-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathseed.py
More file actions
147 lines (140 loc) · 11.7 KB
/
Copy pathseed.py
File metadata and controls
147 lines (140 loc) · 11.7 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
from models import db, Organization, User, KRIDefinition, KRIScore, AuditLog
from werkzeug.security import generate_password_hash
from datetime import date, datetime
import json
KRI_DATA = [ # Threshold definitions for each KRI (based on Assignment #2 PDF)
{"name": "Traffic Data Retention for more than 1 Year", "weight": 6, "reg_ref": "PECA 2016 Sec32(1); CTDISR-2025", "method": "Quarterly audit via OSS/BSS & DB queries", "thresholds": [{"min": 90, "max": 100, "level": "Low", "score": 10}, {"min": 80, "max": 89, "level": "Medium", "score": 40}, {"min": 70, "max": 79, "level": "High", "score": 70}, {"min": 0, "max": 69, "level": "Critical", "score": 100}]},
{"name": "Expedited Preservation Requests Completed (24h)", "weight": 7, "reg_ref": "PECA 2016 Sec31", "method": "Legal/compliance ticketing system", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 95, "max": 99, "level": "Medium", "score": 40}, {"min": 80, "max": 94, "level": "High", "score": 70}, {"min": 0, "max": 79, "level": "Critical", "score": 100}]},
{"name": "Investigation Cooperation Requests done On Time", "weight": 8, "reg_ref": "PECA 2016 Sec33-35", "method": "Compliance management system", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 95, "max": 99, "level": "Medium", "score": 40}, {"min": 80, "max": 94, "level": "High", "score": 70}, {"min": 0, "max": 79, "level": "Critical", "score": 100}]},
{"name": "Real-Time Data Collection only-on a Court Order", "weight": 5, "reg_ref": "PECA 2016 Sec39", "method": "LI system logs vs court orders", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 95, "max": 99, "level": "Medium", "score": 40}, {"min": 80, "max": 94, "level": "High", "score": 70}, {"min": 0, "max": 79, "level": "Critical", "score": 100}]},
{"name": "Critical Telecommunication Data Stored in Pakistan", "weight": 10, "reg_ref": "CTDISR-2025 Data Localisation", "method": "Data inventory & asset management", "thresholds": [{"min": 99, "max": 100, "level": "Low", "score": 10}, {"min": 95, "max": 98, "level": "Medium", "score": 40}, {"min": 90, "max": 94, "level": "High", "score": 70}, {"min": 0, "max": 89, "level": "Critical", "score": 100}]},
{"name": "Appointment of CISO and Compliance Reporting", "weight": 8, "reg_ref": "CTDISR-2025 & NCSP 2021", "method": "HR & governance system check", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 50, "max": 99, "level": "Medium", "score": 40}, {"min": 0, "max": 49, "level": "Critical", "score": 100}]}, # Partial = 50-99
{"name": "Serious Cyber Incidents Reported Within 24h", "weight": 12, "reg_ref": "CTDISR-2025 & CERT Rules 2023", "method": "SIEM / nTSOC timestamps", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 95, "max": 99, "level": "Medium", "score": 40}, {"min": 80, "max": 94, "level": "High", "score": 70}, {"min": 0, "max": 79, "level": "Critical", "score": 100}]},
{"name": "24/7 SOC Monitoring & nTSOC Compliance Integration", "weight": 8, "reg_ref": "PISF 2025 & CTDISR-2025", "method": "SIEM/SOC dashboard uptime", "thresholds": [{"min": 99.9, "max": 100, "level": "Low", "score": 10}, {"min": 95, "max": 99.8, "level": "Medium", "score": 40}, {"min": 90, "max": 94, "level": "High", "score": 70}, {"min": 0, "max": 89, "level": "Critical", "score": 100}]},
