Skip to content

Commit

Permalink
Sync changes from 'TNG/cumulus.git'
Browse files Browse the repository at this point in the history
  • Loading branch information
ChristophNiehoff committed Sep 4, 2024
1 parent 4c93943 commit e5527c6
Show file tree
Hide file tree
Showing 6 changed files with 465 additions and 1,826 deletions.
2,156 changes: 456 additions & 1,700 deletions docs/img/cards.svg
Loading
Sorry, something went wrong. Reload?
Sorry, we cannot display this file.
Sorry, this file is invalid so it cannot be displayed.
8 changes: 4 additions & 4 deletions readme.md
Original file line number Diff line number Diff line change
Expand Up @@ -4,7 +4,7 @@
SPDX-License-Identifier: CC-BY-4.0
-->

# Cumulus - *Threat modeling the clouds*[<img style="height:50px;cursor:pointer;float:right" src="docs/img/download.svg"/>](https://github.com/TNG/cumulus/releases/latest)
# OWASP Cumulus - *Threat modeling the clouds*[<img style="height:50px;cursor:pointer;float:right" src="docs/img/download.svg"/>](https://github.com/OWASP/cumulus/releases/latest)

![Cumulus Cards](docs/img/cards.svg)

Expand All @@ -13,7 +13,7 @@ Cumulus is the easy way to bring security into cloud and devOps teams.
As a variant of the card game Elevation of Privilege it follows the idea to threat model a system via gamification.
This lightweight and low-barrier approach helps you find threats to your devOps or cloud project and teaches the developers a security oriented mindset.

Find the latest release [here](https://github.com/TNG/cumulus/releases/latest).
Find the latest release [here](https://github.com/OWASP/cumulus/releases/latest).

## Threat Modeling
The idea of threat modeling via serious games goes back to the card game [Elevation of Privilege](https://shostack.org/games/elevation-of-privilege) by [Adam Shostack](https://github.com/adamshostack).
Expand Down Expand Up @@ -51,7 +51,7 @@ The dealer plays a card in the starting suit.Each other players has to follow th
If that is not possible, the player can choose any card on hand.
The winner of the round takes the trick and is the one who played the highest value card in the round's suit or the highest trump card.

Trumps are cards from the suit *resources*.
Trumps are cards from the suit *Access & Secrets*.

The winner then receives a point, starts a new round and chooses the new suit.
Each time a new card is played, all players are asked to think about whether that particular threat, mentioned on the current card, applies to their system in some form.
Expand Down Expand Up @@ -80,7 +80,7 @@ You can find it under:
Contributions to the card deck are very much appreciated.
In the end, this card deck is intended to be a community project.

Changes to the threat formulations are welcome as pull requests to [cards.tex](https://github.com/TNG/cumulus/blob/main/cards.tex).
Changes to the threat formulations are welcome as pull requests to [cards.tex](https://github.com/OWASP/cumulus/blob/main/cards.tex).

## Versioning
The card deck follows [semantic versioning](https://semver.org/).
Expand Down
104 changes: 1 addition & 103 deletions tex/additional_cards.tex
Original file line number Diff line number Diff line change
Expand Up @@ -3,106 +3,4 @@
% SPDX-License-Identifier: Apache-2.0
%
%
\newcommand{\TNGLogo}{%
\node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.1*\cardwidth+\bleed,0.15*\cardheight+\bleed)%
{%
\includegraphics[width=\textwidth]{img/tng/tng_logo.pdf}
};%
}%
%
\newcommand{\TNGMotto}{%
\node[text centered, text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0] at (\textpadding+\bleed,0.9*\cardheight)%
{%
{\summaryfontsize{\color{ColorCoverLogo1} We solve hard IT problems.}}
};%
}%
%
\newcommand{\TNGPillar}[4]{%
% Card value and icon
\node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.2*\cardwidth,#2*\cardheight)%
{%
\includegraphics[width=1cm]{#3}
};%
\node[text width=(\cardwidth-4*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.4*\cardwidth,#1*\cardheight-0.03*\cardheight)%
{%
{\textfontsize{#4}}
};%
}%
%
\newcommand{\Teaser}[5]{%
% Card value and icon
\node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.55*\cardwidth,#1*\cardheight)%
{%
\includegraphics[width=2.8cm]{#2}
};%
\node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (\textpadding+\bleed,#1*\cardheight-0.12*\cardheight)%
{%
\includegraphics[width=1.25cm]{#5}
};%
\node[text width=(\cardwidth-4*\textpadding)*1cm,below right,inner sep=0, align=left] at (\textpadding+\bleed,#1*\cardheight+0.05*\cardheight)%
{%
{\textfontsize{#4}}
};%
\node[text width=(\cardwidth-4*\textpadding)*1cm,below right,inner sep=0, align=left] at (\textpadding+\bleed,#1*\cardheight-0.25*\cardheight)%
{%
{\small{#3}}
};%
}%
%
\newcommand{\GithubTeaser}[4]{%
\Teaser{#1}{#2}{#3}{#4}{img/tng/icon_github.pdf}
}%
%
\newcommand{\OWASPTeaser}[4]{%
\Teaser{#1}{#2}{#3}{#4}{img/tng/icon_owasp.pdf}
}%
%
\begin{tikzpicture}%
\begin{scope}[xshift=0, yshift=0, local bounding box=scopeAinner]%
\clip [rounded corners=0] (0, 0) rectangle ++(\cardwidthPrint,\cardheightPrint);%
%
\Frame
\TNGLogo
\TNGMotto
\TNGPillar{0.68}{0.655}{img/tng/icon_coding.pdf}{Agile Software Development}
\TNGPillar{0.53}{0.505}{img/tng/icon_ai.pdf}{Artificial Intelligence}
\TNGPillar{0.37}{0.37}{img/tng/icon_devops.pdf}{DevOps \& Cloud}
\end{scope}%
\end{tikzpicture}\\%
%
\begin{tikzpicture}%
\begin{scope}[xshift=0, yshift=0, local bounding box=scopeAinner]%
\clip [rounded corners=0] (0, 0) rectangle ++(\cardwidthPrint,\cardheightPrint);%
%
\Frame
\node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (\textpadding+\bleed,\cardheight-0.04*\cardheight)%
{%
{\footnotesize{Cumulus is a trick taking card game for 2-9 players with threat categories as suits, of which \textbf{access\&secrets} is trump.

