performing-threat-modeling-with-owasp-threat-dragon skill (Anthropic-Cybersecurity-Skills)

From Public Agent Wiki

What it does. Uses OWASP Threat Dragon (web or desktop) to build data flow diagrams, identify threats with STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies via its auto-generation rule engine, and produce PDF threat model reports. Use during secure design review of an application architecture to build a formal threat model and document mitigations for GRC compliance. Part of mukul975/Anthropic-Cybersecurity-Skills (817 security skills) (mukul975/Anthropic-Cybersecurity-Skills).
Upstream mukul975/Anthropic-Cybersecurity-Skills
Skill file skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md
License Apache-2.0 (skill folder LICENSE)
Author mukul975
Fetched 2026-09-10

Install

  • npx skills add mukul975/Anthropic-Cybersecurity-Skills --skill performing-threat-modeling-with-owasp-threat-dragon, or copy the skill folder into ~/.claude/skills/performing-threat-modeling-with-owasp-threat-dragon/.
  • Raw file: curl -sL https://raw.githubusercontent.com/mukul975/Anthropic-Cybersecurity-Skills/HEAD/skills/performing-threat-modeling-with-owasp-threat-dragon/SKILL.md

SKILL.md (verbatim)

name: performing-threat-modeling-with-owasp-threat-dragon
description: >-
  Uses OWASP Threat Dragon (web or desktop) to build data flow diagrams,
  identify threats with STRIDE, LINDDUN, CIA, DIE, or PLOT4ai methodologies
  via its auto-generation rule engine, and produce PDF threat model reports.
  Use during secure design review of an application architecture to build a
  formal threat model and document mitigations for GRC compliance.
domain: cybersecurity
subdomain: devsecops
tags:
- threat-modeling
- owasp
- threat-dragon
- stride
- linddun
- secure-design
- dfd
- data-flow
version: '1.0'
author: mahipal
license: Apache-2.0
nist_ai_rmf:
- MEASURE-2.7
- MAP-5.1
- MANAGE-2.4
atlas_techniques:
- AML.T0070
- AML.T0066
- AML.T0082
nist_csf:
- PR.PS-01
- GV.SC-07
- ID.IM-04
- PR.PS-04
mitre_attack:
- T1195
- T1554
- T1059.004

Performing Threat Modeling with OWASP Threat Dragon

Overview

OWASP Threat Dragon is an open-source threat modeling tool that enables security teams and developers to create threat model diagrams, identify threats using established methodologies (STRIDE, LINDDUN, CIA, DIE, PLOT4ai), and generate comprehensive reports. Threat Dragon runs as both a web application and desktop application (Windows, macOS, Linux), supporting distributed teams working collaboratively on threat models. Version 2.x provides drag-and-drop diagram creation, an auto-generation rule engine for threats and mitigations, and PDF report output for documentation and GRC compliance.

When to Use

  • When conducting security assessments that involve performing threat modeling with owasp threat dragon
  • When following incident response procedures for related security events
  • When performing scheduled security testing or auditing activities
  • When validating security controls through hands-on testing

Prerequisites

  • OWASP Threat Dragon desktop application or web instance
  • Understanding of data flow diagram (DFD) notation
  • Familiarity with STRIDE or LINDDUN threat classification
  • Application architecture documentation and network diagrams
  • Stakeholder access for design review sessions

Threat Modeling Methodologies

STRIDE

Category Threat Type Description Example
S Spoofing Impersonating a user or system Stolen session tokens
T Tampering Modifying data in transit or at rest SQL injection altering records
R Repudiation Denying an action occurred Missing audit logs
I Information Disclosure Exposing sensitive data API returning excessive fields
D Denial of Service Making a service unavailable Resource exhaustion attack
E Elevation of Privilege Gaining unauthorized access Broken access control

LINDDUN (Privacy-Focused)

Category Threat Type Description
L Linkability Associating data items across contexts
I Identifiability Identifying an individual from data
N Non-repudiation Inability to deny an action (privacy risk)
D Detectability Determining if data about a subject exists
D Disclosure Exposing personal information
U Unawareness User unaware of data collection
N Non-compliance Violating privacy regulations

Workflow

Step 1 --- Install Threat Dragon

Desktop Application: Download the installer from the OWASP Threat Dragon releases page for Windows (.exe), macOS (.dmg), or Linux (.AppImage/.deb/.rpm).

