search

OWASP / threat-dragon

An open source threat modeling tool from OWASP
https://owasp.org/www-project-threat-dragon/
Apache License 2.0
842 stars 228 forks source link

Use RAAML for threat models #639

Open kuwv opened 1 year ago

kuwv commented 1 year ago

Describe what problem your feature request solves

The Risk Analysis and Assessment Modeling Language (RAAML) specification is a sysml compliant format that would allow integration with other modeling capabilities such as simulation. It is also a component UAFML.

Describe the solution you'd like

Implement modeling capabilities to support RAAML either as default or as content import/export.

Additional context

https://www.omg.org/spec/RAAML/1.0/Beta2/About-RAAML https://emfjson.github.io/projects/ecorejs/latest/

jgadsden commented 1 year ago

This would be a good feature for either version 2.2 or maybe later

kuwv commented 1 year ago

Seems like another OWASP project is doing ontology-driven threat modeling: https://github.com/OWASP/OdTM.

@nets4geeks Any of your work reusable here? RAAML is RDF based can be used with RDF (via OSLC).

nets4geeks commented 1 year ago

It is easy to make RDF from OWL, and I used to parse and modify Threat Dragon json configs in order to add advanced threats, however I think this does not help.

I did not find any mention regarding RDF and even DFD in RAAML specification. As I understand RAAML is based on SysML and does not deal with OWL, RDF, etc.

kuwv commented 1 year ago

@nets4geeks, yes RAAML is SysML based. To state it more accurately MBSE ecosystem uses SysML with OSLC to provide interoperability between other components through RDF.

https://www.omgwiki.org/OMGSysML/lib/exe/fetch.php?media=sysml-oslc:mapping_sysml_to_rdf_vocabulary_-_april_28_2014.pdf