A web app that simplifies building decision trees to model adverse scenarios. Hosted at https://www.deciduous.app/
It allows you to document your assumptions about how a system, service, app, etc. will respond to adverse events. Its heritage is in helping defenders anticipate attacker behavior and prepare mitigations accordingly, but it also applies to anticipating reliability-related failures, too.
It is especially useful as a foundation to conduct resilience stress testing / chaos experimentation, allowing you to continually refine your mental models of a system with reality. The end goal of using decision trees is to document your beliefs about how failure will unfold across your system in a given scenario, which can inform design improvements to better sustain resilience to that failure.
Getting started guide: https://kellyshortridge.com/blog/posts/deciduous-attack-tree-app/
Theme options include:
theme: default - the default tree stylingtheme: accessible - for more color differentiation between attack and mitigation nodestheme: classic - classic Graphviz stylingtheme: dark - dark modeFor a more detailed write-up of using decision trees in practice, refer to the book Security Chaos Engineering: Sustaining Resilience in Software and Systems.
Example trees for #inspo are hosted in /examples.
FAQs
App that simplifies building decision trees to model adverse scenarios
The npm package deciduous receives a total of 2 weekly downloads. As such, deciduous popularity was classified as not popular.
We found that deciduous demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
A developer is accusing Tencent of violating the GPL by modifying a Python utility and changing its license to BSD, highlighting the importance of copyleft compliance.
Security News
In an open letter, JavaScript community leaders urge Oracle to give up the JavaScript trademark, arguing that it has been effectively abandoned through nonuse.
Security News
The initial version of the Socket Python SDK is now on PyPI, enabling developers to more easily interact with the Socket REST API in Python projects.