Upload File

threat modeling: security development lifecycle

5
Threat Modeling: Security Development Lifecycle Tyrell Flurry Jeff Thomas Akhil Oniha

Upload: questa

Post on 05-Jan-2016

27 views

Category:

Documents


0 download

Report

DESCRIPTION

Threat Modeling: Security Development Lifecycle. Tyrell Flurry Jeff Thomas Akhil Oniha. What is Threat Modeling?. - PowerPoint PPT Presentation

TRANSCRIPT

Page 1: Threat Modeling: Security Development Lifecycle

Threat Modeling:Security Development Lifecycle

Tyrell FlurryJeff ThomasAkhil Oniha

Page 2: Threat Modeling: Security Development Lifecycle

What is Threat Modeling?

• An engineering technique used to aid in the identification of assets, vulnerabilities, threats, attacks and countermeasures for a given system or software. Threat modeling helps to:

• Identify security objectives.• Identify threats.• Identify vulnerabilities and countermeasures

Page 3: Threat Modeling: Security Development Lifecycle

Why Microsoft SDL?

• Threat modeling is a complex task that few individuals can properly execute

• Software architects are generally more concerned with operation and performance than security

• Microsoft SDL transforms threat modeling into an activity that any software architect can perform effectively

Page 4: Threat Modeling: Security Development Lifecycle

How Does Microsoft SDL work?

• Microsoft based application must be used on Microsoft OS and requires Microsoft Visio for diagramming system

• Step 1: Diagram/whiteboard system• Step 2: Identify Threats (STRIDE approach)• Step 3: Identify Mitigation Strategies• Step 4: Validate system and repeat

Page 5: Threat Modeling: Security Development Lifecycle

Our Approach

• Utilize the Microsoft SDL to analyze the threats faced by a fictitious bank’s online banking application.

• Whiteboard system Level 0 DFD• Utilize Microsoft SDL to identify threats that

face each component/element of the DFD• Establish appropriate mitigation strategies


Adam Shostack Microsoft - LayerOne...Threat Modeling (Swiderski and Snyder, Microsoft Press) "Guerilla Threat Modeling" (Torr) Patterns and Practices (J.D. Meier) Threat modeling for

RISIKEN EFFEKTIV MINIMIEREN MIT THREAT LIFECYCLE … · RISIKEN EFFEKTIV MINIMIEREN MIT THREAT LIFECYCLE MANAGEMENT Verhindern Sie folgenschwere Datenpannen durch schnelleres Erkennen

Threat Modeling - ISACA

Analytical Lifecycle Modeling and Threat Analysis of Botnets · 2018-12-31 · Analytical Botnet Expansion/Lifecycle Models Our Modeling echniquesT Modeling echniquesT and Assumptions

threat modeling - SecAppDev Peeters/threat... · threat modeling Johan Peeters ... threat model looks out: adversaries ... assignment I who are the potential adversaries?

Security Threat Modeling

Threat Modeling for Automotive Security Analysisonlinepresent.org/proceedings/vol139_2016/68.pdf · Threat Modeling for Automotive Security Analysis ... threat modeling STRIDE method

Lifecycle of an advanced persistent threat

Threat Modeling - GBV

Threat Modeling (Part 4)

NET3389BUS Integrating Threat Defense Lifecycle or ... · Integrating Threat Defense Lifecycle Security Services with ... •This overview of new technology represents no commitment

Take Control of the Endpoint Threat Defense Lifecycle

…using threat lifecycle management to defeat insider ...€¦ · Threat lifecycle management technology has a core place in their strategies. This document discusses how security

Threat Modeling: Security Development Lifecycle

Security for Developers Threat Modeling and the Security Development Lifecycle Steven Borg & Richard Hundhausen Accentient, Inc

Application Threat Modeling

THE THREAT LIFECYCLE MANAGEMENT FRAMEWORK€¦ · PAGE 3 THE THREAT LIFECYCLE MANAGEMENT FRAMEWOR Preface Globally, sophisticated cyber-attacks are compromising organizations at an

Threat Modeling - home.eng.iastate.edu

Threat Modeling / iPad

Threat Modeling And Analysis

Threat Modeling with STRIDE - Concordia Universityusers.encs.concordia.ca/~clark/courses/1601-6150/scribe/L04c.pdf · Threat Modeling with STRIDE Slides adapted from Threat Modeling:

Presenter Name Date Introduction to Microsoft ® Security Development Lifecycle (SDL) Threat Modeling Secure software made easier

Reverse Threat Modeling

Cloud Threat Modeling

Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Threat Modeling for Mobile Health Systems · Threat Modeling Overview TLP: WHITE, ID# 202004301030 • Threat modeling is an important aspect of the security development lifecycle,

Cryptocurrency-based Systems Threat Modeling for · Threat Modeling and Cryptocurrencies Threat modeling is an essential step in secure systems design. Explore the threat space to

DNS Threat Modeling - OWASP · Threat Modeling Using STRIDE By: Girindro Pringgo Digdo, ... Threat Modeling Diagram Identify Threats Identify Threats Mitigate Validate STRIDE Trike

Lifecycle Modeling Language (LML) SPECIFICATION

Microsoft® Security Development Lifecycle (SDL) Threat Modeling · 2009-12-04 · Microsoft® Security Development Lifecycle (SDL) Threat Modeling Securitybyte & OWASP Confidential

Advanced Threat Protection Lifecycle Infographic

Threat Modeling (Part 1)

Threat Modeling (Part 3)

Tactical Threat Modeling - SAFECode · Tactical Threat Modeling

Threat Modeling - Overview