Threat + Mitigation properties

Techniques & Tooling
1

Let’s say I design a TM tool and it has threats and mitigations.

When you click on them, you get a key/value editor.

  1. What are the properties you would like to see in a threat editor?
  2. What are the properties you would like to see in a mitigation editor?
  3. If those are enum types, what enum values would you propose?

I’m looking for maximal ideas + a minimal loveable set of properties.

2

At a minimum:

  • I want to be able to support multiple threat modeling frameworks. The frameworks themselves may have degrees of overlap, or operate in a chain (e.g. STRIDE-LM tells me the loss of a cybersecurity property, LINDDUN tells me the loss of a privacy property, but MITRE CAPEC/ATT&CK tell me how these attacks result in the loss of associated security properties)
  • For a mitigation editor, I need to be able to keep a repository of said mitigations, how they may lower risk likelihood, where they are applied, whether or not they adequately address risk.