CAIRIS vs EnCo SOX ATA

CAIRIS is an open-source platform for specifying and checking systems with security and usability requirements in view. It brings together design information such as assets, countermeasures, factoids, personas, requirements, and architectural components. As a design develops, it can generate 12 views covering perspectives such as people, risks, requirements, architecture, and physical location, as well as threat models including Data Flow Diagrams. Its security analysis uses attack and architectural patterns to assess attack surface and check for known security problems and potential GDPR compliance issues. CAIRIS can produce Volere-compliant requirement specifications and GDPR DPIA documents. Its API supports design apps and connections to existing toolchains. It is free under the Apache Software License. Deployment options include Docker, Vagrant, or source installation on supported platforms; Ubuntu is the most tested. The web app supports modern browsers other than Internet Explorer, including Edge. A Chrome extension can turn highlighted webpage text into references linked to a CAIRIS server. The live demo is rebuilt nightly, and its data is visible to everyone.

EnCo SOX ATA is an attack tree analysis module in the SOX engineering workbench. It models hierarchical attack paths with logical AND and OR gates and links those trees to TARA threat scenarios. Users score attack steps against feasibility criteria; the module propagates scores through the tree to calculate threat or attack-feasibility levels according to the selected norm and expose critical paths. Threats can move between TARA and ATA, with paths linked by drag and drop. Reusable attack paths can be placed elsewhere in a tree or another analysis. The module connects requirements, system design, TARA and cybersecurity goals, while trace views show requirement relationships and assets can be assigned to elements. Teams can assign tasks, set statuses, track progress and review changes through a central database. Outputs include printed or image-exported diagrams, Excel results and Report Designer documentation. It runs on web and Windows; pricing is on request.