": "Prioridades de segurança mal definidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
83
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-041", "manual_v2_entity_label": "Requisitos definidos sem base em ameaças", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
84
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-042", "manual_v2_entity_label": "Ameaças a privacidade ignoradas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
85
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-043", "manual_v2_entity_label": "Falta de cobertura de ameaças não técnicas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
86
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-044", "manual_v2_entity_label": "Arquitetura insegura não identificada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
87
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-045", "manual_v2_entity_label": "Validação superficial em design reviews", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
88
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-046", "manual_v2_entity_label": "Controles aplicados sem base em arquitetura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
89
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-047", "manual_v2_entity_label": "Ausência de revisão em interfaces críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
90
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-048", "manual_v2_entity_label": "Ameaças descobertas demasiado tarde", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
91
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-049", "manual_v2_entity_label": "Mudanças críticas sem nova modelação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
92
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-050", "manual_v2_entity_label": "Descontinuidade entre equipas e fases", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
93
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-051", "manual_v2_entity_label": "Ameaças não visíveis na pipeline CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
94
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-052", "manual_v2_entity_label": "Conhecimento de ameaças não acumulado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
95
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-053", "manual_v2_entity_label": "Inconsistência entre projetos e equipas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
96
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-054", "manual_v2_entity_label": "Ferramentas desconectadas do ciclo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
97
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ausencia-de-ameaca-no-modelo", "manual_v2_entity_label": "Ausência de ameaça no modelo", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
98
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:omissao-estrutural-de-ameacas", "manual_v2_entity_label": "Omissão estrutural de ameaças", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
99
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças desconhecidas e não tratadas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-039"}
|
|
100
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Prioridades de segurança mal definidas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-040"}
|
|
101
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos definidos sem base em ameaças", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-041"}
|
|
102
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças a privacidade ignoradas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "LINDDUN", "threat_id": "MT-042"}
|
|
103
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cobertura de ameaças não técnicas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-043"}
|
|
104
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura insegura não identificada", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-044"}
|
|
105
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação superficial em design reviews", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-045"}
|
|
106
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Controles aplicados sem base em arquitetura", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-046"}
|
|
107
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de revisão em interfaces críticas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-047"}
|
|
108
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças descobertas demasiado tarde", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-048"}
|
|
109
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mudanças críticas sem nova modelação", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-049"}
|
|
110
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Descontinuidade entre equipas e fases", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-050"}
|
|
111
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ameaças não visíveis na pipeline CI/CD", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-051"}
|
|
112
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conhecimento de ameaças não acumulado", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-052"}
|
|
113
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre projetos e equipas", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-053"}
|
|
114
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas desconectadas do ciclo", "iter_introduced": "run-2", "manual_chapter": "03-threat-modeling", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-054"}
|
|
115
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-055", "manual_v2_entity_label": "Interfaces expostas sem isolamento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
116
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-056", "manual_v2_entity_label": "Mistura de dados e controlo na mesma zona", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
117
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-057", "manual_v2_entity_label": "Acesso lateral não controlado entre módulos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
118
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-058", "manual_v2_entity_label": "Ausência de isolamento entre utilizadores", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
119
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-059", "manual_v2_entity_label": "Arquitetura inexistente ou desatualizada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
120
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-060", "manual_v2_entity_label": "Confusão sobre localização de controlos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
121
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-061", "manual_v2_entity_label": "Ambiguidade sobre fronteiras e zonas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
122
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-062", "manual_v2_entity_label": "Arquitetura não revê mecanismos de fallback", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
123
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-063", "manual_v2_entity_label": "Arquitetura nunca revista", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
124
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-064", "manual_v2_entity_label": "Alterações estruturais sem revalidação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
125
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-065", "manual_v2_entity_label": "Design informal ou ad hoc", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
126
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-066", "manual_v2_entity_label": "Exceções de arquitetura sem rasto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
127
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-067", "manual_v2_entity_label": "Requisitos de arquitetura não definidos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
128
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-068", "manual_v2_entity_label": "Impossibilidade de mapear decisões a controlos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
129
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-069", "manual_v2_entity_label": "Diagrama não reflete controlos implementados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
130
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-070", "manual_v2_entity_label": "Aplicações L1 tratadas como críticas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
131
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-071", "manual_v2_entity_label": "Sobredimensionamento de segurança da arquitetura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
132
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-072", "manual_v2_entity_label": "Ambientes de execução não refletidos no design", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
133
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:dependencia-circular", "manual_v2_entity_label": "dependência circular", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
134
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:excecoes-nao-documentadas", "manual_v2_entity_label": "Exceções não documentadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
135
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:modelos-inconsistentes-incompletos-ou-desatualizados", "manual_v2_entity_label": "Modelos inconsistentes, incompletos ou desatualizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
136
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:threat-modeling-sem-arquitetura-clara", "manual_v2_entity_label": "Threat modeling sem arquitetura clara", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
137
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Interfaces expostas sem isolamento", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-055"}
