owasp / threat-model-cookbook Goto Github PK

View Code? Open in Web Editor NEW

396.0 44.0 68.0 6.27 MB

This project is about creating and publishing threat model examples.

Home Page: https://owasp.org/www-project-threat-model-cookbook/

License: Other

Python 100.00%

threat-models threat-model appsec threat-modeling threat-modelling

threat-model-cookbook's Introduction

OWASP Threat Model Cookbook Project

This project is about creating and publishing threat model examples. They can be in the form of code, graphical or textual representations. The models will use diverse technologies, methodologies and techniques.

You can learn from those models, use them a base to start your own, or contribute to and expand some of the models. Thus making this a collaborative cookbook of threat models.

https://owasp.org/www-project-threat-model-cookbook/

https://twitter.com/OWASP_tmcb

Disclaimer

Examples provided in this repository are not representations of secure systems, but rather insecure systems that are easy to model. Most of them are made up systems that don't exist in reality. Any resemblance to real life systems is purely coincidental.

Contributing

We are welcoming PRs containing examples to add to the cookbook. If you want to add new threat models, create more versions based of existing drafts, feel free to directly submit a PR.

Here's some guidelines on how our file structure works:

INDEX.md contains all systems that are modeled with embeded pictures and short descriptions.
Top-level directories are the type of threat models. Example: Flow Diagram.
If your threat model has 1 or 2 files, you can put the files directly in that directory. If they have more, please create a folder with the name of your system to be modeled.
The name of the system needs to be using dashes and alphanumeric characters only. No spaces.
A file needs to have a specific extension depending on the format: system-name.tool and system-name.tool.exportfiletype. As examples, we have the code file cryptowallet.plantuml and the output to an image file generated from that code as cryptowallet.plantuml.svg. Refer to the README.md in each top-level folder for a list of tools and their file extension matches.
If you have multiple representation of the same system using the same tool, we suggest you add altN- at the start of the file where N is a number.

If this sounds complicated and you just want to contribute, you can still submit a PR and we'll refactor it for you. We might have more automation and outside references in the future so we want to keep a strict file structure.

If you'd like to discuss about the structure of the project, feel free to join the discussion on OWASP Slack.

Licenses

All models in form of textual or graphical representations are under CC-BY 4.0

All models as code are under Apache License 2.0

threat-model-cookbook's People

Contributors

Stargazers

Watchers

Forkers

gronau-it-cloud-computing davidcervigni ajaynegi-websecresearch owaspmemphis jmarcil netsec raimundojimenez vinayasathyanarayana dipsec albertchae jun3p4rk javierjeronimo jgadsden salmankhwaja fukai6 sthagen jangelesg guled zbraiterman magnologan vpnj012k tclark000 qp53catoei2wwrhhsoco nnazeer araiaan apython123 securestep9 kunwaratulhax0r izar tohch4 zlzhangv007 sumodgeorge ekmixon quinn-yan cybernewbies coloristlife adhoceric kushalvenkatesh watch-dog-man theuiz sulaimanzai santhoshinty marcostolosa sekamug amarjitghuman ankityadavv2014 manjula-aw adamrsummers fintoalef maneeshs az1688 isabella232 boykoatwork rogerjardi booktube356 kstrowski dievus bigugo21 doohsom mohamedtaoufik jcdelpino24 giovanninibarbosa opflep cvlabsio zpaav horatiohe nemo-nesciam

threat-model-cookbook's Issues

Create example TM from IriusRisk

Create Leanpub book for this project

Archive this project or warn contributors

The Threat Model Cookbook project has been dormant for a long time, and the www pages have been archived

@alyssa-hardin should this repo should also be archived read-only or instead the contributors warned that it is a dormant project?

Convert jetscout diagrams from analoge diagram to digital

https://github.com/OWASP/threat-model-cookbook/tree/master/Flow%20Diagram/jetscout

Examples of Identified Threats, Risk Ratings, and Mitigations?

These are really useful assets for demonstrating how to diagraming the system, "What are we working on".

I don't see any artifacts that capture the threats that have been identified by these models (steps 2 and 3 of a a threat model). i.e., What can go wrong? What can we do about it?

Have I overlooked something, or is there a plan to add examples of a completed threat model exercise?

Find examples of TMs and push to this repo

Idea to improve this content for academic purposes

Hi guys, very nice idea!

One thing that would be very important to add real value to this threat model proyect is to ask for a description that comes with the diagrams. Some times is very difficult to understand a diagram without context and the threat model should be context based.

IDEA

What do you think about asking people who uploads types of threat model to add a description of the products to be threat modeled?

Thanks!

Create & Publish "Request for Threat Models"

Write post to community asking for TM (anonymised or samples)

to go on

twitter
linked in
email
blog post

Create an index for models

Right now we're lacking a quick way to index and reference the examples. The repo is more made to be cloned and then browsed locally.

Indexed items would also need to be grouped by "systems" rather than by "model". For example iot-device has an attack tree and a flow diagram, and we should have them grouped together with perhaps a quick description of what the system is.

Dinis suggestion on #25 is also a good idea of having the index page show the actual images. That'd be way better for quick reference or sharing.

Create Contributing docs

related to #3

Book AppSec EU meetup

to sync up efforts

Create Waffle.io board for this project

Create Twitter account

Owasp-TM-cookbook ?
TM-Cookbook ?
Owasp_tmcookbooks
Owasp_tmchefs

logs

Create Readme for Attack trees with images of attack trees

https://github.com/OWASP/threat-model-cookbook/tree/master/Attack%20Tree

This will make it easier to see what exists and to learn from it

Create hugo website for this project

Contact previous contributors of this repo

Contact people who previously contributed/interacted with this repo to inform them that an official project is being started.

They might just see this so https://www.owasp.org/index.php/OWASP_Threat_Model_Cookbook !

But the plan was to have Tash contact them with a more personalized touch 😄.

Book first collaboration session

hosted at one of the participants
focus on reviewing the existing content
to be booked in about 1 month

Create disclaimer

We need to add some text in the readme that says that examples in this repo are not examples of good systems, but rather contains bad insecure systems that are easy to model.

Same goes with the threat models examples, most of them will actually be ok, but models should be used as examples and tailed to the particular needs of the viewer context and reality.

(maybe put this as DISCLAIMER.md or just a section)