huncode/progcode
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

revise January 2023 threat model articles
Build and deploy / deploy (push) Successful in 16s
Details

Browse Source
This commit is contained in:
huncode
2026-07-31 14:24:50 +03:00
parent 1fe13dbdbe
commit 31ed7053e7
7 changed files with 383 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
web/public/assets/editorial/2023/threat-model-2023-contract.svg
+21
View File
@@ -0,0 +1,21 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="720" viewBox="0 0 1200 720" role="img" aria-labelledby="title desc">
<title id="title">Контракт threat, control и evidence</title>
<desc id="desc">Показаны обязательные поля учебной модели, принятый план с одной связью control-evidence, ветки отклонения и rollback к snapshot.</desc>
<defs><marker id="a" markerWidth="10" markerHeight="10" refX="9" refY="3" orient="auto"><path d="M0 0 L10 3 L0 6 Z" fill="#17324d"/></marker></defs>
<rect width="1200" height="720" fill="#f8fafc"/>
<text x="70" y="75" font-family="Arial, sans-serif" font-size="34" font-weight="700" fill="#17324d">Контракт: не угадывать пропущенный контекст</text>
<rect x="70" y="140" width="290" height="370" rx="18" fill="#e8f2ff" stroke="#2176ae" stroke-width="3"/>
<text x="100" y="190" font-family="Arial, sans-serif" font-size="25" font-weight="700" fill="#17324d">Вход модели</text>
<text x="100" y="245" font-family="Arial, sans-serif" font-size="21" fill="#17324d">actor</text><text x="100" y="300" font-family="Arial, sans-serif" font-size="21" fill="#17324d">asset</text><text x="100" y="355" font-family="Arial, sans-serif" font-size="21" fill="#17324d">boundary</text><text x="100" y="410" font-family="Arial, sans-serif" font-size="21" fill="#17324d">abuse</text><text x="100" y="465" font-family="Arial, sans-serif" font-size="21" fill="#17324d">control</text>
<line x1="360" y1="325" x2="500" y2="325" stroke="#17324d" stroke-width="5" marker-end="url(#a)"/>
<rect x="500" y="165" width="330" height="320" rx="18" fill="#e3f4e6" stroke="#287744" stroke-width="3"/>
<text x="665" y="215" text-anchor="middle" font-family="Arial, sans-serif" font-size="25" font-weight="700" fill="#185d31">accepted plan</text>
<text x="535" y="270" font-family="Arial, sans-serif" font-size="20" fill="#17324d">threat → unsigned request</text><text x="535" y="325" font-family="Arial, sans-serif" font-size="20" fill="#17324d">control → signed-request</text><text x="535" y="380" font-family="Arial, sans-serif" font-size="20" fill="#17324d">evidence → local rejection</text><text x="535" y="435" font-family="Arial, sans-serif" font-size="20" fill="#17324d">rollback → snapshot</text>
<line x1="830" y1="265" x2="965" y2="265" stroke="#17324d" stroke-width="5" marker-end="url(#a)"/>
<rect x="965" y="185" width="180" height="160" rx="16" fill="#eee8ff" stroke="#6a52a3" stroke-width="3"/>
<text x="1055" y="245" text-anchor="middle" font-family="Arial, sans-serif" font-size="23" font-weight="700" fill="#4b3881">one evidence</text><text x="1055" y="280" text-anchor="middle" font-family="Arial, sans-serif" font-size="18" fill="#17324d">for one control</text>
<path d="M250 510 V595 H950 V485" fill="none" stroke="#6a52a3" stroke-width="4" stroke-dasharray="11 9" marker-end="url(#a)"/>
<text x="600" y="630" text-anchor="middle" font-family="Arial, sans-serif" font-size="20" font-weight="700" fill="#4b3881">rollback restores the teaching snapshot; it is not a deployment rollback</text>
<rect x="70" y="540" width="235" height="100" rx="12" fill="#ffe4e4" stroke="#c44" stroke-width="2"/>
<text x="92" y="580" font-family="Arial, sans-serif" font-size="20" font-weight="700" fill="#8e2424">reject</text><text x="92" y="615" font-family="Arial, sans-serif" font-size="17" fill="#3c2424">missing asset / unknown control</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 3.5 KiB