|
|
138
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mistura de dados e controlo na mesma zona", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-056"}
|
|
139
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso lateral não controlado entre módulos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-057"}
|
|
140
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de isolamento entre utilizadores", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-058"}
|
|
141
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura inexistente ou desatualizada", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-059"}
|
|
142
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão sobre localização de controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-060"}
|
|
143
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambiguidade sobre fronteiras e zonas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-061"}
|
|
144
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura não revê mecanismos de fallback", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-062"}
|
|
145
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Arquitetura nunca revista", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-063"}
|
|
146
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações estruturais sem revalidação", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-064"}
|
|
147
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Design informal ou ad hoc", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-065"}
|
|
148
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções de arquitetura sem rasto", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-066"}
|
|
149
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Requisitos de arquitetura não definidos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-067"}
|
|
150
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de mapear decisões a controlos", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-068"}
|
|
151
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Diagrama não reflete controlos implementados", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-069"}
|
|
152
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicações L1 tratadas como críticas", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-070"}
|
|
153
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Sobredimensionamento de segurança da arquitetura", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-071"}
|
|
154
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes de execução não refletidos no design", "iter_introduced": "run-2", "manual_chapter": "04-arquitetura-segura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-072"}
|
|
155
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-073", "manual_v2_entity_label": "Inclusão de bibliotecas com CVEs ativos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
156
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-074", "manual_v2_entity_label": "Dependências desatualizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
157
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-075", "manual_v2_entity_label": "Ausência de registo de versões", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
158
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-076", "manual_v2_entity_label": "Inclusão de bibliotecas não auditadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
159
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-077", "manual_v2_entity_label": "Desconhecimento de bibliotecas utilizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
160
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-078", "manual_v2_entity_label": "Falta de associação entre vulnerabilidade e artefacto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
161
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-079", "manual_v2_entity_label": "Falta de histórico de introdução de pacotes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
162
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-080", "manual_v2_entity_label": "Inclusão de pacotes de repositórios maliciosos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
163
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-081", "manual_v2_entity_label": "Dependência transitiva com componente inseguro", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
164
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-082", "manual_v2_entity_label": "Pipeline injeta versão não autenticada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
165
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-083", "manual_v2_entity_label": "CVEs ignoradas sem justificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
166
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-084", "manual_v2_entity_label": "Mitigações aplicadas sem rastreio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
167
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-085", "manual_v2_entity_label": "Falta de ciclo de revisão de exceções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
168
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-086", "manual_v2_entity_label": "Uso arbitrário de bibliotecas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
169
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-087", "manual_v2_entity_label": "Bibliotecas proibidas são usadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
170
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-088", "manual_v2_entity_label": "Falta de política de substituição", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
171
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-089", "manual_v2_entity_label": "Introdução de dependência vulnerável não declarada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
172
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-090", "manual_v2_entity_label": "Confusão de dependências", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
173
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-091", "manual_v2_entity_label": "Backdoor via ferramenta de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
174
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-092", "manual_v2_entity_label": "Drift de composição entre builds", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
175
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas com CVEs ativos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-073"}
|
|
176
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependências desatualizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-074"}
|
|
177
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de registo de versões", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-075"}
|
|
178
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas não auditadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-076"}
|
|
179
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desconhecimento de bibliotecas utilizadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-077"}
|
|
180
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de associação entre vulnerabilidade e artefacto", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-078"}
|
|
181
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de histórico de introdução de pacotes", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-079"}
|
|
182
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de pacotes de repositórios maliciosos", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-080"}
|
|
183
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dependência transitiva com componente inseguro", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-081"}
|
|
184
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Pipeline injeta versão não autenticada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-082"}
|
|
185
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "CVEs ignoradas sem justificação", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-083"}
|
|
186
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Mitigações aplicadas sem rastreio", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-084"}
|
|
187
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ciclo de revisão de exceções", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-085"}
|
|
188
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso arbitrário de bibliotecas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-086"}
|
|
189
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bibliotecas proibidas são usadas", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-087"}
|
|
190
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de política de substituição", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-088"}
|
|
191
|
+
{"associated_controls": "SBOM boundary, revisão de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Introdução de dependência vulnerável não declarada", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-089"}
|
|
192
|
+
{"associated_controls": "SCA, validação de origem", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Confusão de dependências", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-090"}
|
|
193
|
+
{"associated_controls": "Governance de tooling", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Backdoor via ferramenta de build", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-091"}
|
|
194
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Drift de composição entre builds", "iter_introduced": "run-2", "manual_chapter": "05-dependencias-sbom-sca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-092"}
|
|
195
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-093", "manual_v2_entity_label": "Inclusão de padrões inseguros por hábito", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
196
