¶ What are the categories in Diri?
One of the core features in Diri is the use of predefined libraries with suggestions and categorisation. When you build a risk assessment, you pick threats, vulnerabilities, event types and consequence categories from these libraries instead of writing every item yourself, and you can add your own when something is unique to your organisation.
This significantly reduces the workload. Research and experience show that a relatively limited set of events and consequences tend to occur in cyber security contexts, while some events are specific to particular systems. The libraries give you both.
¶ The libraries
| Library | Used for | Where to manage it |
|---|---|---|
| Threats | Who or what could act against you. Threats raise the probability side of a risk. | Threats in the module group in the menu (Operational risk, Cyber security or Privacy) |
| Vulnerabilities | Weaknesses that can be exploited. They are connected to causes in the bow tie. | Vulnerabilities in the module group in the menu |
| Threat categories and Vulnerability categories | Grouping of threats and vulnerabilities. Cyber security organisations get the ISO 27005 categories as a starting point. | Settings > Risk assessment settings > the module |
| Event types | The unwanted event at the centre of the bow tie. | Settings > Risk assessment settings > the module |
| Consequence categories | The kind of consequence that follows the event. | Settings > Risk assessment settings > the module |
| Asset types | The types offered when you register an asset (Operational risk and Cyber security). | Settings > Risk assessment settings > the module |
Each module has its own libraries, so the threats and categories you see depend on the module you are working in. Settings can only be changed by users with access to Settings, usually administrators. See Settings.
¶ Built-in items
Some event types and consequence categories are marked Built in: Unavailable IT system, Compromised IT system, Loss of availability and Loss of confidentiality and integrity. They come with Diri, are the same in every organisation, and cannot be renamed, deleted or stop being inherited. The dependency analysis pre-selects them when it creates a risk from "If it goes down" or "If it is compromised".
¶ Using the libraries in a risk assessment
In the risk assessment, select Add event and choose an event type under Select event type. The event type is a category; describe what the event means for this assessment in the Description field. Threats, vulnerabilities and consequence categories are chosen the same way when you add causes and consequences.
If none of the existing event types fits, select Add new event type, enter the Event type name and save. The new event type appears in the list and in the settings.
¶ Libraries across organisations
Library items can be inherited by sub-organisations, so a group can maintain one common library. Items inherited from a parent organisation are marked as inherited and are read-only; they are edited in the organisation that owns them. Use the inherit toggle on each item, or toggle inheritance for all items at once. See Inheritance of settings and rights and top-down threats and vulnerabilities.