Skip to content

[IDEA] Add OWASP Threat Model Library parity #1034

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
P3tra-WP wants to merge 4 commits into
base: 2.0-dev
Choose a base branch
from
+312 −58
Draft

[IDEA] Add OWASP Threat Model Library parity #1034

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
fac5276
Add threat model library parity
petra-dv Aug 20, 2026
c6d6522
Remove threat model mapping document
petra-dv Aug 24, 2026
6a3bc10
Merge branch '2.0-dev' into 2.0-dev-threatmodeling-library-parity
jkowalleck Aug 24, 2026
4d46aa9
Merge branch '2.0-dev' into 2.0-dev-threatmodeling-library-parity
jkowalleck Sep 1, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
58 changes: 1 addition & 57 deletions schema/2.0/model/cyclonedx-blueprint-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,7 +52,7 @@
}
},
"scope": {
"$ref": "#/$defs/scope"
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope"

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

On the TM call, we discussed adding an inscope/out-of-scope on a per-asset basis. The scope here will remain unchanged, thus this should be reverted.

},
"assets": {
"type": "array",
Expand Down Expand Up @@ -342,62 +342,6 @@
}
}
},
"scope": {

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Keep scope in blueprint

"type": "object",
"title": "Scope",
"description": "Specifies what is included and excluded from the blueprint model, establishing the boundaries within which the modelling and analysis is performed.",
"required": [
"name"
],
"additionalProperties": false,
"properties": {
"bom-ref": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
},
"name": {
"type": "string",
"title": "Name",
"minLength": 1,
"description": "Name of the scope."
},
"description": {
"type": "string",
"title": "Description",
"description": "Description of what is included and excluded from the model."
},
"boundaries": {
"type": "array",
"title": "Boundaries",
"uniqueItems": true,
"items": {
"type": "string",
"minLength": 1
},
"description": "Explicit boundaries of the model."
},
"includedComponents": {
"type": "array",
"title": "Included Components",
"uniqueItems": true,
"items": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
},
"description": "References using bom-link or bom-ref to components explicitly included."
},
"excludedComponents": {
"type": "array",
"title": "Excluded Components",
"uniqueItems": true,
"items": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType"
},
"description": "References using bom-link or bom-ref to components explicitly excluded."
},
"properties": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
}
}
},
"asset": {
"type": "object",
"title": "Asset",
Expand Down
56 changes: 56 additions & 0 deletions schema/2.0/model/cyclonedx-common-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -16,6 +16,62 @@
"allOf": [{ "$ref": "#/$defs/refType" }],
"$comment": "value-range is same as 'refType'"
},
"modelScope": {

@jkowalleck jkowalleck Aug 21, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why would the model scope live here, and not in cyclonedx-ai-modelcard-2.0.schema.json ?

@P3tra-WP P3tra-WP Aug 23, 2026

Copy link
Copy Markdown
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

modelScope is intentionally a common definition because it is reused by metadata.scope and blueprint.scope. It describes analysis/model boundaries generally, not AI-model-card-specific scope. Keeping it in the common schema avoids duplicating the same structure and allows threat models beyond AI systems to use it.

This comes from the need of having a threat modelling scope very well defined - i.e. if you are threat modelling a feature - but have a full system diagram it is important to define the scope boundaries of the threat model, especially if something is out of scope but for completeness still mentioned in the dataflows etc (i.e. if modelling a new feature, perhaps authentication is out of scope, but for completeness of the diagram it is still mentioned)

@jkowalleck jkowalleck Aug 24, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see. so this "model" is actually some threat model?
or behavior?
For me this all looks unintuitive, anyway. see #1034 (comment)

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per the TM call, the modelScope should be removed from common.

