diff --git a/NOTICE b/NOTICE index 6c3ee31af2..7e70ecb464 100644 --- a/NOTICE +++ b/NOTICE @@ -65,6 +65,7 @@ Copyright (c) 2018 Adrian Wersching Copyright (c) 2018-2019 Björn Müller Copyright (c) 2018 Christoph Krieger Copyright (c) 2018 Ghareeb Falazi +Copyright (c) 2018 Julian Sudendorf Copyright (c) 2018 Marius Altmann Copyright (c) 2018 Marius Fischer Copyright (c) 2018 Vladimir Yussupov diff --git a/docs/adr/0028-use-hardcoded-namespaces-for-threat-modeling.md b/docs/adr/0028-use-hardcoded-namespaces-for-threat-modeling.md new file mode 100644 index 0000000000..b3c9742f15 --- /dev/null +++ b/docs/adr/0028-use-hardcoded-namespaces-for-threat-modeling.md @@ -0,0 +1,33 @@ +# Use hardcoded namespaces for threat modeling + +## Context and Problem Statement + +The threat modeling approach relies on pairs of threats and mitigations. +Each "threat" should be referenced by one particular "mitigation". + +## Considered Options + +* hardcoding the namespaces, default node types and properties. +* dynamic namespaces similar to "pattern namespaces" for threats and mitigations + +## Decision Outcome + +Chosen option: hardcoded namespaces, due to ease of implementation and static nature of the problem + +### Positive Consequences +In the context of threat modeling multiple different types of threats/mitigations are not necesaary so a minimal base type that carries the required properties (reference) can be used and extended + + +## License + +Copyright (c) 2018 Contributors to the Eclipse Foundation + +See the NOTICE file(s) distributed with this work for additional +information regarding copyright ownership. + +This program and the accompanying materials are made available under the +terms of the Eclipse Public License 2.0 which is available at +http://www.eclipse.org/legal/epl-2.0, or the Apache Software License 2.0 +which is available at https://www.apache.org/licenses/LICENSE-2.0. + +SPDX-License-Identifier: EPL-2.0 OR Apache-2.0 diff --git a/docs/adr/index.md b/docs/adr/index.md index 50b8b86a46..7fa0b61b3b 100644 --- a/docs/adr/index.md +++ b/docs/adr/index.md @@ -32,6 +32,7 @@ This lists the architectural decisions for Eclipse Winery. - [ADR-0025](0025-use-same-logback-test-xml-for-each-sub-project.md) - Use same `logback-test.xml` for each sub project - [ADR-0026](0026-store-license-and-readme-in-entity-root-folder-in-csar.md) - Store `LICENSE` and `README.md` in respective entity's root folder in a CSAR - [ADR-0027](0027-use-dasherization-for-filenames.md) - Use dasherization for filenames +- [ADR-0028](0028-use-hardcoded-namespaces-for-threat-modeling.md) - Use hardcoded namespaces for threat modeling diff --git a/docs/user/ThreatModelingNFV.md b/docs/user/ThreatModelingNFV.md new file mode 100644 index 0000000000..487437d8d7 --- /dev/null +++ b/docs/user/ThreatModelingNFV.md @@ -0,0 +1,72 @@ +# Threat Modeling for security-aware NFV + +Threat modeling enables a user to annotate threats in a topology using a structured approach and receive recommendations which security-related Virtual Network Function (S-VNF) should be used. + +This documents specifies how this functionality is intended to be used. + +## Why threat modeling? +In order to protect something of value, threats that impose risk on a application need to be modeled and assessed. +Network Function Virtualization (NFV) can be used as a component based approach to mitigate a certain class of threats. +For Example a virtual firewall could mitigate the threat of publicly exposed ports of a database. + +This way it is possible to create a relation between a threat and a potentially mitigating NFV implementation. +To realize this, this module relies on the presents of two special PolicyTypes and a special NodeType. +The setup of these types is automatically triggered if a new threat is created using the designated UI. +It is assumed that each VNF implementations is encapsulated in it's own ServiceTemplate. + +## Creating threats + +A threat is a PolicyTemplate of a special PolicyType ("{http://opentosca.org/threatmodeling}Security.Threat-w1_wip1") and can therefore be created like a regular PolicyTemplate. +The topology modeler UI and repository UI can both be used to create threats. +However it is recommended to create threats using the designed UI in the topology modler UI. +This way it is ensured that threats are created using the required parameters and the corresponding mitigation is created automatically and set up properly. +[STRIDE](https://docs.microsoft.com/de-de/azure/security/azure-security-threat-modeling-tool-threats) is used as a threat modeling methodology. +Each threat requires a name, a textual description, stride classification and a severity rating