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-094", "manual_v2_entity_label": "Uso de funções descontinuadas ou perigosas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
197
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-095", "manual_v2_entity_label": "Injeção de código sem escape adequado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
198
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-096", "manual_v2_entity_label": "Código inseguro sem deteção", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
199
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-097", "manual_v2_entity_label": "Ausência de rastreabilidade entre problemas e decisões", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
200
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-098", "manual_v2_entity_label": "Validação apenas reativa (ex: testes QA)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
201
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-099", "manual_v2_entity_label": "Segurança removida por “incompatibilidade”", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
202
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-100", "manual_v2_entity_label": "Exceções não revistas ou revalidadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
203
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-101", "manual_v2_entity_label": "Desvios não rastreados entre guideline e prática", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
204
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-102", "manual_v2_entity_label": "Geração de código inseguro via IA", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
205
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-103", "manual_v2_entity_label": "Inclusão de vulnerabilidades conhecidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
206
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-104", "manual_v2_entity_label": "Falta de accountability sobre código gerado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
207
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-105", "manual_v2_entity_label": "Inclusão de bibliotecas descontinuadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
208
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-106", "manual_v2_entity_label": "Falta de justificação para uso de dependência insegura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
209
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-107", "manual_v2_entity_label": "Componente vulnerável mantido no build final", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
210
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-108", "manual_v2_entity_label": "Inconsistência entre equipas e projetos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
211
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-109", "manual_v2_entity_label": "Inexistência de baseline de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
212
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-110", "manual_v2_entity_label": "Fraca responsabilização pela segurança do código", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
213
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de padrões inseguros por hábito", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-093"}
|
|
214
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de funções descontinuadas ou perigosas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-094"}
|
|
215
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de código sem escape adequado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-095"}
|
|
216
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código inseguro sem deteção", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-096"}
|
|
217
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de rastreabilidade entre problemas e decisões", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-097"}
|
|
218
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validação apenas reativa (ex: testes QA)", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-098"}
|
|
219
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança removida por “incompatibilidade”", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-099"}
|
|
220
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exceções não revistas ou revalidadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-100"}
|
|
221
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desvios não rastreados entre guideline e prática", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-101"}
|
|
222
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Geração de código inseguro via IA", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-102"}
|
|
223
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de vulnerabilidades conhecidas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-103"}
|
|
224
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de accountability sobre código gerado", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-104"}
|
|
225
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de bibliotecas descontinuadas", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-105"}
|
|
226
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de justificação para uso de dependência insegura", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-106"}
|
|
227
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Componente vulnerável mantido no build final", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-107"}
|
|
228
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inconsistência entre equipas e projetos", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-108"}
|
|
229
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inexistência de baseline de segurança", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-109"}
|
|
230
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Fraca responsabilização pela segurança do código", "iter_introduced": "run-2", "manual_chapter": "06-desenvolvimento-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-110"}
|
|
231
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-111", "manual_v2_entity_label": "Execução de código não autorizado em pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
232
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-112", "manual_v2_entity_label": "Comprometimento do ambiente de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
233
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-113", "manual_v2_entity_label": "Elevação de privilégios no pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
234
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-114", "manual_v2_entity_label": "Push não autorizado para branches protegidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
235
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-115", "manual_v2_entity_label": "Execução de código não auditado", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
236
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-116", "manual_v2_entity_label": "Substituição silenciosa de código legítimo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
237
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-117", "manual_v2_entity_label": "Build forjado fora da pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
238
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-118", "manual_v2_entity_label": "Injeção de lógica dinâmica em pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
239
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-119", "manual_v2_entity_label": "Uso de componentes externos inseguros", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
240
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-120", "manual_v2_entity_label": "Vazamento de segredos via logs", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
241
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-121", "manual_v2_entity_label": "Segredos hardcoded", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
242
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-122", "manual_v2_entity_label": "Reutilização de segredos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
243
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-123", "manual_v2_entity_label": "Ausência de gates de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
244
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-124", "manual_v2_entity_label": "Validações não executadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
245
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-125", "manual_v2_entity_label": "Falta de rastreabilidade", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
246
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-126", "manual_v2_entity_label": "Bypass de controlos sem rasto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
247
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-127", "manual_v2_entity_label": "Alterações críticas sem visibilidade", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
248
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-128", "manual_v2_entity_label": "Promoções sem responsável humano", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
249
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-129", "manual_v2_entity_label": "Evidência plausível sem execução", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
250
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-130", "manual_v2_entity_label": "Não-determinismo do pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
251
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-131", "manual_v2_entity_label": "Exfiltração de contexto sensível", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
252
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:exposicao-excessiva-de-contexto-em-logs-e-artefactos", "manual_v2_entity_label": "exposição excessiva de contexto em logs e artefactos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
