Anzeige
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-1-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-2-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-3-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-4-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-5-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-6-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-7-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-8-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-9-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-10-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-11-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-12-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-13-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-14-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-15-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-16-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-17-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-18-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-19-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-20-2048.jpg?cb=1669771009)
![[Lithuania] Introduction to threat modeling](https://image.slidesharecdn.com/introductiontothreatmodelingowaspeee2015-151008055901-lva1-app6891-151026110555-lva1-app6891/75/lithuania-introduction-to-threat-modeling-21-2048.jpg?cb=1669771009)
[Lithuania] Introduction to threat modeling
26. Oct 2015•0 gefällt mir•441 Aufrufe
0 gefällt mir
Sei der Erste, dem dies gefällt
Mehr anzeigen
Aufrufe
Aufrufe insgesamt
0
Auf Slideshare
0
Aus Einbettungen
0
Anzahl der Einbettungen
0
Downloaden Sie, um offline zu lesen
Melden
Internet
Introduction to threat modeling. Audrius Kovalenko.
OWASP EEEFolgen
OWASPAnzeige
Anzeige
Anzeige
Recomendados
Security of Web Applications: Top 6 Risks To Avoidslicklash
Introduction to Threat Modelingslicklash
Selenium -Test automation for web applicationsAnisGhelissi
تست وب اپ ها با سلنیوم - علیرضا عظیم زاده میلانیirpycon
Intro to silverlight_20110602Ethos Technologies
Security Threats and Solutions of Cloud ComputingKartik Shenoy
[Lithuania] Introduction to threat modeling
- Introduction to threat modeling OWASP EEE 2015
- About me Audrius Kovalenko | @slicklash NOT Computer Security Expert Just a developer
- Prelude
- Princess in your possession
- You’ve built a castle for a princess
- Thieves want to take her away
- Your castle has a weakness “dead” zones
- You guard them mitigation
- Threat modeling software project
- What are you building? data flow diagram
- Decomposition roles User Roles Name Description Authentication Admin Administrators have complete and unrestricted access to Notices, Partner Accounts and Logs. Windows Partner Partners can create, read and update Notices. Basic User Users can read and update Notices. Forms Service Roles Name Description Authentication APP Role Identity APP is running as. Windows Integrated (ApplicationPoolIndentity) SVC Role Identity SVC is running as. Windows Integrated (Local System) MSMQ Role Identity MSMQ is running as. Windows Integrated (Network Service)
- Decomposition (2) components Components Name Roles Type Run As Communication Channel Technology Uses APP Admin User Website APP Role HTTPS C#, ASP.NET MVC 5 Cryptography, File I/O API Partner Website API Role HTTPS C#, ASP.NET MVC 5 Cryptography, File I/O SVC MSMQ Windows Service SVC Role TCP/IP C# Cryptography, File I/O
- Decomposition (3) data Data Name Description Data Elements Data Stores Form Defines structure of a Notice Fields Database Access Control Role Access Control Remarks Admin C R U D Partner R Limited information. Form must be published. User
- What can go wrong? card games
- What can go wrong? (2) checklists CAPEC https://capec.mitre.org/data/index.html OWASP ASVS https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification... OWASP AppSensor https://www.owasp.org/index.php/AppSensor_DetectionPoints
- How to prioritize? convert threat to risk Risk Loss event frequence Loss magnitude Threat event frequence prob. Threat agent actions result in loss
- How to mitigate? raise the cost Time Skills Money etc. capability
- How to make it work for you? Practice Experience Reflection Theory find your own way
- Books FAIR STRIDE PASTA
- Resources OWASP Cornucopia https://www.owasp.org/index.php/OWASP_Cornucopia EoP Card Game https://www.microsoft.com/en-us/SDL/adopt/eop.aspx STRIDE http://blogs.microsoft.com/cybertrust/2007/09/11/stride-chart FAIR http://www.risklens.com/what-is-fair SAFECode http://www.safecode.org/publications
- QA
Anzeige