in the form of "Low", "Middle" and "High". + +![threat-creation.png](graphics/threatmodelingNFV/threat-creation.png) + +## Assigning threats to NodeTemplates +The created threat PolicyTemplate is intended to be used on a NodeTemplate of a topology to indicate that this NodeTemplate is the target of the threat. +This is done in the topology modeler UI. +The Threat Modeling Modal can be used to generate an overview of all available threats under the menu "Threat Catalog" and receive info on description, stride and severity. +Subsequently the desired threat PolicyTemplate has to be assigned like any other PolicyTemplate using the regular UI. + +![threat-catalog.png](graphics/threatmodelingNFV/threat-catalog.png) + +## Assigning mitigations to VNFs +When threats are created using the threat modeling UI (topology modeler) a corresponding mitigation PolicyTemplate is created. +A naming convention of prepending the given threat name with the string "MITIGATE_" is established to ease working with threat and mitigations. +Referencing the corresponding threat is done by using the "ThreatReference" property of the PolicyTemplate. +Here a string representation of the QName of the threat needs to be specified. +Again, this is done automatically when using the UI. + +A mitigation PolicyTemplate is intended to be used in the boundary definitions of a ServiceTemplate to indicate that the topology of the ServiceTemplate can be used to mitigate a given threat. +Multiple mitigations can be assigned to the same ServiceTemplate. + +## Specifying substitutable NodeTypes for ServiceTemplates +In order to use the topology of a ServiceTemplate in the application topology where threats are present, a substitutable NodeType needs to be specified. +The implemented functionality makes no assumptions how these NodeTypes are modeled besides being abstract and derive from the SVNF NodeType ({http://opentosca.org/nfv/security}S-VNF-w1_wip1). +It is intended to model NodeTypes that inherit from S-VNF (referred to as S-VNF Groups) in a way that multiple VNF implementations can substitute the same S-VFN Group. +All this is done in order to enable users to use abstract NodeTypes in their topologies to hide the underlying complexity and later substitute. Therefore the general rules of substitution apply. + +## Threat assessment and mitigation recommendation +The "Threat Assessment" menu can be viewed in the repository UI on each ServiceTemplate. +An overview of present threats, their targets, and potential mitigation strategies using available VNFs are presented. +This way a detailed look on the current state of the threats is enabled. +Each recommendation can be directly added to the topology by clicking the corresponding button in the "Available Mitigations" part of the threat modeling modal. + +![threat-assessment.png](graphics/threatmodelingNFV/threat-assessment.png) + +## License + +Copyright (c) 2018 Contributors to the Eclipse Foundation + +See the NOTICE file(s) distributed with this work for additional +information regarding copyright ownership. + +This program and the accompanying materials are made available under the +terms of the Eclipse Public License 2.0 which is available at +http://www.eclipse.org/legal/epl-2.0, or the Apache Software License 2.0 +which is available at https://www.apache.org/licenses/LICENSE-2.0. + +SPDX-License-Identifier: EPL-2.0 OR Apache-2.0 diff --git a/docs/user/graphics/threatmodelingNFV/threat-assessment.png b/docs/user/graphics/threatmodelingNFV/threat-assessment.png new file mode 100644 index 0000000000..dae4822aef Binary files /dev/null and b/docs/user/graphics/threatmodelingNFV/threat-assessment.png differ diff --git a/docs/user/graphics/threatmodelingNFV/threat-catalog.png b/docs/user/graphics/threatmodelingNFV/threat-catalog.png new file mode 100644 index 0000000000..c15dbc7d0a Binary files /dev/null and b/docs/user/graphics/threatmodelingNFV/threat-catalog.png differ diff --git a/docs/user/graphics/threatmodelingNFV/threat-creation.png b/docs/user/graphics/threatmodelingNFV/threat-creation.png new file mode 100644 index 0000000000..7f59c21850 Binary files /dev/null and b/docs/user/graphics/threatmodelingNFV/threat-creation.png differ diff --git a/docs/user/index.md b/docs/user/index.md index d97304fe83..595f84e86d 100644 --- a/docs/user/index.md +++ b/docs/user/index.md @@ -20,6 +20,8 @@ For more information on TOSCA see [our TOSCA information page](../tosca/). - [Implementation Artifact Generation](generateIA.md) - Shows how to generate and update an implementation artifact of type .war - [Accountability](../../org.eclipse.winery.accountability/README.md) - Enables enforcing accountability in decentralized