cairis-platform / cairis

Computer Aided Integration of Requirements and Information Security - Server
https://cairis.org
Apache License 2.0
147 stars 57 forks source link

Unable to select target for countermeasures/unable to import models #634

Closed LukeLaboosh closed 2 years ago

LukeLaboosh commented 2 years ago

Expected behaviour

I have created threats threats and requirements and should be able to fully write the counter measures by selecting the associated requirement and threat. Also I have created backups of my Cairis which I should be able to import.

Actual behaviour

When attempting to create a counter measure no targets come up. everything else seems to function as expected I also cannot import the model after exporting it.

Steps to reproduce the behaviour

Create new counter measure. Name, requirement, description etc. Add requirement. Should be able to add target.

also: export as model.cairis should be able to import model.cairis

Version of CAIRIS

Cairis.2.3.8

Details of browser or, if applicable, details of the OS used to host CAIRIS

Windows Chrome Version 95.0.4638.69 and firefox SBD not working.zip image

failys commented 2 years ago

There are a two reasons why this is happening.
First, to view targets then you need to add a KAOS association such that the sub-goal is your requirement, and the goal is either linked to your risk response, or a refinement to a goal that is. In your model, the requirement isn't linked to anything, which is why you aren't getting any targets (as CAIRIS doesn't see the requirement as linked to any risks). Second, it's important that the 'Prevent' goal is generated by CAIRIS and not simply created by hand. This is because CAIRIS adds a link between the response and the goal before the sub-goals (associated with the threat and vulnerability are created). In your model, it looks like you created all these goals by hand.

I suggest deleting your prevent goals, generating the goals again from the response, and then adding the missing KAOS association as mentioned above. Once the requirement in your countermeasure is linked back to your risks then you should see your targets.