Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

https://github.com/rusakovichma/TicTaaC

Easy-to-use Threat modeling-as-a-Code (TaaC) solution following DevSecOps principles. Simple CI/CD integration as well as console usage. Sugar-Free and Secure: no any external dependencies except for chart plotting are used
https://github.com/rusakovichma/TicTaaC

application-security appsec devsecops secure-development threat threat-model threat-modeling threat-modeling-from-code threat-modeling-tool threat-models

Last synced: 3 months ago
JSON representation

Easy-to-use Threat modeling-as-a-Code (TaaC) solution following DevSecOps principles. Simple CI/CD integration as well as console usage. Sugar-Free and Secure: no any external dependencies except for chart plotting are used

Lists

README 

        
# [![TicTaaC](https://raw.githubusercontent.com/rusakovichma/TicTaaC/master/etc/tic-taac-logo-40per.png)](https://github.com/rusakovichma/TicTaaC) [![Join the chat at https://gitter.im/TicTaaC/TicTaaC-support](https://badges.gitter.im/TicTaaC/TicTaaC-support.svg)](https://gitter.im/TicTaaC/TicTaaC-support?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) [![CI](https://github.com/rusakovichma/TicTaaC/actions/workflows/ci.yml/badge.svg)](https://github.com/rusakovichma/TicTaaC/actions/workflows/ci.yml) [![Testing](https://github.com/rusakovichma/TicTaaC/actions/workflows/tests.yml/badge.svg)](https://github.com/rusakovichma/TicTaaC/actions/workflows/tests.yml)


 Threat modeling-as-a-Code in a Tick (TicTaaC)

Lightweight and easy-to-use Threat modeling solution following DevSecOps principles



## Preface

"One day the customer asked to perform threat modeling for our product. Of course, we have heard about it a lot

from different teams, I have even read several articles and looked through a book to get familiar with this process,

but they were too abstract as for me and didn't give me a certainty at all. Then we have faced several enterprise - level 

products which theoretically would help us, but we didn't want to deploy the whole security program because of it, 

we just wanted to get the prioritized threats list for our product to put it in our security backlog. Nothing else"

Anonymous Developer



## Idea

The idea behind this product is clear - I want to create something simple that would help to solve this difficult problem.

Ideally, with one click or a command and with a possibility to integrate it into a pipeline and do it continuously if needed. Inspired by dependency-check architecture and simplicity plus taking in mind that developers just love mapping everything in code, I've created "TicTaaC", which means "Threat modeling-as-a-Code in a Tick"



## Usage

All the tool is needed is a data flow code file described in the yml-like format specially designed for this.


The examples of these files with verbose comments describing every aspect may be found [here](https://github.com/rusakovichma/TicTaaC/tree/master/expl). 



### Command Line

More detailed instructions can be found on the

[github wiki](https://github.com/rusakovichma/TicTaaC/wiki).

The latest CLI can be downloaded from github in the [releases section](https://github.com/rusakovichma/TicTaaC/releases). 


On *nix:

```

$ ./bin/tic-taac.sh -h

$ ./bin/tic-taac.sh --out . --threatModel [path to threat model file(s) or folder to scan]

```

On Windows:

```

> .\bin\tic-taac.bat -h

> .\bin\tic-taac.bat --out . --threatModel [path to threat model file(s) or folder to scan]

```



### Docker

See [TicTaaC Docker Hub repository](https://hub.docker.com/r/rusakovichma/tic-taac).



Quickstart on Windows:

```

> docker run --volume /D/threat-model:/threat-model --volume /D/report:/report rusakovichma/tic-taac:latest --threatModel /threat-model/ --out /report

```



*nix script:

```console

#!/bin/sh



TT_VERSION="latest"

THREAT_MODEL_DIR=$HOME/threat-model



# Make sure we are using the latest version

docker pull rusakovichma/tic-taac:$TT_VERSION



docker run --rm \

    -e user=$USER \

    -u $(id -u ${USER}):$(id -g ${USER}) \

    --volume $THREAT_MODEL_DIR:/threat-model:z \

    --volume $(pwd)/report:/report:z \

    rusakovichma/tic-taac:$TT_VERSION \

    --threatModel /threat-model \

    --outFormat html \

    --out /report

    # Set mitigation strategy for the corresponding threats

    # see https://github.com/rusakovichma/TicTaaC/blob/master/expl/mitigations.yml 

    # --mitigations /threat-model/mitigations.yml 

    # or set the folder where scan the mitigations files: --mitigations /mitigations

```

### Jenkins pipeline

For TicTaaC usage at Jenkins pipeline, see [Jenkinsfile example](https://github.com/rusakovichma/TicTaaC/blob/master/cicd/Jenkinsfile).



## Data Flows Examples

* [Simple Threat Model](https://github.com/rusakovichma/TicTaaC/blob/master/expl/simpest-threat-model.yml)

* [Intermediate Model](https://github.com/rusakovichma/TicTaaC/blob/master/expl/intermediate-threat-model.yml)

* [Advanced Model](https://github.com/rusakovichma/TicTaaC/blob/master/expl/advanced-threat-model.yml)



## Generated report example

![Threat Modeling Report Example](https://raw.githubusercontent.com/rusakovichma/TicTaaC/master/etc/threat-modeling-report-example.png)



## Features

* [x] Automatic Data Flow generation in a report

* [x] Ideal for Security Teams - it has flexible [Threats Library logic](https://github.com/rusakovichma/TicTaaC/blob/master/src/main/resources/threats-library/default-threats-library.yml) customization in a separate file with special expression language support

* [x] Suitable for [CICD pipeline integration](https://github.com/rusakovichma/TicTaaC/blob/master/cicd/Jenkinsfile)

* [X] Setting Quality Gate that can block the product release in case if unmitigated threats are presented

* [x] No *required* additional dependencies

* [x] Special [lightweight and easy-to-understand format](https://github.com/rusakovichma/TicTaaC/blob/master/expl/simpest-threat-model.yml) for data flows description

* [x] Automatic Threats Attack Vector & Risk Score calculation based on the data flow context

* [x] Threats classification by OWASP Top 10 and Microsoft STRIDE

* [x] Setting Threats mitigation strategy in [one place](https://github.com/rusakovichma/TicTaaC/blob/master/expl/mitigations.yml)

* [x] Reporting in html or json format



## License



Copyright (c) Mikhail Rusakovich



Licensed under the [Apache License version 2.0](LICENSE)