private IEnumerable <GridRow> GetRows([NotNull] IThreatEvent threatEvent)
{
List <GridRow> result = new List <GridRow>();
var rows = _grid.PrimaryGrid.Rows.OfType <GridRow>().ToArray();
if (rows.Any())
{
foreach (var row in rows)
{
var panel = row.Rows.OfType <GridPanel>()
.FirstOrDefault(x => string.CompareOrdinal(x.Name, "ThreatEventMitigations") == 0);
if (panel != null)
{
var temRows = panel.Rows.OfType <GridRow>().ToArray();
if (temRows.Any())
{
foreach (var temRow in temRows)
{
if (temRow.Tag is IThreatEventMitigation threatEventMitigation &&
threatEventMitigation.ThreatEvent == threatEvent)
{
result.Add(temRow);
}
}
}
}
}
}
return(result.AsReadOnly());
}
private void AddThreatEvent([NotNull] IThreatEvent source, [NotNull] IThreatEventsContainer container)
{
var threatEvent = container.AddThreatEvent(source.ThreatType);
threatEvent.Name = source.Name;
threatEvent.Description = source.Description;
threatEvent.Severity = source.Severity;
source.CloneProperties(threatEvent);
var scenarios = source.Scenarios?.ToArray();
if (scenarios?.Any() ?? false)
{
foreach (var scenario in scenarios)
{
var newScenario =
threatEvent.AddScenario(scenario.Actor, scenario.Severity, scenario.Name);
newScenario.Description = scenario.Description;
newScenario.Motivation = scenario.Motivation;
scenario.CloneProperties(newScenario);
}
}
var mitigations = source.Mitigations?.ToArray();
if (mitigations?.Any() ?? false)
{
foreach (var mitigation in mitigations)
{
var newMitigation = threatEvent.AddMitigation(mitigation.Mitigation, mitigation.Strength,
mitigation.Status, mitigation.Directives);
mitigation.CloneProperties(newMitigation);
}
}
}
public void Initialize([NotNull] IThreatEvent threatEvent)
{
_threatEvent = threatEvent;
_model = threatEvent.Model;
_standardMitigationsContainer.Visible = true;
InitializeGrid(true);
InitializeItem(threatEvent);
var existingMitigations = threatEvent.Mitigations?.ToArray();
var mitigations = _model?.Mitigations?.OrderBy(x => x.Name);
if (mitigations != null)
{
var defaultStrength = _model.GetStrength((int)DefaultStrength.Average);
foreach (var mitigation in mitigations)
{
var existingMitigation = existingMitigations?.FirstOrDefault(x => x.MitigationId == mitigation.Id);
var row = new GridRow(mitigation.Name,
mitigation.ControlType.GetEnumLabel(),
existingMitigation?.Strength ?? defaultStrength,
existingMitigation?.Status ?? MitigationStatus.Undefined);
row.Tag = mitigation;
row.Checked = existingMitigation != null;
_grid.PrimaryGrid.Rows.Add(row);
}
}
}
public IThreatEvent AddThreatEvent(IThreatType threatType)
{
if (!(IsInitialized?.Get() ?? false))
{
return(null);
}
IThreatEvent result = null;
var threatEventsContainer = ThreatEventsContainer?.Get();
if ((_threatEvents?.All(x => x.ThreatTypeId != threatType.Id) ?? true) &&
threatEventsContainer is IIdentity identity)
{
result = new ThreatEvent(Model?.Get(), threatType, identity);
if (_threatEvents == null)
{
_threatEvents = new List <IThreatEvent>();
}
_threatEvents.Add(result);
Dirty.IsDirty = true;
_threatEventAdded?.Invoke(threatEventsContainer, result);
}
return(result);
}
private void ApplyThreatEvent([NotNull] IDataFlow target, [NotNull] IThreatEvent threatEvent)
{
var newEvent = target.AddThreatEvent(threatEvent.ThreatType);
if (newEvent != null)
{
newEvent.Name = threatEvent.Name;
newEvent.Description = threatEvent.Description;
ApplyProperties(threatEvent, newEvent);
var scenarios = threatEvent.Scenarios?.ToArray();
if (scenarios?.Any() ?? false)
{
foreach (var scenario in scenarios)
{
var newScenario = newEvent.AddScenario(scenario.Actor, scenario.Severity, scenario.Name);
newScenario.Description = scenario.Description;
ApplyProperties(scenario, newScenario);
}
}
var mitigations = threatEvent.Mitigations?.ToArray();
