OWASP Threat Dragon

cupcake logo

What is Threat Dragon?

OWASP Threat Dragon is a tool used to create threat model diagrams and to record possible threats and decide on their mitigations.

TD is both an online threat modelling web application and a desktop application. It includes system diagramming as well as a rule engine to auto-generate threats and their mitigations. The focus of TD is on great UX, a powerful rule engine and alignment with other development lifecycle tools.

The documentation is a good starting point, and there is also a recording of Mike Goodwin in a lightning demo recorded during the OWASP Open Security Summit in June 2020.

Threat Dragon has a demonstration page. This is on older version which is due to be updated soon, and the notable difference is that we now have a dekstop version that can be installed on linux - along with Windows and MacOS.

Company Collaborators

Many thanks to these companies for donating various projects to Threat Dragon :

OWASP participation

The Open Web Application Security Project (OWASP) is a nonprofit foundation that works to improve the security of software. All of our projects ,tools, documents, forums, and chapters are free and open to anyone interested in improving application security.

Everyone is welcome and encouraged to participate in our Projects, Local Chapters, Events, Online Groups, and Community Slack Channel. We especially encourage diversity in all our initiatives. OWASP is a fantastic place to learn about application security, to network, and even to build your reputation as an expert. We also encourage you to be become a member or consider a donation to support our ongoing work.


Description

Threat modelling is widely regarded as a powerful way to build security into the design of applications early in the development lifecycle. At its best, it is especially good for

  • Ensuring defence-in-depth
  • Establishing consistent security design patterns across an application
  • Flushing out security requirements and user stories

However, effective adoption by organisations can be difficult. Reasons for this include:

  • There are no cross-platform, free tools (that I am aware of)
  • The usability of existing tools is not great - productivity for the team is therefore poor, especially in the early stages of adoption
  • The learning curve for teams is steep - threat modelling often ends up being left to a small “expert” subset of a team and ignores the valuable perspectives from the wider team
  • Integration with other development lifecycle tools (e.g. issue tracking tools) is poor - leading to models being ignored

OWASP Threat Dragon addresses this by providing a free, open-source, threat modelling web application for teams implementing the STRIDE approach. The key areas of focus for the tool is:

  • Great UX - using Threat Dragon should be simple, engaging and fun
  • A powerful threat/mitigation rule engine - this lowers the barrier to entry for teams and allow non-specialists to contribute
  • Integration points with other development lifecycle tools - when implemented this will ensure that models slot easily into the development lifecycle and remain relevant as the project evolves

Getting Involved

Testers

Easy user experience is one of the key goals for the project and to get that right it needs more users! If you would like to try the tool out, that would be great.

The released version of the web application is at:

https://threatdragon.org/

For the desktop variant, installers for Linux, Windows and MacOS can be downloaded from:

https://github.com/mike-goodwin/owasp-threat-dragon-desktop/releases

To help you get started, take a look at the docs:

http://docs.threatdragon.org/

If you are still having problems, let us know and we will be pleased to help ([email protected] and [email protected]). All feedback is very welcome, so either email us or add an issue on the GitHub repo.

https://github.com/OWASP/threat-dragon-core/issues

Coding

Coding help of any kind is always welcome. The project builds easily (let us know if you have any problems) so getting up and running should be simple. There are some developer notes in the core threat dragon repo to help get started with this project.

Threat rule engine

If you are not into javascript, you can still help! We want to create a powerful threat generation rule engine to enhance the one that is in place for the early releases. If you can contribute in this area by defining rules, that would be great.


FAQs

Q1: What browsers can be used for Threat Dragon?

A1: Threat Dragon has been tested on these browsers, but there are certainly more.

Platform Browser Tested
Windows Edge Microsoft Edge 38 for Windows 10
Windows IE Internet Explorer 11 for Windows 10
Windows Chrome Windows 10
Windows Firefox Windows 10
Linux Abrowser Mozilla 68.0.2 for Trisquel / Gnu Linux trisquel 8.0
MacOS Firefox Firefox 73.0.1 for macOS version 10.15
MacOS Safari Safari 13.0.2 for macOS 10.15
MacOS Chrome Google Chrome 80.0 for macOS 10.15

Q2: Hold on…isn’t this the same as Mozilla’s SeaSponge?

A2: As Mike was working on prototyping this, mostly as a way of getting himself properly up to speed with javascript, he found out about SeaSponge via the OWASP leaders mailing list. SeaSponge has a lot in common with this project and Mike based his implementation of the threat model file download feature on theirs. Maybe they could be merged in the future? Who knows?

