Security Diagram Family

Overview

Base Control: SecurityControl : MaterialControl
Namespace: Beep.Skia.Security

The SecurityControl is the root control for this diagram family. It inherits MaterialControl and provides shared port management, styling, and template methods for all nodes in the family.

This family contains 9 node types.

Node Types

Connection Points

Every node in this family exposes connection points (ports) for linking to other nodes. Port positions are computed lazily by LayoutPorts(), which runs when MarkPortsDirty() flags the layout as stale after a move or resize.

Connection Conventions

When building diagrams with this family, follow these conventions:

• Assets connect to threats they face
• Controls mitigate threats and reduce vulnerabilities
• Vulnerabilities link to assets they affect
• Mitigation links use dashed lines to distinguish from data flow

Usage Example

Complete example showing creation, node placement, and connection:

var sec = new SecurityControl
{
    X = 50, Y = 50,
    Width = 700, Height = 500
};
drawingManager.AddComponent(sec);

var asset = new AssetNode
{
    X = 100, Y = 150,
    Text = "Customer Database",
    AssetType = "Data"
};
var threat = new ThreatNode
{
    X = 350, Y = 80,
    ThreatType = "SQL Injection",
    Severity = "High"
};
var control = new ControlNode
{
    X = 350, Y = 220,
    ControlType = "Input Validation",
    ControlCategory = "Preventive"
};
var vuln = new VulnerabilityNode
{
    X = 600, Y = 150,
    CVE = "CVE-2023-XXXXX"
};

drawingManager.AddComponent(asset);
drawingManager.AddComponent(threat);
drawingManager.AddComponent(control);
drawingManager.AddComponent(vuln);

drawingManager.ConnectComponents(asset.OutPoints[0], threat.InPoints[0]);
drawingManager.ConnectComponents(threat.OutPoints[1], vuln.InPoints[0]);
drawingManager.ConnectComponents(control.OutPoints[0], threat.InPoints[1]);

STRIDE Analysis

StrideAnalyzer.Analyze(components) inspects the diagram's asset nodes and produces a threat list. Each threat records its STRIDE category, the asset it affects, a suggested mitigation, a severity, matching MITRE ATT&CK techniques and a DREAD score:

var analyzer = new StrideAnalyzer();
analyzer.Analyze(drawingManager.GetComponents());

foreach (var threat in analyzer.Threats)
    Console.WriteLine($"[{threat.Category}] {threat.AssetName}: {threat.Threat} " +
                      $"(DREAD {threat.Dread.Average:0.0}, {threat.Dread.RiskLevel})");

DREAD Scoring

DreadScore rates five dimensions and derives an average and a risk level:

DreadCalculator builds scores from a ThreatNode, from severity/likelihood pairs, or from their string names, so threat tables can be scored in bulk.

MITRE ATT&CK Mapping

MitreAttackLibrary ships a technique catalog and maps STRIDE categories onto it: