Security Fundamentals & Threat Modeling

# threat_model.py, STRIDE Threat Report Generator
from dataclasses import dataclass, field
from enum import Enum
from typing import List


class StrideCategory(Enum):
    SPOOFING = "Spoofing"
    TAMPERING = "Tampering"
    REPUDIATION = "Repudiation"
    INFO_DISCLOSURE = "Information Disclosure"
    DENIAL_OF_SERVICE = "Denial of Service"
    ELEVATION_OF_PRIVILEGE = "Elevation of Privilege"


class Severity(Enum):
    LOW = "LOW"
    MEDIUM = "MEDIUM"
    HIGH = "HIGH"
    CRITICAL = "CRITICAL"


@dataclass
class Threat:
    category: StrideCategory
    description: str
    severity: Severity
    component: str
    mitigation: str


@dataclass
class SystemComponent:
    name: str
    component_type: str   # e.g., "web_server", "database", "api_gateway"
    threats: List[Threat] = field(default_factory=list)

    def add_threat(self, threat: Threat) -> None:
        self.threats.append(threat)

    def threat_count_by_severity(self) -> dict:
        counts = {s.value: 0 for s in Severity}
        for t in self.threats:
            counts[t.severity.value] += 1
        return counts


def generate_stride_report(components: List[SystemComponent]) -> None:
    total_threats = sum(len(c.threats) for c in components)
    print("=" * 60)
    print("        STRIDE THREAT MODEL REPORT")
    print("=" * 60)
    print(f"Components analyzed: {len(components)}")
    print(f"Total threats identified: {total_threats}")
    print()

    for component in components:
        print(f"[COMPONENT] {component.name} ({component.component_type})")
        print(f"  Threats: {len(component.threats)}")
        counts = component.threat_count_by_severity()
        for severity, count in counts.items():
            if count > 0:
                print(f"    {severity}: {count}")

        for threat in sorted(component.threats,
                             key=lambda t: list(Severity).index(t.severity),
                             reverse=True):
            print(f"  ┌─ [{threat.severity.value}] {threat.category.value}")
            print(f"  │  Description: {threat.description}")
            print(f"  └─ Mitigation: {threat.mitigation}")
        print()


# ── Define your system ──────────────────────────────────────────
api_gateway = SystemComponent("API Gateway", "api_gateway")
api_gateway.add_threat(Threat(
    category=StrideCategory.SPOOFING,
    description="Attacker sends requests with forged JWT token",
    severity=Severity.CRITICAL,
    component="API Gateway",
    mitigation="Validate JWT signature with RS256; use short expiry + refresh"
))
api_gateway.add_threat(Threat(
    category=StrideCategory.DENIAL_OF_SERVICE,
    description="Flood of unauthenticated requests exhausts connection pool",
    severity=Severity.HIGH,
    component="API Gateway",
    mitigation="Implement rate limiting (100 req/min per IP) + WAF rules"
))

database = SystemComponent("PostgreSQL Database", "database")
database.add_threat(Threat(
    category=StrideCategory.INFO_DISCLOSURE,
    description="SQL error messages reveal table schema to attacker",
    severity=Severity.MEDIUM,
    component="PostgreSQL Database",
    mitigation="Catch exceptions; return generic error messages to client"
))
database.add_threat(Threat(
    category=StrideCategory.TAMPERING,
    description="Unparameterized queries allow SQL injection data modification",
    severity=Severity.CRITICAL,
    component="PostgreSQL Database",
    mitigation="Use parameterized queries / ORM; never interpolate user input"
))

generate_stride_report([api_gateway, database])

# defense_in_depth.py, Model your security layers
from dataclasses import dataclass, field
from typing import List


@dataclass
class SecurityControl:
    name: str
    control_type: str   # preventive, detective, corrective
    effectiveness: str  # low, medium, high


@dataclass
class SecurityLayer:
    name: str
    controls: List[SecurityControl] = field(default_factory=list)

    def add_control(self, control: SecurityControl) -> None:
        self.controls.append(control)

    def coverage_score(self) -> float:
        """Returns % of high-effectiveness controls."""
        if not self.controls:
            return 0.0
        high_count = sum(1 for c in self.controls if c.effectiveness == "high")
        return (high_count / len(self.controls)) * 100


# Define defense layers
layers = [
    SecurityLayer("Perimeter"),
    SecurityLayer("Application"),
    SecurityLayer("Data"),
]

layers[0].add_control(SecurityControl("WAF", "preventive", "high"))
layers[0].add_control(SecurityControl("Rate Limiter", "preventive", "high"))
layers[0].add_control(SecurityControl("IDS Alerts", "detective", "medium"))

layers[1].add_control(SecurityControl("Input Validation", "preventive", "high"))
layers[1].add_control(SecurityControl("SAST Scan", "detective", "medium"))

layers[2].add_control(SecurityControl("AES-256 Encryption", "preventive", "high"))
layers[2].add_control(SecurityControl("Access Logging", "detective", "high"))

print("Defense in Depth Analysis")
print("=" * 40)
for layer in layers:
    score = layer.coverage_score()
    status = "✅" if score >= 75 else "⚠️"
    print(f"{status} {layer.name:15}, Coverage: {score:.0f}%")
    for ctrl in layer.controls:
        print(f"   • {ctrl.name} ({ctrl.control_type}, {ctrl.effectiveness})")