{"name": "Implementation of Zero Trust Security Model", "weight": 7, "reg_ref": "CTDISR-2025 Access Control", "method": "IAM & network access scans", "thresholds": [{"min": 95, "max": 100, "level": "Low", "score": 10}, {"min": 80, "max": 94, "level": "Medium", "score": 40}, {"min": 60, "max": 79, "level": "High", "score": 70}, {"min": 0, "max": 59, "level": "Critical", "score": 100}]},
{"name": "Yearly Third-Party Security Audits Completed", "weight": 6, "reg_ref": "CTDISR-2025 & NCSP 2021", "method": "Audit management system", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 1, "max": 99, "level": "Medium", "score": 40}, {"min": 0, "max": 0, "level": "Critical", "score": 100}]}, # 100% = Low, Partial = Medium, 0% = Critical
{"name": "Threat Intelligence & IOCs Shared with the PkCERT", "weight": 6, "reg_ref": "NCSP 2021 & CERT Rules 2023", "method": "Threat intelligence platform logs", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 80, "max": 99, "level": "Medium", "score": 40}, {"min": 50, "max": 79, "level": "High", "score": 70}, {"min": 0, "max": 49, "level": "Critical", "score": 100}]},
{"name": "Disaster Recovery Plan (DRP) Test Success Rate", "weight": 6, "reg_ref": "CTDISR-2025 Business Continuity", "method": "Annual DR/BCP drill reports", "thresholds": [{"min": 95, "max": 100, "level": "Low", "score": 10}, {"min": 80, "max": 94, "level": "Medium", "score": 40}, {"min": 60, "max": 79, "level": "High", "score": 70}, {"min": 0, "max": 59, "level": "Critical", "score": 100}]},
{"name": "Effectiveness of Network Segmentation Measures", "weight": 5, "reg_ref": "PISF 2025 & CTDISR-2025", "method": "Network architecture scans", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 90, "max": 99, "level": "Medium", "score": 40}, {"min": 70, "max": 89, "level": "High", "score": 70}, {"min": 0, "max": 69, "level": "Critical", "score": 100}]},
{"name": "Critical Vulnerabilities Patched within 7 days", "weight": 6, "reg_ref": "PISF 2025 & CERT Rules 2023", "method": "Vulnerability scanner + patch logs", "thresholds": [{"min": 100, "max": 100, "level": "Low", "score": 10}, {"min": 80, "max": 99, "level": "Medium", "score": 40}, {"min": 60, "max": 79, "level": "High", "score": 70}, {"min": 0, "max": 59, "level": "Critical", "score": 100}]}
]
def seed_data(reset=False):
if reset:
db.session.query(KRIScore).delete()
db.session.query(AuditLog).delete()
db.session.query(User).delete()
db.session.query(KRIDefinition).delete()
db.session.query(Organization).delete()
db.session.commit()
elif Organization.query.first(): return
orgs = [
Organization(name="Telenor Pakistan", sector_type="Telecommunication", registration_date=date(2005, 3, 15)),
Organization(name="Jazz 5G Pakistan", sector_type="Telecommunication", registration_date=date(1990, 7, 1)),
Organization(name="Zong 5G (CMPak)", sector_type="Telecommunication", registration_date=date(2008, 8, 1))
]
db.session.add_all(orgs)
db.session.commit()
users = [
User(username="admin", password_hash=generate_password_hash("admin123"), role="admin", organization_id=None),
User(username="telenor", password_hash=generate_password_hash("telenor123"), role="org_user", organization_id=orgs[0].id),
User(username="jazz", password_hash=generate_password_hash("jazz123"), role="org_user", organization_id=orgs[1].id),
User(username="zong", password_hash=generate_password_hash("zong123"), role="org_user", organization_id=orgs[2].id)
]
db.session.add_all(users)
db.session.commit()
kri_objs = []
for k in KRI_DATA:
kri = KRIDefinition(
kri_name=k["name"],
weight_pct=k["weight"],
regulatory_reference=k["reg_ref"],
measurement_method=k["method"],
thresholds=json.dumps(k["thresholds"])
