OWASP Threat Dragon - Revision history

Michael Goodwin: update roadmap progress

2019-06-30T12:19:16Z

update roadmap progress

Michael Goodwin: update roadmap progress

2019-06-30T12:14:25Z

update roadmap progress

Michael Goodwin: updated roadmap progress

2019-06-30T12:11:28Z

updated roadmap progress

Michael Goodwin: Updated following architecture review

2017-06-14T10:56:41Z

Updated following architecture review

Michael Goodwin: fixed broken link

2017-04-25T21:34:59Z

fixed broken link

Michael Goodwin: /* Project Resources */

2015-12-12T14:48:02Z

‎Project Resources

Michael Goodwin: /* Project Resources */

2015-12-12T14:42:34Z

‎Project Resources

Michael Goodwin: /* Project Resources */

2015-12-12T14:41:44Z

‎Project Resources

Michael Goodwin: /* Roadmap */

2015-11-27T21:28:48Z

‎Roadmap

Michael Goodwin: /* Road Map and Getting Involved */

2015-11-27T21:24:39Z

‎Road Map and Getting Involved

@@ Line 105: / Line 105: @@
 * Development of tests (unit and manual) - '''complete: [https://codecov.io/github/mike-goodwin/owasp-threat-dragon?branch=master Codecov report]'''
 * Draft end user documentation - '''complete: [http://mike-goodwin.github.io/owasp-threat-dragon/ GitHub pages]'''
-* "Publicity drive" to sign up alpha/beta users and generate feedback
+* "Publicity drive" to sign up alpha/beta users and generate feedback - '''Some progress on this. The desktop app has had 13k downloads - unclear how many people are actually using it. The GH repo for the desktop version has 79 stars. The web version gets about 94 unique visitors per day on average and the GH repo has 229 stars.'''
 Milestone 2: Beta release - Threat/mitigation rule engine

@@ Line 110: / Line 110: @@
 * Refinement of UX based on feedback from the alpha release
-* (Some) feature enhancements based on feedback from the alpha release
+* (Some) feature enhancements based on feedback from the alpha release - '''Implemented some feature requests (e.g. snap-to-grid) and fixed issues reports (e.g. save bugs) by users'''
 * Implementation of a rule engine for generation of threats/mitigations
 * Updated tests and end-user documentation

@@ Line 101: / Line 101: @@
 Milestone 1: Alpha release - Basic threat modelling experience
-* Architecture review of the existing prototype with refinement/change where required - '''complete: Confirmed JointJs works fine, Storage model changed and addition of Electon based desktop variant. TBC replacement for Nools rule engine, since it is no longer maintained, shift from Grunt/Bower to NPM/Browserify'''
+* Architecture review of the existing prototype with refinement/change where required - '''complete: Confirmed JointJs works fine, Storage model changed and addition of Electon based desktop variant. Nools rule engine (no longer supported) replaced by [https://github.com/cachecontrol/json-rules-engine json-rules-engine]. Shifted from Grunt/Bower to NPM/Browserify'''
 * Secure design review and implementation of findings
 * Development of tests (unit and manual) - '''complete: [https://codecov.io/github/mike-goodwin/owasp-threat-dragon?branch=master Codecov report]'''

