Scribd Logo
Upload

Welcome to Scribd!

  • Threat Modeling Framework

    Uploaded by

    عطاف أبو هدة
    12 views13 pages
    The document outlines the STRIDE threat modeling framework which identifies six categories of threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. For each threat, it describes how to prevent it and lists common security controls to reduce or eliminate the risk, such as authentication, encryption, access control lists, and digital signatures.

    Original Description:

    Copyright

    © © All Rights Reserved

    Available Formats

    PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    Report this Document
    The document outlines the STRIDE threat modeling framework which identifies six categories of threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. For each threat, it describes how to prevent it and lists common security controls to reduce or eliminate the risk, such as authentication, encryption, access control lists, and digital signatures.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    12 views13 pages

    Threat Modeling Framework

    Uploaded by

    عطاف أبو هدة
    The document outlines the STRIDE threat modeling framework which identifies six categories of threats: Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege. For each threat, it describes how to prevent it and lists common security controls to reduce or eliminate the risk, such as authentication, encryption, access control lists, and digital signatures.

    Copyright:

    © All Rights Reserved
    Download as PDF, TXT or read online from Scribd
    Flag for inappropriate content
    Download as pdf or txt
    of 13

    Threat modeling framework

    STRIDE
    Spoofing
    pretending to be someone or something else
    How to prevent Spoofing

    Authentication verifies that users and systems are who they claim to be.

    Common security controls to reduce or eliminate risk:

    For your data:


    • Hashes
    For your system:
    • User Authentication
    • Cookie Authentication
    • SSL/TLS
    • Certificates
    Tampering
    changing data without authorization
    How to prevent Tampering

    Integrity prevents data from being maliciously modified.

    Common security controls to reduce or eliminate risk


    • Access control lists (ACL)
    • Validating input to prevent the processing of malicious payloads
    • Using SSL/TLS to secure transmission
    Repudiation
    not claiming responsibility for an action taken
    How to prevent Repudiation

    Non-repudiation ensures each action can be traced back to its origin by creating and
    protecting security logs.

    Common security controls to reduce or eliminate risk


    • Strong authentication
    • Secure logging and monitoring
    • Digital signatures
    • Secure timestamps
    • Trusted third parties
    Information disclosure
    seeing data I am not supposed to see
    How to prevent Information disclosure

    Confidentiality ensures data is protected.

    Common security controls to reduce or eliminate risk


    • Encryption
    • Access Control Lists (ACL)
    • Enforcing SSL/TLS to secure transmission
    Denial of Service
    overwhelming the system
    How to prevent Denial of Service

    Availability ensures your system is up and running for users.

    Common security controls to reduce or eliminate risk


    • Access control lists (ACL)
    • Filtering
    • Quotas
    • Authorization
    • High availability
    Elevation of privilege
    having permissions I should not have
    How to prevent Elevation of privilege

    Authorization ensures users have proper permissions.

    Common security controls to reduce or eliminate risk


    • Access-control lists (ACL)
    • Role-based access controls (RBAC)
    • Group-based access
    • Permissions
    • Input validation

    You might also like