Home

Welcome to the STTK wiki!

About

Here we got some additional information outside code.

Aim of this project: provide good agile security threat modeling with least effort

Easy setup in development

Developers shall easily integrate a sttk-${major.minor.hotfix}.jar inside their sources (e.g. in a own gradle subproject), design and maintain their setup here when developing new features etc.

How security should go on in agile way

• Developers add STTK jar to sub project and design their system by fluent API in a JVM language as code see Example model 1
• Build server uses STTK generators to generate asciidoc on build + creates documentation via asciidoc tools like https://asciidoctor.github.io/asciidoctor-gradle-plugin/
• So developer got always an up-to-date architecural overview over their project
• Security experts/architects do not longer need to write documents from scratch, but discuss with developers changes by output of the STTK generators.
• Changes/additons are done by developers and or security experts directly in code, so history changes are easy to track by SCMs like GIT
• Documentation is always up-to-date and easy to maintain