crosswalks: add AVE to MAESTRO pilot (6 records, 3 of 7 layers) - #243
Merged
Conversation
Re-verified a stale premise before building anything: an internal note treated a MAESTRO 'v2' as a blocker. CSA's own framework post carries no version marker, and CloudSecurityAlliance/MAESTRO on GitHub has zero tags/releases despite active recent pushes. MAESTRO evolves continuously, not by discrete release -- the blocker never existed. 6 AVE records mapped to 5 of MAESTRO's named layer/threat combinations, each checked against the framework's own primary-source text (CSA's February 2025 announcement), not category-name resemblance. Two tempting matches were checked and rejected rather than forced -- AVE-2026-00006 (Cryptocurrency Drain) does not fit Layer 4's 'Resource Hijacking' (infrastructure/compute, not wallet theft) and maps to Layer 7's 'Agent Tool Misuse' instead; AVE-2026-00017 (Server Impersonation) is excluded entirely, since MAESTRO's 'Agent Impersonation' is scoped to one agent impersonating another, not a non-agent service impersonating a server. Validated: scripts/validate_crosswalks.py, pytest tests/ -k crosswalk.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Re-verified a stale premise before building anything: an internal note treated a MAESTRO "v2" as a blocker for this crosswalk. CSA's own framework post carries no version marker anywhere, and
CloudSecurityAlliance/MAESTROon GitHub has zero tags and zero releases despite being actively pushed to as recently as 2026-08-27. No search result anywhere mentions a discrete "v2." MAESTRO evolves continuously through community contribution, not by discrete release — the blocker never existed.6 AVE records mapped to 5 of MAESTRO's named layer/threat combinations (7 layers, ~49 combinations total), a deliberate pilot following the same sizing discipline as the OpenCRE and GenAI Crosswalk pilots. Each mapping checked against the framework's own primary-source text directly, not category-name resemblance.
Two tempting matches were checked and rejected rather than forced, documented in the file's own note field:
Validated:
scripts/validate_crosswalks.py(10/10 pass) andpytest tests/ -k crosswalk.