From assets to countermeasures, factoids to personas, and requirements to architectural components, enter or import a wide range of security, usability, and requirements data to find new insights ranging from interconnections between requirements and risks, to the justification behind persona characteristics.
No single view captures a complex system, so automatically generate 12 different views of your emerging design from perspectives ranging from people, risks, requirements, architecture, and even physical location.
Automatically generate threat models such as Data Flow Diagrams (DFDs) as your early stage design evolves.
Leverage open source intelligence about potential attacks and candidate security architectures to measure your attack surface.
Show all the security, usability, and design elements associated with your product's risks.
Quickly validate even the most basic design for known security design problems and potential GDPR compliance issues.
Use the CAIRIS API to build design apps or integrate CAIRIS into your existing toolchain.
Generate a range of documentation from Volere compliant requirement specifications to GDPR DPIA documents.
CAIRIS stands for Computer Aided Integration of Requirements and Information Security. It is an open source platform for eliciting, specifying, and validating secure and usable systems. It was built from the ground up to support all the elements necessary for usability, requirements, and risk analysis.
Some tools focus on the specification of requirements. Others focus on modelling threats. Still, others are centred around managing UX data. CAIRIS is the only tool that does all of this (and more). CAIRIS is also the only security design tool that supports the notion of environments, making it possible to model contexts of use.
Yes. CAIRIS has been made freely available under an Apache Software License.
We expect security to be 'built in' software, but software is useless if people can't or won't use it. We built CAIRIS to support the activities need to build security AND usability into the earliest stages of software design. Additionally, by using CAIRIS as the repository for data you collect, you benefit from CAIRIS' automatic analysis, validation and visualisation capabilities.
We have a live demo where you can play with three preloaded models.