Proposal

Introduce support for creating threat modeling diagrams using Mermaid.js. Threat modeling is a critical process in cybersecurity, enabling architects, developers, and security professionals to identify, analyze, and document potential threats in a system's design. Integrating threat modeling diagrams will expand Mermaid.js's capabilities, allowing users to visualize threat landscapes directly in their documentation

Key Features:

Nodes and Components:

Support for different types of components commonly found in threat modeling, such as: Processes: Represented as circles or ovals. Data Stores: Represented as open-ended rectangles. External Entities/ Actors: Represented as regular rectangles. Data Flows: Arrows indicating data transfer between components.

Threat Indicators:

Allow the annotation of potential threats directly on the diagram using specific markers/icons (e.g., a warning triangle) to indicate threat categories such as Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE model). Data Flow Lines:

Support for different line styles (solid, dashed, etc.) to represent different types of data flows, like secure vs. insecure communication. Security Boundaries:

Ability to draw security boundaries (represented as dashed or bold lines/boxes) to highlight trust zones and separation between different security levels. Labels and Descriptions:

Support for adding detailed labels and descriptions to each component, data flow, and threat indicator to provide context and information about identified risks. Customizable Colors and Icons:

Allow customization of colors and icons for each element to match organizational threat modeling standards.

For more information please see the following requirements: OWASP Threat Modelling

Use Cases

Security architects can use Mermaid.js to create threat models during system design reviews.
Developers can include threat models directly in documentation to ensure security concerns are considered throughout the development lifecycle.
Security analysts can leverage Mermaid.js to illustrate and communicate findings from threat assessments.

Screenshots

Basic Diagram

Syntax

threatModel actor User process "Web Application" as WebApp dataStore "Database" as DB dataFlow "User Request" from User to WebApp dataFlow "Data Fetch" from WebApp to DB boundary "Trust Boundary" { WebApp DB } threat "SQL Injection" on dataFlow "Data Fetch"

Implementation

None

mermaid-js / mermaid

Threat modelling #5895