Additional information, tips and tricks can now be accessed under https://www.security-analyst.org. Since the last release we have given a couple of presentations on how to do an ISO/SAE 21434 compliant TARA with our tool. You may watch it here at the very bottom.
New Report Items specific for ISO/SAE 21434
We have added three new report items that can be added to any report template:
Assets and Damage Scenarios Table: This report item shows identified assets with the associated damage scenarios. It is aligned with Table G.2 of the ISO/SAE 21434 DIS.
Damage and Threat Scenarios Table: This report item shows the threat scenarios for each damage scenario. It is aligned with Table G.6 of the ISO/SAE 21434 DIS.
Threat Scenarios and Attack Paths Table: This report items shows the attack paths of each threat scenario. Because the number of possible attack paths can be very high the number of shown paths can be reduced by skipping paths that result in an identical rating to other paths. The table is aligend with Table G.10 of the ISO/SAE 21434 DIS.
Improved Attack Feasibility Rating
We have fixed the behavior of rare or invalid combinations in the attack feasibility rating. For example, an error is displayed when consecutive risk factors are defined even though no initial risk factors or initial explicit attack feasibility is present. This takes inherited risk factors into account. Furthermore, the distinction between “don’t use consecutive risk factors” and “inherit all consecutive risk factors” is now possible. For the latter case it was fixed that corresponding risk factors where not always shown at the inheriting element.
Fixed Risk Calculation
If identical damage was received from different sources, only the first source was considered. This could lead to wrong risk levels because relevant attack paths might have been omitted. This has been fixed.
Consistent Inheritance for Catalog Elements
We have fixed inconsistencies when properties of catalog elements (threat classes, control classes) were derived. Now, only risk factors are derived. All other properties (e.g. technologies, threatened or protected security properties, …) are never derived.
XSAM: Aligned XML Tags and Name based References
The names used in xml tags and name based references have been aligned. This means that name based references now should match the following syntax: “name/<TagName>/<ElementNameAttributeValue>”.
Display Damage Scenarios in Security Graph
Damage Scenarios are now displayed in the security graph (“Graphing” tool window) above security objectives.
The installer now supports installation of different Security Analyst versions in parallel. We have fixed a bug which might have prevented that Security Analyst could be started by the installer right after installation.
Improved Tooltips in Assistants
Tooltips in the assistants now show the full name, title and an excerpt of the description as it was already the case for other places with cross references.
Dangling References Notification for most Elements
If an element is deleted and leaves dangling references, the user is notified about this in a popup. Previously this was only the case when a threat was deleted. Now, deletion of any main element as well as assessment model entries will cause this notification.
Various Fixes and Improvements
Fixed that the description of an element might got lost when copy & paste was used
The “is impossible” property of threats/controls can now be set in the table view
Fixed editing of (inherited) risk factors in the table view
Fixed editing of consecutive risk factors in the table view
Fixed missing properties and expression parser for XSAM import/export
Improved derived title of security objectives when no security property or concerned system element was specified
Improved auto layout of system diagram: now automatically triggers “fit view”
Improved default chunk names (after new project creation)
Improved report template editor
Documented version mapping (see end of this document)