Skip to content

Commit 3b9d3fa

Browse files
Felipe Campos PenhaFelipe Campos Penha
authored andcommitted
add: threat model. docs: revision.
1 parent 0d005da commit 3b9d3fa

File tree

5 files changed

+860
-1
lines changed

5 files changed

+860
-1
lines changed

initiatives/genai_red_team_handbook/sandboxes/RAG_local/README.md

Lines changed: 9 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -352,9 +352,12 @@ Opens at `http://localhost:7860` with a user-friendly chat UI.
352352
```
353353
.
354354
├── config/ # Configuration files
355+
│ ├── client_config.toml # Client settings
355356
│ ├── model.toml # Model settings (default model, Ollama config)
356357
│ └── prompts.toml # Test prompts for automated testing
357-
├── data/ # Placeholder for document files
358+
├── data/ # Data directory
359+
│ ├── chromadb/ # ChromaDB persistence
360+
│ └── documents/ # Document files
358361
├── app/ # FastAPI mock server package
359362
│ ├── __init__.py
360363
│ ├── main.py # FastAPI entry point
@@ -363,14 +366,19 @@ Opens at `http://localhost:7860` with a user-friendly chat UI.
363366
│ ├── __init__.py
364367
│ ├── openai.py # Mock OpenAI API using Ollama
365368
│ ├── pinecone.py # Mock Pinecone API using ChromaDB
369+
│ ├── s3.py # Mock S3 API
366370
│ └── README.md # Guide for adding new mocks
367371
├── client/ # Client scripts
368372
│ ├── main.py # Automated test runner
369373
│ └── gradio_app.py # Web UI client
370374
├── threat_model/ # Threat modeling artifacts
375+
│ ├── RAG_TM_diagram.json
376+
│ ├── RAG_TM_report.md
377+
│ └── RAG_TM_report.pdf
371378
├── Containerfile # Podman container definition
372379
├── entrypoint.sh # Container entrypoint script
373380
├── Makefile # Developer commands
381+
├── packages.txt # System packages
374382
├── pyproject.toml # uv project definition
375383
├── uv.lock # Lock file generated by uv
376384
└── README.md # This file

initiatives/genai_red_team_handbook/sandboxes/llm_local/README.md

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -89,6 +89,11 @@ graph LR
8989
- **Application Server** → Containerized mock API (instead of cloud deployment)
9090
- **External Services** → Local Ollama + model (instead of cloud LLM/VectorDB)
9191

92+
## Threat Modeling
93+
The threat model for this RAG architecture is available in the `threat_model/` directory. It includes:
94+
- **Diagram**: `RAG_TM_diagram.json` (ThreatCanvas compatible)
95+
- **Report**: `RAG_TM_report.md` and `RAG_TM_report.pdf`
96+
9297
## Prerequisites
9398
- **Python 3.10** (or newer, but <3.11)
9499
- **uv** – Python package manager (`pip install uv` if not already installed)
@@ -247,6 +252,7 @@ Opens at `http://localhost:7860` with a user-friendly chat UI.
247252
```
248253
.
249254
├── config/ # Configuration files
255+
│ ├── client_config.toml # Client settings
250256
│ ├── model.toml # Model settings (default model, Ollama config)
251257
│ └── prompts.toml # Test prompts for automated testing
252258
├── data/ # Placeholder for document files
@@ -261,9 +267,13 @@ Opens at `http://localhost:7860` with a user-friendly chat UI.
261267
│ ├── main.py # Automated test runner
262268
│ └── gradio_app.py # Web UI client
263269
├── threat_model/ # Threat modeling artifacts
270+
│ ├── LLM_TM_diagram.json
271+
│ ├── LLM_TM_report.md
272+
│ └── LLM_TM_report.pdf
264273
├── Containerfile # Podman container definition
265274
├── entrypoint.sh # Container entrypoint script
266275
├── Makefile # Developer commands
276+
├── packages.txt # System packages
267277
├── pyproject.toml # uv project definition
268278
├── uv.lock # Lock file generated by uv
269279
└── README.md # This file
Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{"version":5,"meta":{"description":"","generalNotes":"","projectType":"web","riskTemplates":["OWASP Top 10"],"selectedRiskTemplates":{"OWASP Top 10":true},"riskModifiers":{"paymentData":false,"personalData":false,"healthData":false,"missionCritical":false,"internetFacing":false}},"nodes":[{"id":"n1","label":"Client