taralizer

README

Taralizer - The Threat and Risk Analyzer

The following project performs a Threat and Risk Analysis based on an architecture model defined through simple YAML file. We aim to implement the OWASP Application Security Verification Standard (ASVS)(https://owasp.org/www-project-application-security-verification-standard/) and also destribute their great database (https://github.com/OWASP/ASVS/raw/v4.0.2/4.0/docs_en/OWASP%20Application%20Security%20Verification%20Standard%204.0.2-en.csv). Furthermore, we use and distribute MITRE Common Weakness Enumeration (https://cwe.mitre.org/data/downloads.html) as a way to classify weaknesses.

Motivation

The taralizer project was highly inspired by the Threagile (https://threagile.io) project which is a first class threat modelling tool for OWASP ASVP. Unfortunately, Threagile has some limits in the customization of reports and the extendability with custom rules. Taralizer tries to overcome these limitations with the following approach:

• Using Golang templating (https://golang.org/pkg/text/template/) for all reports and diagrams
• Use the Open Policy Agent (OPA) engine (https://www.openpolicyagent.org) to allow extentabilty
• use plantuml or graphviz dot to generate compelling diagrams
• use of wkhtmltopdf to create PDF reports

Features

Taralizer currently provides the following features:

• backward compatiblity with Threagile (https://threagile.io) model files
• taralizer is packaged for all major devopment environments:
  • MacOSX (x86_64, ARM64 M1)
  • Linux (x86, x86_64, ARM64)
  • Windows (x86, x86_64)
• supports graphviz dot and plantuml flow charts

• support of PDF and HTML reports

We demonstate the usage of Taralizer on the popular Bank of Anthos example application HERE

Installation

Getting Started

1. Download latest release for your platform: https://github.com/devmatic-it/taralizer/releases/latest
2. extract archive: unzip taralizer_X.Y.Z_linux_amd64.zip
3. create dataflow diagram diagram.png using graphviz: ./taralizer diagram ./examples/gcp/bank_of_anthos.yaml
4. create dataflow diagram diagram.png using plantuml: ./taralizer diagram ./examples/gcp/bank_of_anthos.yaml --engine plantuml
5. create example HTML report: ./taralizer report ./examples/gcp/bank_of_anthos.yaml
6. open examples HTML report report.htmlon browser
7. create example PDF report: ./taralizer report ./examples/gcp/bank_of_anthos.yaml --type pdf

Contribute

New Issues

1. Use the search tool before opening a new issue: https://github.com/devmatic-it/taralizer/issues
2. Please provide source code and commit fix if you found a bug.
3. Review existing issues and provide feedback or react to them.

Pull requests

1. Open your pull request against master: https://github.com/devmatic-it/taralizer/pulls
2. Your pull request should have no more than two commits, if not you should squash them.
3. It should pass all tests in the available continuous integrations systems such as TravisCI.
4. You should add/modify tests to cover your proposed code changes.
5. If your pull request contains a new feature, please document it on the https://github.com/devmatic-it/taralizer/blob/master/README.md

Credits

This work has been inspired and would not be possible without the following awesome open source projects:

• Threagile - Agile Threat Modelling (https://threagile.io)
• Open Policy Agent (https://www.openpolicyagent.org)
• PlantUML (https://plantuml.com)
• GraphViz (https://graphviz.org)
• WKhtmltoPDF (https://wkhtmltopdf.org)
• OWASP Application Security Verification Standard https://owasp.org/www-project-application-security-verification-standard/
• Common Weakness Enumeration (https://cwe.mitre.org/index.html)
• GoRleaser Builder Image (https://github.com/goreleaser/goreleaser)
• Building a basic CI/CD pipeline for a Golang application using GitHub Actions (https://dev.to/brpaz/building-a-basic-ci-cd-pipeline-for-a-golang-application-using-github-actions-icj)

Documentation

Overview

Package main contains the main enty point of the Taralizer Copyright 2021 taralizer authors

Licensed under the Apache License, Version 2.0 (the "License"); you may not use this file except in compliance with the License. You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software distributed under the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the License for the specific language governing permissions and limitations under the License.