11. Decomposition
roles
User Roles
Name Description Authentication
Admin Administrators have complete and unrestricted access to Notices, Partner Accounts and Logs. Windows
Partner Partners can create, read and update Notices. Basic
User Users can read and update Notices. Forms
Service Roles
Name Description Authentication
APP Role Identity APP is running as. Windows Integrated (ApplicationPoolIndentity)
SVC Role Identity SVC is running as. Windows Integrated (Local System)
MSMQ Role Identity MSMQ is running as. Windows Integrated (Network Service)
12. Decomposition (2)
components
Components
Name Roles Type Run As Communication Channel Technology Uses
APP Admin
User
Website APP Role HTTPS C#, ASP.NET MVC 5 Cryptography,
File I/O
API Partner Website API Role HTTPS C#, ASP.NET MVC 5 Cryptography,
File I/O
SVC MSMQ Windows
Service
SVC Role TCP/IP C# Cryptography,
File I/O
13. Decomposition (3)
data
Data
Name Description Data Elements Data Stores
Form Defines structure of a Notice Fields Database
Access Control
Role Access Control Remarks
Admin C R U D
Partner R Limited information. Form must be published.
User
15. What can go wrong? (2)
checklists
CAPEC
https://capec.mitre.org/data/index.html
OWASP ASVS
https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification...
OWASP AppSensor
https://www.owasp.org/index.php/AppSensor_DetectionPoints
16. How to prioritize?
convert threat to risk
Risk
Loss event
frequence
Loss
magnitude
Threat event
frequence
prob. Threat agent actions
result in loss