253
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:uso-de-segredos-estaticos", "manual_v2_entity_label": "uso de segredos estáticos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
254
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:sinal-automatico", "manual_v2_entity_label": "sinal automático", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
255
|
+
{"associated_controls": "Design seguro de pipelines; isolamento de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não autorizado em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-111"}
|
|
256
|
+
{"associated_controls": "Isolamento e efemeridade de runners", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Comprometimento do ambiente de build", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-112"}
|
|
257
|
+
{"associated_controls": "Hardening de pipelines", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Elevação de privilégios no pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-113"}
|
|
258
|
+
{"associated_controls": "Gestão segura de código-fonte", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Push não autorizado para branches protegidas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-114"}
|
|
259
|
+
{"associated_controls": "Políticas de execução", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de código não auditado", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-115"}
|
|
260
|
+
{"associated_controls": "Rastreabilidade e assinaturas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição silenciosa de código legítimo", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-116"}
|
|
261
|
+
{"associated_controls": "Integridade e proveniência", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Build forjado fora da pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-117"}
|
|
262
|
+
{"associated_controls": "Segurança do código de pipeline", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeção de lógica dinâmica em pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-118"}
|
|
263
|
+
{"associated_controls": "Controlo de dependências", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de componentes externos inseguros", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-119"}
|
|
264
|
+
{"associated_controls": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Vazamento de segredos via logs", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-120"}
|
|
265
|
+
{"associated_controls": "Gestão de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-121"}
|
|
266
|
+
{"associated_controls": "Lifecycle de segredos", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de segredos", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-122"}
|
|
267
|
+
{"associated_controls": "Políticas de gates", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de gates de segurança", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-123"}
|
|
268
|
+
{"associated_controls": "Validações integradas", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não executadas", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-124"}
|
|
269
|
+
{"associated_controls": "Rastreabilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-125"}
|
|
270
|
+
{"associated_controls": "Gestão de exceções", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Bypass de controlos sem rasto", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-126"}
|
|
271
|
+
{"associated_controls": "Governação contínua", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações críticas sem visibilidade", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-127"}
|
|
272
|
+
{"associated_controls": "Gates e governação", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoções sem responsável humano", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-128"}
|
|
273
|
+
{"associated_controls": "Evidência empírica", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Evidência plausível sem execução", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-129"}
|
|
274
|
+
{"associated_controls": "Reprodutibilidade", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Não-determinismo do pipeline", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-130"}
|
|
275
|
+
{"associated_controls": "Controlo de integrações", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exfiltração de contexto sensível", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-131"}
|
|
276
|
+
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "07-cicd-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`uso-de-segredos-estaticos`", "`MT-121`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
|
|
277
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-132", "manual_v2_entity_label": "Defaults inseguros ou permissivos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
278
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-133", "manual_v2_entity_label": "Configurações sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
279
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-134", "manual_v2_entity_label": "Campos críticos deixados em branco ou default", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
280
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-135", "manual_v2_entity_label": "Ambientes inconsistentes entre execuções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
281
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-136", "manual_v2_entity_label": "Uso de módulos inseguros ou sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
282
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-137", "manual_v2_entity_label": "Hardcoded de parâmetros críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
283
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-138", "manual_v2_entity_label": "Ambientes inseguros provisionados por erro", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
284
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-139", "manual_v2_entity_label": "Provisionamento com permissões excessivas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
285
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-140", "manual_v2_entity_label": "Falta de tags de classificação de dados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
286
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-141", "manual_v2_entity_label": "Uso de dados reais em ambientes de teste", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
287
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-142", "manual_v2_entity_label": "Segredos hardcoded ou mal geridos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
288
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-143", "manual_v2_entity_label": "Alterações aplicadas sem revisão", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
289
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-144", "manual_v2_entity_label": "Falta de owner e accountability", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
290
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-145", "manual_v2_entity_label": "Reutilização de módulos sem tracking", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
291
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-146", "manual_v2_entity_label": "Aplicação de alterações inseguras por bypass", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
292
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-147", "manual_v2_entity_label": "Justificações informais ou inexistentes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
293
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-148", "manual_v2_entity_label": "Ambientes provisionados com exceções acumuladas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
294
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ambientes-mal-segregados", "manual_v2_entity_label": "Ambientes mal segregados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
295
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:confianca-na-experiencia-individual-sem-automacao", "manual_v2_entity_label": "Confiança na experiência individual sem automação", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
296
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:erros-de-configuracao", "manual_v2_entity_label": "Erros de configuração", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
297
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:ignorar-momentos-criticos-no-ciclo-de-vida-do-iac", "manual_v2_entity_label": "Ignorar momentos críticos no ciclo de vida do IaC", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
298
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:permissoes-excessivas", "manual_v2_entity_label": "Permissões excessivas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
299
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:uso-de-modulos-maliciosos", "manual_v2_entity_label": "Uso de módulos maliciosos", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
300
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:catalogo-de-modulos-certificados", "manual_v2_entity_label": "Catálogo de módulos certificados", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
301
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:dashboards-de-validacao", "manual_v2_entity_label": "Dashboards de validação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
302
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:gestao-centralizada-de-excecoes", "manual_v2_entity_label": "Gestão centralizada de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
303
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:pipelines-ci-cd-obrigatorios", "manual_v2_entity_label": "Pipelines CI/CD obrigatórios", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
304
