diff --git a/docs/img/cards.svg b/docs/img/cards.svg index bb528f3..23cfe1b 100644 --- a/docs/img/cards.svg +++ b/docs/img/cards.svg @@ -5,100 +5,58 @@ xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:svg="http://www.w3.org/2000/svg" xmlns="http://www.w3.org/2000/svg" - id="svg1203" + id="svg2688" version="1.1" viewBox="0 0 210 137" height="137mm" width="210mm"> + id="defs2682"> - - - - - - - - - - - - - - - - - - + id="metadata2685"> @@ -113,765 +71,374 @@ transform="translate(0,-160)" id="layer1"> + transform="matrix(0.33675359,-0.10511504,-0.10511504,-0.33675359,37.384109,297.04647)" + id="g3281"> - - - + id="g3283"> + id="g3285"> + id="g3287"> + clip-path="url(#clipPath3293)" + id="g3289"> + + + + id="g3299"> + transform="translate(-88.526,95.177)" + id="g3301"> + id="g3303"> - + transform="translate(200.563)" + id="g3305"> + + + + + J + + + + + + - + + + - - - - - - - - - - - - - - - - - - + id="g3327"> + transform="translate(20.043,298.004)" + id="g3329"> + id="g3331"> - + transform="translate(2.223)" + id="g3333"> + + + J + + + + transform="translate(-2.223,-35.216)" + id="g3343"> + transform="scale(2.00024)" + id="g3345"> - - + id="g3347"> + + + + + + + + + + + + + - - - - - - - - - - + id="g3371"> - - - - - - - - - - - - - - - - - - - + transform="translate(103.381,320.685)" + id="g3373"> + + + + + jack/access&secrets + + + + + + + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + id="g3391"> + + + + + Ourdeployment + artifactscontain + secretsthatcan + beextracted. + + + + + + - - - - - - - - - - - + id="g3413"> + transform="rotate(90,6.901,24.11)" + id="g3415"> + id="g3417"> + transform="translate(-31.011,-17.201)" + id="g3419"> + + Secretsinartifacts + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + transform="translate(31.011,17.201)" + id="g3425" /> + - + transform="matrix(0.35277777,0,0,-0.35277777,71.095059,281.11038)" + id="g4216"> + id="g4218"> + id="g4220"> + id="g4222"> + clip-path="url(#clipPath4228)" + id="g4224"> + id="g4230"> + id="g4234"> + id="g4236"> + id="g4238"> + id="g4240"> + id="g4242"> + id="g4244"> - + - - + transform="matrix(1,0,0,-1,112.062,50.139)"> + 5 + + id="g4252" /> + id="g4254" /> + id="g4256" /> + id="g4262"> + id="g4264"> + id="g4266"> - + - - + transform="matrix(1,0,0,-1,20.043,297.998)"> + 5 + + id="g4274" /> + id="g4276"> + id="g4278"> + id="g4280"> + id="g4282" /> + id="g4296"> + id="g4294" + clip-path="url(#clipPath4286)"> + id="g4290"> @@ -882,434 +449,114 @@ + id="g4298" /> + id="g4300" /> + id="g4302"> + id="g4304"> + id="g4306"> + id="g4308"> - + - - - - - - - - - - - - - + transform="matrix(1,0,0,-1,140.779,320.677)"> + fve/recovery + + id="g4316" /> + id="g4318" /> + id="g4320" /> + id="g4322"> + id="g4324"> + id="g4326"> - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + transform="matrix(1,0,0,-1,73.187,226.841)"> + Wehaveno + backupsofour + applicationdata. + + id="g4338" /> + id="g4340" /> + id="g4342"> + id="g4344"> + id="g4346"> - + - - - - - - - - - - - - - - - - + transform="matrix(1,0,0,-1,31.011,17.201)"> + Nobackupsofdata + + id="g4354" /> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + id="g4356" /> @@ -1318,125 +565,125 @@ + transform="matrix(0.33581878,0.10806433,0.10806433,-0.33581878,106.85119,275.1304)" + id="g5136"> + id="g5138"> + id="g5140"> + id="g5142"> + clip-path="url(#clipPath5148)" + id="g5144"> + id="g5150"> + id="g5154"> + id="g5156"> + id="g5158"> + id="g5160"> + id="g5162"> + id="g5164"> - + - - + transform="matrix(1,0,0,-1,112.062,41.819)"> + 9 + + id="g5172" /> + id="g5174" /> + id="g5176" /> + id="g5182"> + id="g5184"> + id="g5186"> - + - - + transform="matrix(1,0,0,-1,20.043,297.998)"> + 9 + + id="g5194" /> + id="g5196"> + id="g5198"> + id="g5200"> + id="g5202" /> + id="g5218"> + id="g5216" + clip-path="url(#clipPath5206)"> + id="g5212"> @@ -1447,633 +694,142 @@ + id="g5220" /> + id="g5222" /> + id="g5224"> + id="g5226"> + id="g5228"> + id="g5230"> - + - - - - - - - - - - - - - - - - + transform="matrix(1,0,0,-1,127.215,320.677)"> + nine/monitoring + + id="g5238" /> + id="g5240" /> + id="g5242" /> + id="g5244"> + id="g5246"> + id="g5248"> - + - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - + transform="matrix(1,0,0,-1,58.013,226.841)"> + Wedon’tknowif + anauthenticated + attacker/developer + accessedthe + production + environment. + + id="g5266" /> + id="g5268" /> + id="g5270"> + id="g5272"> + id="g5274"> - + - - - - - - - - - - - - - - - - - - - - - - + transform="matrix(1,0,0,-1,31.011,17.201)"> + Noauditsforprodaccess + + id="g5282" /> + id="g5284" /> - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - i - - - - + i diff --git a/readme.md b/readme.md index dcbf57b..0e98260 100644 --- a/readme.md +++ b/readme.md @@ -4,7 +4,7 @@ SPDX-License-Identifier: CC-BY-4.0 --> -# Cumulus - *Threat modeling the clouds*[](https://github.com/TNG/cumulus/releases/latest) +# OWASP Cumulus - *Threat modeling the clouds*[](https://github.com/OWASP/cumulus/releases/latest) ![Cumulus Cards](docs/img/cards.svg) @@ -13,7 +13,7 @@ Cumulus is the easy way to bring security into cloud and devOps teams. As a variant of the card game Elevation of Privilege it follows the idea to threat model a system via gamification. This lightweight and low-barrier approach helps you find threats to your devOps or cloud project and teaches the developers a security oriented mindset. -Find the latest release [here](https://github.com/TNG/cumulus/releases/latest). +Find the latest release [here](https://github.com/OWASP/cumulus/releases/latest). ## Threat Modeling The idea of threat modeling via serious games goes back to the card game [Elevation of Privilege](https://shostack.org/games/elevation-of-privilege) by [Adam Shostack](https://github.com/adamshostack). @@ -51,7 +51,7 @@ The dealer plays a card in the starting suit.Each other players has to follow th If that is not possible, the player can choose any card on hand. The winner of the round takes the trick and is the one who played the highest value card in the round's suit or the highest trump card. -Trumps are cards from the suit *resources*. +Trumps are cards from the suit *Access & Secrets*. The winner then receives a point, starts a new round and chooses the new suit. Each time a new card is played, all players are asked to think about whether that particular threat, mentioned on the current card, applies to their system in some form. @@ -80,7 +80,7 @@ You can find it under: Contributions to the card deck are very much appreciated. In the end, this card deck is intended to be a community project. -Changes to the threat formulations are welcome as pull requests to [cards.tex](https://github.com/TNG/cumulus/blob/main/cards.tex). +Changes to the threat formulations are welcome as pull requests to [cards.tex](https://github.com/OWASP/cumulus/blob/main/cards.tex). ## Versioning The card deck follows [semantic versioning](https://semver.org/). diff --git a/tex/additional_cards.tex b/tex/additional_cards.tex index 295f509..2ed97f9 100644 --- a/tex/additional_cards.tex +++ b/tex/additional_cards.tex @@ -3,106 +3,4 @@ % SPDX-License-Identifier: Apache-2.0 % % -\newcommand{\TNGLogo}{% - \node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.1*\cardwidth+\bleed,0.15*\cardheight+\bleed)% - {% - \includegraphics[width=\textwidth]{img/tng/tng_logo.pdf} - };% -}% -% -\newcommand{\TNGMotto}{% - \node[text centered, text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0] at (\textpadding+\bleed,0.9*\cardheight)% - {% - {\summaryfontsize{\color{ColorCoverLogo1} We solve hard IT problems.}} - };% -}% -% -\newcommand{\TNGPillar}[4]{% - % Card value and icon - \node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.2*\cardwidth,#2*\cardheight)% - {% - \includegraphics[width=1cm]{#3} - };% - \node[text width=(\cardwidth-4*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.4*\cardwidth,#1*\cardheight-0.03*\cardheight)% - {% - {\textfontsize{#4}} - };% -}% -% -\newcommand{\Teaser}[5]{% - % Card value and icon - \node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.55*\cardwidth,#1*\cardheight)% - {% - \includegraphics[width=2.8cm]{#2} - };% - \node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (\textpadding+\bleed,#1*\cardheight-0.12*\cardheight)% - {% - \includegraphics[width=1.25cm]{#5} - };% - \node[text width=(\cardwidth-4*\textpadding)*1cm,below right,inner sep=0, align=left] at (\textpadding+\bleed,#1*\cardheight+0.05*\cardheight)% - {% - {\textfontsize{#4}} - };% - \node[text width=(\cardwidth-4*\textpadding)*1cm,below right,inner sep=0, align=left] at (\textpadding+\bleed,#1*\cardheight-0.25*\cardheight)% - {% - {\small{#3}} - };% -}% -% -\newcommand{\GithubTeaser}[4]{% - \Teaser{#1}{#2}{#3}{#4}{img/tng/icon_github.pdf} -}% -% -\newcommand{\OWASPTeaser}[4]{% - \Teaser{#1}{#2}{#3}{#4}{img/tng/icon_owasp.pdf} -}% -% -\begin{tikzpicture}% - \begin{scope}[xshift=0, yshift=0, local bounding box=scopeAinner]% - \clip [rounded corners=0] (0, 0) rectangle ++(\cardwidthPrint,\cardheightPrint);% - % - \Frame - \TNGLogo - \TNGMotto - \TNGPillar{0.68}{0.655}{img/tng/icon_coding.pdf}{Agile Software Development} - \TNGPillar{0.53}{0.505}{img/tng/icon_ai.pdf}{Artificial Intelligence} - \TNGPillar{0.37}{0.37}{img/tng/icon_devops.pdf}{DevOps \& Cloud} - \end{scope}% -\end{tikzpicture}\\% -% -\begin{tikzpicture}% - \begin{scope}[xshift=0, yshift=0, local bounding box=scopeAinner]% - \clip [rounded corners=0] (0, 0) rectangle ++(\cardwidthPrint,\cardheightPrint);% - % - \Frame - \node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (\textpadding+\bleed,\cardheight-0.04*\cardheight)% - {% - {\footnotesize{Cumulus is a trick taking card game for 2-9 players with threat categories as suits, of which \textbf{access\&secrets} is trump. - - We advise to decide together on the category you want to investigate first and timebox the game. - - \textbf{Before you play:} Define the system to talk about based on a simple architectural diagram. - - \begin{enumerate}[left=0cm, label=\textcolor{ColorCoverLogo1}{\arabic*}] - \item Shuffle and distribute all cards. - \item The lowest card in the starting suit begins the game and every other player adds one card, following suit if able. - \item Every time a player places a card, all players try to identify how it applies to their system. If something is found, it is noted down and the finder receives a point. - \item The winner of the trick receives a point and may start the next trick with a card of their choice. - \item Don't forget to take a break if needed. - \end{enumerate} - }} - };% - \end{scope}% -\end{tikzpicture}\\% -% -\begin{tikzpicture}% - \begin{scope}[xshift=0, yshift=0, local bounding box=scopeAinner]% - \clip [rounded corners=0] (0, 0) rectangle ++(\cardwidthPrint,\cardheightPrint);% - % - \Frame - \TNGLogo - \OWASPTeaser{0.92}{img/tng/qr-owasp-cumulus.pdf}{owasp.org/www-project-cumulus}{Find it online!} - \draw (\textpadding+\bleed,0.57*\cardheight+\bleed) -- (\cardwidth-\textpadding+\bleed,0.57*\cardheight+\bleed); - \GithubTeaser{0.5}{img/tng/qr-tng-eop.pdf}{github.com/TNG/elevation-of-privilege}{Play it online!} - \end{scope}% -\end{tikzpicture}\\% +% empty diff --git a/tex/img/cover_logo.pdf b/tex/img/cover_logo.pdf index 788102b..1338686 100644 Binary files a/tex/img/cover_logo.pdf and b/tex/img/cover_logo.pdf differ diff --git a/tex/lib/logo.tex b/tex/lib/logo.tex index 248ec0b..45802a3 100644 --- a/tex/lib/logo.tex +++ b/tex/lib/logo.tex @@ -1,16 +1,9 @@ % © 2023 TNG Technology Consulting % % SPDX-License-Identifier: Apache-2.0 -%% +% +% Categories +% % Logo -\newcommand{\Logo}[1]{% - \node[text width=(0.65*\cardwidth)*1cm,below right,inner sep=0, align=left] at (0.38*\cardwidth+\bleed, 0.115*\cardheight+\bleed)% - {% - \ifthenelse{\boolean{doPrintLogoInColor}}{% - \includegraphics[width=0.8\textwidth]{#1}% - }{% - \includegraphics[width=0.8\textwidth]{\LogoBlack}% - }% - };% -}% +\newcommand{\Logo}[1]{}% % diff --git a/tex/lib/logo_for_back.tex b/tex/lib/logo_for_back.tex index 576d997..72dd685 100644 --- a/tex/lib/logo_for_back.tex +++ b/tex/lib/logo_for_back.tex @@ -3,13 +3,6 @@ % SPDX-License-Identifier: Apache-2.0 %% % Logo for the back -\newcommand{\TNGLogo}{% - \node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.15*\cardwidth+\bleed,0.93*\cardheight+\bleed)% - {% - \includegraphics[width=.9\textwidth]{img/tng/tng_logo_white.pdf} - };% -}% -% \newcommand{\OWASPLogo}{% \node[text width=(\cardwidth-2*\textpadding)*1cm,below right,inner sep=0, align=left] at (0.15*\cardwidth+\bleed,0.18*\cardheight+\bleed)% {% @@ -18,7 +11,6 @@ }% % \newcommand{\Logo}{% - \TNGLogo \OWASPLogo% }% %