Package: materialize-threats-nathan
materialize threats.
                              '             .           .
                           o       '   o  .     '   . O
                        '   .   ' .   _____  '    .      .
                         .     .   .mMMMMMMMm.  '  o  '   .
                       '   .     .MMXXXXXXXXXMM.    .   ' 
                      .       . /XX77:::::::77XX\ .   .   .
                         o  .  ;X7:::''''''':::7X;   .  '
                        '    . |::'.:'        '::| .   .  .
                           .   ;:.:.            :;. o   .
                        '     . \'.:            /.    '   .
                           .     `.':.        .'.  '    .
                         '   . '  .`-._____.-'   .  . '  .
                          ' o   '  .   O   .   '  o    '
                           . ' .  ' . '  ' O   . '  '   '
                            . .   '    '  .  '   . '  '
                             . .'..' . ' ' . . '.  . '
                              `.':.'        ':'.'.'
                                `\\_  |     _//'
                                  \(  |\    )/
                                  //\ |_\  /\\
                                 (/ /\(" )/\ \)
                                  \/\ (  ) /\/
                                     |(  )|
                                     | \( \
                                     |  )  \
                                     |      \
                                     |       \
                                     |wizardsh`.__,_
                                     \_________.-'
It's magic.:confetti_ball: Who is this for?Developers and security practitioners who want to perform 'graph' analysis on data flow diagrams -using SQL.materialize-threatsingests draw.io data flow diagrams into a database, represents them like a property graph, then uses SQL to answer questions about them.Today, we can answer questions like:What STRIDE based threat classes :warning: impact which elements and flows in my diagram?What mitigations :lock: & test cases :white_check_mark: should be considered for this diagram?These are just a few ideas.:moneybag: What's in the box?materialize_threats python moduleParsedraw.iodata flow diagrams into graph representation (nodes, edges) stored in a RDBMS (sqlite in this demo)SQL (ORM) implementation ofRapid Threat Model Prototyping methodologyused to generate threat classes(Optional) Minimal Draw.io shape library (dfd-materialize.xml)Tag trust zones more easilyGherkin+STRIDEtest plan/feature file generator:wrench: How do I use it?Demo1. Creating the diagramUsedraw.iowith the built-in threat modeling shape set, or use oursCreate a data flow diagram using some guidelinesUse processes between entities to describe flowsExample: [Entity: Browser] --> (Process: Login) ----> [Entity: API]Identify trust zones using the green 'security control label' following theRapid Threat Model Prototyping methodologyprocessuntrusted sources (entities) are 0sinks (data store) are <=9+1 or -1 in betweenProcesses inherit trust zones from the upstream entitySave it as a .drawio file in a convenient locationSome notes about how to make the diagram:You don't need to include a Trust Boundary - it won't get parsed and has no bearing on the threats which appearYou don't need to include the STRIDE labels - we generate the threats for you!Bi-directional flows are currently not supported - flows move in one direction. In some cases, data might flow from Entity A to Entity B, while data also flows from Entity B to Entity A; model these as two separate flows and you'll be fine.Entities must talk to other entities through processes - the process is mandatory and must be included.Example2. Enumerating threatspip install materialize-threats
materialize-threats --diagram=/path/to/diagram.drawio3. Creating the feature fileMaterialize threats will create a Gherkin feature file with boilerplate scenarios and mitigations, along with remediation tips. By default, it uses the diagram filename.:mag_right: Sample datamaterialize-threatsMore samples can be found in the /samples directorymaterialize-threats --diagram=samples/bookface.drawio:warning: Is this production ready?Not yet.There are no tests written, but im pretty sure it works.Lots of other python stuff that might horrify you but wont impact functionality that I know of.:computer: Developmentgit clone git@github.com:secmerc/materialize_threats.git
cd materialize_threats
python3 -m venv ./venv
source ./venv/bin/activate
pip install -e .
pytestPublishingpython3-mpipinstall--user--upgradesetuptoolswheeltwine

python3setup.pysdistbdist_wheel
python3-mtwineuploaddist/*:link: Linkshttps://docs.microsoft.com/en-us/archive/blogs/larryosterman/threat-modeling-again-presenting-the-playsound-threat-modelhttps://github.com/geoffrey-hill-tutamantic/rapid-threat-model-prototyping-docs