scenarios for collaborative development of CSARs - [Version Management](VersionManagement.md) - shows how to update the version of a node template in the topology modeler +- [Threat Modeling For NFV](ThreatModelingNFV.md) - Enables threat modeling capabilities and NFV-based mitigation recommendation + ## Background Literature [BBKL14] Breitenbücher, Uwe; Binz, Tobias; Kopp, Oliver; Leymann, Frank: Vinothek - A Self-Service Portal for TOSCA. In: Herzberg, Nico (Hrsg); Kunze, Matthias (Hrsg): Proceedings of the 6th Central-European Workshop on Services and their Composition (ZEUS 2014). diff --git a/org.eclipse.winery.frontends/app/topologymodeler/src/app/canvas/canvas.component.html b/org.eclipse.winery.frontends/app/topologymodeler/src/app/canvas/canvas.component.html index d92f63a41a..751024d45c 100644 --- a/org.eclipse.winery.frontends/app/topologymodeler/src/app/canvas/canvas.component.html +++ b/org.eclipse.winery.frontends/app/topologymodeler/src/app/canvas/canvas.component.html @@ -327,6 +327,98 @@ + + + + +
+
+
+
+ +
+
+ +
+
+
+
+ +
+ +
+
+
+ +
+
+
+ +
+
+
+ +
+ +
+
+ +
+
+
+
+
+
+
+ +
+
+
+
+

Click on a Mitigation to directly add it to the topology

+ +
+
+
+
+
+
+ +
+
+
+
+
    +
  • +
    {{threat.templateName}}
    +

    {{threat.properties.description}}

    +
    + {{threat.properties.strideClassification}} + {{threat.properties.severity}} +
    +
    • +
+
+
+
+
+ + + + + + = []; @@ -177,6 +184,7 @@ export class CanvasComponent implements OnInit, OnDestroy, OnChanges, AfterViewI this.capabilities = new CapabilitiesModalData(); this.requirements = new RequirementsModalData(); this.importTopologyData = new ImportTopologyModalData(); + this.threatModelingData = new ThreatModelingModalData(); } ngOnChanges(changes: SimpleChanges) { @@ -957,6 +965,28 @@ export class CanvasComponent implements OnInit, OnDestroy, OnChanges, AfterViewI this.importTopologyModal.show(); } else if (this.topologyRendererState.buttonsState.splitTopologyButton) { this.splitMatchService.splitTopology(this.backendService, this.ngRedux, this.topologyRendererActions, this.errorHandler); + } else if (this.topologyRendererState.buttonsState.threatModelingButton) { + + // don't cache data, always refetch. + this.threatModelingData = new ThreatModelingModalData(); + this.ngRedux.dispatch(this.topologyRendererActions.threatModeling()); + // show modal + this.threatModelingModal.show(); + + this.backendService.threatCatalogue().subscribe( + threats => threats.forEach(threat => this.threatModelingData.threatCatalog.push(threat)) + ); + + this.backendService.threatAssessment().subscribe( + assessment => { + Object.keys(assessment.threats) + .map(key => assessment.threats[key]) + .map(threat => threat.mitigations + .filter(mitigation => assessment.svnfs.includes(mitigation)) + .map(mitigation => this.threatModelingData.mitigations.add(new QName(mitigation))) + ); + } + ); } else if (this.topologyRendererState.buttonsState.matchTopologyButton) { this.splitMatchService.matchTopology(this.backendService, this.ngRedux, this.topologyRendererActions, this.errorHandler); } else if (this.topologyRendererState.buttonsState.substituteTopologyButton) { @@ -1012,6 +1042,44 @@ export class CanvasComponent implements OnInit, OnDestroy, OnChanges, AfterViewI this.importTopologyData.selectedTopologyTemplateId = null; } + /** + * Closes the threat modeling modal + */ + closeThreatModeling(): void { + this.threatModelingModal.hide(); + } + + createNewThreat(): void { + this.backendService.threatCreation(this.threatModelingData.threatCreation).subscribe(res => { + this.threatModelingData.threatCreation = new ThreatCreation(); + this.alert.info(res); + }); + } + + addMitigationToTopology(mitigation): void { + this.closeThreatModeling(); + const newNode: TNodeTemplate = new TNodeTemplate( + {}, + mitigation.localName + '_' + Math.floor(Math.random() * 10), + mitigation.qName, + mitigation.localName, + 1, + 1, + TopologyTemplateUtil.getNodeVisualsForNodeTemplate(mitigation.qName, this.entityTypes.nodeVisuals), + [], + [], + {}, + 1, + 1, + null, + null, + null, + null + ); + + this.ngRedux.dispatch(this.actions.saveNodeTemplate(newNode)); + } + /** * Revalidates the offsets and other data of the container in the DOM. */ @@ -1084,12 +1152,35 @@ export class CanvasComponent implements OnInit, OnDestroy, OnChanges, AfterViewI labelString = newRelationship.type.substring(newRelationship.type.indexOf('}') + 1); } + let relationSource = newRelationship.sourceElement.ref; + let relationTarget = newRelationship.targetElement.ref; + + // check if source reference is not a node template + if (!this.allNodesIds.includes(relationSource)) { + // check if source reference is a