Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/rusakovichma/TicTaaC

Easy-to-use Threat modeling-as-a-Code (TaaC) solution following DevSecOps principles. Simple CI/CD integration as well as console usage. Sugar-Free and Secure: no any external dependencies except for chart plotting are used
https://github.com/rusakovichma/TicTaaC

application-security appsec devsecops secure-development threat threat-model threat-modeling threat-modeling-from-code threat-modeling-tool threat-models

Last synced: 3 months ago
JSON representation

Host: GitHub
URL: https://github.com/rusakovichma/TicTaaC
Owner: rusakovichma
License: apache-2.0
Created: 2021-08-26T10:30:22.000Z (about 3 years ago)
Default Branch: master
Last Pushed: 2023-12-18T21:53:15.000Z (11 months ago)
Last Synced: 2024-04-08T11:35:08.602Z (7 months ago)
Topics: application-security, appsec, devsecops, secure-development, threat, threat-model, threat-modeling, threat-modeling-from-code, threat-modeling-tool, threat-models
Language: Java
Homepage:
Size: 741 KB
Stars: 46
Watchers: 4
Forks: 11
Open Issues: 6
Metadata Files:
- Readme: README.md
- License: LICENSE.txt
- Security: SECURITY.md

Awesome Lists containing this project

awesome-threat-modelling - TicTaaC - Threat modeling-as-a-Code in a Tick (TicTaaC). Lightweight and easy-to-use Threat modeling solution following DevSecOps principles (Tools / Free tools)

README

# [![TicTaaC](https://raw.githubusercontent.com/rusakovichma/TicTaaC/master/etc/tic-taac-logo-40per.png)](https://github.com/rusakovichma/TicTaaC) [![Join the chat at https://gitter.im/TicTaaC/TicTaaC-support](https://badges.gitter.im/TicTaaC/TicTaaC-support.svg)](https://gitter.im/TicTaaC/TicTaaC-support?utm_source=badge&utm_medium=badge&utm_campaign=pr-badge&utm_content=badge) [![CI](https://github.com/rusakovichma/TicTaaC/actions/workflows/ci.yml/badge.svg)](https://github.com/rusakovichma/TicTaaC/actions/workflows/ci.yml) [![Testing](https://github.com/rusakovichma/TicTaaC/actions/workflows/tests.yml/badge.svg)](https://github.com/rusakovichma/TicTaaC/actions/workflows/tests.yml)

Threat modeling-as-a-Code in a Tick (TicTaaC)
Lightweight and easy-to-use Threat modeling solution following DevSecOps principles

## Preface
"One day the customer asked to perform threat modeling for our product. Of course, we have heard about it a lot
from different teams, I have even read several articles and looked through a book to get familiar with this process,
but they were too abstract as for me and didn't give me a certainty at all. Then we have faced several enterprise - level
products which theoretically would help us, but we didn't want to deploy the whole security program because of it,
we just wanted to get the prioritized threats list for our product to put it in our security backlog. Nothing else"

Anonymous Developer

## Idea
The idea behind this product is clear - I want to create something simple that would help to solve this difficult problem.
Ideally, with one click or a command and with a possibility to integrate it into a pipeline and do it continuously if needed. Inspired by dependency-check architecture and simplicity plus taking in mind that developers just love mapping everything in code, I've created "TicTaaC", which means "Threat modeling-as-a-Code in a Tick"

## Usage
All the tool is needed is a data flow code file described in the yml-like format specially designed for this.

The examples of these files with verbose comments describing every aspect may be found [here](https://github.com/rusakovichma/TicTaaC/tree/master/expl).

### Command Line
More detailed instructions can be found on the
[github wiki](https://github.com/rusakovichma/TicTaaC/wiki).
The latest CLI can be downloaded from github in the [releases section](https://github.com/rusakovichma/TicTaaC/releases).

On *nix:
```
$ ./bin/tic-taac.sh -h
$ ./bin/tic-taac.sh --out . --threatModel [path to threat model file(s) or folder to scan]
```
On Windows:
```
> .\bin\tic-taac.bat -h
> .\bin\tic-taac.bat --out . --threatModel [path to threat model file(s) or folder to scan]
```

### Docker
See [TicTaaC Docker Hub repository](https://hub.docker.com/r/rusakovichma/tic-taac).

Quickstart on Windows:
```
> docker run --volume /D/threat-model:/threat-model --volume /D/report:/report rusakovichma/tic-taac:latest --threatModel /threat-model/ --out /report
```

*nix script:
```console
#!/bin/sh

TT_VERSION="latest"
THREAT_MODEL_DIR=$HOME/threat-model

# Make sure we are using the latest version
docker pull rusakovichma/tic-taac:$TT_VERSION

docker run --rm \
-e user=$USER \
-u $(id -u ${USER}):$(id -g ${USER}) \
--volume $THREAT_MODEL_DIR:/threat-model:z \
--volume $(pwd)/report:/report:z \
rusakovichma/tic-taac:$TT_VERSION \
--threatModel /threat-model \
--outFormat html \
--out /report
# Set mitigation strategy for the corresponding threats
# see https://github.com/rusakovichma/TicTaaC/blob/master/expl/mitigations.yml
# --mitigations /threat-model/mitigations.yml
# or set the folder where scan the mitigations files: --mitigations /mitigations
```
### Jenkins pipeline
For TicTaaC usage at Jenkins pipeline, see [Jenkinsfile example](https://github.com/rusakovichma/TicTaaC/blob/master/cicd/Jenkinsfile).

## Data Flows Examples
* [Simple Threat Model](https://github.com/rusakovichma/TicTaaC/blob/master/expl/simpest-threat-model.yml)
* [Intermediate Model](https://github.com/rusakovichma/TicTaaC/blob/master/expl/intermediate-threat-model.yml)
* [Advanced Model](https://github.com/rusakovichma/TicTaaC/blob/master/expl/advanced-threat-model.yml)

## Generated report example
![Threat Modeling Report Example](https://raw.githubusercontent.com/rusakovichma/TicTaaC/master/etc/threat-modeling-report-example.png)

## Features
* [x] Automatic Data Flow generation in a report
* [x] Ideal for Security Teams - it has flexible [Threats Library logic](https://github.com/rusakovichma/TicTaaC/blob/master/src/main/resources/threats-library/default-threats-library.yml) customization in a separate file with special expression language support
* [x] Suitable for [CICD pipeline integration](https://github.com/rusakovichma/TicTaaC/blob/master/cicd/Jenkinsfile)
* [X] Setting Quality Gate that can block the product release in case if unmitigated threats are presented
* [x] No *required* additional dependencies
* [x] Special [lightweight and easy-to-understand format](https://github.com/rusakovichma/TicTaaC/blob/master/expl/simpest-threat-model.yml) for data flows description
* [x] Automatic Threats Attack Vector & Risk Score calculation based on the data flow context
* [x] Threats classification by OWASP Top 10 and Microsoft STRIDE
* [x] Setting Threats mitigation strategy in [one place](https://github.com/rusakovichma/TicTaaC/blob/master/expl/mitigations.yml)
* [x] Reporting in html or json format

## License

Licensed under the [Apache License version 2.0](LICENSE)