Skip to content

Commit 1e2f360

Browse files
spoorccspoorcc
committed
Threat models
1 parent 0d797da commit 1e2f360

8 files changed

Lines changed: 1972 additions & 0 deletions

File tree

‎pyproject.toml‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -167,6 +167,9 @@ ignore-paths = [
167167
"tests",
168168
]
169169

170+
[tool.pylint.typecheck]
171+
ignored-modules = ["pytm"]
172+
170173
[tool.pydocstyle]
171174
convention = "google"
172175

‎security/README.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# Security
2+
3+
This folder contains the threat models. They depend on features not yet in a
4+
pytm release; install a pinned commit until an official release is available:
5+
6+
`pip install git+https://github.com/OWASP/pytm.git@279ed14aa13ea8f0b989717812fd4626bfcddf3d`
7+
8+
To update the pin, verify the new commit in the upstream repository and replace
9+
the SHA above.
10+
11+
After this you can generate various reports using:
12+
13+
```bash
14+
cd security
15+
python -m tm_supply_chain --report report_template.md > report.md
16+
python -m tm_supply_chain --dfd
17+
python -m tm_supply_chain --seq
18+
19+
python -m tm_usage --report report_template.md > report_usage.md
20+
python -m tm_usage --dfd
21+
python -m tm_usage --seq
22+
```

‎security/__init__.py‎

Whitespace-only changes.