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:uso-de-ferramentas-de-scanning", "manual_v2_entity_label": "Uso de ferramentas de scanning", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
305
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Defaults inseguros ou permissivos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-132"}
|
|
306
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-133"}
|
|
307
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Campos críticos deixados em branco ou default", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-134"}
|
|
308
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inconsistentes entre execuções", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-135"}
|
|
309
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de módulos inseguros ou sem validação", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-136"}
|
|
310
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Hardcoded de parâmetros críticos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-137"}
|
|
311
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes inseguros provisionados por erro", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-138"}
|
|
312
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Provisionamento com permissões excessivas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-139"}
|
|
313
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de tags de classificação de dados", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-140"}
|
|
314
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de dados reais em ambientes de teste", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-141"}
|
|
315
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos hardcoded ou mal geridos", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-142"}
|
|
316
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alterações aplicadas sem revisão", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-143"}
|
|
317
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de owner e accountability", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-144"}
|
|
318
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização de módulos sem tracking", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-145"}
|
|
319
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Aplicação de alterações inseguras por bypass", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-146"}
|
|
320
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Justificações informais ou inexistentes", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-147"}
|
|
321
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ambientes provisionados com exceções acumuladas", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-148"}
|
|
322
|
+
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "08-iac-infraestrutura", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`permissoes-excessivas`", "`MT-139`", "0.76", "alias_match, bundle_grounding, threat_label_match"]}
|
|
323
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-149", "manual_v2_entity_label": "Imagens base vulneráveis/obsoletas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
324
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-150", "manual_v2_entity_label": "Inclusão de dependências inseguras no build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
325
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-151", "manual_v2_entity_label": "Conteúdo inesperado no _context_ de build", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
326
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-152", "manual_v2_entity_label": "Configurações inseguras no Dockerfile", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
327
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-153", "manual_v2_entity_label": "Imagens não assinadas / sem verificação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
328
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-154", "manual_v2_entity_label": "Substituição maliciosa em registo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
329
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-155", "manual_v2_entity_label": "Falta de trilho de auditoria (quem construiu o quê)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
330
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-156", "manual_v2_entity_label": "Execução como root / capabilities excessivas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
331
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-157", "manual_v2_entity_label": "Montagens e volumes inseguros", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
332
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-158", "manual_v2_entity_label": "Falta de políticas de rede", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
333
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-159", "manual_v2_entity_label": "_Admission_ permissivo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
334
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-160", "manual_v2_entity_label": "Segredos embebidos em imagem", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
335
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-161", "manual_v2_entity_label": "Exposição em variáveis de ambiente", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
336
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-162", "manual_v2_entity_label": "Manifestos inseguros aprovados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
337
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-163", "manual_v2_entity_label": "Desalinhamento imagem↔manifesto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
338
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-164", "manual_v2_entity_label": "Falta de rastreabilidade de deploys", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
339
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-165", "manual_v2_entity_label": "_Shadow containers_ fora do pipeline", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
340
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-166", "manual_v2_entity_label": "_Drift_ de configuração", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
341
|
+
{"associated_controls": "*Checklist 3–4*, *Policies: Gestão de Vulnerabilidades*, *Rastreabilidade: SSDF RV.1*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens base vulneráveis/obsoletas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-149"}
|
|
342
|
+
{"associated_controls": "*Checklist 3–4*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de dependências inseguras no build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-150"}
|
|
343
|
+
{"associated_controls": "*Policies: Construção Segura de Imagens*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdo inesperado no _context_ de build", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-151"}
|
|
344
|
+
{"associated_controls": "*Checklist 6*, *Policies: Construção Segura*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configurações inseguras no Dockerfile", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-152"}
|
|
345
|
+
{"associated_controls": "*Checklist 5 & 10–11*, *Policies: Assinatura e Proveniência*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Imagens não assinadas / sem verificação", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-153"}
|
|
346
|
+
{"associated_controls": "*Policies: Repositórios*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Substituição maliciosa em registo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-154"}
|
|
347
|
+
{"associated_controls": "*Checklist 14–15*, *Rastreabilidade: DSOMM Ops*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de trilho de auditoria (quem construiu o quê)", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-155"}
|
|
348
|
+
{"associated_controls": "*Checklist 7–9*, *Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução como root / capabilities excessivas", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-156"}
|
|
349
|
+
{"associated_controls": "*Policies: Hardening de Runtime*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Montagens e volumes inseguros", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-157"}
|
|
350
|
+
{"associated_controls": "*Policies: Runtime*, *Checklist 8*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de políticas de rede", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-158"}
|
|
351
|
+
{"associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Admission_ permissivo", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-159"}
|
|
352
|
+
{"associated_controls": "*Policies: Segredos*, *Checklist 3 & 5*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segredos embebidos em imagem", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-160"}
|
|
353
|
+
{"associated_controls": "*Policies: Segredos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Exposição em variáveis de ambiente", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-161"}
|
|
354
|
+
{"associated_controls": "*Checklist 11*, *Policies: Validação de Manifestos*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Manifestos inseguros aprovados", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-162"}
|
|
355
|
+
{"associated_controls": "*Rastreabilidade: SLSA*, *Checklist 2 & 10–11*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Desalinhamento imagem↔manifesto", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-163"}
|
|
356
|
+
{"associated_controls": "*Checklist 14–15*, *DSOMM Ops Monitoring*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de deploys", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-164"}
|
|
357
|
+
{"associated_controls": "*Rastreabilidade: DSOMM*", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Shadow containers_ fora do pipeline", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-165"}
