OWASP Threat Dragon

Threat modeling is widely regarded as a powerful way to build security into the design of applications and systems early in a secure development lifecycle. At its best, threat modeling is especially good for:

• Ensuring defence-in-depth
• Establishing consistent security design patterns across an application
• Flushing out security requirements and user stories

OWASP Threat Dragon provides a free, open-source, threat modeling application that is powerful and easy to use. It can be used for categorising threats using STRIDE, LINDDUN CIA, DIE and PLOT4ai. The key areas of focus for the tool is:

• Simplicity - you can install and start using Threat Dragon very quickly
• Flexibility - the diagramming and threat generation allows all types of threat to be described
• Accessibility - different types of teams can benefit from Threat Dragon’s simplicity and flexibility

FAQs

• Where are the arrows that allow me to create data flows?

• Why do the earlier releases come from Mike Goodwin’s repo, not the OWASP repo?

• I get failures when installing from source code

• I get a failure when printing a report

• Why do I get ‘OWASP-Threat-Dragon-Setup isn’t commonly downloaded’ warnings after downloading on Windows?

• Why do I get ‘Apple cannot check it for malicious software’ errors after installing on MacOS?

• Why do I get ‘Permissions failure opening Mac desktop app’ when installing from the zip file?

• Why do I get ‘developer can not be verified’ errors after installing on MacOS?

• Can I run Threat Dragon Desktop from a command line?

• Is there a command line interface for Threat Dragon Desktop?

• What browsers can be used for Threat Dragon?

• Hold on…isn’t this the same as Mozilla’s SeaSponge?

• When is Threat Dragon’s birthday? And does Threat Dragon have a theme tune?

Version 2.2: in progress

• provide an API for CI/CD pipelines
• provide a CLI for scripting based on TD’s existing use of yargs
• provide multiple methods of authentication and access similar to draw.io login page

model access for both desktop and web app:

• load models from various sources similar to drawio:
  • github enterprise
  • gitlab
  • Google Drive
  • OneDrive
  • Dropbox

Version 2.1: released October 2023

Stable version of 2.x.x with bug fixes and usable diagram tools. Still not feature complete:

• missing CLI for scripting based
• missing automated threats (both by element and by OATS)

Version 2.0: released February 2023

migrate to a combined application for both desktop and webapp:

• be strictly open source
• use Vue for frontend application
• use @antv/g6 for the drawing library
• frontend logging using bunyan and optional logging to the console during development
• use electron to wrap webapp for desktop
• provide auto-update using electron
• expand electron unit tests using WDIO Electron Service
• webapp unit test framework Jest
• component test Vue testing library
• end-to-end test cypress
• set up ZAP to provide security testing on commit
• design files are to be backwardly compatible to Threat Dragon json

demonstration pages:

• an online demonstration to be provided on threat dragon’s site
• demo should either be a snapshot or a release version

Version 1.4: released May 2021

• written in javascript ES6 / ECMAScript 2015 or compatible
• run on node.js server
• use express for backend application
• provide a dockerfile for running in docker, similar to existing TD
• static code analysis using ESLint
• webapp test runner Karma with Jasmine for Vue Test Utils
• backend unit test framework MochaJS and assertions from chai
• bundle the application and api for production using webpack
• be strictly open source, avoiding using languages or frameworks maintained outside the open source community

documentation:

• documentation should be updated at the threat dragon github pages
• version 1.x docs are preserved and migrated to version 2.0
• docs should be static pages based on Jekyll and markdown

Previous versions

Mike Goodwin’s initial roadmap for the project is archived here. The original roadmap had various milestones, most of which were achieved by late 2020.

Milestone 4: Dev lifecycle integration

• Some CLI interface available mid 2020

Milestone 3: Release 1.0

• production version released February 2020
• version 1.3.1 released October 2020

Milestone 2: Beta release: Threat/mitigation rule engine

• achieved May 2017 with version 0.1.26

Milestone 1: Alpha release - Basic threat modelling experience

• achieved October 2015

Releases