‎security/report_template.md‎

Lines changed: 178 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,178 @@
1+
## System Description
2+
3+
{tm.description}
4+
5+
## Dataflow Diagram - Level 0 DFD
6+
7+
## Dataflows
8+
9+
Name|From|To |Data|Protocol|Port
10+
|:----:|:----:|:---:|:----:|:--------:|:----:|
11+
{dataflows:repeat:|{{item.display_name:call:}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}|
12+
}
13+
14+
## Data Dictionary
15+
16+
Name|Description|Classification|Carried|Processed
17+
|:----:|:--------:|:----:|:----|:----|
18+
{data:repeat:|{{item.name}}|{{item.description}}|{{item.classification.name}}|{{item.carriedBy:repeat:{{{{item.name}}}}<br>}}|{{item.processedBy:repeat:{{{{item.name}}}}<br>}}|
19+
}
20+
21+
## Actors
22+
23+
{actors:repeat:
24+
Name|{{item.name}}
25+
|:----|:----|
26+
Description|{{item.description}}|
27+
Is Admin|{{item.isAdmin}}|
28+
Finding Count|{{item:call:getFindingCount}}|
29+
30+
{{item:call:getInScopeFindings:
31+
**Threats**
32+
33+
<details>
34+
<summary>
35+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
36+
</summary>
37+
38+
<h6> Targeted Element </h6>
39+
<p>{{item:call:getFindingTarget}}</p>
40+
<h6> Severity </h6>
41+
<p>{{item:call:getFindingSeverity}}</p>
42+
<h6>Example Instances</h6>
43+
<p>{{item:call:getFindingExample}}</p>
44+
<h6>Mitigations</h6>
45+
<p>{{item:call:getFindingMitigations}}</p>
46+
<h6>References</h6>
47+
<p>{{item:call:getFindingReferences}}</p>
48+
&emsp;
49+
</details>
50+
}}
51+
}
52+
53+
## Boundaries
54+
55+
{boundaries:repeat:
56+
Name|{{item.name}}
57+
|:----|:----|
58+
Description|{{item.description}}|
59+
In Scope|{{item.inScope}}|
60+
Immediate Parent|{{item.parents:if:{{item:call:getParentName}}}}{{item.parents:not:N/A, primary boundary}}|
61+
All Parents|{{item.parents:call:{{{{item.display_name:call:}}}}, }}|
62+
Classification|{{item.maxClassification}}|
63+
Finding Count|{{item:call:getFindingCount}}|
64+
65+
{{item:call:getInScopeFindings:
66+
**Threats**
67+
68+
<details>
69+
<summary>
70+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
71+
</summary>
72+
<h6>Targeted Element</h6>
73+
<p>{{item:call:getFindingTarget}}</p>
74+
<h6>Severity</h6>
75+
<p>{{item:call:getFindingSeverity}}</p>
76+
<h6>Example Instances</h6>
77+
<p>{{item:call:getFindingExample}}</p>
78+
<h6>Mitigations</h6>
79+
<p>{{item:call:getFindingMitigations}}</p>
80+
<h6>References</h6>
81+
<p>{{item:call:getFindingReferences}}</p>
82+
</details>
83+
}}
84+
}
85+
86+
87+
## Assets
88+
89+
{assets:repeat:
90+
Name|{{item.name}}|
91+
|:----|:----|
92+
Description|{{item.description}}|
93+
In Scope|{{item.inScope}}|
94+
Type|{{item:call:getElementType}}|
95+
Finding Count|{{item:call:getFindingCount}}|
96+
97+
{{item:call:getInScopeFindings:
98+
**Threats**
99+
100+
<details>
101+
<summary>
102+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
103+
</summary>
104+
<h6>Targeted Element</h6>
105+
<p>{{item:call:getFindingTarget}}</p>
106+
<h6>Severity</h6>
107+
<p>{{item:call:getFindingSeverity}}</p>
108+
<h6>Example Instances</h6>
109+
<p>{{item:call:getFindingExample}}</p>
110+
<h6>Mitigations</h6>
111+
<p>{{item:call:getFindingMitigations}}</p>
112+
<h6>References</h6>
113+
<p>{{item:call:getFindingReferences}}</p>
114+
</details>
115+
}}
116+
}
117+
118+
119+
## Data Flows
120+
121+
{dataflows:repeat:
122+
Name|{{item.name}}
123+
|:----|:----|
124+
Description|{{item.description}}|
125+
Sink|{{item.sink}}|
126+
Source|{{item.source}}|
127+
Is Response|{{item.isResponse}}|
128+
In Scope|{{item.inScope}}|
129+
Finding Count|{{item:call:getFindingCount}}|
130+
131+
{{item:call:getInScopeFindings:
132+
**Threats**
133+
134+
<details>
135+
<summary>
136+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
137+
</summary>
138+
<h6>Targeted Element</h6>
139+
<p>{{item:call:getFindingTarget}}</p>
140+
<h6>Severity</h6>
141+
<p>{{item:call:getFindingSeverity}}</p>
142+
<h6>Example Instances</h6>
143+
<p>{{item:call:getFindingExample}}</p>
144+
<h6>Mitigations</h6>
145+
<p>{{item:call:getFindingMitigations}}</p>
146+
<h6>References</h6>
147+
<p>{{item:call:getFindingReferences}}</p>
148+
</details>
149+
}}
150+
}
151+
152+
153+
{tm.excluded_findings:if:
154+
# Excluded Threats
155+
}
156+
157+
{tm.excluded_findings:repeat:
158+
<details>
159+
<summary>
160+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
161+
</summary>
162+
<p>
163+
<b>{{item:call:getThreatId}}</b> was excluded for
164+
<b>{{item:call:getFindingTarget}}</b>
165+
because of the assumption "{{item.assumption.name}}"
166+
</p>
167+
{{item.assumption.description:if:
168+
<h6>Assumption description</h6>
169+
<p>{{item.assumption.description}}</p>
170+
}}
171+
<h6>Severity</h6>
172+
<p>{{item:call:getFindingSeverity}}</p>
173+
<h6>Example Instances</h6>
174+
<p>{{item:call:getFindingExample}}</p>
175+
<h6>References</h6>
176+
<p>{{item:call:getFindingReferences}}</p>
177+
</details>
178+
}

0 commit comments

Comments
 (0)