Web Application (Docker):

docker run -p 3000:3000 \
  -e ENCRYPTION_JWT_SIGNING_KEY=$(openssl rand -hex 32) \
  -e ENCRYPTION_JWT_REFRESH_SIGNING_KEY=$(openssl rand -hex 32) \
  -e ENCRYPTION_KEYS='[{"isPrimary":true,"id":0,"value":"'$(openssl rand -hex 16)'"}]' \
  -e NODE_ENV=production \
  owasp/threat-dragon:latest

Step 2 --- Define the Scope

Before creating diagrams, document the scope:

  • System name and description
  • Assets being protected (user data, credentials, payment info)
  • External dependencies (third-party APIs, cloud services)
  • Compliance requirements (GDPR, HIPAA, PCI DSS)
  • Trust boundaries (network segments, authentication zones)

Step 3 --- Create Data Flow Diagrams

In Threat Dragon, create a new threat model and add diagrams using the following DFD elements:

Processes: Applications, microservices, API endpoints that transform data. Represented as circles/rounded rectangles.

Data Stores: Databases, file systems, caches, message queues that persist data. Represented as parallel lines.

External Entities: Users, external systems, third-party services outside the trust boundary. Represented as rectangles.

Data Flows: Communication channels between elements showing data direction. Represented as arrows with labels describing the data.

Trust Boundaries: Dashed lines separating zones of different trust levels (internet/DMZ/internal network, user/admin).

Step 4 --- Identify Threats

For each DFD element, apply the STRIDE methodology:

Element Type Applicable STRIDE Categories
External Entity Spoofing, Repudiation
Process Spoofing, Tampering, Repudiation, Information Disclosure, DoS, Elevation of Privilege
Data Store Tampering, Information Disclosure, DoS
Data Flow Tampering, Information Disclosure, DoS

Threat Dragon's rule engine automatically suggests threats based on element types. Review each suggestion and mark as:

  • Mitigated: Existing controls address the threat
  • Not Applicable: Threat does not apply to this context
  • Open: Threat needs to be addressed (assign priority and owner)

Step 5 --- Define Mitigations

For each open threat, document:

  • Mitigation strategy (prevent, detect, respond, transfer)
  • Specific technical controls (encryption, authentication, rate limiting)
  • Owner responsible for implementation
  • Priority and timeline for remediation

Step 6 --- Generate Reports

Threat Dragon produces PDF reports containing:

  • Executive summary of the threat model
  • Data flow diagrams with annotations
  • Threat inventory with severity ratings
  • Mitigation status and recommendations
  • Compliance mapping where applicable

Step 7 --- Integrate into SDLC

  • Conduct threat modeling during the design phase of new features
  • Update threat models when architecture changes occur
  • Review threat models during security design reviews
  • Store threat model files in version control alongside code
  • Reference threat model findings in security acceptance criteria

Threat Model File Format

Threat Dragon uses JSON format for threat models, enabling version control and programmatic manipulation:

{
  "version": "2.2.0",
  "summary": {
    "title": "E-Commerce Application",
    "owner": "Security Team",
    "description": "Threat model for the checkout flow"
  },
  "detail": {
    "contributors": [
      {"name": "Security Architect"}
    ],
    "diagrams": [
      {
        "id": 0,
        "title": "Checkout Flow",
        "diagramType": "STRIDE",
        "cells": []
      }
    ]
  }
}

CycloneDX TMBOM Integration

Threat Dragon participates in the CycloneDX Threat Model Bill of Materials (TMBOM) effort, enabling export to a common format that can be consumed by other threat modeling tools and GRC platforms, preventing vendor lock-in.

Best Practices

  1. Start simple: Begin with high-level DFDs (Level 0) before decomposing into detailed diagrams
  2. Involve developers: Include development team members in threat modeling sessions for realistic threat assessment
  3. Time-box sessions: Limit initial sessions to 90 minutes; iterate in follow-up sessions
  4. Prioritize by risk: Use severity ratings (Critical, High, Medium, Low) to prioritize mitigations
  5. Living documents: Treat threat models as living documents that evolve with the system
  6. Automate where possible: Use the rule engine for initial threat generation, then refine manually

References

Other files in this skill

assets/template.md (verbatim)

Threat Modeling Session Template

System Information

Field Value
System Name
Version/Release
Owner
Date
Participants
Methodology [ ] STRIDE [ ] LINDDUN [ ] CIA [ ] DIE

Scope Definition

Assets to Protect: 1. 2. 3.

Trust Boundaries: 1. 2.

External Dependencies: 1. 2.

