Conflicting rules in Rules Engine | How to approach if there's a use-case

Techniques & Tooling
1

What to do in case we have conflicting rules for the same model?

  1. I created a Rule in IRIUSRISK called “Conflict Rule 1”

    • Context: Threat – Component conditions

    • When: a Component of type Web Service is added

    • Then: set the Threat “Authentication Bypass” to Mitigated

  2. I created a 2nd Rule in IRIUSRISK called “Conflict Rule 2”

    • Context: Threat – Component conditions

    • When: a Component of type Web Service is added

    • Then: set the Threat “Authentication Bypass” to Required

2

Interesting question. In IriusRisk, you can only set Threats to Not Applicable. If you want to mitigate that threat, you would need to set the associated countermeasure attached to that threat to “implemented” or if you wanted to demonstrate planned mitigation on that threat you could set it to “required”.

In any event where you have conflicting rules, the rule that runs last will win and will be the expressed rule in your threat model.