Integrate rudimentary threat modeling capabilities.

[Mwessc]

This commit introduces a new system for performing basic threat modeling analysis on an application architecture.

Key features:

• Application Architecture Definition:

  • architecture.py defines classes (NetworkZone, Component, Service, Database, Application) to represent an application's structure.
  • Architectures can be loaded from YAML files using load_architecture_from_yaml.

• Threat Modeling Components:

  • threat_model.py defines classes (ThreatActor, AttackVector, Vulnerability, SecurityControl, IdentifiedAttackSurface, SuggestedControl) for security analysis.

• Analysis Logic:

  • identify_attack_surfaces: Analyzes an Application object to identify potential attack surfaces based on network exposure (e.g., public services) and data sensitivity. Associates known vulnerabilities with these surfaces.
  • suggest_security_controls: Recommends SecurityControls for IdentifiedAttackSurfaces based on the vulnerabilities they aim to mitigate.

• Examples & Documentation:

  • example_architecture.yaml provides a sample application architecture.
  • example_security_knowledge_base.yaml demonstrates how to define threat actors, attack vectors, vulnerabilities, and controls (note: direct YAML loading for these is not yet implemented; they are instantiated in Python for now).
  • README.md has been updated with a section explaining the new features and how to use them, including a conceptual code example.

• Unit Tests:

  • tests/test_architecture.py and tests/test_threat_model.py provide unit tests for the new functionality, covering YAML loading, attack surface identification, and security control suggestion.

This integration allows you to define your application architecture and perform a basic security assessment to identify potential weaknesses and receive suggestions for appropriate security controls.

Description

Please provide a brief description of your addition or change.

Checklist

• I've added the prompt in the correct section.
• The prompt is helpful, concise, and clear.
• I've double-checked the markdown formatting.