OWASP Threat Dragon

Threat modeling is widely regarded as a powerful way to build security into the design of applications early in a secure development lifecycle. At its best, it is especially good for:

• Ensuring defence-in-depth
• Establishing consistent security design patterns across an application
• Flushing out security requirements and user stories

OWASP Threat Dragon provides a free, open-source, threat modeling application for teams implementing the STRIDE approach. It can also be used for categorising threats using LINDDUN and CIA. The key areas of focus for the tool is:

• Great UX - using Threat Dragon should be simple, engaging and fun
• A powerful threat/mitigation rule engine - this lowers the barrier to entry for teams and allow non-specialists to contribute
• Integration points with other development lifecycle tools - when implemented this will ensure that models slot easily into the development lifecycle and remain relevant as the project evolves

Testers

Easy user experience is one of the key goals for the project and to get that right it needs more users! If you would like to try the tool out, the released versions are on the github release area.

The desktop variant has installers for Linux, Windows and MacOS which be downloaded from the github release area.

To help you get started, take a look at the documentation area.

If you are still having problems, let us know and we will be pleased to help ([email protected] and [email protected]). All feedback is very welcome, so either email us or add an issue on the GitHub repo.

Coding

Coding help of any kind is always welcome. The project builds easily (let us know if you have any problems) so getting up and running should be simple. There are some developer notes in the threat dragon repo to help get started with this project.

Threat rule engine

If you are not into javascript, you can still help! We want to create a powerful threat generation rule engine to enhance the one that is in place for the early releases. If you can contribute in this area by defining rules, that would be great.

FAQs

• Why do the earlier releases come from Mike Goodwin’s repo, not the OWASP repo?

• Why do I get ‘developer can not be verified’ errors after installing on MacOS?

• Can I run Threat Dragon Desktop from a command line?

• Is there a command line interface for Threat Dragon Desktop?

• What browsers can be used for Threat Dragon?

• Hold on…isn’t this the same as Mozilla’s SeaSponge?

Version 2.0: in development and planned for late 2022

migrate to a combined application for both desktop and webapp

• be strictly open source
• use Vue for frontend application
• use @antv/g6 for the drawing library
• provide an API for CI/CD pipelines, see here for an example
• provide a CLI for scripting based on TD’s existing use of yargs
• frontend logging using bunyan and optional logging to the console during development
• use electron to wrap webapp for desktop
• provide auto-update using electron
• expand electron unit tests using WDIO Electron Service
• webapp unit test framework Jest
• component test Vue testing library
• end-to-end test cypress
• set up ZAP to provide security testing on commit, similar to existing TD
• in progress provide multiple methods of authentication and access similar to draw.io login page

model access for both desktop and web app:

• load models from various sources similar to drawio:
  • github
  • gitlab
  • Google Drive
  • OneDrive
  • Dropbox
  • local filesystem device
• design files are to be backwardly compatible to Threat Dragon json

demonstration pages:

• an online demonstration to be provided on threat dragon’s site
• demo should either be a snapshot or a release version

Version 1.4: released May 2021

• written in javascript ES6 / ECMAScript 2015 or compatible
• run on node.js server
• use express for backend application
• provide a dockerfile for running in docker, similar to existing TD
• static code analysis using ESLint
• webapp test runner Karma with Jasmine for Vue Test Utils
• backend unit test framework MochaJS and assertions from chai
• bundle the application and api for production using webpack
• be strictly open source, avoiding using languages or frameworks maintained outside the open source community

documentation:

• documentation should be updated at the threat dragon github pages
• version 1.x docs are preserved and migrated to version 2.0
• docs should be static pages based on Jekyll and markdown

Previous versions

Mike Goodwin’s initial roadmap for the project is archived here. The original roadmap had various milestones, most of which were achieved by late 2020.

Milestone 4: - Dev lifecycle integration

• Still to be completed, some CLI interface available mid 2020

Milestone 3: Release 1.0

• production version released February 2020
• version 1.3.1 released October 2020

Milestone 2: Beta release - Threat/mitigation rule engine

• achieved May 2017 with version 0.1.26

Milestone 1: Alpha release - Basic threat modelling experience

• achieved October 2015

Releases