if (mitigations?.Any() ?? false)
{
foreach (var mitigation in mitigations)
{
var newMitigation = newEvent.AddMitigation(mitigation.Mitigation, mitigation.Strength, mitigation.Status);
newMitigation.Directives = mitigation.Directives;
ApplyProperties(mitigation, newMitigation);
}
}
}
}
public IThreatEvent AddThreatEvent(IThreatType threatType)
{
IThreatEvent result = null;
if (threatType != null && Instance is IIdentity identity)
{
IThreatModel model = (Instance as IThreatModel) ?? (Instance as IThreatModelChild)?.Model;
if (model != null)
{
if (_threatEvents?.All(x => x.ThreatTypeId != threatType.Id) ?? true)
{
result = new ThreatEvent(model, threatType, identity);
if (_threatEvents == null)
{
_threatEvents = new List <IThreatEvent>();
}
_threatEvents.Add(result);
if (Instance is IDirty dirtyObject)
{
dirtyObject.SetDirty();
}
if (Instance is IThreatEventsContainer container)
{
_threatEventAdded?.Invoke(container, result);
}
}
}
}
return(result);
}
private void OnThreatEventRemoved(IThreatEventsContainer container, IThreatEvent threatEvent)
{
((INotifyPropertyChanged)threatEvent).PropertyChanged -= OnThreatEventPropertyChanged;
var rows = _grid.PrimaryGrid.Rows.OfType <GridRow>().ToArray();
foreach (var row in rows)
{
var panel = row.Rows.OfType <GridPanel>()
.FirstOrDefault(x => string.CompareOrdinal("ThreatEventMitigations", x.Name) == 0);
if (panel != null)
{
var toBeRemoved = panel.Rows.OfType <GridRow>().Where(x =>
(x.Tag is IThreatEventMitigation threatEventMitigation) &&
threatEventMitigation.ThreatEvent.Id == threatEvent.Id).ToArray();
if (toBeRemoved?.Any() ?? false)
{
foreach (var tbr in toBeRemoved)
{
RemoveEventSubscriptions(tbr);
panel.Rows.Remove(tbr);
}
}
}
}
}
private bool IsSelected([NotNull] IThreatEvent item, string filter)
{
bool result;
if (string.IsNullOrWhiteSpace(filter))
{
result = true;
}
else
{
result = (!string.IsNullOrWhiteSpace(item.Name) &&
item.Name.IndexOf(filter, StringComparison.OrdinalIgnoreCase) >= 0) ||
(!string.IsNullOrWhiteSpace(item.Description) &&
item.Description.IndexOf(filter, StringComparison.OrdinalIgnoreCase) >= 0);
if (!result && (item.Properties?.Any() ?? false))
{
var properties = item.Properties.ToArray();
foreach (var property in properties)
{
var stringValue = property.StringValue;
if ((!string.IsNullOrWhiteSpace(stringValue) &&
stringValue.IndexOf(filter, StringComparison.OrdinalIgnoreCase) >= 0))
{
result = true;
break;
}
}
}
}
return(result);
}
public void Add([NotNull] IThreatEvent threatEvent)
{
if (_threatEvents == null)
{
_threatEvents = new List <IThreatEvent>();
}
_threatEvents.Add(threatEvent);
}
public ThreatEventMitigationSelectionDialog([NotNull] IThreatEvent threatEvent) : this()
{
_threatEvent = threatEvent;
_threatTypeName.Text = threatEvent.ThreatType?.Name;
_threatEventName.Text = threatEvent.Name;
_associatedTo.Text = threatEvent.Parent?.Name;
_associatedTo.Image = threatEvent.Parent.GetImage(ImageSize.Small);
_superTooltip.SetSuperTooltip(_associatedTo, _threatEvent.Model?.GetSuperTooltipInfo(threatEvent.Parent, false));
var strengths = threatEvent.Model?.Strengths.Where(x => x.Visible).ToArray();
if (strengths?.Any() ?? false)
{
_strength.Items.AddRange(strengths);
}
var alreadyIncludedMitigations = threatEvent.Mitigations?.ToArray();
var standardMitigations = threatEvent.ThreatType?.Mitigations?
.Where(x => !(alreadyIncludedMitigations?.Any(y => y.MitigationId == x.MitigationId) ?? false))
.OrderBy(x => x.Mitigation.Name)
.ToArray();
if (standardMitigations?.Any() ?? false)
{
_standardMitigation.Items.AddRange(standardMitigations);
_standardMitigation.Tag = standardMitigations;
}
else
{
_associateNonstandard.Checked = true;
_associateStandard.Enabled = false;
}
var mitigations = threatEvent.Model?.Mitigations?
