CAIRIS documentation

Contents:

• Quick Start
  • Live Demo
  • Video tutorials
  • Example models
  • Define your contexts of use
  • Save early and often
  • Supporting UX
  • Asset-driven security design
  • Threat-driven security design
  • Working with requirements
  • Thinking about architecture
  • Generating documentation
• Installing CAIRIS
  • Installation via Vagrant
  • Installation via Docker
  • Installation and configuration via GitHub (automated)
  • Installation and configuration of server with account registration via GitHub (automated)
  • Installation and configuration via GitHub (manual)
• Starting CAIRIS
  • Starting the CAIRIS server
  • Starting the web application
• CAIRIS databases
  • Default database
  • Using other databases
  • Providing database access to other users
• Reserved characters in object names
• Importing and Exporting models
  • Importing models
  • Exporting models
• Sample models
  • Exemplars
  • Threat and Vulnerability Directories
• Creating a new project
• Environments
  • Adding a new environment
• Assets
  • Adding, updating, and deleting an asset
  • Asset modelling
• Roles
  • Adding, updating, and deleting a role
  • Responsibility modelling
• Personas
  • Adding, updating, or deleting a persona
  • Assured personas with persona characteristics
  • Automating persona characteristic creation
• Tasks
  • Adding, updating, or deleting a task
  • Task traceability
  • Visualising tasks
• Misusability Cases
  • Creating concept references
  • Creating the skeleton scenario
  • Creating task characteristics
  • View misusability case models
• Domain Properties
  • Adding, updating, and deleting a domain property
• Goals, Requirements, and Obstacles
  • Adding, updating, and deleting a goal
  • Goal Modelling
  • Adding, updating, and deleting an obstacle
  • Obstacle Modelling
  • Adding, updating, and deleting requirements
  • Visualising Requirements Quality using Chernoff Faces
  • Attack tree modelling with obstacles
• Use Cases
  • Adding, updating, or deleting a use cases
  • Add exceptions to use case steps
• User goals and user goal models
  • Adding, updating, and deleting user goals
  • Adding, updating, and deleting user goal contributions
  • Task contributions
  • Adding User goal elements to persona characteristics
  • Adding GRL elements to use cases (jUCMNav export only)
  • Viewing a user goal model
  • Working with workbooks
  • Generating a jUCMNav compatible GRL model
• Dependencies
  • Adding, updating, and deleting a dependency
  • Viewing dependencies
  • Introducing Personal data into CAIRIS using dependencies
• Security Patterns
  • Create a template asset
  • Create a security pattern
  • Situate a security pattern
• Vulnerabilities
  • Create a vulnerability
  • Introducing template threats and vulnerabilities
• Attackers
  • Adding, updating, and deleting an attacker
• Threats
  • Adding, updating, and deleting a threat
• Threat Modelling
  • Data flows and Data Flow Diagrams
  • Attack trees
• Using CAIRIS as tool-support for STPA
  • Overview
  • Step 1: Define purpose of the analysis
  • Step 2: Model the control structure
  • Step 3: Identify unsafe control actions
  • Step 4: Identify loss scenarios
  • Supporting other STPA outputs
• Modelling access control needs and policies
  • Overview
  • Modelling access needs
  • Modelling access control policies with policy statements
  • Access control model validation checks
• Risks
  • Adding, updating, and deleting a risk
  • Risk Analysis model
• Locations
  • Adding, updating, and deleting a locations object
  • Viewing location models
• Risk Responses
  • Adding, updating, and deleting a response
  • Generating goals
• Countermeasures
  • Adding, updating, and deleting a countermeasure
  • Generating countermeasure assets and security patterns
  • Associating countermeasures with pre-existing patterns
  • Weakening the effectiveness of countermeasures
  • Mitigating weakening effects
• Traceability
  • Allowable manual traceability links
  • Editing manual traceability links
  • Visualising manual traceability links
• Architectural Patterns
  • Editing Architectural Patterns
  • Viewing Architectural Patterns
  • Situating a pattern
• Model Validation
  • General validity checks
  • Security design checks
  • Privacy design checks
  • Access control checks
• Configurable Types and Values
  • Asset Values
  • Asset Types
  • Vulnerability and Threat Types
  • Other Types
• Searching model objects
• Tags
• Generating Documentation
  • Problems with wide models
  • Customsing model files
• CAIRIS server maintenance
  • Account management
  • Importing and exporting models
  • Backing up and restoring servers
• Using the CAIRIS API
  • API documentation
  • Authenticating with the CAIRIS server
  • The cairis_test database
• Extending CAIRIS
  • 1. Define the database tables
  • 2. Define the database procedures
  • 3. Update the Python database proxy
  • 4. Write your model object test case
  • 5. Update the CAIRIS DTDs
  • 6. Update the model import / export code
  • 7. Implement the server end-points
  • 8. Write your API test case
  • 9. Update the UI
  • 10. Update the documentation generation process
• Troubleshooting
  • Log files
  • Raising issues

Indices and tables

• Index
• Module Index
• Search Page