@@ Line 101: / Line 101: @@
 Milestone 1: Alpha release - Basic threat modelling experience
-* Architecture review of the existing prototype with refinement/change where required
+* Architecture review of the existing prototype with refinement/change where required - '''complete: Confirmed JointJs works fine, Storage model changed and addition of Electon based desktop variant. TBC replacement for Nools rule engine, since it is no longer maintained, shift from Grunt/Bower to NPM/Browserify'''
 * Secure design review and implementation of findings
 * Development of tests (unit and manual) - '''complete: [https://codecov.io/github/mike-goodwin/owasp-threat-dragon?branch=master Codecov report]'''
@@ Line 130: / Line 130: @@
 '''Technology'''
-The technical architecture is javascript from top to bottom. In the client the key libraries are Angular for the MVC architecture and JointJS for the diagraming. JointJS has a log of great features, but is not a perfect fit for Angular. This needs a review. In the prototype, all storage is done on the client using browser local storage.
+The technical architecture is javascript from top to bottom. In the client the key libraries are Angular for the MVC architecture and JointJS for the diagramming. JointJS has a log of great features, but is not a perfect fit for Angular. This needs a review. In the prototype, all storage is done on the client using browser local storage.
-There is nothing on the server side at the moment in the prototype. Areas where this might become necessary are
+Following an architecture review the following key changes were made:
-* If the threat rule engine requires too much power to run feasibly on the client
+* A new Electron based, installable desktop variant was introduced using the local file system for model storage
-* Supporting hooks in to other dev lifecycle tools
+* The web variant was changed to use GitHub for model storage - other source control systems will follow (e.g. BitBucket)
+* Seperation of common code into a new NPM package, shared between the web and desktop variants
-If needed I plan to use node.js on the server so that the rule engine can be flexible enough to run either client or server side.
+* The Nools rule engine will be replaced since it is no longer maintained
 '''Challenges'''
 * Getting enough usage of the alpha and beta to get the UX and rule engine right
-* Finding a sustainable way to host it, especially if it needs any kind of server side storage or processing - the prototype today just serves static content and all the logic is on the client side
+* Finding a sustainable way to host it, especially to support deeper GitHub/BitBucket/Etc. integration
 ==Getting Involved==
@@ Line 152: / Line 150: @@
 Great user experience is one of the key goals for the project and to get that right it needs some users! If you would like to try the tool out, that would be great. A working prototype can be found at:
-http://threatdragon.azurewebsites.net/
+https://threatdragon.org/
 To help you get started, take a look at the (draft) docs:
-http://mike-goodwin.github.io/owasp-threat-dragon/
+[http://mike-goodwin.github.io/owasp-threat-dragon/ http://docs.threatdragon.org/]
 If you are still having problems, let me know and I will be pleased to help (mike.goodwin@owasp.org). All feedback is ''very'' welcome. Either email me or put an issue on GitHub
@@ Line 177: / Line 179: @@
 ) An online hosted version of the tool

@@ Line 4: / Line 4: @@
 {| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
-| valign="top"  style="border-right: 1px dotted gray;padding-right:25px;" |
+| valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |
 ==OWASP Threat Dragon Project==
@@ Line 33: / Line 33: @@
 This program is free software: you can redistribute it and/or modify it under the terms of the [http://www.apache.org/licenses/LICENSE-2.0 Apache 2.0 License]
-| valign="top"  style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
+| valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |
 == Project Resources ==
@@ Line 43: / Line 43: @@
 You can click here to see a working prototype:
-https://threatdragon.azurewebsites.net/
+https://threatdragon.org
 And (draft) end-user documentation can be found here:
@@ Line 59: / Line 59: @@
     {| width="200" cellpadding="2"
     |-
-    | colspan="2" align="center"  | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
+    | colspan="2" align="center" | [[File:Project_Type_Files_TOOL.jpg|link=https://www.owasp.org/index.php/Category:OWASP_Tool]]
     |-
-    | align="center" valign="top" width="50%" rowspan="2"| [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
+    | rowspan="2" align="center" valign="top" width="50%" | [[File:Owasp-incubator-trans-85.png|link=https://www.owasp.org/index.php/OWASP_Project_Stages#tab=Incubator_Projects|Incubator Project]]
-    | align="center" valign="top" width="50%"| [[File:Owasp-builders-small.png|link=Builders]]
+    | align="center" valign="top" width="50%" | [[File:Owasp-builders-small.png|link=Builders]]
     |}
-| valign="top"  style="padding-left:25px;width:200px;" |
+| valign="top" style="padding-left:25px;width:200px;" |
 == News and Events ==
@@ Line 180: / Line 180: @@
-__NOTOC__ <headertabs />
+__NOTOC__ <headertabs></headertabs>
-[[Category:OWASP Project]]  [[Category:OWASP_Builders]] [[Category:OWASP_Defenders]]  [[Category:OWASP_Tool]]
+[[Category:OWASP Project]]

@@ Line 103: / Line 103: @@
 * Architecture review of the existing prototype with refinement/change where required
 * Secure design review and implementation of findings
-* Development of tests (unit and manual) - '''complete'''
+* Development of tests (unit and manual) - '''complete: [https://codecov.io/github/mike-goodwin/owasp-threat-dragon?branch=master]'''
-* Draft end user documentation - '''complete'''
+* Draft end user documentation - '''complete: [http://mike-goodwin.github.io/owasp-threat-dragon/]'''
 * "Publicity drive" to sign up alpha/beta users and generate feedback