"type": "object",
"title": "Model Scope",
"description": "Specifies what is included and excluded from a model or analysis, establishing the boundaries within which it is performed.",
"required": [
"name"
],
"additionalProperties": false,
"properties": {
"bom-ref": {
"$ref": "#/$defs/refType"
},
"name": {
"type": "string",
"title": "Name",
"minLength": 1,
"description": "Name of the scope."
},
"description": {
"type": "string",
"title": "Description",
"description": "Description of what is included and excluded from the model."
},
"boundaries": {
"type": "array",
"title": "Boundaries",
"uniqueItems": true,
"items": {
"type": "string",
"minLength": 1
},
"description": "Explicit boundaries of the model."
},
"includedComponents": {
"type": "array",
"title": "Included Components",
"uniqueItems": true,
"items": {
"$ref": "#/$defs/refLinkType"
},
"description": "References using bom-link or bom-ref to components explicitly included."
},
"excludedComponents": {
"type": "array",
"title": "Excluded Components",
"uniqueItems": true,
"items": {
"$ref": "#/$defs/refLinkType"
},
"description": "References using bom-link or bom-ref to components explicitly excluded."
},
"properties": {
"$ref": "#/$defs/properties"
}
}
},
"bomLinkDocumentType": {
"title": "BOM-Link Document",
"description": "Descriptor for another BOM document. See https://cyclonedx.org/capabilities/bomlink/",
Expand Down
49 changes: 49 additions & 0 deletions schema/2.0/model/cyclonedx-metadata-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -47,6 +47,14 @@
"description": "The component that the BOM describes.",
"$ref": "cyclonedx-component-2.0.schema.json#/$defs/component"
},
"scope": {
"description": "The scope of the analysis represented by this BOM, including what is in and out of scope.",

@jkowalleck jkowalleck Aug 24, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CycloneDX is about system transparency, not BOM.
therefore, i would not put this here.

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per the TM call, the scope should be removed from metadata.

"$ref": "cyclonedx-common-2.0.schema.json#/$defs/modelScope"
},
"modelLifecycle": {

@jkowalleck jkowalleck Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

too specific for a metadata. shall go somewhere else

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per the TM call, the modelLifecycle should be removed from metadata, however, if there are common lifecycles that we want to add to the existing lifecycles enum, those can be added.

"description": "Lifecycle metadata for the model represented by this BOM.",
"$ref": "#/$defs/modelLifecycle"
},
"supplier": {
"title": "Supplier",
"description": " The organization that supplied the component that the BOM describes. The supplier may often be the manufacturer, but may also be a distributor or repackager.",
Expand All @@ -65,6 +73,47 @@
}
}
},
"modelLifecycle": {

@jkowalleck jkowalleck Aug 24, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

why put this here, and not in the existing threat or blueprint or behaviour space?

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per the TM call, the modelLifecycle should be removed from metadata.

"type": "object",
"title": "Model Lifecycle",
"description": "Version, release, review, and freeze information for the model represented by this BOM.",
"additionalProperties": false,
"properties": {
"version": {

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

We already have an ordinalVersion for the blueprint. This field is not necessary.

"type": "string",
"pattern": "^\\d+(\\.\\d+)*$",
"description": "The structured version of the model."
},
"frozen": {

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not sure if frozen is currently supported or not, but it can be added to the blueprint in the same area as the ordinalVersion.

"type": "boolean",
"description": "Whether the model is frozen and must be versioned before modification."
},
"releasedAt": {
"$ref": "#/$defs/dateOrDateTime",
"description": "When the model was released."
},
"productReleaseDate": {
"$ref": "#/$defs/dateOrDateTime",
"description": "When the product release modeled by this BOM was released."
},
"reviewedAt": {
"$ref": "#/$defs/dateOrDateTime",
"description": "When the model was last reviewed."
}
}
},
"dateOrDateTime": {
"oneOf": [
{
"type": "string",
"format": "date"
},
{
"type": "string",
"format": "date-time"
}
]
},
"distributionConstraints": {
"title": "Distribution Constraints",
"description": "Conditions and constraints governing the sharing and distribution of the data or components described by this BOM.",
Expand Down
128 changes: 128 additions & 0 deletions schema/2.0/model/cyclonedx-risk-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,11 +38,130 @@
},
"description": "The risk appetites that apply to this collection. Multiple entries support a document covering more than one party."
},
"qualitativeMatrices": {
"type": "array",
"title": "Qualitative Matrices",
"uniqueItems": true,
"items": {
"$ref": "#/$defs/qualitativeMatrix"
},
"description": "Named qualitative risk matrices available to ratings in this collection."
},
"properties": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/properties"
}
}
},
"qualitativeMatrix": {

@stevespringett stevespringett Sep 3, 2026

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Lets discuss this on a call, between now and the next TM call. I believe most of this is already being covered by the existing spec, but we need to walk through it.

