Product Update: Release 4.2 - Featuring New AWS CloudFormation API Endpoint

Product Update: Release 4.2

We've been working very hard on improvements to the product as well as some cool new functionality. Some of the highlights in this release include:

• A new AWS CloudFormation API endpoint
• Improved login screen and Community Edition signup
• Major improvements to the threats and countermeasures tabs
• Simplified rules management
• 40 new AWS components
• and more!

AWS CloudFormation API endpoint

Following the inclusion of the Open Threat Model (OTM) standard and API endpoint in release v4.1, this release sees the inclusion of our first parser for OTM. Creating a threat model from an AWS CloudFormation template is as simple as calling the API. IriusRisk generates the full threat model completely automatically, meaning that you can now fully embed threat model creation into your CI/CD pipelines.

For our SaaS customers this new API endpoint will available automatically in this release. On-prem customers will need to update their Docker Compose file.

‍

Login screen

The login page has a fresh new look that matches the IriusRisk style and branding, as well as improved account creation for Community Edition users.

‍

Threats & Countermeasures

Managing your project's threats and countermeasures in IriusRisk just got better. You can now manually set the  priority on countermeasures, overriding the calculated value. This means you have full control over how you manage your implementation plan.

For users on lower resolutions we have improved how we display the details panel for threats and countermeasures. By default we will now hide the details panel and just show the full table. When you select a threat or countermeasure in the table, the details panel will appear. On larger resolution screens it will use about half the screen, but on lower resolution it will automatically fill the entire screen. A close button has been added to easily hide the panel again.

Other improvements include:

• Sorting threats in flatten view
• Filtering countermeasures by the Rejected state
• Previously bulk actions on threats was only available in the nested view, this is fixed in the flattened view
• PUT API endpoint for updating countermeasures. This is useful, for example, when updating a JIRA reference via the API.

Analytics and Reports

Standard sections covered by countermeasures

Content, library, and rules management

When managing rules, you no longer have to click Add in order to set the condition or action. Instead, the condition or action is automatically added after the value is selected. This means no more missing conditions or actions because of forgetting click the Add button, and it makes the whole process of rule management simpler and faster.

When creating an action for a rule, you can now choose whether the action should override any manual changes that may have already taken place.

In the above example, the rule would mark the “Access the data store…” countermeasure to implemented if the conditions were met. If somebody had already set the countermeasure to Rejected, we may want to preserve that change. Ticking the “Override manual actions” checkbox would force the countermeasure status to be updated.

Finally, the icon is now shown when editing a Component Definition.

‍

New Content

This release includes an update to the FedRAMP standard which now has references to relevant NIST 800-53 sections. Additionally, new questions are available for Server Side Components giving a smoother integration with FedRAMP.

40 new AWS components have also been released, including:

• AWS AppFlow
• AWS Application Discovery Service
• AWS Augmented AI (A2I)
• AWS Data Exchange
• AWS DocumentDB

Plus improved security content for AWS Config.

Release notes

For more information, see the Version 4.2 Release Notes.

Shape the future of Threat Modeling with us!

Join IriusRisk Horizon

IriusRisk Horizon - Customer Research, Product Discovery, and Early Access