web/public/assets/editorial/2023/threat-model-2023-diagnosis-rollback.svg
+22
View File
@@ -0,0 +1,22 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="720" viewBox="0 0 1200 720" role="img" aria-labelledby="title desc">
<title id="title">Маршрут диагностики и rollback модели угроз</title>
<desc id="desc">Последовательность вопросов ведёт от контроля без объекта защиты к активу, границе, злоупотреблению и evidence. Принятый учебный план можно вернуть к исходной записи.</desc>
<defs><marker id="a" markerWidth="10" markerHeight="10" refX="9" refY="3" orient="auto"><path d="M0 0 L10 3 L0 6 Z" fill="#17324d"/></marker></defs>
<rect width="1200" height="720" fill="#f8fafc"/>
<text x="70" y="78" font-family="Arial, sans-serif" font-size="34" font-weight="700" fill="#17324d">Маршрут ревью: от готового контроля к проверяемой связи</text>
<g font-family="Arial, sans-serif" fill="#17324d">
<rect x="70" y="175" width="210" height="105" rx="14" fill="#ffe4e4" stroke="#c44" stroke-width="3"/><text x="175" y="220" text-anchor="middle" font-size="21" font-weight="700">control без asset</text><text x="175" y="252" text-anchor="middle" font-size="17">остановить выбор</text>
<rect x="350" y="175" width="210" height="105" rx="14" fill="#e8f2ff" stroke="#2176ae" stroke-width="3"/><text x="455" y="220" text-anchor="middle" font-size="21" font-weight="700">назвать asset</text><text x="455" y="252" text-anchor="middle" font-size="17">что защищаем?</text>
<rect x="630" y="175" width="210" height="105" rx="14" fill="#e8f2ff" stroke="#2176ae" stroke-width="3"/><text x="735" y="220" text-anchor="middle" font-size="21" font-weight="700">назвать boundary</text><text x="735" y="252" text-anchor="middle" font-size="17">где решение?</text>
<rect x="910" y="175" width="210" height="105" rx="14" fill="#e8f2ff" stroke="#2176ae" stroke-width="3"/><text x="1015" y="220" text-anchor="middle" font-size="21" font-weight="700">назвать abuse</text><text x="1015" y="252" text-anchor="middle" font-size="17">что блокируем?</text>
</g>
<g stroke="#17324d" stroke-width="5" marker-end="url(#a)"><line x1="280" y1="227" x2="350" y2="227"/><line x1="560" y1="227" x2="630" y2="227"/><line x1="840" y1="227" x2="910" y2="227"/></g>
<line x1="1015" y1="280" x2="1015" y2="390" stroke="#17324d" stroke-width="5" marker-end="url(#a)"/>
<rect x="815" y="390" width="300" height="120" rx="16" fill="#e3f4e6" stroke="#287744" stroke-width="3"/>
<text x="965" y="438" text-anchor="middle" font-family="Arial, sans-serif" font-size="23" font-weight="700" fill="#185d31">control + evidence</text><text x="965" y="475" text-anchor="middle" font-family="Arial, sans-serif" font-size="18" fill="#17324d">названный отрицательный check</text>
<path d="M815 450 H500 V575" fill="none" stroke="#17324d" stroke-width="5" marker-end="url(#a)"/>
<rect x="325" y="575" width="350" height="95" rx="15" fill="#eee8ff" stroke="#6a52a3" stroke-width="3"/>
<text x="500" y="615" text-anchor="middle" font-family="Arial, sans-serif" font-size="23" font-weight="700" fill="#4b3881">accepted teaching plan</text><text x="500" y="647" text-anchor="middle" font-family="Arial, sans-serif" font-size="17" fill="#17324d">snapshot can be restored</text>
<path d="M325 620 H130 V365" fill="none" stroke="#6a52a3" stroke-width="4" stroke-dasharray="11 9" marker-end="url(#a)"/>
<text x="80" y="350" font-family="Arial, sans-serif" font-size="18" font-weight="700" fill="#4b3881">rollback of model</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 3.6 KiB

