Package: tmac
tmacAgile Threat Modeling as CodeClose to the code - close to developersInstallpipinstalltmacHow to usepython3tmac.py#!/usr/bin/env python3fromtmacimport(Model,Process,Protocol,Score,TableFormat,Technology,TrustBoundary,)fromtmac.plusimportBrowser,Databasemodel=Model("Demo Model",description="Sample description")internet=TrustBoundary(model,"Internet")dmz=TrustBoundary(model,"DMZ")intranet=TrustBoundary(model,"Intranet")browser=Browser(model,"Browser",trust_boundary=internet)web_server=Process(model,"WebServer",technology=Technology.WEB_APPLICATION,trust_boundary=dmz,)database=Database(model,"Database",trust_boundary=intranet,)web_traffic=browser.add_data_flow("WebTraffic",destination=web_server,protocol=Protocol.HTTPS,)web_traffic.transfers("UserCredentials",confidentiality=Score.HIGH,integrity=Score.HIGH,availability=Score.HIGH,)database_traffic=web_server.add_data_flow("DatabaseTraffic",destination=database,protocol=Protocol.SQL,)database_traffic.transfers("UserDetails",confidentiality=Score.HIGH,integrity=Score.HIGH,availability=Score.HIGH,)print(model.risks_table(table_format=TableFormat.GITHUB))Output:IDCategoryRiskTreatmentCAPEC-62@WebServer@WebTrafficSubvert Access ControlCross-Site Request Forgery (CSRF) risk at WebServer via WebTraffic from Browserin-progressCAPEC-63@WebServerInject Unexpected ItemsCross-Site Scripting (XSS) risk at WebServeracceptedCAPEC-66@WebServer@DatabaseTrafficInject Unexpected ItemsSQL Injection risk at WebServer against database Database via DatabaseTrafficmitigated............print(model.create_backlog_table(table_format=TableFormat.GITHUB))Output:IDCategoryUser StoryStateASVS-13.2.3@CAPEC-62@WebServer@WebTrafficRESTful Web ServiceVerify that RESTful web services that utilize cookies are protected from Cross-Site Request Forgery via the use of at least one or more of the following: double submit cookie pattern, CSRF nonces, or Origin request header checks.draftASVS-5.3.5@CAPEC-66@WebServer@DatabaseTrafficOutput Encoding and Injection PreventionVerify that where parameterized or safer mechanisms are not present, context-specific output encoding is used to protect against injection attacks, such as the use of SQL escaping to protect against SQL injection.closedASVS-1.2.3@CAPEC-62@WebServer@WebTrafficAuthentication ArchitectureVerify that the application uses a single vetted authentication mechanism that is known to be secure, can be extended to include strong authentication, and has sufficient logging and monitoring to detect account abuse or breaches.in-progress............Jupyter ThreatbooksThreat modeling with jupyter notebooksGenerating Diagramsmodel.create_data_flow_diagram()High level elements (tmac/plus*)fromtmac.plus_awsimportApplicationLoadBalancer# ...alb=ApplicationLoadBalancer(model,"ALB",waf=True)Custom ThreatLibraryfromtmacimportModel,ThreatLibrarylib=ThreatLibrary()lib.add_threat("""... your custom threats ...""")model=Model("Demo Model",threat_library=lib)ExamplesSee more completeexamples.Prior work and other related projectspytm- A Pythonic framework for threat modelingthreagile- Agile Threat Modeling Toolkitcdk-threagile- Agile Threat Modeling as CodeOpenThreatModel- OpenThreatModelLicenseMIT