Securing Applications with Threat Modelling:A Developer’s Guide to PyTM

Moshood Adekunle — Fri, 24 Jan 2025 17:59:29 +0000

When I began my dissertation on securing pharmaceutical cold chain systems, I faced a common developer’s dilemma: how to approach security in a way that felt practical and aligned with my coding expertise. Traditional threat modeling tools felt cumbersome and disconnected from the iterative, hands-on process I was accustomed to. That changed when I discovered PyTM, a Python-based framework for threat modeling.

PyTM stood out immediately; its code-like structure made it intuitive to use, even for someone new to formal threat modeling. It allowed me to systematically identify and address security risks in my cold chain research without the overhead of complex methodologies. What started as a dissertation tool quickly became a valuable resource for other projects, thanks to its flexibility and ease of use.

What is Threat Modeling

Threat modeling is the process of identifying potential security risks in your application before they become problems. It’s like a blueprint for security, helping you anticipate vulnerabilities and plan defenses early in the development process. However, many developers skip this step because traditional tools can feel cumbersome or overly complex.

This is where PyTM stands out. Built in Python, it integrates seamlessly into your existing workflow, making threat modeling accessible without sacrificing depth. Whether you’re building a small web app or a large-scale system, PyTM provides a structured way to think about security from the ground up.

Threat Modeling a Blog Application

Let’s apply PyTM to a simple blog application. This app has a few key components:

Users: Can read posts and leave comments.

Admin: Can create, edit, and delete posts.

Database: Stores posts, comments, and user data.

Web Server: Hosts the blog and serves content.

Communication: HTTP/HTTPS requests between the browser and server.

First, install PyTM using pip:

pip install pytm
sudo apt install graphviz plantuml

Key Components in PyTM

Threat Model (TM) The overarching container for your threat modeling exercise. It represents the entire system you’re analyzing.

   from pytm import TM
   tm = TM("Blog Application Threat Model")

Boundary A boundary defines a logical or physical perimeter within which components operate. For example, the internet, an internal network, or a trusted zone.

   from pytm import Boundary
   internet = Boundary("Internet")
   internal_network = Boundary("Internal Network")

Actor Actors represent entities that interact with your system. These can be users, administrators, or external systems.

   from pytm import Actor
   user = Actor("User")  
   admin = Actor("Admin", is_admin=True)

Server A server represents a component that processes requests and serves data. In a blog application, this could be the web server hosting the blog.

   from pytm import Server
   web_server = Server("Web Server")

Datastore A datastore represents a component that stores data, such as a database or file system.

   from pytm import Datastore
   database = Datastore("Database")

Dataflow Dataflows represent the movement of data between components. They are critical for identifying where threats might occur.

   from pytm import Dataflow
   user_to_web_server = Dataflow(user, web_server, "View Blog Post")  
   admin_to_web_server = Dataflow(admin, web_server, "Manage Blog Post")  
   web_server_to_database = Dataflow(web_server, database, "Save or Retrieve Data")  # Server interacts with the database

Threats Threats are potential security risks associated with a data flow. For example, a man-in-the-middle attack or SQL injection.

   user_to_web_server.threats = ["Man-in-the-middle attack", "Unauthorized access"]
   admin_to_web_server.threats = ["Brute force login", "Privilege escalation"]
   web_server_to_database.threats = ["SQL Injection", "Data exfiltration"]

Controls Controls are mitigations or countermeasures to address identified threats. For example, using HTTPS to prevent man-in-the-middle attacks.

   user_to_web_server.controls = ["HTTPS", "Web Application Firewall (WAF)"]
   admin_to_web_server.controls = ["CAPTCHA", "Account Lockout"]
   web_server_to_database.controls = ["Parameterized Queries", "Input Validation"]

Putting It All Together

from pytm import TM, Actor, Server, Dataflow, Datastore, Boundary

tm = TM("Blog Application Threat Model")

internet = Boundary("Internet")

user = Actor("User")  
admin = Actor("Admin", is_admin=True) 

web_server = Server("Web Server")  
database = Datastore("Database")  

user_to_web_server = Dataflow(user, web_server, "View Blog Post")  
admin_to_web_server = Dataflow(admin, web_server, "Manage Blog Post")  
web_server_to_database = Dataflow(web_server, database, "Save or Retrieve Data") 

web_server.inBoundary = internet
database.inBoundary = internet

user_to_web_server.threats = ["Man-in-the-middle attack", "Unauthorized access"]
admin_to_web_server.threats = ["Brute force login", "Privilege escalation"]
web_server_to_database.threats = ["SQL Injection", "Data exfiltration"]

user_to_web_server.controls = ["HTTPS", "Web Application Firewall (WAF)"]
admin_to_web_server.controls = ["CAPTCHA", "Account Lockout"]
web_server_to_database.controls = ["Parameterized Queries", "Input Validation"]

tm.process()

When you run the script, PyTM generates a summary of the identified threats and their corresponding mitigations. For example:

 python3 model.py --dfd | dot -Tpng -o model-dfd.png

returns a dataflow diagram of the threat model

python3 model.py --seq | plantuml -tpng -pipe > model-seq.png

returns a sequence diagram of the threat model.

wget https://raw.githubusercontent.com/izar/pytm/master/docs/basic_template.md

python3 model.py --report basic_template.md > model-report.md

returns a generated textual report of the identified threats and the security controls applied to mitigate them.

Conclusion

In my experience with PyTM, both in academic and professional settings, it has been an invaluable tool for simplifying threat modeling. I initially used it for my dissertation on a complex system and quickly saw its benefits in real-world applications, like securing a simple blog. PyTM makes it easy to define components, identify threats, and apply security controls with minimal effort, while generating detailed reports, sequence diagrams, and data flow diagrams.