risque360 — STRIDE Threat Modeling, Vendor Risk & Incident Recalibration
Unified risk register combining three sources under one Likelihood × Impact scoring engine: STRIDE threat modeling per application component, vendor/third-party risk scored by a transparent heuristic, and an incident log that suggests a probability recalibration over a rolling 12-month window — never applied without an explicit click.
Context
risque360 extends matrice-risques (itself a French rebuild of the open-source risk-assessment-matrix project): a classic risk register poorly captures threats specific to an application's architecture, risks carried by vendors/third parties, and how a history of incidents should shift a probability declared "in the abstract". risque360 brings these three angles together in a single register, with a data-driven probability recalibration mechanism — the most differentiating part of the project.
The 4 modules
- Organizational risk register — same spirit as matrice-risques (manual form, business categories)
- Application threat modeling (STRIDE) — for a given component (API Gateway, auth service, database...), generates one risk per STRIDE category: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege
- Vendor/third-party risk register — a vendor (access level, security questionnaire status, known incident) automatically generates a risk, with an initial probability estimated by a transparent heuristic — never enforced, always editable
- Incident log & recalibration — each risk carries a correlation key; incidents logged under that same key are used to compute a suggested probability over a rolling 12-month window. The suggestion is never auto-applied — an explicit "Apply" button is required
Recalibration algorithm
- 0-2 incidents / rolling 12 months
- No adjustment
- 3-5 incidents
- Probability +1 (capped at 5)
- 6+ incidents
- Probability +2 (capped at 5)
- Test-validated example
- "Phishing — credential theft" (declared probability 2/5): 4 related incidents in 12 months → suggested 3/5, shown with an explicit "Apply" button
Vendor heuristic (transparent, editable)
- Base
- High access: 3 · medium: 2 · low: 1
- +1
- If security questionnaire not completed
- +1
- If questionnaire compliant with reservations
- +1
- If a known incident occurred in the last 12 months
- Cap
- 5
Bug found and fixed during development
Automatic correlation-key generation (from a vendor name or a STRIDE component) didn't strip punctuation — for example "PayGateway Inc." generated the vendor key fournisseur-paygateway-inc. with a trailing period, which would have silently broken the link to incidents logged under that same key. Fixed with a shared slugifier() function that strips diacritics and punctuation before generating the key, verified with a direct isolated-module test (cache-busting import) to rule out any ES module caching effect during debugging.
Outcomes
- Stack
- Vanilla HTML/CSS/JS (ES modules, no dependencies) + Python CLI (argparse, Jinja2, pytest)
- Tests
- 6 pytest tests — level boundaries, vendor heuristic, 12-month window, recalibration tiers, preview non-mutation, combined example-data validation
- JS ↔ Python parity
- Recalibration logic duplicated identically in the Python CLI (recalibration.py), tested separately
- Interface
- Tabbed app: Dashboard (heatmap + global register), Register, STRIDE, Vendors, Incidents