requirement of a node template + const findNode = this.allNodeTemplates + .find(node => node.requirements && node.requirements.requirement && node.requirements.requirement.find(req => req.id === relationSource)); + if (findNode) { + relationSource = findNode.id; + } + } + + // check if target reference is a node template + if (!this.allNodesIds.includes(relationTarget)) { + // check if target reference is a capability of a node template + const findNode = this.allNodeTemplates + .find(node => node.capabilities && node.capabilities.capability && node.capabilities.capability.find(cap => cap.id === relationTarget)); + if (findNode) { + relationTarget = findNode.id; + } + } + const border = isNullOrUndefined(newRelationship.state) ? '#fafafa' : VersionUtils.getElementColorByDiffState(newRelationship.state); const me = this; const conn = this.newJsPlumbInstance.connect({ - source: newRelationship.sourceElement.ref, - target: newRelationship.targetElement.ref, + source: relationSource, + target: relationTarget, overlays: [['Arrow', { width: 15, length: 15, location: 1, id: 'arrow', direction: 1 }], ['Label', { label: labelString, diff --git a/org.eclipse.winery.frontends/app/topologymodeler/src/app/models/threatCreation.ts b/org.eclipse.winery.frontends/app/topologymodeler/src/app/models/threatCreation.ts new file mode 100644 index 0000000000..030299d128 --- /dev/null +++ b/org.eclipse.winery.frontends/app/topologymodeler/src/app/models/threatCreation.ts @@ -0,0 +1,20 @@ +/******************************************************************************** + * Copyright (c) 2018 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Eclipse Public License 2.0 which is available at + * http://www.eclipse.org/legal/epl-2.0, or the Apache Software License 2.0 + * which is available at https://www.apache.org/licenses/LICENSE-2.0. + * + * SPDX-License-Identifier: EPL-2.0 OR Apache-2.0 + ********************************************************************************/ + +export class ThreatCreation { + constructor(public stride: string = 'Spoofing', + public name: string = '', + public description: string = '', + public severity: string = 'Low') {} +} diff --git a/org.eclipse.winery.frontends/app/topologymodeler/src/app/models/threatModelingModalData.ts b/org.eclipse.winery.frontends/app/topologymodeler/src/app/models/threatModelingModalData.ts new file mode 100644 index 0000000000..866c90905a --- /dev/null +++ b/org.eclipse.winery.frontends/app/topologymodeler/src/app/models/threatModelingModalData.ts @@ -0,0 +1,59 @@ +/******************************************************************************** + * Copyright (c) 2018 Contributors to the Eclipse Foundation + * + * See the NOTICE file(s) distributed with this work for additional + * information regarding copyright ownership. + * + * This program and the accompanying materials are made available under the + * terms of the Eclipse Public License 2.0 which is available at + * http://www.eclipse.org/legal/epl-2.0, or the Apache Software License 2.0 + * which is available at https://www.apache.org/licenses/LICENSE-2.0. + * + * SPDX-License-Identifier: EPL-2.0 OR Apache-2.0 + ********************************************************************************/ +import { QName } from './qname'; +import { ThreatCreation } from './threatCreation'; + +/** + * Encompasses the threat modelling data defined by the user when using the modal + */ + +export interface ThreatAssessmentApiData { + msg: string; + svnfs: Array; + threats: { + [qname: string]: { + mitigations: Array; + templateName: string, + namespace: string, + properties: ThreatProperties, + targets: [ + { + nodeTemplate: string, + nodeType: string + } + ] + + } + }; +} + +export interface ThreatProperties { + description: string; + severity: string; + strideClassification: string; +} + +export interface Threat { + templateName: string; + namespace: string; + properties: ThreatProperties; +} + +export class ThreatModelingModalData { + constructor(public threatCatalog: Array = [], + public mitigations: Set = new Set(), + public threatAssessment: Object = {}, + public threatCreation: ThreatCreation = new ThreatCreation()) { + } +} diff --git a/org.eclipse.winery.frontends/app/topologymodeler/src/app/navbar/navbar.component.html b/org.eclipse.winery.frontends/app/topologymodeler/src/app/navbar/navbar.component.html index 331db30648..c6ec91532f 100644 --- a/org.eclipse.winery.frontends/app/topologymodeler/src/app/navbar/navbar.component.html +++ b/org.eclipse.winery.frontends/app/topologymodeler/src/app/navbar/navbar.component.html @@ -208,6 +208,11 @@

winery

placement="left" class="dropdown-item" (click)="exportCsar($event)">Export CSAR +
  • + +