Forget Drawing Architecture in Paint: Introduction to OWASP Threat Dragon

Think back to the last time the security team asked you to "create a threat model." More than likely, you opened Miro or Draw.io, threw together some boxes with arrows, and tried to remember the STRIDE acronym. The result was a nice-looking diagram that became outdated a week after release and ended up gathering dust in the corporate Wiki.

OWASP developers recognized this issue long ago and created Threat Dragon. It's an open-source tool that helps you draw data flow diagrams and attach risks directly to architecture elements.

What Threat Dragon Can Do

The project was founded by Mike Goodwin back in 2015, and it now has official OWASP Production status. This means the utility is actively maintained, not abandoned after the first commit.

The point of the tool is to make threat modeling accessible to regular development teams, not just dedicated Secure Architecture specialists.

Here are the main features worth looking at the project for:

• Data Flow Diagram (DFD) building. You lay out processes, data stores, external actors, and trust boundaries on a canvas.
• Threat generation and description. Based on diagram elements, you can quickly compile a list of potential risks and attach specific remediation steps to them.
• Git repository integration. The web version can authorize via GitHub, GitLab, or Bitbucket and save threat models directly to your project code as JSON files.
• Offline capability. If corporate policies prohibit sending architecture diagrams to external services, there are standalone desktop builds available.

Under the Hood

The original first version was difficult to use because the frontend was written in AngularJS 1.x. Due to the framework's obsolescence, the authors made the logical decision to completely rewrite the project.

Version two of Threat Dragon is built on a fresh stack: Vue.js for the user interface and Node.js for the backend. The repository is clearly divided into two directories: td.server and td.vue. If you want to add your own custom rule or tweak the interface for your needs, understanding the structure won't be difficult.

Quick Start

The easiest way to try the tool locally is to run a ready-made Docker container. It literally takes one command:

docker pull threatdragon/owasp-threat-dragon:stable
docker run -it --rm -p 8080:3000 threatdragon/owasp-threat-dragon:stable

After that, the web interface will be available at http://localhost:8080/.

If you prefer a traditional build from source, the processes are also straightforward:

git clone https://github.com/owasp/threat-dragon.git
cd threat-dragon
npm install
npm start

For full functionality of the web version with GitHub or GitLab, you'll need to register an OAuth application in your version control system settings and pass the keys via variables to the .env file. The repository has detailed instructions for each popular service.

Who Will Find This Project Useful

Threat Dragon won't replace a full security audit, and its interface looks fairly austere. But if your team needs to implement DevSecOps practices early in the design phase, it's an excellent alternative to bulky paid systems.

The tool is ideal for documenting architectural decisions right in the project repository. All diagrams are stored alongside the code, making them easy to update during refactoring and refresh during planned architecture reviews.