Open ZenW00kie opened 3 months ago
@dvotipka probably want to update the evaluation method to be more specific, rather than just the four points I have. Not sure if you have a template, but I know we've looked at this from CMU in the past.
And if you can't access Adam's book let me know!
@lisadang04 @esamnesru @giakwon pick three tools each to work through (pick one from each category)
Found in
project/ThreatModelingTools.md
for each tool we need the following:For both advantages and limitations, it would be good to reference which of our design goals (see
project/OVERVIEW.md# Design Goals
) are being used/not used. Additionally, for the tools that are labeled as DSLs or UIs, we want to evaluate how expressive they are using a few examples that we have. The first is from a medical device standard ISO 11073 (see attached) Annex E), one of the four examples listed in Adam Shostack's book (again it's in Appendix E, and you can use your Tufts account to access the book here), and then the threat model described in this work from researchers at Queen's.List of Tools
Diagramming Only
DSLs/Threat Modeling as Code
UIs