The document discusses using Jira to map an organization's security landscape. It describes how Photobox has created issue types and links in Jira to represent different security program elements. Examples are provided of how issues, projects, risks, roles, assets, services, and people can be linked to build the security framework in Jira.

1. Jira Schemas
Open Security Summit, Working Session
London 21st May 2019
1

2. 2
Objective: To discuss the ways different organisations use Jira schemas to map
the Security landscape.

3. 3
Using Jira
● Jira is normally used as a tool to plan, track, and manage agile and software
development projects.
● Here at Photobox, we use it to map the Security landscape of our organisation.
● We have created a range of Issue types and Issue links to help us build our
Security landscape.

4. 4
Photobox Security Schema

5. 5
A good place to start would be to analyse the different Issue Types
that are used
Issue Types
Your Issue Types
Question
Decision

6. 6
For the next exercises, fill in the missing Issue Links

7. 7
Programme
Business Entity
20th May 2019
deliversdelivered by
Project
Business Entity
(Parent)
Photobox LTD
delivers
Is child of
Is child ofis parent of
is parent of
delivered by
use-case #0 (Example)

8. 8
Programme
Business Entity
20th May 2019
Project
Business Entity
(Parent)
Company
use-case #1

9. 9
Project
Role
Role
(Parent)
CEO
Project
Vuln
Risk
R0
20th May 2019
R3,R2
R1
use-case #2 use-case #3

10. 10
I.T Asset
I.T Asset (parent)
20th May 2019
Has technical owner
Role
Has business owner
I.T Asset
Person
Role
Role
Role
Person
use-case #3 (example)
Is child ofIs parent of
Is managed byIs manager of
Is managed byIs manager of
Assigned to role
Assigned to person
Assigned to person
Assigned to role

11. 11
I.T Asset
I.T Asset (parent)
20th May 2019
Role
I.T Asset
Person
Role
Role
Role
Person
use-case #4

12. 12
GS Role
20th May 2019
deliversDelivered by
GS Service
CEO
GS PersonGS Person
Is assigned to
use-case #5

13. 13
20th May 2019
use-case (blank)