diff --git a/README.md b/README.md index c992cd3..c3af97d 100644 --- a/README.md +++ b/README.md @@ -45,7 +45,6 @@ The available properties of an element can be listed by using `--describe` follo (pytm) ➜ pytm git:(master) ✗ ./tm.py --describe Element Element class attributes: - OS definesConnectionTimeout default: False description handlesResources default: False @@ -53,10 +52,8 @@ Element class attributes: implementsNonce default: False inBoundary inScope Is the element in scope of the threat model, default: True - isAdmin default: False isHardened default: False name required - onAWS default: False ``` @@ -83,14 +80,11 @@ user = Actor("User") user.inBoundary = User_Web web = Server("Web Server") -web.OS = "CloudOS" web.isHardened = True db = Datastore("SQL Database (*)") -db.OS = "CentOS" db.isHardened = False db.inBoundary = Web_DB -db.isSql = True db.inScope = False my_lambda = Lambda("cleanDBevery6hours") @@ -261,7 +255,7 @@ If `target` is a Dataflow, remember you can access `target.source` and/or `targe Conditions on assets can analyze all incoming and outgoing Dataflows by inspecting the `target.input` and `target.output` attributes. For example, to match a threat only against servers with incoming traffic, use `any(target.inputs)`. A more advanced example, -matching elements connecting to SQL datastores, would be `any(f.sink.oneOf(Datastore) and f.sink.isSQL for f in target.outputs)`. +matching elements connecting to SQL datastores, would be `any(f.sink.oneOf(Datastore) for f in target.outputs) and target.protocol == 'SQL'`. ## Currently supported threats diff --git a/docs/pytm/index.html b/docs/pytm/index.html index a4e6d34..cf029a4 100644 --- a/docs/pytm/index.html +++ b/docs/pytm/index.html @@ -198,7 +198,6 @@

Class variables

doc="""Correctly checks the revocation status of credentials used to authenticate the destination""", ) - isAdmin = varBool(False) # should not be settable, but accessible providesIntegrity = False @@ -284,22 +283,6 @@

Instance variables

return self.data.get(instance, self.default) -
var isAdmin
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var outputs

outgoing Dataflows

@@ -644,10 +627,8 @@

Instance variables

doc="""Correctly checks the revocation status of credentials used to authenticate the destination""", ) - authenticatedWith = varBool(False) order = varInt(-1, doc="Number of this data flow in the threat model") implementsAuthenticationScheme = varBool(False) - implementsCommunicationProtocol = varBool(False) note = varString("") usesVPN = varBool(False) authorizesSource = varBool(False) @@ -708,22 +689,6 @@

Ancestors

Instance variables

-
var authenticatedWith
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var authenticatesDestination

Verifies the identity of the destination, @@ -822,22 +787,6 @@

Instance variables

return self.data.get(instance, self.default)
-
var implementsCommunicationProtocol
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var isEncrypted

Is the data encrypted

@@ -1097,22 +1046,10 @@

Methods

class Datastore(Asset):
     """An entity storing data"""
 
-    onRDS = varBool(False)
-    storesLogData = varBool(False)
-    storesPII = varBool(
-        False,
-        doc="""Personally Identifiable Information
-is any information relating to an identifiable person.""",
-    )
-    storesSensitiveData = varBool(False)
-    isSQL = varBool(True)
-    providesConfidentiality = varBool(False)
     providesIntegrity = varBool(False)
     isShared = varBool(False)
-    hasWriteAccess = varBool(False)
     handlesResourceConsumption = varBool(False)
     isResilient = varBool(False)
-    handlesInterruptions = varBool(False)
     usesEncryptionAlgorithm = varString("")
     implementsPOLP = varBool(
         False,
@@ -1150,22 +1087,6 @@ 
Ancestors

 
 
Instance variables

 

-
var handlesInterruptions

-

-

-

-
-Expand source code
-
-
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)

-

-

 
var handlesResourceConsumption

 

 

@@ -1182,22 +1103,6 @@ 
Instance variables

     return self.data.get(instance, self.default)
-
var hasWriteAccess
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var implementsPOLP

The principle of least privilege (PoLP), @@ -1235,22 +1140,6 @@

Instance variables

return self.data.get(instance, self.default)
-
var isSQL
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var isShared
@@ -1267,38 +1156,6 @@

Instance variables

return self.data.get(instance, self.default)
-
var onRDS
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
-
var providesConfidentiality
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var providesIntegrity
@@ -1315,55 +1172,6 @@

Instance variables

return self.data.get(instance, self.default)
-
var storesLogData
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
-
var storesPII
-
-

Personally Identifiable Information -is any information relating to an identifiable person.

-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
-
var storesSensitiveData
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var usesEncryptionAlgorithm
@@ -1819,7 +1627,6 @@

Instance variables

class Lambda(Asset):
     """A lambda function running in a Function-as-a-Service (FaaS) environment"""
 
-    onAWS = varBool(True)
     environment = varString("")
     implementsAPI = varBool(False)
 
@@ -1894,22 +1701,6 @@ 
Instance variables

     return self.data.get(instance, self.default)
-
var onAWS
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
@@ -1925,16 +1716,10 @@

Instance variables

class Process(Asset):
     """An entity processing data"""
 
-    codeType = varString("Unmanaged")
-    implementsCommunicationProtocol = varBool(False)
-    providesConfidentiality = varBool(False)
     providesIntegrity = varBool(False)
     isResilient = varBool(False)
-    tracksExecutionFlow = varBool(False)
     implementsCSRFToken = varBool(False)
     handlesResourceConsumption = varBool(False)
-    handlesCrashes = varBool(False)
-    handlesInterruptions = varBool(False)
     implementsAPI = varBool(False)
     usesSecureFunctions = varBool(False)
     environment = varString("")
@@ -1996,22 +1781,6 @@ 
Instance variables

     return self.data.get(instance, self.default)
-
var codeType
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var disablesiFrames
@@ -2076,38 +1845,6 @@

Instance variables

return self.data.get(instance, self.default)
-
var handlesCrashes
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
-
var handlesInterruptions
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var handlesResourceConsumption
@@ -2156,22 +1893,6 @@

Instance variables

return self.data.get(instance, self.default)
-
var implementsCommunicationProtocol
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var implementsPOLP

The principle of least privilege (PoLP), @@ -2209,22 +1930,6 @@

Instance variables

return self.data.get(instance, self.default)
-
var providesConfidentiality
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var providesIntegrity
@@ -2241,22 +1946,6 @@

Instance variables

return self.data.get(instance, self.default)
-
var tracksExecutionFlow
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var usesMFA

Multi-factor authentication is an authentication method @@ -2356,7 +2045,6 @@

Instance variables

class Server(Asset):
     """An entity processing data"""
 
-    providesConfidentiality = varBool(False)
     providesIntegrity = varBool(False)
     validatesHeaders = varBool(False)
     encodesHeaders = varBool(False)
@@ -2531,22 +2219,6 @@ 
Instance variables

     return self.data.get(instance, self.default)
-
var providesConfidentiality
-
-
-
- -Expand source code - -
def __get__(self, instance, owner):
-    # when x.d is called we get here
-    # instance = x
-    # owner = type(x)
-    if instance is None:
-        return self
-    return self.data.get(instance, self.default)
-
-
var providesIntegrity
@@ -3655,7 +3327,6 @@

Actor

  • checksDestinationRevocation
  • data
  • inputs
    • -
  • isAdmin
  • outputs
  • port
  • protocol
    • @@ -3692,7 +3363,6 @@

    Data

  • Dataflow