|
|
358
|
+
{"associated_controls": "*Policies: Runtime*, Cap. 08 (IaC)", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "_Drift_ de configuração", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-166"}
|
|
359
|
+
{"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "09-containers-imagens", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-1104`", "`?`", "supporting reference; primary anchor é Manual threat"]}
|
|
360
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-167", "manual_v2_entity_label": "Injeções (SQLi, OS Command, etc.)", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
361
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-168", "manual_v2_entity_label": "Falhas de controlo de acesso", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
362
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-169", "manual_v2_entity_label": "Lógicas de negócio exploráveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
363
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-170", "manual_v2_entity_label": "Regressão de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
364
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-171", "manual_v2_entity_label": "Baixa cobertura dos testes", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
365
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-172", "manual_v2_entity_label": "Falhas conhecidas não testadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
366
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-173", "manual_v2_entity_label": "Falhas detetadas mas não resolvidas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
367
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-174", "manual_v2_entity_label": "Equipa sem feedback técnico", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
368
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-175", "manual_v2_entity_label": "Validações não repetíveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
369
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-176", "manual_v2_entity_label": "Testes manuais não escaláveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
370
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-177", "manual_v2_entity_label": "Falta de testes antes de go-live", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
371
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-178", "manual_v2_entity_label": "Decisão de qualidade feita sem base", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
372
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-179", "manual_v2_entity_label": "Classes novas não detetadas por SAST/DAST", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
373
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-180", "manual_v2_entity_label": "Testes superficiais sem contexto técnico", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
374
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-181", "manual_v2_entity_label": "Ferramentas não calibradas por contexto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
375
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Injeções (SQLi, OS Command, etc.)", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-167"}
|
|
376
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas de controlo de acesso", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-168"}
|
|
377
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Lógicas de negócio exploráveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-169"}
|
|
378
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão de segurança", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-170"}
|
|
379
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Baixa cobertura dos testes", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-171"}
|
|
380
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas conhecidas não testadas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-172"}
|
|
381
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas detetadas mas não resolvidas", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-173"}
|
|
382
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipa sem feedback técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-174"}
|
|
383
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Validações não repetíveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-175"}
|
|
384
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes manuais não escaláveis", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-176"}
|
|
385
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de testes antes de go-live", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-177"}
|
|
386
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisão de qualidade feita sem base", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-178"}
|
|
387
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Classes novas não detetadas por SAST/DAST", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-179"}
|
|
388
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Testes superficiais sem contexto técnico", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-180"}
|
|
389
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ferramentas não calibradas por contexto", "iter_introduced": "run-2", "manual_chapter": "10-testes-seguranca", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-181"}
|
|
390
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-182", "manual_v2_entity_label": "Código em produção sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
391
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-183", "manual_v2_entity_label": "Ativação funcional sem controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
392
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-184", "manual_v2_entity_label": "Promoção manual fora do CI/CD", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
393
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-185", "manual_v2_entity_label": "Deploy falhado sem rollback", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
394
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-186", "manual_v2_entity_label": "Feature irreversível", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
395
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-187", "manual_v2_entity_label": "Falha sem reação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
396
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-188", "manual_v2_entity_label": "Release conjunta sem segmentação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
397
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-189", "manual_v2_entity_label": "Feature exposta a todos os utilizadores", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
398
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-190", "manual_v2_entity_label": "Falta de validação operacional", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
399
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-191", "manual_v2_entity_label": "Falhas pós-deploy não detetadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
400
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-192", "manual_v2_entity_label": "Reação tardia a problemas críticos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
401
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-193", "manual_v2_entity_label": "Eventos críticos ignorados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
402
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-194", "manual_v2_entity_label": "Toggle ativado inadvertidamente", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
403
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-195", "manual_v2_entity_label": "Release sem segmentação geográfica ou lógica", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
404
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-196", "manual_v2_entity_label": "Execução de função crítica não validada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
405
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Código em produção sem validação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-182"}
|
|
406
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ativação funcional sem controlo", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-183"}
|
|
407
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Promoção manual fora do CI/CD", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-184"}
|
|
408
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Deploy falhado sem rollback", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-185"}
|
|
409
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature irreversível", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-186"}
|
|
410
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falha sem reação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-187"}
|
|
411
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release conjunta sem segmentação", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-188"}
|
|
412
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Feature exposta a todos os utilizadores", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-189"}
|
|
413
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de validação operacional", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-190"}
|
|
414
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falhas pós-deploy não detetadas", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-191"}
|
|
415
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação tardia a problemas críticos", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-192"}
|
|
416
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos ignorados", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-193"}
|
