DSL
- tmnpy.dsl.component.Component
- tmnpy.dsl.Asset
- tmnpy.dsl.threat.Weakness
- tmnpy.dsl.threat.Vulnerability
- tmnpy.dsl.threat.Threat
- tmnpy.dsl.requirement.STRIDE
- tmnpy.dsl.requirement.STRIDE.spoofing
- tmnpy.dsl.requirement.STRIDE.tampering
- tmnpy.dsl.requirement.STRIDE.repudiation
- tmnpy.dsl.requirement.STRIDE.information_disclosure
- tmnpy.dsl.requirement.STRIDE.denial_of_service
- tmnpy.dsl.requirement.STRIDE.elevation_of_privilege
- tmnpy.dsl.requirement.SecurityProperty
- tmnpy.dsl.requirement.SecurityProperty.confidentiality
- tmnpy.dsl.requirement.SecurityProperty.integrity
- tmnpy.dsl.requirement.SecurityProperty.availability
- tmnpy.dsl.requirement.SecurityProperty.authenticity
- tmnpy.dsl.requirement.SecurityProperty.non_repudiation
- tmnpy.dsl.requirement.SecurityProperty.authorization
|
A component is very similar to an element, but it specifically refers to a component of the system being threat modeled (rather than an element of the threat model), i.e. assets and flows. |
|
An Asset is a person, structure, facility, information, and records, information technology systems and resources, material, process, relationships, or reputation that has value[1]. |
|
A weakness is a potential issue in the design of the system in question. |
|
A vulnerability is a previously known weakness in a piece of software, generally associated with a CVE. |
|
A threat is an instance of a weakness (or set of weaknesses) in the system that the threat model is for, that has been determined to apply. |
|
A STRIDE object is assigned to a threat, whereby the user determines, which aspects of STRIDE apply to this particular threat. |
Spoofing requirement. |
|
Tampering threat. |
|
Repudiation threat. |
|
Information Disclosure threat. |
|
Denial of Service threat. |
|
Elevation of Privilege threat. |
|
Determine what are the security properties associated with an element, specifically Confidentiality, Integrity, Availability, Authenticity, Non-Repudiation, and Authorization. |
|
Confidentiality requirement. |
|
Integrity requirement. |
|
Availability requirement. |
|
Authenticity requirement. |
|
Non-Repudiation requirement. |
|
Authorization requirement. |