|
 |
|
|
|
Abstractions Lab released the Alpha version of IDPS-ESCAPE on GitHub.
IDPS-ESCAPE, part of the CyFORT suite of open-source cybersecurity software solutions, addresses various aspects of cybersecurity as an ensemble, targeting different user groups, ranging from public to private and from CIRT/CSIRT to system administrators. The design of IDPS-ESCAPE is targeted to cloud-native deployments, with an eye on CERT/CSIRT-operated monitoring systems.
Click here to read the whole article
itrust Abstractions Lab released the Beta version of C5-DEC on GitHub. This release includes many new functionalities, mainly to assist with Common Criteria evaluations and efficient creation of technical documentation throughout the Secure Software Development Lift Cycle (SSDLC).
We will be happy to receive your feedback at info@abstractionslab.lu
itrust consulting published the open source version of TRICK Service and added it the product list. OpenTRICK is a web-application supporting risk assessment and treatment.
OpenTRICK (formerly called TRICK Service) is a full-featured risk management tool, assisting in assessing risk, planning actions, as required by an ISO/IE 27001 compliant information security management system (ISMS). It accompanies you throughout the whole risk management process; starting with the definition of the risk context, covering risk estimation and treatment, and communicating the results. OpenTRICK prepares you to be certified for ISO 27001, to comply with the requirements of the GDPR, to export the RISK information in the json format requested by the LU regulator ILR or in order to respond to CSSF circular 12/544.
It covers a wide variety of features such as quantitative/qualitative analysis of risk scenarios, estimation of Return on Security Investment (ROSI) based on risk reduction factors (RRF), embedding of custom or pre-defined catalogues for rated security controls (27002, GDPR, 22301, IoT, …), multi-user support and access control, import/export, and versioning. It allows several risk assessment for different customers or contexts to share information such security and risk parameters over a central knowledge Base, thus explaining its name TRICK = Tool for Risk management of an ISMS based on a Central Knowledge base. Note that such information, e.g., ISO/IEC 27002 is copyright protection, i.e. cannot be part of this release, but it can be imported easily, based on formatted documents available at ILNAS.public.lu (e.g.) upon acquisition of the standard's copyrights (in near future).
OpenTRICK comes with user access management, activity logs, two-factor authentication, and smart input output feature interacting with Word and Excel.
Open source Java API for MONARC (Optimised Risk Analysis Method), which allows risk information from other sophisticated risk management tools such as TRICK Service (Tool for Risk management of an ISMS based on a Central Knowledge base) to be imported by facilitating changes to the MONARC JSON data file. The tool has been developed to migrate risk information from several organisations within the scope of NIS into the data format required by the NIS regulator in Luxembourg.
This project conforms to MONARC version 2.12.7. This API reads a JSON data file exported from MONARC and gathers information by interpreting a subset of such a file and creating Java objects from the elements it can interpret from the exported JSON data file.
Furthermore, after the Java objects have been processed by this API, it can export a JSON file compliant with MONARC version 2.12.7.
The tool has been released as open source as part of the CyFORT project initiative, making its main features available for use and inviting further contributions.
The DRAW is an open source tool from itrust consulting and is used to graphically represent assets and their corresponding dependencies. The assets are represented as nodes in the graph and the dependency is represented as an edge from one asset to another. The asset carries information about the name of the asset and its type, e.g. the asset can be a financial asset, a business process, etc. The edge carries the dependency information and also the probability information. Probability implies the chances that one asset will affect the other asset.
The depiction of asset dependencies allows users to graphically see the impact of an asset on other assets. For example, if there is an edge between server and server data, this means that a problem with the server could cause a problem with the server data.
The dependency graph created by DRAW can also be synchronised with TRICK Service risk analysis tool by itrust consulting, enabling the user to perform more effective risk analysis based on asset dependencies and probability propagation associated with edges.
As of version v2.0.5, the tool also supports the Excel format for importing and exporting dependencies to the DRAW whiteboard.
The tool has been released as open source as part of the CyFORT project initiative, making its main features available for use and inviting further contributions.