.Where(x => !(alreadyIncludedMitigations?.Any(y => y.MitigationId == x.Id) ?? false) &&
!(standardMitigations?.Any(y => y.MitigationId == x.Id) ?? false))
.OrderBy(x => x.Name)
.ToArray();
if (mitigations?.Any() ?? false)
{
_nonStandardMitigation.Items.AddRange(mitigations);
_nonStandardMitigation.Tag = mitigations;
}
else
{
_associateNonstandard.Enabled = false;
if (!(standardMitigations?.Any() ?? false))
{
_createNew.Checked = true;
}
}
EnableControls();
}
private void OnThreatEventAdded([NotNull] IThreatEventsContainer container, [NotNull] IThreatEvent threatEvent)
{
var filter = _filter.Text;
if (IsSelected(threatEvent, filter))
{
AddGridRow(threatEvent);
}
}
public Row([NotNull] IThreatEvent threatEvent)
{
RowType = RowType.ThreatEvent;
Values = new[] { threatEvent.Name, threatEvent.Severity.Name, null };
Identity = threatEvent;
SeverityTextColor = threatEvent.Severity.TextColor;
SeverityBackColor = threatEvent.Severity.BackColor;
Mitigations = threatEvent.Mitigations;
}
public static bool ApplyMitigations(this IThreatEvent threatEvent)
{
bool result = false;
if (threatEvent.ThreatType is IThreatType threatType && threatEvent.Model is IThreatModel model &&
threatEvent.Parent is IIdentity identity)
{
var mitigations = threatType.Mitigations?.ToArray();
if (mitigations?.Any() ?? false)
{
ISeverity maximumSeverity = null;
var generated = false;
foreach (var mitigation in mitigations)
{
var rule = GetRule(mitigation);
if (rule?.Evaluate(identity) ?? false)
{
var strength = mitigation.Strength;
if (rule.StrengthId.HasValue &&
model.GetStrength(rule.StrengthId.Value) is IStrength strengthOverride)
{
strength = strengthOverride;
}
if (rule.Status.HasValue)
{
generated = (threatEvent.AddMitigation(mitigation.Mitigation, strength,
rule.Status.Value) !=
null);
}
else
{
generated = (threatEvent.AddMitigation(mitigation.Mitigation, strength) !=
null);
}
result |= generated;
if (generated && rule.SeverityId.HasValue &&
model.GetSeverity(rule.SeverityId.Value) is ISeverity severity &&
(maximumSeverity == null || maximumSeverity.Id > severity.Id))
{
maximumSeverity = severity;
}
}
}
if (maximumSeverity != null && maximumSeverity.Id < threatEvent.SeverityId)
{
threatEvent.Severity = maximumSeverity;
}
}
}
return(result);
}
/// <summary>
/// Auxiliary function to add properties from the Threat to the Threat Event.
/// </summary>
/// <param name="threatEvent">Threat Event to be updated.</param>
/// <param name="threat">Source Threat.</param>
/// <param name="schema">Property Schema for the new Property Types.</param>
public static void AddProperties([NotNull] IThreatEvent threatEvent,
[NotNull] Threat threat, [NotNull] IPropertySchema schema)
{
var names = threat.ParameterNames?.ToArray();
var labels = threat.ParameterLabels?.ToArray();
if ((names?.Any() ?? false) && (labels?.Any() ?? false) && names.Length == labels.Length)
{
for (int i = 0; i < names.Length; i++)
{
var name = names[i];
switch (name)
{
case "Title":
threatEvent.Name = threat.GetValue(name);
break;
case "UserThreatDescription":
threatEvent.Description = threat.GetValue(name);
break;
case "Priority":
var severityValue = threat.GetValue(name);
if (!string.IsNullOrWhiteSpace(severityValue) &&
Enum.TryParse <DefaultSeverity>(severityValue, out var defaultSeverity))
{
var severity = threatEvent.Model?.GetMappedSeverity((int)defaultSeverity);
if (severity != null)
{
threatEvent.Severity = severity;
}
}
break;
default:
var label = labels[i];
var propertyType = schema.GetPropertyType(label);
if (propertyType != null)
{
var property = threatEvent.GetProperty(propertyType);
if (property == null)
{
threatEvent.AddProperty(propertyType, threat.GetValueFromLabel(label));
}
else
{
property.StringValue = threat.GetValueFromLabel(label);
}
}
break;
}
}
}
}
private void OnThreatEventAddedToShape(IThreatEventsContainer container, IThreatEvent threatEvent)
{
if (container is IEntity entity)
{
var node = GetEntity(entity);
if (node != null)
{
node.ThreatsMarker = entity.ThreatEvents?.Any() ?? false;
}
}
}
public ThreatEventVulnerability([NotNull] IThreatEvent threatEvent, [NotNull] IVulnerability vulnerability) : this()
{
_model = threatEvent.Model;
_modelId = threatEvent.Model.Id;
_threatEventId = threatEvent.Id;
_threatEvent = threatEvent;
_vulnerabilityId = vulnerability.Id;
_vulnerability = vulnerability;
_model.AutoApplySchemas(this);
}
public ThreatEventMitigation([NotNull] IThreatEvent threatEvent, [NotNull] IMitigation mitigation, IStrength strength) : this()
{
_model = threatEvent.Model;
_modelId = threatEvent.Model.Id;
_threatEventId = threatEvent.Id;
_threatEvent = threatEvent;
_mitigationId = mitigation.Id;
_mitigation = mitigation;
Strength = strength;
_model.AutoApplySchemas(this);
}
private bool IsSeverityUnchanged([NotNull] IThreatEvent threatEvent)
{
bool result = false;
if (threatEvent.Mitigations?
