diff --git a/docs/img/cards.svg b/docs/img/cards.svg
index 23cfe1b..bb528f3 100644
--- a/docs/img/cards.svg
+++ b/docs/img/cards.svg
@@ -5,58 +5,100 @@
xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
xmlns:svg="http://www.w3.org/2000/svg"
xmlns="http://www.w3.org/2000/svg"
- id="svg2688"
+ id="svg1203"
version="1.1"
viewBox="0 0 210 137"
height="137mm"
width="210mm">
+ id="defs1197">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ id="metadata1200">
@@ -71,374 +113,765 @@
transform="translate(0,-160)"
id="layer1">
+ transform="matrix(0.34047859,-0.09233898,-0.09233898,-0.34047859,31.918299,296.42365)"
+ clip-path="url(#clipPath856)"
+ id="g852">
+ id="g858">
+
+
+
+ transform="translate(-88.526,95.177)"
+ id="g864">
+ id="g866">
-
-
-
+ transform="translate(200.563)"
+ id="g868">
+ transform="matrix(0.70709,0.70709,-0.70709,0.70709,0,0)"
+ id="g870">
+ transform="scale(15.53734)"
+ id="g872">
+ transform="translate(-112.037,-95.17)"
+ id="g874">
-
-
-
-
- J
-
-
-
-
-
-
+ id="text878"
+ style="font-variant:normal;font-weight:bold;font-size:24.78709984px;font-family:'Josefin Sans';-inkscape-font-specification:JosefinSans-Bold;writing-mode:lr-tb;fill:#f4a59b;fill-opacity:1;fill-rule:nonzero;stroke:none"
+ transform="matrix(1,0,0,-1,112.037,95.17)"
+ aria-label="J">
+
+
-
-
-
+ transform="translate(-200.563)"
+ id="g882" />
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ transform="translate(22.266,297.997)"
+ id="g904" />
+
+
+
+ id="g910">
-
-
- J
-
-
-
+ id="g912" />
+
+ id="g926"
+ clip-path="url(#clipPath916)">
+ id="g924"
+ transform="matrix(1,0,0,-1,0,14.173228)">
-
-
-
-
-
-
-
-
-
-
-
+ id="g922">
+
+
-
-
+
+
+
+
+
+
+
+
+
+
+ transform="matrix(1.47612,0,0,1.47612,-170.98636,-473.35773)"
+ id="g942">
-
-
-
-
- jack/access&secrets
-
-
-
-
-
-
-
+ id="text946"
+ style="font-variant:normal;font-weight:normal;font-size:4.98129988px;font-family:'Josefin Sans';-inkscape-font-specification:JosefinSans-Regular;writing-mode:lr-tb;fill:#000000;fill-opacity:1;fill-rule:nonzero;stroke:none"
+ transform="matrix(1,0,0,-1,115.835,320.677)"
+ aria-label="jack/access&secrets">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
-
-
-
- Ourdeployment
- artifactscontain
- secretsthatcan
- beextracted.
-
-
-
-
-
-
+ transform="translate(-12.454)"
+ id="g950" />
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ transform="translate(31.011,17.201)"
+ id="g988" />
+
+
+
+
+
+
+
+
+
+
+ id="g1002" />
+
+ id="g1068"
+ clip-path="url(#clipPath1006)">
-
- Secretsinartifacts
-
+ id="g1066"
+ transform="matrix(1,0,0,-1,0,48)">
+ id="g1064">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
-
+
+ transform="matrix(0.35277777,0,0,-0.35277777,69.002274,282.28883)"
+ id="g1992">
+ id="g1994">
+ id="g1996">
+ id="g1998">
+ clip-path="url(#clipPath2004)"
+ id="g2000">
+ id="g2006">
+ id="g2010">
+ id="g2012">
+ id="g2014">
+ id="g2016">
+ id="g2018">
+ id="g2020">
-
+
- 5
-
+ transform="matrix(1,0,0,-1,112.062,50.139)"
+ aria-label="5">
+
+
+ id="g2028" />
+ id="g2030" />
+ id="g2032" />
+ id="g2038">
+ id="g2040">
+ id="g2042">
-
+
- 5
-
+ transform="matrix(1,0,0,-1,20.043,297.998)"
+ aria-label="5">
+
+
+ id="g2050" />
+ id="g2052">
+ id="g2054">
+ id="g2056">
+ id="g2058" />
+ id="g2072">
+ id="g2070"
+ clip-path="url(#clipPath2062)">
+ id="g2066">
@@ -449,114 +882,434 @@
+ id="g2074" />
+ id="g2076" />
+ id="g2078">
+ id="g2080">
+ id="g2082">
+ id="g2084">
-
+
- fve/recovery
-
+ transform="matrix(1,0,0,-1,140.779,320.677)"
+ aria-label="fve/recovery">
+
+
+
+
+
+
+
+
+
+
+
+
+
+ id="g2092" />
+ id="g2094" />
+ id="g2096" />
+ id="g2098">
+ id="g2100">
+ id="g2102">
-
+
- Wehaveno
- backupsofour
- applicationdata.