Application","notes":"","outOfScope":false,"componentId":3,"trustBoundary":"t1","threats":[{"id":4259,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4197,"notes":"","implemented":false,"rationale":""},{"id":4313,"notes":"","implemented":false,"rationale":""},{"id":3467,"notes":"","implemented":false,"rationale":""}]},{"id":3431,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3477,"notes":"","implemented":false,"rationale":""}]},{"id":4233,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4273,"notes":"","implemented":false,"rationale":""},{"id":4312,"notes":"","implemented":false,"rationale":""},{"id":4281,"notes":"","implemented":false,"rationale":""}]},{"id":4237,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4276,"notes":"","implemented":false,"rationale":""},{"id":4269,"notes":"","implemented":false,"rationale":""}]},{"id":4243,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4270,"notes":"","implemented":false,"rationale":""},{"id":4287,"notes":"","implemented":false,"rationale":""}]},{"id":3418,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3452,"notes":"","implemented":false,"rationale":""},{"id":3459,"notes":"","implemented":false,"rationale":""},{"id":4057,"notes":"","implemented":false,"rationale":""}]}],"position":[86.733347577279,-262.81003707553236]},{"id":"n2","label":"LLM API Gateway","notes":"","outOfScope":false,"componentId":3,"trustBoundary":"t2","threats":[{"id":4233,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4273,"notes":"","implemented":false,"rationale":""},{"id":4312,"notes":"","implemented":false,"rationale":""},{"id":4281,"notes":"","implemented":false,"rationale":""}]},{"id":4237,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4276,"notes":"","implemented":false,"rationale":""},{"id":4269,"notes":"","implemented":false,"rationale":""}]},{"id":4243,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4270,"notes":"","implemented":false,"rationale":""},{"id":4287,"notes":"","implemented":false,"rationale":""}]},{"id":4245,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4021,"notes":"","implemented":false,"rationale":""},{"id":3468,"notes":"","implemented":false,"rationale":""},{"id":3451,"notes":"","implemented":false,"rationale":""},{"id":3473,"notes":"","implemented":false,"rationale":""},{"id":4291,"notes":"","implemented":false,"rationale":""}]},{"id":4249,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":3471,"notes":"","implemented":false,"rationale":""},{"id":3460,"notes":"","implemented":false,"rationale":""}]},{"id":3418,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3452,"notes":"","implemented":false,"rationale":""},{"id":3459,"notes":"","implemented":false,"rationale":""},{"id":4057,"notes":"","implemented":false,"rationale":""}]},{"id":4254,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4058,"notes":"","implemented":false,"rationale":""},{"id":4056,"notes":"","implemented":false,"rationale":""},{"id":3465,"notes":"","implemented":false,"rationale":""},{"id":4272,"notes":"","implemented":false,"rationale":""}]},{"id":4259,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4197,"notes":"","implemented":false,"rationale":""},{"id":4313,"notes":"","implemented":false,"rationale":""},{"id":3467,"notes":"","implemented":false,"rationale":""}]},{"id":3428,"notes":"","status":"Open","rationale":"","riskRating":1,"controls":[{"id":3479,"notes":"","implemented":false,"rationale":""}]},{"id":3431,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3477,"notes":"","implemented":false,"rationale":""}]},{"id":3443,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3460,"notes":"","implemented":false,"rationale":""}]}],"position":[-5.5227265793002545,-36.5197770143488]},{"id":"n3","label":"Application Logic","notes":"","outOfScope":false,"componentId":3,"trustBoundary":"t2","threats":[{"id":4233,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4273,"notes":"","implemented":false,"rationale":""},{"id":4312,"notes":"","implemented":false,"rationale":""},{"id":4281,"notes":"","implemented":false,"rationale":""}]},{"id":4237,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4276,"notes":"","implemented":false,"rationale":""},{"id":4269,"notes":"","implemented":false,"rationale":""}]},{"id":4243,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4270,"notes":"","implemented":false,"rationale":""},{"id":4287,"notes":"","implemented":false,"rationale":""}]},{"id":4245,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4021,"notes":"","implemented":false,"rationale":""},{"id":3468,"notes":"","implemented":false,