Q3: Why do the earlier releases come from Mike Goodwin’s repo, not the OWASP repo?

A3: For more than 4 years Mike hosted Threat Dragon on his personal github area, and in mid-2020 he felt that the time was right for it to migrate to the OWASP organisation github space. This was done through June and July 2020 and with version 1.3 (expected August 2020) the migration will be almost complete. The docs and demo pages are still sourced from Mike’s github space, which gives continuity to the origins of Threat Dragon.


Roadmap

Vision for the project:

The overall vision for the project is to implement a tool that removes as many barriers as possible for organisations wanting to embed threat modelling into their development lifecycle. Barriers I have seen are:

  • Lack of cross platform tooling: Tool needs to be x-platform
  • Poor UX in existing tools, productivity is poor: Great UX is a must
  • Steep learning curve for adopting teams: Tool to build in expert knowledge to help the team get started
  • Models are ignored: Integration with other lifecycle tools is key

Initial high level plan:

Milestone 1: Alpha release - Basic threat modelling experience

  • Architecture review of the existing prototype with refinement/change where required - complete: Confirmed JointJs works fine, Storage model changed and addition of Electon based desktop variant. Nools rule engine (no longer supported) replaced by json-rules-engine. Shifted from Grunt/Bower to NPM/Browserify
  • Secure design review and implementation of findings
  • Development of tests (unit and manual) - complete: Codecov report
  • Draft end user documentation - complete: GitHub pages
  • “Publicity drive” to sign up alpha/beta users and generate feedback Some progress on this. The desktop app has had 13k downloads - unclear how many people are actually using it. The GH repo for the desktop version has 79 stars. The web version gets about 94 unique visitors per day on average and the GH repo has 229 stars.

Milestone 2: Beta release - Threat/mitigation rule engine

  • Refinement of UX based on feedback from the alpha release
  • (Some) feature enhancements based on feedback from the alpha release Implemented some feature requests (e.g. snap-to-grid) and fixed issues reports (e.g. save bugs) by users
  • Implementation of a rule engine for generation of threats/mitigations
  • Updated tests and end-user documentation

Milestone 3: Release 1

  • Key refinements, bug fixes and new features based on feedback from the beta release
  • Complete end user documentation
  • Penetration test

Milestone 4 - Dev lifecycle integration

  • Detailed scope to be defined, but in general the vision is to support hooks into issue tracking and requirements management tool so that threats/mitigations can be tracked through to implementation and test

Timeframes

This is hard to estimate as it could change a lot if there were other developers involved. Based on my current velocity with just me, I would say release 1 could be complete in 1 year (optimistically).

Technology

The technical architecture is javascript from top to bottom. In the client the key libraries are Angular for the MVC architecture and JointJS for the diagramming. JointJS has a log of great features, but is not a perfect fit for Angular. This needs a review. In the prototype, all storage is done on the client using browser local storage.

Following an architecture review the following key changes were made:

  • A new Electron based, installable desktop variant was introduced using the local file system for model storage
  • The web variant was changed to use GitHub for model storage - other source control systems will follow (e.g. BitBucket)
  • Seperation of common code into a new NPM package, shared between the web and desktop variants
  • The Nools rule engine will be replaced since it is no longer maintained

Challenges

  • Getting enough usage of the alpha and beta to get the UX and rule engine right
  • Finding a sustainable way to host it, especially to support deeper GitHub/BitBucket/Etc. integration

Minimum Viable Product

  1. Application source code for a threat modeling tool
  2. End user documentation for the tool
  3. An online hosted version of the tool
  4. An installable, cross-platform desktop version of the tool

Releases

Release Date Location Comments
TBD v1.3 Expected
August 2020
Web app
Desktop
Will include
support for LINDDUN and CIA as well as STRIDE
command line interface
some bug fixes
v1.2 14 April 2020 Web app
Desktop
description for diagram elements
label applied to boundaries
save button always enabled
zoom functionality disabled
hot key copy and paste for diagram elements
v1.1 15 Mar 2020 Web app Duplicate element/diagram feature
v1.1 10 Mar 2020 Desktop Bug fix for blank screen on new model,
and duplicate element/diagram feature
v1.0 22 Feb 2020 Desktop First full release for Windows, MacOS and Linux
v0.1.27-alpha 28 Jul 2019 Desktop Windows only
v0.1.26 16 May 2017 Desktop MacOS and Windows only
0.3.0 14 Mar 2017 Web app  
v0.1.1-alpha 14 Mar 2016 Web app