Bow Tie Kreative SECURITY Grammar
API reference

The grammar

Threat & control graph

Threats, weaknesses, controls and evidence connect. This chapter defines the node and edge types that turn attack paths and control coverage into a queryable graph rather than a prose narrative.

This material is a defensive specification and reference set. It is not an attack tool, a scanner, a certification, or evidence of a completed assessment. It does not automate exploitation; active or state-changing operations require a valid authorization manifest, an in-scope target, an allowed mode, verified preconditions and verified rollback.

14. Threat and control graph

14.1 Why a graph is required

A vulnerability list treats findings as independent rows. Real compromises usually traverse relationships: a public route reaches a vulnerable service, the service reads a secret, the secret controls a database, and the database backup is deletable by the same identity. The risk exists in the path and its amplifiers, not only in any one node.

The graph joins:

ASSET -> EXPOSED_BY -> ENTRY_POINT
ENTRY_POINT -> REACHES -> COMPONENT
COMPONENT -> HAS_WEAKNESS -> WEAKNESS
THREAT_ACTOR -> USES_TECHNIQUE -> TECHNIQUE
TECHNIQUE -> EXPLOITS -> WEAKNESS
WEAKNESS -> ENABLES -> STATE_TRANSITION
STATE_TRANSITION -> CROSSES -> TRUST_BOUNDARY
STATE_TRANSITION -> AFFECTS -> ASSET/DATA/CLIENT
CONTROL -> PREVENTS/DETECTS/CONTAINS/RECOVERS -> EDGE_OR_NODE
TEST -> PRODUCES -> EVIDENCE
EVIDENCE -> SUPPORTS_OR_REFUTES -> CONTROL_CLAIM

14.2 Threat sentence

[ACTOR] with [CAPABILITY]
uses [TECHNIQUE]
through [ENTRY POINT]
under [PRECONDITIONS]
to exploit [WEAKNESS]
and cross [TRUST BOUNDARY]
causing [STATE TRANSITION]
that affects [OBJECT + SECURITY PROPERTY]
with [MAGNITUDE + PROPAGATION + AMPLIFICATION + DURATION]
while [DETECTION CONDITION]
subject to [PREVENTIVE / DETECTIVE / CONTAINMENT / RECOVERY CONTROLS].

14.3 Node types

actor
identity
credential
device
drive
host
network_zone
service
container
artifact
pipeline
domain
route
api_operation
data_store
data_object
backup
provider_account
third_party
control
evidence

Each node records client, tenant, environment, owner, criticality, classification, trust boundary, lifecycle, exposure, and evidence freshness.

14.4 Edge types

owns
administers
authenticates_to
runs_on
connects_to
resolves_to
routes_to
reads
writes
deletes
deploys
signs
backs_up
restores
trusts
inherits_privilege_from
shares_secret_with
monitors
protects
bypasses

Every edge should record direction, condition, protocol or mechanism, privilege, data type, frequency, evidence, and expiry.

14.5 Attack-path grammar

ATTACK_PATH := ENTRY_EDGE + ZERO_OR_MORE(PIVOT_EDGE) + IMPACT_EDGE

ENTRY_EDGE := public_exposure | stolen_identity | compromised_dependency
              | malicious_upload | provider_access | physical_access

PIVOT_EDGE := credential_read | privilege_change | service_control
              | network_reach | tenant_crossing | artifact_poisoning
              | backup_control | persistence | trust_abuse

IMPACT_EDGE := data_read | data_change | service_disruption
               | account_takeover | client_crossing | recovery_destruction

A path is actionable only when its assumptions are labeled:

observed      direct current evidence
inferred      logical relationship supported by evidence
hypothesized  plausible but unverified
refuted       current evidence contradicts the path
stale         evidence is outside the freshness requirement

14.6 Volumetric path fields

Each threat scenario includes:

volume:
  magnitude: 1..5
  rate: description
  direction: toward-or-away-from-risk
  scope: [objects, tenants, clients]
  depth: observation-or-test-depth
  duration: expected-or-observed-duration
  frequency: event-rate-or-review-rate
  acceleration: increasing-stable-decreasing-unknown
  variability: deterministic-variable-unknown
  detectability: 0..5
  reversibility: full-partial-time-sensitive-none-unknown
  propagation: [relationships]
  amplification: [privilege, public-exposure, shared-control-plane]
  accumulation: description

Do not map a control only to a vulnerability identifier. Map it to the exact point in the path where it changes system behavior:

CONTROL_LINK := control_id + relation + target_node_or_edge
                + expected_effect + verification + failure_signal

Relations:

prevent    blocks the transition
reduce     lowers likelihood or impact
isolate    limits propagation
observe    makes the transition visible
attribute  identifies the actor or identity
contain    interrupts an active path
recover    restores the affected object
prove      supplies current evidence

Example:

MFA reduces use-of-stolen-provider-password.
A provider firewall prevents public-network-to-database reachability.
A service-specific identity isolates web compromise from backup deletion.
File-integrity monitoring observes unauthorized change to SSH configuration.
An immutable independent backup recovers from host-and-primary-backup destruction.

14.8 Threat-to-test transformation

IF scenario confidence = observed or inferred
AND affected path is in scope
THEN select the least invasive test that can confirm or refute the next uncertain edge
ELSE collect passive evidence or request client evidence

Test selection order:

existing evidence review
-> configuration verification
-> passive external observation
-> authenticated read-only verification
-> staging active test
-> exceptional production proof

The system does not test an already proven edge more aggressively merely because a stronger tool exists.

14.9 Example cross-layer path

internet
-> public reverse proxy
-> vulnerable application route
-> application service identity
-> readable deployment secret
-> database administrative privilege
-> customer data
-> backup repository writable by same identity

Important controls are not limited to patching the route:

route input/authorization control
service sandbox and least privilege
separate runtime and migration credentials
secret access boundaries
private database listener
backup identity separation
immutable history
application and identity telemetry
isolated restoration test

This is why the system evaluates the complete chain and blast radius.

14.10 Mapping libraries

Use external libraries as controlled vocabularies rather than as the security program itself:

  • MITRE ATT&CK for adversary behavior and technique identifiers;
  • MITRE D3FEND for defensive technique relationships;
  • OWASP threat-modeling guidance for design-time decomposition;
  • OWASP ASVS for application control requirements;
  • OWASP WSTG for test-method references;
  • NIST CSF for program outcomes and operating lifecycle.

Keep local, client-specific facts primary. A framework mapping without local evidence does not prove risk or control effectiveness.

14.11 Graph feedback rules

IF a credential is reused across two boundaries
THEN create a propagation edge and raise structural remediation.

IF one identity can mutate production and delete recovery history
THEN mark recovery amplification critical and require separation.

IF a control fails repeatedly after deployment
THEN move the defect upstream to image, IaC, or pipeline policy.

IF an edge has no evidence inside its freshness window
THEN mark the path confidence stale, not safe.

IF a new public edge appears
THEN open an urgent drift finding and run bounded passive verification.

IF a path crosses a client boundary unexpectedly
THEN stop testing and declare a tenant-isolation incident.