Luke Skywalker needed the force to stop the empire, you need countermeasusres to defeat your risks.
Contents
Change the Countermeasures Status
Seeing countermeasures applicable to a Standard
Create Issue Trackers from your Countermeasures
Configuring your Issue Trackers
This section focuses on what actions can be taken to mitigate the risks. We will go through the Countermeasures (security controls) to show you the options to lower the risk within your threat model.
If you are not already in the 'Threats and countermeasures' view, you can navigate to it at the top of the screen - next to 'Diagram'. This is what the tab looks like.
If you wish, you can widen the column while you work on the Countermeasures area, and even minimize the Threats column all together until you are finished. This view will also be saved for the next time you log in. The columns can easily be changed simply by dragging the columns left or right as you require.
On the right hand side you can filter, expand and minimize depending what you’d like to see. To change the status of a Countermeasure, click on the three ellipses and you will see various options to mark them as 'Required' instead of 'Recommended', for example.
You can even mark as 'Not Applicable' but must add a reason before this status is reflected. The same applies if you mark a threat as 'Rejected'. Which perhaps you may do this with certain context if say it was a third party responsibility for example.
The model will highlight in the top right when you have changed a status.
If you minimize the Recommended section, you will now see there is one item marked as 'Required', and one marked as 'Not Applicable'. And at the end you will have one listed as 'Rejected'.
Perhaps you need to comply with EU-GDPR, PCI, NIST 800-53, or others. You can apply a standard to your Project, and it will filter the results based upon those that are Non-Compliant against that standard. You can then easily mark these as ‘Required’ so that these are mitigated first.
Below are the results when the NIST 800-53 Standard is selected. There are 6 identified as Non Compliant.
Expand this section, select the six items, and go to the blue ‘Bulk edit’ button on the right. Here is where you can mark them as 'Required'.
This is an important section. Whether you use Jira, CA Rally, Azure DevOps, Servicenow, or a mixture of these tools, IriusRisk offers two-way integration with all of them. Meaning any status changes, comments or edits in the issue tracker, are reflected directly into your threat model, including adjusting your Project’s overall risk level.
Select the Countermeasures - in the example two have been chosen - select the blue ‘Bulk edit’ button, and choose Issues, then 'New Issues'. Here you have three choices:
If you are yet to configure your issue trackers, your view will look like this:
Jump to the next heading ‘Configuring Issue Trackers’ to begin setup.
It is possible to create issues in an issue tracker ticket (for instance, in Azure DevOps or Jira) to better manage the mitigation of threats within your systems. To facilitate this, it is possible in IriusRisk to configure multiple issue tracker systems and projects at a global level, allowing individuals to leverage these configurations at lower levels of granularity.
Adding New Issue Tracker Profiles:
