LAKA Threat and Control Graph
threat-model 8 required 10 properties
Required properties
- version
- model_id
- client_id
- scope
- nodes
- edges
- scenarios
- review_triggers
The schema in full
{
"$schema": "https://json-schema.org/draft/2020-12/schema",
"$id": "https://bowtiekreative.example/schemas/laka-security/threat-model.schema.json",
"title": "LAKA Threat and Control Graph",
"type": "object",
"additionalProperties": false,
"required": [
"version",
"model_id",
"client_id",
"scope",
"nodes",
"edges",
"scenarios",
"review_triggers"
],
"properties": {
"version": {
"type": "string"
},
"model_id": {
"type": "string",
"minLength": 3
},
"client_id": {
"type": "string",
"minLength": 1
},
"title": {
"type": "string"
},
"scope": {
"type": "object",
"additionalProperties": false,
"required": [
"environments",
"assets",
"authorization_id"
],
"properties": {
"environments": {
"type": "array",
"minItems": 1,
"items": {
"type": "string"
}
},
"assets": {
"type": "array",
"minItems": 1,
"items": {
"type": "string"
}
},
"authorization_id": {
"type": "string"
},
"exclusions": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"assumptions": {
"type": "array",
"items": {
"type": "string"
}
},
"nodes": {
"type": "array",
"minItems": 1,
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"node_id",
"kind",
"name",
"environment",
"owner",
"criticality",
"trust_boundary"
],
"properties": {
"node_id": {
"type": "string"
},
"kind": {
"type": "string"
},
"name": {
"type": "string"
},
"environment": {
"type": "string"
},
"owner": {
"type": "string"
},
"criticality": {
"type": "integer",
"minimum": 1,
"maximum": 5
},
"classification": {
"type": "string"
},
"trust_boundary": {
"type": "string"
},
"internet_exposed": {
"type": "boolean"
},
"evidence_freshness": {
"type": "string"
},
"attributes": {
"type": "object"
}
}
}
},
"edges": {
"type": "array",
"minItems": 1,
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"edge_id",
"from",
"relation",
"to",
"condition",
"confidence",
"evidence"
],
"properties": {
"edge_id": {
"type": "string"
},
"from": {
"type": "string"
},
"relation": {
"type": "string"
},
"to": {
"type": "string"
},
"condition": {
"type": "string"
},
"privilege": {
"type": "string"
},
"data_class": {
"type": "string"
},
"confidence": {
"enum": [
"observed",
"inferred",
"hypothesized",
"refuted",
"stale"
]
},
"evidence": {
"type": "array",
"items": {
"type": "string"
}
},
"expires": {
"type": "string"
}
}
}
},
"scenarios": {
"type": "array",
"minItems": 1,
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"scenario_id",
"title",
"actor",
"entry_point",
"preconditions",
"attack_path",
"effects",
"volume",
"control_links",
"verification",
"owner",
"status"
],
"properties": {
"scenario_id": {
"type": "string"
},
"title": {
"type": "string"
},
"actor": {
"type": "string"
},
"entry_point": {
"type": "string"
},
"preconditions": {
"type": "array",
"items": {
"type": "string"
}
},
"technique_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"weakness_ids": {
"type": "array",
"items": {
"type": "string"
}
},
"attack_path": {
"type": "array",
"minItems": 2,
"items": {
"type": "string"
}
},
"effects": {
"type": "array",
"minItems": 1,
"items": {
"type": "string"
}
},
"volume": {
"type": "object",
"additionalProperties": false,
"required": [
"magnitude",
"rate",
"direction",
"scope",
"depth",
"duration",
"frequency",
"acceleration",
"variability",
"detectability",
"reversibility",
"propagation",
"amplification",
"accumulation"
],
"properties": {
"magnitude": {
"type": "integer",
"minimum": 0,
"maximum": 5
},
"rate": {
"type": "string"
},
"direction": {
"type": "string"
},
"scope": {
"type": "array",
"items": {
"type": "string"
}
},
"depth": {
"type": "string"
},
"duration": {
"type": "string"
},
"frequency": {
"type": "string"
},
"acceleration": {
"type": "string"
},
"variability": {
"type": "string"
},
"detectability": {
"type": "integer",
"minimum": 0,
"maximum": 5
},
"reversibility": {
"type": "string"
},
"propagation": {
"type": "array",
"items": {
"type": "string"
}
},
"amplification": {
"type": "array",
"items": {
"type": "string"
}
},
"accumulation": {
"type": "string"
}
}
},
"control_links": {
"type": "array",
"items": {
"type": "object",
"additionalProperties": false,
"required": [
"control_id",
"relation",
"target",
"expected_effect",
"verification"
],
"properties": {
"control_id": {
"type": "string"
},
"relation": {
"enum": [
"prevent",
"reduce",
"isolate",
"observe",
"attribute",
"contain",
"recover",
"prove"
]
},
"target": {
"type": "string"
},
"expected_effect": {
"type": "string"
},
"verification": {
"type": "string"
},
"failure_signal": {
"type": "string"
}
}
}
},
"verification": {
"type": "object",
"additionalProperties": false,
"required": [
"next_uncertain_edge",
"least_invasive_method",
"mode",
"evidence_required"
],
"properties": {
"next_uncertain_edge": {
"type": "string"
},
"least_invasive_method": {
"type": "string"
},
"mode": {
"enum": [
"inventory",
"passive",
"audit",
"active",
"change",
"containment",
"recovery"
]
},
"evidence_required": {
"type": "array",
"items": {
"type": "string"
}
},
"stop_conditions": {
"type": "array",
"items": {
"type": "string"
}
}
}
},
"owner": {
"type": "string"
},
"status": {
"enum": [
"draft",
"current",
"testing",
"mitigated",
"accepted",
"refuted",
"stale"
]
}
}
}
},
"review_triggers": {
"type": "array",
"minItems": 1,
"items": {
"type": "string"
}
}
}
}Validate against it
curl -X POST https://security.bowtiekreative.com/v1/validate \
-H 'content-type: application/json' \
--data '{"schema": "threat-model", "document": { … }}'