Show HN: Gram – Self-Hosted Threat Modeling Webapp(github.com)
github.com
Show HN: Gram – Self-Hosted Threat Modeling Webapp
https://github.com/klarna-incubator/gram
2 comments
I am curious what the motivating use case was for creating this? Where did things break down with other tools?
I can't account for all other tools, but we at least think that having our own tool still beats the ones we know about in UX. We actually compare ourselves to some vendor tooling and have regular knowledge sharing with a specific vendor that focuses on threat modeling :)
This started as a quick hackathon project by a different developer like three years ago just coupling a diagramming tool with our system inventory. Over time we've just kept building on it and refining it as one of the many tools we maintain under the "Secure Development" umbrella.
It was always tightly coupled to our system inventory from the start, so it has been fairly easy to get engineers on board. It has even become useful outside of threat modeling (our offensive security people love having it before a pentest as often it's the defacto diagram of the system).
This started as a quick hackathon project by a different developer like three years ago just coupling a diagramming tool with our system inventory. Over time we've just kept building on it and refining it as one of the many tools we maintain under the "Secure Development" umbrella.
It was always tightly coupled to our system inventory from the start, so it has been fairly easy to get engineers on board. It has even become useful outside of threat modeling (our offensive security people love having it before a pentest as often it's the defacto diagram of the system).
I'm the lead dev of this project - let me know if you have any questions or feedback :)