Security
The threat modeller is for design reviews of the systems your application is part of. Draw the system as a data-flow diagram - processes, data stores, external entities, the data flows between them and the trust boundaries they cross - and say what each part is: a web application, a log, encrypted, over the public internet, holding confidential data. From that, its own rules suggest the STRIDE threats each part faces, with a mitigation to start from, and your own threat library adds the threats your organisation's standard asks about.
Each threat has a status, an owner, a mitigation and a score before and after it, on the built-in five by five scale or on your own risk matrix, where a threat can be moved to re-score it. Compare two versions of a model to see what a change brings in, find the gaps, open and save OWASP Threat Dragon (version 2) files as well as the modeller's own JSON, and print the whole model as a PDF report.
Try it with your own threat models in confidence: they are opened by your browser, on your device. Nothing is uploaded, no copy reaches us or anyone else, and nothing is kept once you close this tab.
A council's parking permits, threat by threat
Version 1.0 of resident parking permits for Aldermoor District Council, a made-up council: residents apply on the permits website with proof of address, the permits API checks the vehicle with Keeperline, an invented vehicle-check company, and enforcement officers' handhelds ask whether a car has a permit. A first workshop left two threats of its own. Let the rules suggest the rest, record what the review decided, and see it all on the council's four by four risk matrix.
// Node 20 or later, from the Gold package: fail the build while the threat model has threats nobody has considered.
import { readFileSync, writeFileSync } from 'node:fs';
import { readThreatModel, readThreatLibrary, suggestThreats, checkThreatModel, summarizeThreats, threatReport } from './dist/node/bmx-threat-modeler.mjs';
const model = readThreatModel(readFileSync('threat-models/permits.json', 'utf8'));
const { rules, problems } = readThreatLibrary(readFileSync('standards/ads-4-threats.json', 'utf8'));
for (const p of problems) console.warn(p);
const missing = suggestThreats(model, { library: rules });
for (const s of missing) console.log(`Not yet considered - ${s.element.name}: ${s.threat.title}`);
const gaps = checkThreatModel(model).filter(p => p.severity === 'warning');
for (const g of gaps) console.log(`Gap: ${g.message}`);
const { byStatus, openByBand } = summarizeThreats(model);
console.log(`${byStatus.open} open threats by band:`, openByBand);
writeFileSync('permits-threat-model.pdf', await threatReport(model));
process.exitCode = missing.length || gaps.length ? 1 : 0;
The next version: paying by card
Version 1.1 of the same service takes the permit fee through Tollgate Pay, an invented payment provider: the website starts a payment, Tollgate sends the outcome back to a new payment callbacks process, and payment references get a store of their own. Proof of address is now encrypted and backed up. Compare it with the 1.0 review above, see which threats are new, apply the council's own threat library - the made-up Aldermoor Digital Standard 4 - and save the model as an OWASP Threat Dragon file.