.Any(x => x.Status == MitigationStatus.Existing || x.Status == MitigationStatus.Implemented) ??
false)
{
result = threatEvent.SeverityId == (threatEvent.ThreatType?.SeverityId ?? 0);
}
return(result);
}
private bool SeverityDoesNotMatchCalculated([NotNull] IThreatEvent threatEvent, [NotNull] CalculatedSeverityPropertySchemaManager schemaManager)
{
var result = false;
if (schemaManager.IsCalculatedSeverityEnabled)
{
var configDelta = schemaManager.GetSeverityCalculationConfig(threatEvent)?.Delta ?? 0;
var calculatedSeverity = threatEvent.GetCalculatedSeverity(configDelta);
result = calculatedSeverity != null && calculatedSeverity.Id != threatEvent.SeverityId;
}
return(result);
}
public ThreatEventScenario([NotNull] IThreatEvent threatEvent, [NotNull] IThreatActor actor, string name = null) : this()
{
_id = Guid.NewGuid();
_model = threatEvent.Model;
_modelId = threatEvent.Model.Id;
_threatEvent = threatEvent;
_threatEventId = threatEvent.Id;
_actorId = actor.Id;
_actor = actor;
Name = string.IsNullOrWhiteSpace(name) ? actor.Name : name;
Description = actor.Description;
_model.AutoApplySchemas(this);
}
private static void UpdateMitigationLevel([NotNull] IThreatEvent threatEvent, [NotNull] GridRow row)
{
switch (threatEvent.GetMitigationLevel())
{
case MitigationLevel.NotMitigated:
row.Cells[0].CellStyles.Default.Image = Resources.threat_circle_small;
break;
case MitigationLevel.Partial:
row.Cells[0].CellStyles.Default.Image = Resources.threat_circle_orange_small;
break;
case MitigationLevel.Complete:
row.Cells[0].CellStyles.Default.Image = Resources.threat_circle_green_small;
break;
}
}
private void AddGridRow([NotNull] IThreatEvent threatEvent)
{
if (IsSelected(threatEvent, _filter.Text) && GetRow(threatEvent) == null)
{
var threatType = threatEvent.ThreatType;
var threatTypeRow = GetRow(threatType);
var panel = threatTypeRow?.Rows.OfType <GridPanel>().FirstOrDefault();
if (panel != null)
{
AddGridRow(threatEvent, panel);
}
else
{
AddGridRow(threatType, new[] { threatEvent }, _grid.PrimaryGrid);
}
}
}
public void Add(IThreatEvent threatEvent)
{
if (threatEvent == null)
{
throw new ArgumentNullException(nameof(threatEvent));
}
if (threatEvent is IThreatModelChild child && child.Model != (Instance as IThreatModelChild)?.Model)
{
throw new ArgumentException();
}
if (_threatEvents == null)
{
_threatEvents = new List <IThreatEvent>();
}
_threatEvents.Add(threatEvent);
}
public CalculatedSeverityConfiguration GetSeverityCalculationConfig([NotNull] IThreatEvent threatEvent)
{
CalculatedSeverityConfiguration result = null;
var propertyType = GetCalculatedSeverityPropertyType();
if (propertyType != null)
{
var property = threatEvent.GetProperty(propertyType);
if (property is IPropertyJsonSerializableObject jsonSerializableObject &&
jsonSerializableObject.Value is CalculatedSeverityConfiguration configuration)
{
result = configuration;
}
}
return(result);
}
private GridRow AddGridRow([NotNull] IThreatEvent threatEvent, [NotNull] GridPanel panel)
{
GridRow row = new GridRow(
threatEvent.Name,
threatEvent.Parent?.Name ?? string.Empty,
threatEvent.Severity)
{
Tag = threatEvent
};
UpdateMitigationLevel(threatEvent, row);
if (threatEvent.Parent != null)
{
row.Cells[1].CellStyles.Default.Image = threatEvent.Parent.GetImage(ImageSize.Small);
((INotifyPropertyChanged)threatEvent.Parent).PropertyChanged += OnThreatEventParentPropertyChanged;
if (threatEvent.Parent is IEntity entity)
{