-
+ transform="matrix(1,0,0,-1,73.187,226.841)"
+ aria-label="Wehaveno backupsofour applicationdata.">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ id="g2114" />
+ id="g2116" />
+ id="g2118">
+ id="g2120">
+ id="g2122">
-
+
- Nobackupsofdata
-
+ transform="matrix(1,0,0,-1,31.011,17.201)"
+ aria-label="Nobackupsofdata">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ id="g2130" />
+ id="g2132" />
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
@@ -565,125 +1318,125 @@
+ transform="matrix(0.34542603,0.07164507,0.07164507,-0.34542603,116.02323,280.10694)"
+ id="g3117">
+ id="g3119">
+ id="g3121">
+ id="g3123">
+ clip-path="url(#clipPath3129)"
+ id="g3125">
+ id="g3131">
+ id="g3135">
+ id="g3137">
+ id="g3139">
+ id="g3141">
+ id="g3143">
+ id="g3145">
-
+
- 9
-
+ transform="matrix(1,0,0,-1,112.062,41.819)"
+ aria-label="9">
+
+
+ id="g3153" />
+ id="g3155" />
+ id="g3157" />
+ id="g3163">
+ id="g3165">
+ id="g3167">
-
+
- 9
-
+ transform="matrix(1,0,0,-1,20.043,297.998)"
+ aria-label="9">
+
+
+ id="g3175" />
+ id="g3177">
+ id="g3179">
+ id="g3181">
+ id="g3183" />
+ id="g3199">
+ id="g3197"
+ clip-path="url(#clipPath3187)">
+ id="g3193">
@@ -694,142 +1447,633 @@
+ id="g3201" />
+ id="g3203" />
+ id="g3205">
+ id="g3207">
+ id="g3209">
+ id="g3211">
-
+
- nine/monitoring
-
+ transform="matrix(1,0,0,-1,127.215,320.677)"
+ aria-label="nine/monitoring">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ id="g3219" />
+ id="g3221" />
+ id="g3223" />
+ id="g3225">
+ id="g3227">
+ id="g3229">
-
+
- Wedon’tknowif
- anauthenticated
- attacker/developer
- accessedthe
- production
- environment.
-
+ transform="matrix(1,0,0,-1,58.013,226.841)"
+ aria-label="Wedon’tknowif anauthenticated attacker/developer accessedthe production environment.">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ id="g3247" />
+ id="g3249" />
+ id="g3251">
+ id="g3253">
+ id="g3255">
-
+
- Noauditsforprodaccess
-
+ transform="matrix(1,0,0,-1,31.011,17.201)"
+ aria-label="Noauditsforprodaccess">
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ id="g3263" />
+ id="g3265" />
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ i
+
+
+
+
- i
diff --git a/readme.md b/readme.md
index 0e98260..dcbf57b 100644
--- a/readme.md
+++ b/readme.md
@@ -4,7 +4,7 @@
SPDX-License-Identifier: CC-BY-4.0
-->
-# OWASP Cumulus - *Threat modeling the clouds*[
](https://github.com/OWASP/cumulus/releases/latest)
+# Cumulus - *Threat modeling the clouds*[](https://github.com/TNG/cumulus/releases/latest)
@@ -13,7 +13,7 @@ Cumulus is the easy way to bring security into cloud and devOps teams.
As a variant of the card game Elevation of Privilege it follows the idea to threat model a system via gamification.
This lightweight and low-barrier approach helps you find threats to your devOps or cloud project and teaches the developers a security oriented mindset.
-Find the latest release [here](https://github.com/OWASP/cumulus/releases/latest).
+Find the latest release [here](https://github.com/TNG/cumulus/releases/latest).
## Threat Modeling
The idea of threat modeling via serious games goes back to the card game [Elevation of Privilege](https://shostack.org/games/elevation-of-privilege) by [Adam Shostack](https://github.com/adamshostack).
@@ -51,7 +51,7 @@ The dealer plays a card in the starting suit.Each other players has to follow th
If that is not possible, the player can choose any card on hand.
The winner of the round takes the trick and is the one who played the highest value card in the round's suit or the highest trump card.
-Trumps are cards from the suit *Access & Secrets*.
+Trumps are cards from the suit *resources*.
The winner then receives a point, starts a new round and chooses the new suit.
Each time a new card is played, all players are asked to think about whether that particular threat, mentioned on the current card, applies to their system in some form.
@@ -80,7 +80,7 @@ You can find it under:
Contributions to the card deck are very much appreciated.
In the end, this card deck is intended to be a community project.
-Changes to the threat formulations are welcome as pull requests to [cards.tex](https://github.com/OWASP/cumulus/blob/main/cards.tex).
+Changes to the threat formulations are welcome as pull requests to [cards.tex](https://github.com/TNG/cumulus/blob/main/cards.tex).
## Versioning
The card deck follows [semantic versioning](https://semver.org/).
diff --git a/tex/img/cover_logo.pdf b/tex/img/cover_logo.pdf
index 1338686..788102b 100644
Binary files a/tex/img/cover_logo.pdf and b/tex/img/cover_logo.pdf differ
diff --git a/tex/lib/logo.tex b/tex/lib/logo.tex
index 45802a3..248ec0b 100644
--- a/tex/lib/logo.tex
+++ b/tex/lib/logo.tex
@@ -1,9 +1,16 @@
% © 2023 TNG Technology Consulting
%
% SPDX-License-Identifier: Apache-2.0
-%
-% Categories
-%
+%%
% Logo
-\newcommand{\Logo}[1]{}%
+\newcommand{\Logo}[1]{%
+ \node[text width=(0.65*\cardwidth)*1cm,below right,inner sep=0, align=left] at (0.38*\cardwidth+\bleed, 0.115*\cardheight+\bleed)%
+ {%
+ \ifthenelse{\boolean{doPrintLogoInColor}}{%
+ \includegraphics[width=0.8\textwidth]{#1}%
+ }{%
+ \includegraphics[width=0.8\textwidth]{\LogoBlack}%
+ }%
+ };%
+}%
%