search

OWASP / threat-dragon

An open source threat modeling tool from OWASP
https://owasp.org/www-project-threat-dragon/
Apache License 2.0
888 stars 234 forks source link

Revise data model of threat + mitigations #834

Open jgadsden opened 8 months ago

jgadsden commented 8 months ago

Describe what problem your feature request solves: Multiple mitigations for a threat are possible, and also multiple threats per mitigations

Describe the solution you'd like: revise data model of threat and mitigations to be more flexible

Additional context: User reports: "The data model for threat mitigations is in my opinion simply incorrrect. One threat may have many mitigations, which has different implementation status. At this moment the tool seems to allow tracking only one mitigation per threat.

Not being able to copy or move threats makes impossible to refactor the environment image later on. I would take even "make a copy of this threat to there" without any linking of contents to fix this. Without this I had to redraw the environment and do a lot of manual work to get the final report cleaned up."

jgadsden commented 1 month ago

I agree that the schema / data model of threat dragon is not a good one we are looking at revising the file format, schema and data model in #716 and also #850