search

OWASP / pytm

A Pythonic framework for threat modeling
Other
923 stars 175 forks source link

Documentation for attributes #211

Closed Nathan-Furnal closed 1 year ago

Nathan-Furnal commented 1 year ago

Hi,

I'm reading some of the examples and the code for pytm but there are some attributes where I'm not sure what they correspond to.

For example in the Controls class, there are variables like: 

isHardened = varBool(False)
isResilient = varBool(False)
providesConfidentiality = varBool(False)
providesIntegrity = varBool(False)
sanitizesInput = varBool(False)
tracksExecutionFlow = varBool(False)
usesCodeSigning = varBool(False)

I'm not sure what they correspond to? Is it left up to the lib users to define is the controls are hardened or resilient for example or is there some canonical definition I could look up and reference when working with other people?

Thanks for the help =)

izar commented 1 year ago

It's up to the users. It is also easily extensible, so if there's need the user can add more attributes (PR!).

Nathan-Furnal commented 1 year ago

Alright, I'll probably have to come with some definitions that make sense for my use-case, thanks for the quick answer! I also saw that there was a discussion to move to rule-based library like rule-engine. Is is still a thing?

izar commented 1 year ago

We are definitely checking options, if that's an area you're interested in we'd be very happy to hear your thoughts!

Nathan-Furnal commented 1 year ago

I'm just getting started with threat modelling so I don't have a clear opinion on what should be done or not but I'll get back to you when I have more experience on this =)

izar commented 1 year ago

It's a journey, we welcome your input at any time!