Demo

[johnandersen777]

• CVE Bin Tool PR
  • scanners: Add data flow based scanning for multi language support intel/cve-bin-tool#1698
• Excited about living threat models and their applications to help us keep our applications secure and understand if our code is doing what we think it's doing!
• About John^2
  • Analysis of robustness of security posture
• Demo
  • Good and bad threat models to THREATS.md
• John W
  • auditor.py good.json
  • auditor.py bad.json
    • Finds issues and maps to CVSS
  • THREATS.md
• Need to define a domain specific language
  • http://mal-lang.org/ seems similar
• If we can get get people to open source their threat models, we'll be able to understand how secure dependent projects are based on their usage (context)
• Demo the creation of an LTM
  • Docs on how to extend
• Call to action of defining the language
  • Community, flexible enough
  • As long as you speak schema XYZ then you can build visualization
  • How to deal with false positives (overlays for triage)
• We understand this will not be easy, we know what it means to scan code, or third party stuff with CVEs, that might be an overlay, if it doesn't apply to you don't apply
• John Andersen (15 minutes)
  • Demo
    • 1 or two threats in the threat matrix
  • Overlays
  • Open Architecture Working Group
    • Mention

---

• Take threat model from good/bad
• Operation and dataflow as possible schema, make ADRs for each
  • Show how we represent good/bad using the open architecture
• Augment with scan data
  • Enumerate binaries found
  • Show how we represent these using the open architecture
• Map classification wise to components within the threat model
• Produce warnings and THREATS.md

---

• Take manually generated threat model (good.json/bad.json) and produce open architecture
• CVE Bin Tool does scan, outputs open architecture
• Alice takes both architectures and outputs whatever format we want via whatever overlays we apply
  • THREATS.md by combining the two
  • She optionally runs any auditors via overlays
• Overlays can be arbitrarily nested

---

• Take manually generated threat model (good.json/bad.json) and produce open architecture
• Alice takes both architectures and outputs whatever format we want via whatever overlays we apply
  • THREATS.md by combining the two
  • She optionally runs any auditors via overlays
• Overlays can be arbitrarily layered
• Future work
  • CVE Bin Tool does scan, outputs open architecture

[johnandersen777]

Closed via https://github.com/johnlwhiteman/living-threat-models/blob/main/demo/ALICE.rst in c027d4e