entity.ImageChanged += OnImageChanged;
}
AddSuperTooltipProvider(threatEvent.Parent, row.Cells[1]);
}
for (int i = 0; i < row.Cells.Count; i++)
{
row.Cells[i].PropertyChanged += OnThreatEventCellChanged;
}
panel.Rows.Add(row);
((INotifyPropertyChanged)threatEvent).PropertyChanged += OnThreatEventPropertyChanged;
threatEvent.ThreatEventMitigationAdded += OnThreatEventMitigationAdded;
threatEvent.ThreatEventMitigationRemoved += OnThreatEventMitigationRemoved;
var subPanel2 = CreateThreatEventMitigationsPanel(threatEvent);
if (subPanel2 != null)
{
row.Rows.Add(subPanel2);
}
UpdateThreatTypeSeverity(row);
return(row);
}
public ThreatEventScenarioCreationDialog([NotNull] IThreatEvent threatEvent) : this()
{
_event = threatEvent;
var model = threatEvent.Model;
if (model != null)
{
var actors = model.ThreatActors?.OrderBy(x => x.Name).ToArray();
if (actors?.Any() ?? false)
{
_actor.Items.AddRange(actors);
}
var severities = model.Severities?.Where(x => x.Visible).ToArray();
if (severities?.Any() ?? false)
{
_severity.Items.AddRange(severities);
}
}
}
public static ISeverity GetCalculatedSeverity(this IThreatEvent threatEvent, int configDelta)
{
ISeverity result = null;
if (threatEvent != null)
{
var totalStrength = (threatEvent.Mitigations?
.Where(x => x.Status == MitigationStatus.Existing || x.Status == MitigationStatus.Implemented)
.Sum(x => x.StrengthId) ?? 0) - configDelta;
var severity = Math.Max(threatEvent.ThreatType.SeverityId,
threatEvent.Scenarios?.Max(x => x.SeverityId) ?? 0);
var projected =
(int)Math.Max(Math.Ceiling(severity * (1.0 - (Math.Min(totalStrength, 100.0) / 100.0))), 1.0);
result = threatEvent.Model?.GetMappedSeverity(projected);
}
return(result);
}
private static Image GetMitigationImage([NotNull] IThreatEvent threatEvent)
{
Image result = null;
switch (threatEvent.GetMitigationLevel())
{
case MitigationLevel.Partial:
result = Resources.threat_circle_orange_small;
break;
case MitigationLevel.Complete:
result = Resources.threat_circle_green_small;
break;
default:
result = Resources.threat_circle_small;
break;
}
return(result);
}
public void Add(IThreatEvent threatEvent)
{
if (!(IsInitialized?.Get() ?? false))
{
return;
}
if (threatEvent == null)
{
throw new ArgumentNullException(nameof(threatEvent));
}
if (threatEvent is IThreatModelChild child && child.Model != Model?.Get())
{
throw new ArgumentException();
}
if (_threatEvents == null)
{
_threatEvents = new List <IThreatEvent>();
}
_threatEvents.Add(threatEvent);
}
public CalculatedSeverityConfiguration SetSeverityCalculationConfig([NotNull] IThreatEvent threatEvent,
int points, [Required] string reason)
{
CalculatedSeverityConfiguration result = null;
var propertyType = GetCalculatedSeverityPropertyType();
if (propertyType != null)
{
var property = threatEvent.GetProperty(propertyType);
if (property is IPropertyJsonSerializableObject jsonSerializableObject &&
jsonSerializableObject.Value is CalculatedSeverityConfiguration configuration)
{
result = configuration;
}
else
{
result = new CalculatedSeverityConfiguration();
if (property == null)
{
property = threatEvent.AddProperty(propertyType, null);
if (property is IPropertyJsonSerializableObject jsonObject)
{
jsonObject.Value = result;
}
}
else if (property is IPropertyJsonSerializableObject jsonObject)
{
jsonObject.Value = result;
}
}
result.Delta = points;
result.DeltaReason = reason;
result.DeltaSetBy = UserName.GetDisplayName();
result.DeltaSetOn = DateTime.Now;
}