|
417
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Toggle ativado inadvertidamente", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-194"}
|
|
418
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Release sem segmentação geográfica ou lógica", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-195"}
|
|
419
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Execução de função crítica não validada", "iter_introduced": "run-2", "manual_chapter": "11-deploy-seguro", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-196"}
|
|
420
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-197", "manual_v2_entity_label": "Eventos críticos não registados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
421
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-198", "manual_v2_entity_label": "Logs voláteis ou truncados", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
422
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-199", "manual_v2_entity_label": "Falta de rastreabilidade de execução", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
423
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-200", "manual_v2_entity_label": "Incidentes sem alerta", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
424
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-201", "manual_v2_entity_label": "Alertas ignorados por ruído", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
425
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-202", "manual_v2_entity_label": "Falta de correlação de alertas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
426
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-203", "manual_v2_entity_label": "Incidentes sem owner definido", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
427
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-204", "manual_v2_entity_label": "Reação ad-hoc ou tardia", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
428
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-205", "manual_v2_entity_label": "Eventos sem acionamento de ação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
429
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-206", "manual_v2_entity_label": "Ausência de métricas de postura", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
430
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-207", "manual_v2_entity_label": "Impossibilidade de priorizar riscos", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
431
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-208", "manual_v2_entity_label": "Dados sem granularidade ou visão", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
432
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-209", "manual_v2_entity_label": "Novos sistemas sem monitorização", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
433
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-210", "manual_v2_entity_label": "Equipas ignoram alertas operacionais", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
434
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-211", "manual_v2_entity_label": "Dados não usados para melhoria contínua", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
435
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:alertas-nao-acionaveis", "manual_v2_entity_label": "Alertas não acionáveis", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
436
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:demasiados-alertas", "manual_v2_entity_label": "Demasiados alertas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
437
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:detecao-sem-resposta", "manual_v2_entity_label": "Deteção sem resposta", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
438
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:falta-de-integracao-com-irp", "manual_v2_entity_label": "Falta de integração com IRP", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
439
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:logs-incompletos-ou-ignorados", "manual_v2_entity_label": "Logs incompletos ou ignorados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
440
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:logs-nao-estruturados", "manual_v2_entity_label": "Logs não estruturados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
441
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:retencao-insuficiente", "manual_v2_entity_label": "Retenção insuficiente", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
442
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:falhas-de-login", "manual_v2_entity_label": "Falhas de login", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
443
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:logs", "manual_v2_entity_label": "Logs", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
444
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:metricas-mttd-mttr", "manual_v2_entity_label": "Métricas MTTD/MTTR", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
445
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos críticos não registados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-197"}
|
|
446
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Logs voláteis ou truncados", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-198"}
|
|
447
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de rastreabilidade de execução", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-199"}
|
|
448
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem alerta", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-200"}
|
|
449
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Alertas ignorados por ruído", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-201"}
|
|
450
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de correlação de alertas", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-202"}
|
|
451
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Incidentes sem owner definido", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-203"}
|
|
452
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reação ad-hoc ou tardia", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-204"}
|
|
453
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Eventos sem acionamento de ação", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-205"}
|
|
454
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Ausência de métricas de postura", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-206"}
|
|
455
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Impossibilidade de priorizar riscos", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-207"}
|
|
456
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados sem granularidade ou visão", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-208"}
|
|
457
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Novos sistemas sem monitorização", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-209"}
|
|
458
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Equipas ignoram alertas operacionais", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-210"}
|
|
459
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Dados não usados para melhoria contínua", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-211"}
|
|
460
|
+
{"coverage_status": "antipattern_substantive", "iter_introduced": "run-2", "manual_chapter": "12-monitorizacao-operacoes", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "antipattern_exposure", "row_cells": ["`alertas-nao-acionaveis`", "`MT-200`", "0.70", "alias_match, bundle_grounding, risk_match"]}
|
|
461
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-212", "manual_v2_entity_label": "Configuração insegura por desconhecimento", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
462
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-213", "manual_v2_entity_label": "Reutilização indevida de segredos ou tokens", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
463
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-214", "manual_v2_entity_label": "Acesso técnico concedido sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
464
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-215", "manual_v2_entity_label": "Inclusão de terceiros sem validação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
465
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-216", "manual_v2_entity_label": "Falta de ownership sobre segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
466
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-217", "manual_v2_entity_label": "Regressão comportamental / cultura frágil", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
467
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-218", "manual_v2_entity_label": "Formação não rastreável", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
468
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-219", "manual_v2_entity_label": "Formação desigual entre equipas ou funções", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
469
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-220", "manual_v2_entity_label": "Formação teórica sem impacto prático", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
470
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-221", "manual_v2_entity_label": "Conteúdos desatualizados ou não aplicáveis", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
471
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:dependencia-exclusiva-de-ferramentas-automatizadas", "manual_v2_entity_label": "dependência exclusiva de ferramentas automatizadas", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
472
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:falta-de-onboarding", "manual_v2_entity_label": "Falta de Onboarding", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
473