Threat Register

ID Element STRIDE Category Threat Description Severity Status Mitigation Owner
T-001 [ ] Open [ ] Mitigated [ ] N/A
T-002 [ ] Open [ ] Mitigated [ ] N/A

Action Items

Item Description Owner Due Date Status

Review Schedule

  • Initial threat model created
  • Peer review completed
  • Architecture review board sign-off
  • Quarterly review scheduled
  • Model updated for last architecture change

references/api-reference.md (verbatim)

API Reference: Threat Modeling with OWASP Threat Dragon

Threat Dragon JSON Model Structure

Field Description
version Threat Dragon version (e.g., "2.2.0")
summary.title Threat model name
summary.owner Model owner
detail.diagrams[] Array of DFD diagrams
detail.diagrams[].cells[] DFD elements within a diagram
detail.diagrams[].diagramType Methodology (STRIDE, LINDDUN, CIA)

DFD Element Types

Type Threat Dragon Class STRIDE Categories
Process tm.Process S, T, R, I, D, E
Data Store tm.Store T, I, D
Data Flow tm.Flow T, I, D
External Entity tm.Actor S, R
Trust Boundary tm.Boundary N/A

STRIDE Categories

Letter Threat Mitigation
S Spoofing Strong authentication, MFA
T Tampering Integrity checks, HMAC
R Repudiation Audit logging
I Information Disclosure Encryption, least privilege
D Denial of Service Rate limiting, auto-scaling
E Elevation of Privilege RBAC, authorization checks

Threat Status Values

Status Description
Open Threat needs mitigation
Mitigated Controls address the threat
Not Applicable Threat does not apply

Docker Deployment

docker run -p 3000:3000 \
  -e ENCRYPTION_JWT_SIGNING_KEY=$(openssl rand -hex 32) \
  -e ENCRYPTION_JWT_REFRESH_SIGNING_KEY=$(openssl rand -hex 32) \
  owasp/threat-dragon:latest

Python Libraries

Library Version Purpose
json stdlib Threat Dragon model serialization
uuid stdlib Generate unique element IDs

References

references/standards.md (verbatim)

Standards Reference for Threat Modeling

OWASP Threat Modeling Process

  1. Decompose the application: Create DFDs showing data flows, trust boundaries, entry points
  2. Determine and rank threats: Apply STRIDE per element, rank by DREAD or risk matrix
  3. Determine countermeasures and mitigations: Map threats to controls
  4. Review and validate: Peer review the model, validate against architecture

NIST SP 800-154: Guide to Data-Centric System Threat Modeling

  • Identify data assets and their sensitivity levels
  • Map data flows through system components
  • Identify threat actors and attack vectors targeting data
  • Assess risk based on data exposure and impact
  • Document countermeasures protecting data at rest, in transit, and in use

ISO 27005 Risk Assessment Alignment

ISO 27005 Step Threat Dragon Activity
Context establishment Define system scope and trust boundaries
Risk identification STRIDE threat enumeration per DFD element
Risk analysis Severity rating and likelihood assessment
Risk evaluation Prioritize threats by risk score
Risk treatment Define mitigations (mitigate, accept, transfer, avoid)

STRIDE-per-Element Mapping

DFD Element S T R I D E
External Entity x x
Process x x x x x x
Data Store x x x
Data Flow x x x

Threat Severity Rating Scale

Rating Score Description
Critical 9-10 Immediate exploitation possible, severe business impact
High 7-8 Likely exploitation, significant business impact
Medium 4-6 Possible exploitation, moderate business impact
Low 1-3 Unlikely exploitation or minimal impact

references/workflows.md (verbatim)

Threat Modeling Workflows

Workflow 1: Feature-Level Threat Modeling

Product team proposes new feature
       |
Security champion schedules threat modeling session
       |
Gather architecture docs, API specs, DFDs
       |
Workshop session (60-90 min):
  - Review DFD for new feature
  - Apply STRIDE to each element
  - Identify threats and rank by severity
  - Document mitigations needed
       |
Threats documented in Threat Dragon
       |
Mitigation tasks created in backlog
       |
Security acceptance criteria added to user stories
       |
Feature development includes mitigations
       |
Threat model updated during code review

Workflow 2: Architecture Review Threat Model

New system or major refactor proposed
       |
Create Level 0 DFD (context diagram)
       |
Identify trust boundaries and data sensitivity
       |
Decompose into Level 1 DFDs per subsystem
       |
Apply STRIDE per element in each diagram
       |
Auto-generate threats using Threat Dragon rule engine
       |
Review and refine auto-generated threats
       |
Assign severity ratings
       |
Document existing controls as mitigations
       |
Identify gaps (open threats without mitigations)
       |
Generate PDF report for architecture review board
       |
Remediation plan approved and tracked

Workflow 3: Continuous Threat Modeling in Agile

Sprint planning identifies security-relevant stories
       |
Pull existing threat model from version control
       |
Update DFD to reflect planned changes
       |
Quick STRIDE review (30 min) focused on changes
       |
New threats added, mitigations defined
       |
Threat model committed alongside code changes
       |
Sprint retrospective reviews threat model accuracy
       |
Quarterly full threat model review cycle

Back to mukul975/Anthropic-Cybersecurity-Skills (817 security skills) or Agent skills.