Identifying Assets And Damage Scenarios

Owned by Tino Pförtner
Last updated: Sept 05, 2024
3 min read

Asset Identification

Step 1: Asset Candidates

To manage your asset candidates, open a global asset catalog in the Catalogs View or create a new Assets Catalog if you want your assets to be available thoughout your SOX respository.

grafik-20240905-060545.png

If you want to define project-specific asstes, you can use the Assets Catalog in your TARA → Project Catalogs folder

grafik-20240905-060924.png

 

Add content as needed:

  • Text fields are provided to assign a Name and Description to your Asset.

  • Select an Element Category from the drop-down menu.

  • The column Model Element provides a drop-down menu containing all model elements in your project that have the stereotype “Asset” assigned to them.

  • The column Vulnerability provides a drop-down menu containing all model elements in your project that have the stereotype “Vunerability” assigned to them. You can also find the Vulnerability catalog in the catalog view grafik-20240828-064951.png under Public → TARA Catalogs

 

Step 2: Cybersecurity Assets and Damage Scenarios

TARA main table - group “Asset Identification”

An asset candidate can be added to TARA table by either double-clicking in column Asset Name and selecting from drop-down menu, or dragging-and-dropping an asset from the global Asset Catalog or the Project Catalog. Assets added from the Global Catalog will result in a copy in the Project Catalog. Any attributes defined for the asset like Description and Element Category will be transferred along with the asset name.

To further analyze an asset, add a cybersecurity property via selection from the drop-down menu in the column Cybersecurity Property.

TARA main table - group “Damage Scenario”

To finalize asset identification, you need to identify damage scenarios that might be realized in case an asset’s cybersecurity property is compromised.

To manage your damage scenarios, open the Damage Scenarios in the Project Catalogs or the Global TARA Catalogs folder and click the grafik-20240827-053602.png - icon to add a new row.

Name and Description are once again text fields which will take input after double-clicking them. A stakeholder can be selected from drop-down in column Stakeholder. The impact can be rated in the categories Safety, Financial, Operational, and Privacy. Complete your damage scenario by filling in text in columns Justification and Assumptions on Impact as needed.

To assign a damage scenario from the Project- or Global Damage Scenarios to an asset in TARA, drag-and-drop it anywhere in a row. Alternatively a damage scenario can be selected from the drop-down menu in the column Name. Selecting a Damage Scenario from a Global Catalog will create a copy in the respective Project Catalog.