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:checklist-completo", "manual_v2_entity_label": "Checklist Completo", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
474
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-eficacia-formativa", "manual_v2_entity_label": "KPIs de eficácia formativa", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
475
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-formacao", "manual_v2_entity_label": "KPIs de Formação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
476
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:resultados-de-quiz", "manual_v2_entity_label": "Resultados de Quizzes", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
477
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Configuração insegura por desconhecimento", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-212"}
|
|
478
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Reutilização indevida de segredos ou tokens", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-213"}
|
|
479
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Acesso técnico concedido sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-214"}
|
|
480
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Inclusão de terceiros sem validação", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-215"}
|
|
481
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de ownership sobre segurança", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-216"}
|
|
482
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Regressão comportamental / cultura frágil", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-217"}
|
|
483
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação não rastreável", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-218"}
|
|
484
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação desigual entre equipas ou funções", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-219"}
|
|
485
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Formação teórica sem impacto prático", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-220"}
|
|
486
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Conteúdos desatualizados ou não aplicáveis", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-221"}
|
|
487
|
+
{"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-693`", "`?`", "supporting reference; primary anchor é Manual threat"]}
|
|
488
|
+
{"coverage_status": "cwe_supporting", "iter_introduced": "run-2", "manual_chapter": "13-formacao-onboarding", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "rastreabilidade_role": "cwe_supporting", "row_cells": ["`CWE-798`", "`?`", "supporting reference; primary anchor é Manual threat"]}
|
|
489
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-222", "manual_v2_entity_label": "Adoção de fornecedor sem avaliação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
490
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-223", "manual_v2_entity_label": "Falta de cláusulas contratuais", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
491
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-224", "manual_v2_entity_label": "Uso de serviços sem rastreio", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
492
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-225", "manual_v2_entity_label": "Iniciativas paralelas sem coordenação", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
493
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-226", "manual_v2_entity_label": "Falta de continuidade organizacional", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
494
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-227", "manual_v2_entity_label": "Risco de decisões legadas sem controlo", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
495
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-228", "manual_v2_entity_label": "Decisões não revistas com mudança de contexto", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
496
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-229", "manual_v2_entity_label": "Falta de governança em decisões históricas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
497
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-230", "manual_v2_entity_label": "Falta de conhecimento sobre o estado de segurança", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
498
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-231", "manual_v2_entity_label": "Estratégia de segurança desarticulada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
499
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-232", "manual_v2_entity_label": "Segurança definida mas não aplicada", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
500
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "normative", "manual_v2_entity_id": "MT-233", "manual_v2_entity_label": "Políticas de segurança não institucionalizadas", "manual_v2_entity_type": "Threat", "manual_v2_source_mode": "heuristic", "rastreabilidade_role": "manual_v2_entity"}
|
|
501
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:confianca-exclusiva-em-mecanismos-tecnicos-automatizados", "manual_v2_entity_label": "confiança exclusiva em mecanismos técnicos automatizados", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
502
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:antipattern:limitacao-do-sbd-toe-a-pratica-tecnica-local", "manual_v2_entity_label": "limitação do SbD-ToE à prática técnica local", "manual_v2_entity_type": "AntiPattern", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
503
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:clausulas-contratuais-rastreadas", "manual_v2_entity_label": "Cláusulas contratuais rastreadas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
504
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:excecoes-as-praticas-prescritas", "manual_v2_entity_label": "exceções às práticas prescritas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
505
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:excecoes-registadas-e-aprovadas", "manual_v2_entity_label": "Exceções registadas e aprovadas", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
506
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-consolidados", "manual_v2_entity_label": "KPIs consolidados", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
507
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:kpis-de-governacao", "manual_v2_entity_label": "KPIs de governação", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
508
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:ligacao-explicita-a-frameworks-normativos", "manual_v2_entity_label": "Ligação explícita a frameworks normativos", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
509
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:registo-e-aprovacao-de-excecoes", "manual_v2_entity_label": "registo e aprovação de exceções", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
510
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:reporting-periodico-a-gestao", "manual_v2_entity_label": "reporting periódico à gestão", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
511
|
+
{"coverage_status": "v2_entity_index", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "manual_v2_authority_class": "semantic", "manual_v2_entity_id": "sem:signal:validacao-continua-de-fornecedores", "manual_v2_entity_label": "validação contínua de fornecedores", "manual_v2_entity_type": "Signal", "manual_v2_source_mode": "scored", "rastreabilidade_role": "manual_v2_entity"}
|
|
512
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Adoção de fornecedor sem avaliação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-222"}
|
|
513
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de cláusulas contratuais", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-223"}
|
|
514
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Uso de serviços sem rastreio", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-224"}
|
|
515
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Iniciativas paralelas sem coordenação", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-225"}
|
|
516
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de continuidade organizacional", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-226"}
|
|
517
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Risco de decisões legadas sem controlo", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-227"}
|
|
518
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Decisões não revistas com mudança de contexto", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-228"}
|
|
519
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de governança em decisões históricas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-229"}
|
|
520
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Falta de conhecimento sobre o estado de segurança", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-230"}
|
|
521
|
+
{"associated_controls": "30, 90", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Estratégia de segurança desarticulada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-231"}
|
|
522
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Segurança definida mas não aplicada", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "forte", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-232"}
|
|
523
|
+
{"associated_controls": "", "capec_anchor": "—", "coverage_status": "threat_substantive", "essence": "Políticas de segurança não institucionalizadas", "iter_introduced": "run-2", "manual_chapter": "14-governanca-contratacao", "manual_commit_sha": "8e03454c5137ded5a0a88ac2b91b1c4d6ee8fdac", "manual_file": "canon/50-ameacas-mitigadas.md", "methodology_label": "Explícito", "mitigation_strength": "parcial", "rastreabilidade_role": "threat_mitigation", "threat_category": "STRIDE", "threat_id": "MT-233"}
|