Skip to content

Commit 8dd08d0

Browse files
author
jon gadsden
committed
release version 2.1.2
1 parent 70fad8e commit 8dd08d0

File tree

8 files changed

+343
-23
lines changed

8 files changed

+343
-23
lines changed

‎ThreatDragonModels/example-open-threat-model.json‎

Lines changed: 320 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,320 @@
1+
{
2+
"otmVersion": "0.2.0",
3+
"project": {
4+
"name": "Test project",
5+
"id": "test-project",
6+
"description": "This is a test project for the OTM development",
7+
"owner": "John Doe",
8+
"ownerContact": "[email protected]",
9+
"attributes": {
10+
"cmdbId": "MyApp123"
11+
}
12+
},
13+
"representations": [
14+
{
15+
"name": "Architecture Diagram",
16+
"id": "architecture-diagram",
17+
"type": "diagram",
18+
"size": {
19+
"width": 1000,
20+
"height": 1100
21+
},
22+
"attributes": null
23+
},
24+
{
25+
"name": "Application Code",
26+
"id": "application-code",
27+
"type": "code",
28+
"repository": {
29+
"url": "https://github.com/my-project"
30+
},
31+
"attributes": null
32+
}
33+
],
34+
"assets": [
35+
{
36+
"name": "Credit Card Data",
37+
"id": "cc-data",
38+
"description": "Credit card numbers used for payments in the platform",
39+
"risk": {
40+
"confidentiality": 100,
41+
"integrity": 100,
42+
"availability": 100,
43+
"riskComments": "We have decided that the values are a 100 for all values since this highly sensitive information"
44+
},
45+
"attributes": null
46+
},
47+
{
48+
"name": "Public Info",
49+
"id": "public-info",
50+
"description": "Public information meant to be seen by any interested customer",
51+
"risk": {
52+
"confidentiality": 0,
53+
"integrity": 100,
54+
"availability": 50,
55+
"riskComments": "Public information has no confidentiality at all but it is quite important for it to be available and to not be changed by attakers"
56+
},
57+
"attributes": null
58+
}
59+
],
60+
"components": [
61+
{
62+
"name": "Web Client",
63+
"id": "web-client",
64+
"description": "It represent a connection from the internet to our ecosystem",
65+
"parent": {
66+
"trustZone": "f0ba7722-39b6-4c81-8290-a30a248bb8d9"
67+
},
68+
"type": "web-client",
69+
"tags": [
70+
"external"
71+
],
72+
"representations": [
73+
{
74+
"representation": "architecture-diagram",
75+
"id": "web-client-box",
76+
"position": {
77+
"x": 100,
78+
"y": 100
79+
},
80+
"size": {
81+
"width": 50,
82+
"height": 50
83+
}
84+
}
85+
],
86+
"assets": null,
87+
"threats": null,
88+
"attributes": null
89+
},
90+
{
91+
"name": "Web Service",
92+
"id": "web-service",
93+
"description": "Runs our web application",
94+
"parent": {
95+
"trustZone": "2ab4effa-40b7-4cd2-ba81-8247d29a6f2d"
96+
},
97+
"type": "web-service",
98+
"tags": [
99+
"tomcat"
100+
],
101+
"representations": [
102+
{
103+
"representation": "architecture-diagram",
104+
"id": "web-service-box",
105+
"position": {
106+
"x": 100,
107+
"y": 100
108+
},
109+
"size": {
110+
"width": 50,
111+
"height": 50
112+
}
113+
}
114+
],
115+
"assets": {
116+
"processed": [
117+
"cc-data",
118+
"public-info"
119+
],
120+
"stored": [
121+
"public-info"
122+
]
123+
},
124+
"threats": [
125+
{
126+
"threat": "22724267-be7e-44c0-8b1f-d7d33e9a34ec",
127+
"state": "exposed",
128+
"mitigations": [
129+
{
130+
"mitigation": "fd6136f4-e2ff-11eb-ba80-0242ac130004",
131+
"state": "implemented"
132+
}
133+
]
134+
}
135+
],
136+
"attributes": null
137+
},
138+
{
139+
"name": "Customer Database",
140+
"id": "customer-database",
141+
"description": "Postgres database",
142+
"parent": {
143+
"trustZone": "2ab4effa-40b7-4cd2-ba81-8247d29a6f2d"
144+
},
145+
"type": "database",
146+
"tags": [
147+
"postgres"
148+
],
149+
"representations": [
150+
{
151+
"representation": "architecture-diagram",
152+
"id": "box-for-postgress-DB",
153+
"position": {
154+
"x": 200,
155+
"y": 100
156+
},
157+
"size": {
158+
"width": 50,
159+
"height": 50
160+
}
161+
}
162+
],
163+
"attributes": null
164+
},
165+
{
166+
"name": "Class CustomerDatabase",
167+
"id": "class-customerdatabase",
168+
"description": "Managages customer database",
169+
"type": "code-class",
