QuBA-libre is an risk assessment tool that allows organizations to identify and mitigate risks in their product development lifecycle. The starting point for the QuBA-libre was the Modular Risk Assessment (MoRA), developed by the Fraunhofer Institute AISEC. Based on this, QuBA-libre was developed - a customized solution that takes up the basic principles of MoRA, but streamlines them and focuses on individual products (e.g. sensors, edge devices). The aim was to create an analysis that assesses risks quickly, precisely and in a resource-saving manner without compromising security.

It ensures that security is integrated into our product development efficiently. With QuBA, you may close the gap between highly complex risk analyses and the requirements of specialized individual components.

Usage

For starters, please see the Quick Start Guide on the worksheet "README" after downloading the QuBA-libre.xlsx.

Features

• Answering a questionnaire with questions about the impact rating and the required attack potential
• Automated risk assessment based on the answers using existing risk catalogs
• Automated generation of suitable countermeasures to mitigate identified risks
• Assignment of proposed countermeasures to evaluated risks
• Risk assessment for remaining risks by IT security specialists
• Automated generation of documentation with a summary of the results and assignment to the requirements from the EU Cyber Resilience Act

Prerequisites

The template requires LAMBDA functions, please ensure that your spreadsheet calculation tool supports this. Currently we are aware of the following tools:

• The desktop version of Excel for Microsoft365 (Recommended).
• Partial support for the browser version of Excel for Microsoft365.

Contributing

Interested in contributing to QuBA-libre? Please check CONTRIBUTING.md to see how you can help!

Copyright & License

QuBA-libre is Copyright (c) by Fraunhofer-Institut für Angewandte und Integrierte Sicherheit AISEC and SICK AG. All Rights Reserved.

Permission to modify and redistribute is granted under the terms of the Creative Commons Attribution Share Alike 4.0 International.