We advise to decide together on the category you want to investigate first and timebox the game.

\textbf{Before you play:} Define the system to talk about based on a simple architectural diagram.

\begin{enumerate}[left=0cm, label=\textcolor{ColorCoverLogo1}{\arabic*}]
\item Shuffle and distribute all cards.
\item The lowest card in the starting suit begins the game and every other player adds one card, following suit if able.
\item Every time a player places a card, all players try to identify how it applies to their system. If something is found, it is noted down and the finder receives a point.
\item The winner of the trick receives a point and may start the next trick with a card of their choice.
\item Don't forget to take a break if needed.
\end{enumerate}
}}
};%
\end{scope}%
\end{tikzpicture}\\%
%
\begin{tikzpicture}%
\begin{scope}[xshift=0, yshift=0, local bounding box=scopeAinner]%
\clip [rounded corners=0] (0, 0) rectangle ++(\cardwidthPrint,\cardheightPrint);%
%
\Frame
\TNGLogo
\OWASPTeaser{0.92}{img/tng/qr-owasp-cumulus.pdf}{owasp.org/www-project-cumulus}{Find it online!}
\draw (\textpadding+\bleed,0.57*\cardheight+\bleed) -- (\cardwidth-\textpadding+\bleed,0.57*\cardheight+\bleed);
\GithubTeaser{0.5}{img/tng/qr-tng-eop.pdf}{github.com/TNG/elevation-of-privilege}{Play it online!}
\end{scope}%
\end{tikzpicture}\\%
% empty
Binary file modified tex/img/cover_logo.pdf
Binary file not shown.
15 changes: 4 additions & 11 deletions tex/lib/logo.tex
Original file line number Diff line number Diff line change
@@ -1,16 +1,9 @@
% © 2023 TNG Technology Consulting
%
% SPDX-License-Identifier: Apache-2.0
%%
%
% Categories
%
% Logo
\newcommand{\Logo}[1]{%
\node[text width=(0.65*\cardwidth)*1cm,below right,inner sep=0, align=left] at (0.38*\cardwidth+\bleed, 0.115*\cardheight+\bleed)%
{%
\ifthenelse{\boolean{doPrintLogoInColor}}{%
\includegraphics[width=0.8\textwidth]{#1}%
}{%
\includegraphics[width=0.8\textwidth]{\LogoBlack}%
}%
};%
}%
\newcommand{\Logo}[1]{}%
%
8 changes: 0 additions & 8 deletions tex/lib/logo_for_back.tex
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,6 @@
% SPDX-License-Identifier: Apache-2.0
%%
% Logo for the back
\newcommand{\TNGLogo}{%
\node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.15*\cardwidth+\bleed,0.93*\cardheight+\bleed)%
{%
\includegraphics[width=.9\textwidth]{img/tng/tng_logo_white.pdf}
};%
}%
%
\newcommand{\OWASPLogo}{%
\node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.15*\cardwidth+\bleed,0.18*\cardheight+\bleed)%
{%
Expand All @@ -18,7 +11,6 @@
}%
%
\newcommand{\Logo}{%
\TNGLogo
\OWASPLogo%
}%
%

0 comments on commit e5527c6

Please sign in to comment.