Skip to content

Commit 9a3619a

Browse files
spoorccspoorcc
committed
Threat models
1 parent 0d797da commit 9a3619a

7 files changed

Lines changed: 2167 additions & 0 deletions

File tree

‎security/README.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
# Security
2+
3+
This folder contains the threat models. They depend on features not yet in a
4+
pytm release; install a pinned commit until an official release is available:
5+
6+
`pip install git+https://github.com/OWASP/pytm.git@279ed14aa13ea8f0b989717812fd4626bfcddf3d`
7+
8+
To update the pin, verify the new commit in the upstream repository and replace
9+
the SHA above.
10+
11+
After this you can generate various reports using:
12+
13+
```bash
14+
python -m security.tm_supply_chain --report security/report_template.md > report.md
15+
python -m security.tm_supply_chain --dfd
16+
python -m security.tm_supply_chain --seq
17+
18+
python -m security.tm_usage --report security/report_template.md > report_usage.md
19+
python -m security.tm_usage --dfd
20+
python -m security.tm_usage --seq
21+
```

‎security/__init__.py‎

Whitespace-only changes.

‎security/report_template.md‎

Lines changed: 180 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,180 @@
1+
## System Description
2+
3+
{tm.description}
4+
5+
## Dataflow Diagram - Level 0 DFD
6+
7+
{tm.dfd}
8+
9+
## Dataflows
10+
11+
Name|From|To |Data|Protocol|Port
12+
|:----:|:----:|:---:|:----:|:--------:|:----:|
13+
{dataflows:repeat:|{{item.display_name:call:}}|{{item.source.name}}|{{item.sink.name}}|{{item.data}}|{{item.protocol}}|{{item.dstPort}}|
14+
}
15+
16+
## Data Dictionary
17+
18+
Name|Description|Classification|Carried|Processed
19+
|:----:|:--------:|:----:|:----|:----|
20+
{data:repeat:|{{item.name}}|{{item.description}}|{{item.classification.name}}|{{item.carriedBy:repeat:{{{{item.name}}}}<br>}}|{{item.processedBy:repeat:{{{{item.name}}}}<br>}}|
21+
}
22+
23+
## Actors
24+
25+
{actors:repeat:
26+
Name|{{item.name}}
27+
|:----|:----|
28+
Description|{{item.description}}|
29+
Is Admin|{{item.isAdmin}}|
30+
Finding Count|{{item:call:getFindingCount}}|
31+
32+
{{item:call:getInScopeFindings:
33+
**Threats**
34+
35+
<details>
36+
<summary>
37+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
38+
</summary>
39+
40+
<h6> Targeted Element </h6>
41+
<p>{{item:call:getFindingTarget}}</p>
42+
<h6> Severity </h6>
43+
<p>{{item:call:getFindingSeverity}}</p>
44+
<h6>Example Instances</h6>
45+
<p>{{item:call:getFindingExample}}</p>
46+
<h6>Mitigations</h6>
47+
<p>{{item:call:getFindingMitigations}}</p>
48+
<h6>References</h6>
49+
<p>{{item:call:getFindingReferences}}</p>
50+
&emsp;
51+
</details>
52+
}}
53+
}
54+
55+
## Boundaries
56+
57+
{boundaries:repeat:
58+
Name|{{item.name}}
59+
|:----|:----|
60+
Description|{{item.description}}|
61+
In Scope|{{item.inScope}}|
62+
Immediate Parent|{{item.parents:if:{{item:call:getParentName}}}}{{item.parents:not:N/A, primary boundary}}|
63+
All Parents|{{item.parents:call:{{{{item.display_name:call:}}}}, }}|
64+
Classification|{{item.maxClassification}}|
65+
Finding Count|{{item:call:getFindingCount}}|
66+
67+
{{item:call:getInScopeFindings:
68+
**Threats**
69+
70+
<details>
71+
<summary>
72+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
73+
</summary>
74+
<h6>Targeted Element</h6>
75+
<p>{{item:call:getFindingTarget}}</p>
76+
<h6>Severity</h6>
77+
<p>{{item:call:getFindingSeverity}}</p>
78+
<h6>Example Instances</h6>
79+
<p>{{item:call:getFindingExample}}</p>
80+
<h6>Mitigations</h6>
81+
<p>{{item:call:getFindingMitigations}}</p>
82+
<h6>References</h6>
83+
<p>{{item:call:getFindingReferences}}</p>
84+
</details>
85+
}}
86+
}
87+
88+
89+
## Assets
90+
91+
{assets:repeat:
92+
Name|{{item.name}}|
93+
|:----|:----|
94+
Description|{{item.description}}|
95+
In Scope|{{item.inScope}}|
96+
Type|{{item:call:getElementType}}|
97+
Finding Count|{{item:call:getFindingCount}}|
98+
99+
{{item:call:getInScopeFindings:
100+
**Threats**
101+
102+
<details>
103+
<summary>
104+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
105+
</summary>
106+
<h6>Targeted Element</h6>
107+
<p>{{item:call:getFindingTarget}}</p>
108+
<h6>Severity</h6>
109+
<p>{{item:call:getFindingSeverity}}</p>
110+
<h6>Example Instances</h6>
111+
<p>{{item:call:getFindingExample}}</p>
112+
<h6>Mitigations</h6>
113+
<p>{{item:call:getFindingMitigations}}</p>
114+
<h6>References</h6>
115+
<p>{{item:call:getFindingReferences}}</p>
116+
</details>
117+
}}
118+
}
119+
120+
121+
## Data Flows
122+
123+
{dataflows:repeat:
124+
Name|{{item.name}}
125+
|:----|:----|
126+
Description|{{item.description}}|
127+
Sink|{{item.sink}}|
128+
Source|{{item.source}}|
129+
Is Response|{{item.isResponse}}|
130+
In Scope|{{item.inScope}}|
131+
Finding Count|{{item:call:getFindingCount}}|
132+
133+
{{item:call:getInScopeFindings:
134+
**Threats**
135+
136+
<details>
137+
<summary>
138+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
139+
</summary>
140+
<h6>Targeted Element</h6>
141+
<p>{{item:call:getFindingTarget}}</p>
142+
<h6>Severity</h6>
143+
<p>{{item:call:getFindingSeverity}}</p>
144+
<h6>Example Instances</h6>
145+
<p>{{item:call:getFindingExample}}</p>
146+
<h6>Mitigations</h6>
147+
<p>{{item:call:getFindingMitigations}}</p>
148+
<h6>References</h6>
149+
<p>{{item:call:getFindingReferences}}</p>
150+
</details>
151+
}}
152+
}
153+
154+
155+
{tm.excluded_findings:if:
156+
# Excluded Threats
157+
}
158+
159+
{tm.excluded_findings:repeat:
160+
<details>
161+
<summary>
162+
{{item:call:getThreatId}} — {{item:call:getFindingDescription}}
163+
</summary>
164+
<p>
165+
<b>{{item:call:getThreatId}}</b> was excluded for
166+
<b>{{item:call:getFindingTarget}}</b>
167+
because of the assumption "{{item.assumption.name}}"
168+
</p>
169+
{{item.assumption.description:if:
170+
<h6>Assumption description</h6>
171+
<p>{{item.assumption.description}}</p>
172+
}}
173+
<h6>Severity</h6>
174+
<p>{{item:call:getFindingSeverity}}</p>
175+
<h6>Example Instances</h6>
176+
<p>{{item:call:getFindingExample}}</p>
177+
<h6>References</h6>
178+
<p>{{item:call:getFindingReferences}}</p>
179+
</details>
180+
}

0 commit comments

Comments
 (0)