web/public/assets/editorial/2023/threat-model-2023-flow.svg
+23
View File
@@ -0,0 +1,23 @@
<svg xmlns="http://www.w3.org/2000/svg" width="1200" height="720" viewBox="0 0 1200 720" role="img" aria-labelledby="title desc">
<title id="title">Учебный DFD одного потока и связанный контроль</title>
<desc id="desc">Browser client пересекает границу доверия перед handler. Handler сохраняет change request. Возле границы показаны злоупотребление, контроль и evidence.</desc>
<defs><marker id="arrow" markerWidth="10" markerHeight="10" refX="9" refY="3" orient="auto"><path d="M0,0 L10,3 L0,6 Z" fill="#17324d"/></marker></defs>
<rect width="1200" height="720" fill="#f7fafc"/>
<text x="70" y="80" font-family="Arial, sans-serif" font-size="34" font-weight="700" fill="#17324d">Один учебный поток: сначала актив и граница</text>
<rect x="70" y="250" width="215" height="120" rx="16" fill="#d8ecff" stroke="#2176ae" stroke-width="3"/>
<text x="177" y="302" text-anchor="middle" font-family="Arial, sans-serif" font-size="24" font-weight="700" fill="#17324d">browser-client</text><text x="177" y="335" text-anchor="middle" font-family="Arial, sans-serif" font-size="18" fill="#17324d">source</text>
<line x1="285" y1="310" x2="475" y2="310" stroke="#17324d" stroke-width="5" marker-end="url(#arrow)"/>
<line x1="390" y1="165" x2="390" y2="480" stroke="#d64545" stroke-width="5" stroke-dasharray="12 10"/>
<text x="390" y="140" text-anchor="middle" font-family="Arial, sans-serif" font-size="19" font-weight="700" fill="#a12c2c">trust boundary</text><text x="390" y="505" text-anchor="middle" font-family="Arial, sans-serif" font-size="17" fill="#a12c2c">public-api-to-handler</text>
<rect x="475" y="250" width="220" height="120" rx="16" fill="#e6f5df" stroke="#3b7a35" stroke-width="3"/>
<text x="585" y="302" text-anchor="middle" font-family="Arial, sans-serif" font-size="25" font-weight="700" fill="#17324d">handler</text><text x="585" y="335" text-anchor="middle" font-family="Arial, sans-serif" font-size="18" fill="#17324d">process</text>
<line x1="695" y1="310" x2="885" y2="310" stroke="#17324d" stroke-width="5" marker-end="url(#arrow)"/>
<path d="M885 250 H1085 L1115 280 V370 H885 Z" fill="#fff4cf" stroke="#9c6d00" stroke-width="3"/>
<text x="1000" y="302" text-anchor="middle" font-family="Arial, sans-serif" font-size="23" font-weight="700" fill="#17324d">change-request</text><text x="1000" y="335" text-anchor="middle" font-family="Arial, sans-serif" font-size="18" fill="#17324d">asset / store</text>
<rect x="78" y="545" width="315" height="105" rx="12" fill="#ffe1e1" stroke="#c44" stroke-width="2"/>
<text x="97" y="582" font-family="Arial, sans-serif" font-size="20" font-weight="700" fill="#8e2424">Abuse</text><text x="97" y="617" font-family="Arial, sans-serif" font-size="18" fill="#3c2424">request without valid signature</text>
<rect x="440" y="545" width="310" height="105" rx="12" fill="#dff4e4" stroke="#287744" stroke-width="2"/>
<text x="459" y="582" font-family="Arial, sans-serif" font-size="20" font-weight="700" fill="#185d31">Control</text><text x="459" y="617" font-family="Arial, sans-serif" font-size="18" fill="#17324d">signed-request: reject before handler</text>
<rect x="790" y="545" width="340" height="105" rx="12" fill="#e8e2ff" stroke="#6a52a3" stroke-width="2"/>
<text x="809" y="582" font-family="Arial, sans-serif" font-size="20" font-weight="700" fill="#4b3881">Evidence</text><text x="809" y="617" font-family="Arial, sans-serif" font-size="18" fill="#17324d">local check: unsigned value rejected</text>
</svg>
Side by Side

After

Width:  |  Height:  |  Size: 3.6 KiB