¶ Sharing asset, threat and vulnerability analysis with your users
If you already have, or are working on, an overall asset, threat and vulnerability analysis for your organisation, you can put it into Diri and share it with your users. Users in sub-organisations then build their risk assessments on the same assets, threats and vulnerabilities, which makes the risk work more consistent, efficient and aligned.
¶ How it works
Administrators register a standard set of assets, threats and vulnerabilities in the top-level organisation (or another organisation high in the tree) and choose, per item, whether it is inherited by the sub-organisations and whether the sub-organisations may change it. Users in sub-organisations can then choose from these shared items in their own risk assessments.
The registers are found in each module's menu group:
- Information assets (Cyber security) and Business Assets (Operational risk)
- Threats and Vulnerabilities (Cyber security, Operational risk and Privacy)
To enter many items at once, use the Excel/CSV import. See Bulk import.
¶ Setting inheritance
For each asset, threat or vulnerability, the form has two toggles:
- Allow child organizations to inherit this … – users in sub-organisations can see and use the item in their risk assessments.
- Allow child organizations to modify this … – users in sub-organisations can also change the item. If this is off, the item is read-only for them.
To see and change the status for many items, use Configure on the table and show the Use Inherited and Can Modify columns.
In the example above, the sub-organisations both receive and can modify the threats.
To decide the starting inheritance for new items, use New records: offered below by default on the Access and sharing tab of the organisation settings. See What is offered to the organisations below.
¶ Assets
Shared assets can be added directly to risk assessments. Each asset has confidentiality, integrity and availability (CIA) levels set where it is registered. The CIA levels guide the consequence assessment, which helps keep it consistent across the organisation.
¶ Threats
Threats have a name, description, Threat Level and Threat category. The threat level is used to guide the probability in your risk assessments.
¶ Vulnerabilities
Vulnerabilities have a name, description, Exposure Level and vulnerability category. The exposure level is also used to guide the probability in your risk analysis.
¶ Using them in risk assessments
- When users connect assets, threats and vulnerabilities to a risk assessment, Diri recommends probability and consequence levels based on them, and explains how the suggestion was derived. Users can apply the recommendation directly.
- A threat or vulnerability can be given a different level in a specific risk assessment, without changing the shared item. The assessment-specific level is used in the bowtie, the recommendations, the risk calculation and the PDF report.
- The threat and vulnerability registers show in which risk assessments each item is used.
¶ Benefits
Sharing the analysis gives consistent terminology and scoring across all organisational levels, makes it quicker to create new risk assessments by reusing established items, and gives every assessment the same decision basis. It also keeps central control while allowing flexibility in sub-organisations.
¶ Administrator checklist
- Set up threat and vulnerability categories under Settings → Risk assessment settings for each module, if you want your own in addition to the predefined ones. See Settings.
- Register your assets, threats and vulnerabilities in the top-level organisation.
- Decide for each item whether it should be inherited and whether sub-organisations may modify it.
- Tell your users that the shared items are available when they add assets, threats and vulnerabilities to their risk assessments.
Users with a restricted role only see the threats and vulnerabilities they have created themselves. See Restricted roles.