#!/usr/bin/env python3 from pytm import TM, Server, Datastore, Dataflow, Boundary, Actor, Lambda tm = TM("my test tm") tm.description = "This is a sample threat model of a very simple system - a web-based comment system. The user enters comments and these are added to a database and displayed back to the user. The thought is that it is, though simple, a complete enough example to express meaningful threats." User_Web = Boundary("User/Web") Web_DB = Boundary("Web/DB") VPC = Boundary("AWS VPC") user = Actor("User") user.inBoundary = User_Web web = Server("Web Server") web.OS = "CloudOS" web.isHardened = True my_lambda = Lambda("cleanDBevery6hours") my_lambda.hasAccessControl = True my_lambda.inBoundary = Web_DB #my_lambda.inBoundary = VPC # TODO: need multiple boundaries capability for these situations db = Datastore("SQL Database") db.OS = "CentOS" db.isHardened = False db.inBoundary = Web_DB db.isSQL = True db.inScope = False my_lambda_to_db = Dataflow(my_lambda, db, "(λ)Periodically cleans DB")
Lambda, Server, ) tm = TM("my test tm") tm.description = "This is a sample threat model of a very simple system - a web-based comment system. The user enters comments and these are added to a database and displayed back to the user. The thought is that it is, though simple, a complete enough example to express meaningful threats." tm.isOrdered = True tm.mergeResponses = True internet = Boundary("Internet") server_db = Boundary("Server/DB") server_db.levels = [2] vpc = Boundary("AWS VPC") user = Actor("User") user.inBoundary = internet user.levels = [2] web = Server("Web Server") web.OS = "Ubuntu" web.isHardened = True web.sanitizesInput = False web.encodesOutput = True web.authorizesSource = False web.sourceFiles = ["pytm/json.py", "docs/template.md"] db = Datastore("SQL Database") db.OS = "CentOS" db.isHardened = False db.inBoundary = server_db db.isSQL = True
#!/usr/bin/env python3 from pytm import TM, Server, Datastore, Dataflow, Boundary, Actor, Element tm = TM("Apps") tm.description = "Apps threat modeling" internet = Boundary("Internet") machine = Boundary("User's machine") apps_vpc = Boundary("Apps VPC") rds_boundary = Boundary("RDS security group") cache_boundary = Boundary("ElastiCache security group") user = Actor("User/Browser") user.inBoundary = machine apigee = Element("Apigee") apigee.inBoundary = internet apigee.isHardened = True apigee = Element("Apigee") apigee.inBoundary = internet apigee.isHardened = True server = Server("Apps Server") server.inBoundary = apps_vpc server.isHardened = True server.hasAccessControl = True server.encodesOutput = True db = Datastore("MySQL DB") db.isHardened = True