"rationale":""},{"id":3451,"notes":"","implemented":false,"rationale":""},{"id":3473,"notes":"","implemented":false,"rationale":""},{"id":4291,"notes":"","implemented":false,"rationale":""}]},{"id":3418,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3452,"notes":"","implemented":false,"rationale":""},{"id":3459,"notes":"","implemented":false,"rationale":""},{"id":4057,"notes":"","implemented":false,"rationale":""}]},{"id":4254,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4058,"notes":"","implemented":false,"rationale":""},{"id":4056,"notes":"","implemented":false,"rationale":""},{"id":3465,"notes":"","implemented":false,"rationale":""},{"id":4272,"notes":"","implemented":false,"rationale":""}]},{"id":4259,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4197,"notes":"","implemented":false,"rationale":""},{"id":4313,"notes":"","implemented":false,"rationale":""},{"id":3467,"notes":"","implemented":false,"rationale":""}]},{"id":3428,"notes":"","status":"Open","rationale":"","riskRating":1,"controls":[{"id":3479,"notes":"","implemented":false,"rationale":""}]},{"id":3431,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3477,"notes":"","implemented":false,"rationale":""}]}],"position":[176.5574377861043,133.524939916715]},{"id":"n4","label":"Language Model Service","notes":"","outOfScope":false,"componentId":3,"trustBoundary":"t3","threats":[{"id":4233,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4273,"notes":"","implemented":false,"rationale":""},{"id":4312,"notes":"","implemented":false,"rationale":""},{"id":4281,"notes":"","implemented":false,"rationale":""}]},{"id":4237,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4276,"notes":"","implemented":false,"rationale":""},{"id":4269,"notes":"","implemented":false,"rationale":""}]},{"id":4243,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4270,"notes":"","implemented":false,"rationale":""},{"id":4287,"notes":"","implemented":false,"rationale":""}]},{"id":4245,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4021,"notes":"","implemented":false,"rationale":""},{"id":3468,"notes":"","implemented":false,"rationale":""},{"id":3451,"notes":"","implemented":false,"rationale":""},{"id":3473,"notes":"","implemented":false,"rationale":""},{"id":4291,"notes":"","implemented":false,"rationale":""}]},{"id":4249,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":3471,"notes":"","implemented":false,"rationale":""},{"id":3460,"notes":"","implemented":false,"rationale":""}]},{"id":3418,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3452,"notes":"","implemented":false,"rationale":""},{"id":3459,"notes":"","implemented":false,"rationale":""},{"id":4057,"notes":"","implemented":false,"rationale":""}]},{"id":4254,"notes":"","status":"Open","rationale":"","riskRating":3,"controls":[{"id":4058,"notes":"","implemented":false,"rationale":""},{"id":4056,"notes":"","implemented":false,"rationale":""},{"id":3465,"notes":"","implemented":false,"rationale":""},{"id":4272,"notes":"","implemented":false,"rationale":""}]},{"id":4259,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":4197,"notes":"","implemented":false,"rationale":""},{"id":4313,"notes":"","implemented":false,"rationale":""},{"id":3467,"notes":"","implemented":false,"rationale":""}]},{"id":3428,"notes":"","status":"Open","rationale":"","riskRating":1,"controls":[{"id":3479,"notes":"","implemented":false,"rationale":""}]},{"id":3431,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3477,"notes":"","implemented":false,"rationale":""}]},{"id":3443,"notes":"","status":"Open","rationale":"","riskRating":2,"controls":[{"id":3460,"notes":"","implemented":false,"rationale":""}]}],"position":[86.73334757727902,359.81522621078693]}],"links":[{"id":"l1","from":"n1","to":"n2","label":"HTTPS","twoWay":true},{"id":"l2","from":"n2","to":"n3","label":"","twoWay":true},{"id":"l3","from":"n3","to":"n4","label":"API Call","twoWay":true}],"trustBoundaries":[{"id":"t1","label":"Client Environment"},{"id":"t2","label":"Application Server"},{"id":"t3","label":"External Services"}]}

initiatives/genai_red_team_handbook/sandboxes/llm_local/threat_model/LLM_TM_report.md

Lines changed: 840 additions & 0 deletions
Large diffs are not rendered by default.
Binary file not shown.

0 commit comments

Comments
 (0)