)
db.session.add(kri)
kri_objs.append(kri)
db.session.commit()
def get_score(thresholds_json, raw_val):
thresholds = json.loads(thresholds_json)
for t in thresholds:
if t["min"] <= raw_val <= t["max"]: return t["score"]
return 100
# Sample KRI scores for 2024 and 2025 for each organization
sample_raw = {
2015: { # Pre-PECA 2016 - minimal regulatory enforcement
0: [78, 72, 70, 75, 80, 50, 45, 85, 55, 70, 60, 75, 82, 65],
1: [65, 60, 58, 65, 70, 30, 35, 78, 45, 55, 50, 65, 72, 55],
2: [55, 50, 48, 58, 62, 20, 25, 72, 38, 45, 42, 58, 65, 48],
},
2016: { # PECA 2016 enacted - early compliance scramble
0: [82, 78, 76, 80, 85, 60, 55, 88, 62, 80, 68, 78, 85, 70],
1: [70, 68, 65, 70, 75, 50, 45, 82, 52, 65, 58, 70, 78, 62],
2: [62, 58, 55, 65, 68, 40, 38, 78, 48, 55, 52, 62, 70, 55],
},
2017: { # PECA enforcement strengthened - notable improvements
0: [85, 82, 80, 85, 88, 75, 65, 90, 70, 85, 75, 82, 88, 78],
1: [75, 74, 72, 76, 80, 65, 55, 86, 62, 75, 68, 74, 82, 70],
2: [68, 65, 62, 70, 74, 55, 48, 82, 56, 65, 60, 68, 76, 62],
},
2018: { # NCSP 2021 being drafted - industry awareness rising
0: [88, 88, 85, 88, 90, 85, 72, 92, 78, 90, 82, 85, 90, 82],
1: [80, 80, 78, 82, 84, 75, 65, 90, 70, 82, 76, 80, 86, 75],
2: [73, 72, 70, 76, 78, 65, 57, 86, 64, 72, 68, 72, 80, 68],
},
2019: { # Steady operational improvements across all operators
0: [90, 90, 88, 92, 92, 90, 76, 94, 82, 95, 86, 88, 92, 86],
1: [83, 83, 81, 86, 86, 80, 70, 92, 76, 86, 80, 83, 88, 78],
2: [77, 76, 74, 80, 81, 70, 62, 89, 68, 76, 72, 75, 83, 72],
},
2020: { # COVID-19 year - SOC uptime pressured, some KRIs dipped
0: [92, 93, 92, 95, 93, 95, 78, 96, 86, 98, 90, 90, 94, 88],
1: [86, 87, 85, 90, 88, 82, 72, 94, 80, 88, 82, 85, 90, 80],
2: [80, 79, 77, 84, 83, 72, 63, 91, 72, 79, 75, 77, 85, 75],
},
2021: { # NCSP 2021 published - formal frameworks enforced
0: [94, 95, 95, 97, 94, 98, 80, 97, 88, 99, 94, 90, 95, 90],
1: [90, 90, 88, 93, 90, 85, 74, 96, 83, 90, 84, 86, 91, 82],
2: [83, 82, 80, 87, 86, 74, 64, 93, 75, 82, 77, 79, 87, 77],
},
2022: { # CERT Rules 2023 being drafted - incident reporting focus
0: [96, 97, 96, 98, 95, 100, 80, 98, 91, 100, 97, 91, 97, 92],
1: [93, 94, 91, 96, 91, 88, 76, 97, 86, 92, 86, 87, 92, 83],
2: [85, 84, 82, 89, 87, 76, 65, 94, 78, 84, 78, 80, 88, 78],
},
2023: { # CERT Rules 2023 & PISF 2025 preview - high compliance drive
0: [97, 99, 97, 99, 96, 100, 81, 99, 93, 100, 98, 91, 98, 93],
1: [95, 96, 93, 98, 93, 90, 77, 98, 88, 93, 87, 89, 93, 84],
2: [87, 84, 82, 91, 88, 76, 65, 95, 80, 85, 80, 81, 89, 78],
},
2024: { # CTDISR-2025 announced - operators accelerating compliance
0: [99, 100, 98, 100, 96, 100, 82, 99.5, 94, 100, 99, 92, 98, 95],
1: [97, 98, 95, 99, 92, 80, 78, 98, 88, 90, 85, 88, 92, 85],
2: [88, 85, 82, 90, 85, 60, 65, 92, 72, 70, 75, 70, 80, 78],
},
2025: { # CTDISR-2025 & PISF 2025 fully in effect
0: [100, 100, 99, 100, 98, 100, 95, 99.9, 96, 100, 100, 96, 99, 98],
1: [99, 99, 98, 100, 95, 90, 85, 99, 92, 95, 90, 91, 95, 92],
2: [92, 92, 89, 94, 90, 75, 78, 96, 82, 85, 82, 83, 88, 85],
},
}
for year, org_data in sample_raw.items():
for org_idx, raw_list in org_data.items():
org = orgs[org_idx]
total_score = 0.0
for i, kri in enumerate(kri_objs):
raw_val = raw_list[i]
num_score = get_score(kri.thresholds, raw_val)
contrib = num_score * (kri.weight_pct / 100.0)
total_score += contrib
kri_score = KRIScore(
organization_id=org.id,
year=year,
kri_id=kri.id,
raw_value=raw_val,
numerical_score=num_score,
contribution=contrib
)
db.session.add(kri_score)
pass
db.session.commit()
print("Database seeded successfully.")