OWASP / threat-dragon

An open source threat modeling tool from OWASP
https://owasp.org/www-project-threat-dragon/
Apache License 2.0
874 stars 231 forks source link

Add the full database of LINDDUN threats to Threat Dragon #797

Open rhite-tech opened 9 months ago

rhite-tech commented 9 months ago

Describe what problem your feature request solves: LINDDUN contains a database of 35 threats. Threat Dragon already has support for the categories, similar to the other frameworks, but it would be nice if the threats under each category would become available from a drop-down menu as well. The way threats are organized under the categories can be observed here: https://downloads.linddun.org/linddun-go/default/v20230802/go.pdf

Describe the solution you'd like: When you add a threat (or edit one), you can already select the threat type, which corresponds to the linddun category. If the linddun cards were to be digitalized in json format - similar to plot4ai - then this could serve as a database; then, based on this json file and the selected type/category, the relevant threats could be loaded and used to populate a drop-down box called 'threat'. The user could then select the applicable threat. Additionally, the rest of the information on the linddun cards could be used to prefill the Description-field in Threat Dragon.

Additional context: LINDDUN is very similar to PLOT4ai, which was also recently added to Threat Dragon. Adding this functionality would also open the possibility to add the threats from PLOT4ai to threat dragon.

jgadsden commented 9 months ago

another very good suggestion @rhite-tech , did you want to work on this in parallel with #796 ?

rhite-tech commented 9 months ago

Yes, my expectation is that once the code for one model is in place it will be very easy to add the same functionality for the other.

Maybe good to know: I've also reached out to the team behind LINDDUN to ask if they like to be involved.

raghav1030 commented 6 months ago

Hey @jgadsden, could you please assign this task to me? I'm ready to start working on it.

jgadsden commented 1 month ago

This is in active development by @rhite-tech , pushing it back to version 2.4 later this year (2024) because version 2.3 is due fairly soon for August 2024.