Tagged Questions

The process of describing possible threats and analyzing their possible affect on target systems.

learn more… | top users | synonyms

0
votes
1answer
123 views

Installed some software over a public insecure wireless network — should I consider myself compromised?

A couple months earlier, I made the mistake of downloading some software over an insecure wireless network and running it without checking its integrity. I am now considering reinstalling my system, ...
7
votes
1answer
83 views

What considerations should apply for self service Renewing, Revoking, or Unrevoking a certificate?

I need to design a self service portal for renewing, revoking, and unrevoking a certificate and have come up with the following rules*: Renewal Certificates have a short term validity and need to ...
2
votes
1answer
101 views

Do heuristics exist for modeling the “harmlessness” of a file?

There's a file processing service that looks for some know attacks and sometimes returns messages like: Probably harmless! There are strong indicators suggesting that this file is safe to use. ...
1
vote
1answer
267 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
0
votes
4answers
282 views

Is it bad practice to use the same password on different sites?

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same ...
1
vote
1answer
132 views

Uses of Threat Modeling outside of application development?

Is threat modeling useful outside of application development? Is it a useful tool for doing operational assessments of information systems already in existence? I am confused how threat modeling ...
2
votes
1answer
295 views

Can malicious phone software mount a MITM attack on a phone call?

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root. If I'm on ...
1
vote
2answers
97 views

Malware for testing [duplicate]

IS there websites and places where you can download all types of malware that you can run and test the security setup of your system? I am currently playing around with UAC+EMET4+MSE and would like ...
1
vote
1answer
264 views

Why do we need to differenciate between External Interactor and a Process?

In MS SDL Threat Modeling, there is an External Interactor and Process. While the meaning clearly shows a difference between them, when threat modeling, one can't really threat model an external ...
5
votes
1answer
350 views

Dataflow diagram - how far do I need to drill down?

I'm trying to create a DFD for a threat modeling exercise. How much detail should I get into? The SDL Threat Modeling guidelines state that I know that my DFD needs more detail when there is still ...
3
votes
1answer
356 views

Does anyone know how to use TRIKE?

TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real ...
1
vote
0answers
34 views

What is the smallest possible Windows shellcode? [duplicate]

Possible Duplicate: Are there any tools that focus on shellcode analysis? Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
6
votes
4answers
357 views

Worst case scenario of having the ability to remotely write files to disk as admin

I'm working on creating a program ("My Program") that will communicate with another program ("Their Program") via XML commands over a raw TCP/IP connection. Their program allows files to be written to ...
2
votes
2answers
249 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
1
vote
2answers
320 views

What is the best book on threat modeling that you've read? [closed]

I have been involved with developing threat models for several software products and features, and I'd like to formalize this process a little bit and create some documentation for my company's devs. ...
3
votes
2answers
117 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
1
vote
1answer
160 views

What would be good resources to conduct Technical Impact Analysis?

As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as: https://www.owasp.org/index.php/Top_10_2010-A1 Similarly, CAPEC list impact in ...
3
votes
1answer
105 views

How and where to begin on the Return of Web Application Security Investment?

While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce. What ...
8
votes
3answers
197 views

would threat modeling help in scanning code?

threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
3
votes
2answers
434 views

Secure Software Development

I'm researching models on building security into the SDLC and so far have come across: BSIMM Microsoft SDL Open SAMM Are there any other documents and resources to look into? Specific tools that ...
3
votes
1answer
205 views

Finding an up to date website with detailed information on viruses

Is there a website with the ability to search through viruses that will return detailed information on them? I can't seem to find one and I'm tired of only getting forums when I search for a specific ...
4
votes
2answers
321 views

Is there a superior approach for threat modeling?

There are at least three different common approaches to creating a threat model: Attacker-centric Software-centric Asset-centric You can take a look at Wikipedia for a quick overview. I wonder if ...
2
votes
1answer
612 views

Minimum credential for WMI parameters Monitoring?

I'm developing a big project to monitor a remote machine's performance parameters like CPU, memory, disk space, and etc. through C# WMI. I want to use the minimum possible credentials to connect the ...
3
votes
3answers
258 views

Where can I find a collection of Threat Models?

I found a very nice SSL Threat model on this web page and would like to find more on different topics. How would I go about locating more images like these? Is there an organisation or website I ...
3
votes
2answers
144 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and ...
9
votes
2answers
5k views

How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?

Practically speaking, how easy difficult is it to spoof DNS? What scenarios are more risky than others? For example: A phishing email or twitter link that attracts users to click a hyperlink A ...
7
votes
5answers
771 views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
5
votes
1answer
100 views

Modeling vectors of an unknown exploit

Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an ...
20
votes
3answers
1k views

Help me find a lightweight threat modeling framework

We're a small company and we do not have resources that we can dedicate to heavyweight threat modeling. However, if we could find a threat modeling framework that was pretty lightweight I think there ...
5
votes
3answers
737 views

How to use and create attack graphs

I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I ...