OWASP Threat Dragon

Releases

Threat Dragon: making threat modeling less threatening

FAQs

• Where are the arrows that allow me to create data flows?

• Why do the earlier releases come from Mike Goodwin’s repo, not the OWASP repo?

• I get failures when installing from source code

• I get a failure when printing a report

• Why do I get ‘OWASP-Threat-Dragon-Setup isn’t commonly downloaded’ warnings after downloading on Windows?

• Why do I get ‘Apple cannot check it for malicious software’ errors after installing on MacOS?

• Why do I get ‘Permissions failure opening Mac desktop app’ when installing from the zip file?

• Why do I get ‘developer can not be verified’ errors after installing on MacOS?

• Can I run Threat Dragon Desktop from a command line?

• Is there a command line interface for Threat Dragon Desktop?

• What browsers can be used for Threat Dragon?

• Hold on…isn’t this the same as Mozilla’s SeaSponge?

• When is Threat Dragon’s birthday? And does Threat Dragon have a theme tune?

Threat Dragon: making threat modeling less threatening

Version 2.5: in progress

• provide an API for CI/CD pipelines
• provide a CLI for scripting based on TD’s existing use of yargs

Version 2.3: released December 2024

• automated threats (both by element and by OATS)

Version 2.2: released February 2024

Threat model access for web app:

• load models from various repos :
  • github enterprise
  • gitlab
  • github enterprise
  • BitBucket

Version 2.1: released October 2023

Stable version of 2.x.x with bug fixes and usable diagram tools. Still not feature complete:

• missing CLI for scripting based
• missing automated threats (both by element and by OATS)

Version 2.0: released February 2023

migrate to a combined application for both desktop and webapp:

• be strictly open source
• use Vue for frontend application
• use @antv/g6 for the drawing library
• frontend logging using bunyan and optional logging to the console during development
• use electron to wrap webapp for desktop
• provide auto-update using electron
• expand electron unit tests using WDIO Electron Service
• webapp unit test framework Jest
• component test Vue testing library
• end-to-end test cypress
• set up ZAP to provide security testing on commit
• design files are to be backwardly compatible to Threat Dragon json

demonstration pages:

• an online demonstration to be provided on threat dragon’s site
• demo should either be a snapshot or a release version

Version 1.4: released May 2021

• written in javascript ES6 / ECMAScript 2015 or compatible
• run on node.js server
• use express for backend application
• provide a dockerfile for running in docker, similar to existing TD
• static code analysis using ESLint
• webapp test runner Karma with Jasmine for Vue Test Utils
• backend unit test framework MochaJS and assertions from chai
• bundle the application and api for production using webpack
• be strictly open source, avoiding using languages or frameworks maintained outside the open source community

documentation:

• documentation should be updated at the threat dragon github pages
• version 1.x docs are preserved and migrated to version 2.0
• docs should be static pages based on Jekyll and markdown

Previous versions

Mike Goodwin’s initial roadmap for the project is archived here. The original roadmap had various milestones, most of which were achieved by late 2020.

Milestone 4: Dev lifecycle integration

• Some CLI interface available mid 2020

Milestone 3: Release 1.0

• production version released February 2020
• version 1.3.1 released October 2020

Milestone 2: Beta release: Threat/mitigation rule engine

• achieved May 2017 with version 0.1.26

Milestone 1: Alpha release - Basic threat modelling experience

• achieved October 2015

Threat Dragon: making threat modeling less threatening

Threat Model File (TMF) format

Threat Dragon version 1.x and Threat Dragon version 2.x use closely related but incompatible JSON file formats. In addition both these file formats are arranged around diagram elements used by the graph editing engines: JointJS for version 1.x and AntV/X6 for version2.x. The data model use in the Threat Dragon file format would be better centred round threat model information rather than the data used for the graph editing.

Both Threat Dragon file formats are incompatible with other open source Threat Modeling files such as pytm, Threagile and Open Threat Model.

The intention is to change the model file format in Threat Dragon version 3.x onwards. The goal will be to define a schema that is flexible enough to easily convert from the existing:

• OWASP Threat Dragon versions 1.x and 2.x
• OWASP pytm pythonic threat modeling
• Threagile open-source toolkit for agile threat modeling
• Open Threat Model (OTM) file format

There is an open discussion for suggestions and debate on this subject.