"type": "object",
"title": "Qualitative Matrix",
"description": "A named risk matrix that defines likelihood and impact scales and the resulting score and level for each combination.",
"required": [
"bom-ref",
"name",
"likelihoodLevels",
"impactLevels",
"outcomes"
],
"additionalProperties": false,
"properties": {
"bom-ref": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refType"
},
"name": {
"type": "string",
"minLength": 1,
"description": "The name of the matrix."
},
"description": {
"type": "string",
"description": "A description of the matrix and its intended use."
},
"likelihoodLevels": {
"type": "array",
"minItems": 1,
"uniqueItems": true,
"items": {
"$ref": "#/$defs/qualitativeMatrixAxisLevel"
},
"description": "The ordered likelihood levels used by the matrix."
},
"impactLevels": {
"type": "array",
"minItems": 1,
"uniqueItems": true,
"items": {
"$ref": "#/$defs/qualitativeMatrixAxisLevel"
},
"description": "The ordered impact levels used by the matrix."
},
"outcomes": {
"type": "array",
"minItems": 1,
"uniqueItems": true,
"items": {
"$ref": "#/$defs/qualitativeMatrixOutcome"
},
"description": "The score and named result for each likelihood and impact combination."
}
}
},
"qualitativeMatrixAxisLevel": {
"type": "object",
"required": [
"name",
"value"
],
"additionalProperties": false,
"properties": {
"name": {
"type": "string",
"minLength": 1,
"description": "The stable name of this level."
},
"value": {
"type": "number",
"minimum": 0,
"description": "The ordinal or numeric value of this level."
},
"description": {
"type": "string",
"description": "The meaning of this level."
}
}
},
"qualitativeMatrixOutcome": {
"type": "object",
"required": [
"likelihood",
"impact",
"score",
"level"
],
"additionalProperties": false,
"properties": {
"likelihood": {
"type": "string",
"minLength": 1,
"description": "The name of a level from the matrix likelihood scale."
},
"impact": {
"type": "string",
"minLength": 1,
"description": "The name of a level from the matrix impact scale."
},
"score": {
"type": "number",
"minimum": 0,
"description": "The numeric score assigned by this combination."
},
"level": {
"type": "string",
"minLength": 1,
"description": "The matrix-specific qualitative result."
}
}
},
"riskDomain": {
"type": "object",
"required": [
Expand Down Expand Up @@ -895,6 +1014,15 @@
"type": "string",
"description": "A textual representation of the metric values used to derive the score, in the format defined by the methodology."
},
"qualitativeMatrix": {
"$ref": "cyclonedx-common-2.0.schema.json#/$defs/refLinkType",
"description": "Reference to the qualitative matrix used to derive this score."
},
"matrixLevel": {
"type": "string",
"minLength": 1,
"description": "The matrix-specific qualitative result, such as very-low or very-high."
},
"methodology": {
"title": "Methodology",
"description": "The risk rating methodology used to derive this score. Only methodologies that define a scoring calculation are listed; governance frameworks such as [ISO 31000](https://www.iso.org/iso-31000-risk-management.html) are recorded as standards rather than as a score methodology. Use the custom option for methodologies not listed.",
Expand Down
22 changes: 22 additions & 0 deletions schema/2.0/model/cyclonedx-threat-2.0.schema.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,11 @@
"title": "Description",
"description": "A description of the threat."
},
"event": {
"type": "string",
"title": "Event",
"description": "The event that realizes or triggers the threat."
},
"source": {
"type": "string",
"title": "Source",
Expand Down Expand Up @@ -514,6 +519,23 @@
"persistent": "The actor pursues the target persistently over time."
}
},
"maliciousIntent": {
"type": "boolean",
"title": "Malicious Intent",
"description": "Whether the actor intends to cause harm in this scenario."
},
"applicability": {
"type": "string",
"title": "Applicability",
"description": "The applicability of this scenario to the organization.",
"enum": [
"minimal",
"low",
"moderate",
"high",
"maximal"
]
},
"accessLevel": {
"type": "string",
"title": "Access Level",
Expand Down
Loading