170+
"parent": {
171+
"trustZone": "2ab4effa-40b7-4cd2-ba81-8247d29a6f2d"
172+
},
173+
"representations": [
174+
{
175+
"representation": "application-code",
176+
"id": "database class",
177+
"package": "com.open.threat.model",
178+
"file": "src/main/otm-file/OTMClass.java",
179+
"line": 324,
180+
"codeSnippet": "public void createOTM(String[] args) { Scanner reader = new Scanner(System.in); System.out.print(\"Enter a number: \"); int number = reader.nextInt() System.out.println(\"You entered: \" + number); }"
181+
}
182+
],
183+
"attributes": null
184+
}
185+
],
186+
"dataflows": [
187+
{
188+
"name": "Dataflow between webclient and webservice.",
189+
"id": "webclient-to-webservice",
190+
"bidirectional": true,
191+
"source": "web-client",
192+
"destination": "web-service",
193+
"tags": null,
194+
"assets": null,
195+
"representations": null,
196+
"threats": null,
197+
"attributes": null
198+
},
199+
{
200+
"name": "Dataflow between webservice and mongo.",
201+
"id": "cc-store-in-db",
202+
"bidirectional": true,
203+
"source": "web-service",
204+
"destination": "customer-database",
205+
"tags": [
206+
"tag1-df",
207+
"tag2-df"
208+
],
209+
"assets": [
210+
"cc-data"
211+
],
212+
"representations": null,
213+
"threats": [
214+
{
215+
"threat": "22724267-be7e-44c0-8b1f-d7d33e9a34ec",
216+
"state": "exposed",
217+
"mitigations": [
218+
{
219+
"mitigation": "fd6136f4-e2ff-11eb-ba80-0242ac130004",
220+
"state": "required"
221+
}
222+
]
223+
}
224+
],
225+
"attributes": null
226+
}
227+
],
228+
"trustZones": [
229+
{
230+
"name": "Internet",
231+
"id": "f0ba7722-39b6-4c81-8290-a30a248bb8d9",
232+
"type": "internet",
233+
"description": "This is the internet trust zone",
234+
"risk": {
235+
"trustRating": 20
236+
},
237+
"representations": [
238+
{
239+
"representation": "architecture-diagram",
240+
"id": "internet-box-shape",
241+
"position": {
242+
"x": 600,
243+
"y": 100
244+
},
245+
"size": {
246+
"width": 100,
247+
"height": 100
248+
}
249+
}
250+
],
251+
"attributes": null
252+
},
253+
{
254+
"name": "Private",
255+
"id": "2ab4effa-40b7-4cd2-ba81-8247d29a6f2d",
256+
"type": "private",
257+
"description": "Private trustzone for protected components",
258+
"risk": {
259+
"trustRating": 100
260+
},
261+
"representations": [
262+
{
263+
"representation": "architecture-diagram",
264+
"id": "private-box-shape",
265+
"position": {
266+
"x": 0,
267+
"y": 0
268+
},
269+
"size": {
270+
"width": 100,
271+
"height": 100
272+
}
273+
}
274+
],
275+
"attributes": null
276+
}
277+
],
278+
"threats": [
279+
{
280+
"name": "Threat 1",
281+
"id": "22724267-be7e-44c0-8b1f-d7d33e9a34ec",
282+
"description": "Description fo the threat number 1",
283+
"categories": [
284+
"Spoofing",
285+
"Tampering"
286+
],
287+
"cwes": [
288+
"CWE-79",
289+
"CWE-787"
290+
],
291+
"risk": {
292+
"likelihood": 50,
293+
"likelihoodComment": "It is reasonable to think this might happen but it requires for the attaketr to have a deep cyprografy knowledge",
294+
"impact": 100,
295+
"impactComment": "If this threat becomes a rallity company will strruggle to keep customers and the monetory loss would jeopardise the whole company"
296+
},
297+
"attributes": null,
298+
"tags": [
299+
"sql",
300+
"cwe-123"
301+
]
302+
}
303+
],
304+
"mitigations": [
305+
{
306+
"name": "This is the name of mitigation 1",
307+
"id": "fd6136f4-e2ff-11eb-ba80-0242ac130004",
308+
"description": "Description for mitigation 1",
309+
"riskReduction": 50,
310+
"attributes": null
311+
},
312+
{
313+
"name": "Mitigation 2",
314+
"id": "3b837730-e300-11eb-ba80-0242ac130004",
315+
"description": "Description for mitigation 2",
316+
"riskReduction": 100,
317+
"attributes": null
318+
}
319+
]
320+
}

‎package-lock.json‎

Lines changed: 2 additions & 2 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎package.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"name": "threat-dragon",
3-
"version": "2.1.1",
3+
"version": "2.1.2",
44
"private": true,
55
"scripts": {
66
"audit": "npm-run-all -c audit:server audit:site",

0 commit comments

Comments
 (0)