The process of describing possible threats and analyzing their possible affect on target systems.
5
votes
1answer
122 views
Dataflow diagram - how far do I need to drill down?
I'm trying to create a DFD for a threat modeling exercise. How much detail should I get into?
The SDL Threat Modeling guidelines state that I know that my DFD needs more detail when there is still ...
3
votes
1answer
139 views
Does anyone know how to use TRIKE?
TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real ...
1
vote
0answers
29 views
What is the smallest possible Windows shellcode? [duplicate]
Possible Duplicate:
Are there any tools that focus on shellcode analysis?
Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
6
votes
4answers
314 views
Worst case scenario of having the ability to remotely write files to disk as admin
I'm working on creating a program ("My Program") that will communicate with another program ("Their Program") via XML commands over a raw TCP/IP connection. Their program allows files to be written to ...
2
votes
2answers
177 views
Security model for datacenters
I have several datacentres and now I want to plan security for it, so it's resilient to external attacks.
I need to make a security model which will cover my web servers, auth servers, log servers, ...
1
vote
2answers
179 views
What is the best book on threat modeling that you've read? [closed]
I have been involved with developing threat models for several software products and features, and I'd like to formalize this process a little bit and create some documentation for my company's devs. ...
3
votes
2answers
108 views
Vertical information portal security with a customized web browser
I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP).
In my research I have found that by developing a custom lean web browser and installing it on the clients ...
1
vote
1answer
87 views
What would be good resources to conduct Technical Impact Analysis?
As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as:
https://www.owasp.org/index.php/Top_10_2010-A1
Similarly, CAPEC list impact in ...
3
votes
1answer
76 views
How and where to begin on the Return of Web Application Security Investment?
While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce.
What ...
8
votes
3answers
154 views
would threat modeling help in scanning code?
threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
3
votes
2answers
301 views
Secure Software Development
I'm researching models on building security into the SDLC and so far have come across:
BSIMM
Microsoft SDL
Open SAMM
Are there any other documents and resources to look into? Specific tools that ...
3
votes
1answer
147 views
Finding an up to date website with detailed information on viruses
Is there a website with the ability to search through viruses that will return detailed information on them? I can't seem to find one and I'm tired of only getting forums when I search for a specific ...
4
votes
2answers
205 views
Is there a superior approach for threat modeling?
There are at least three different common approaches to creating a threat model:
Attacker-centric
Software-centric
Asset-centric
You can take a look at Wikipedia for a quick overview.
I wonder if ...
2
votes
1answer
269 views
Minimum credential for WMI parameters Monitoring?
I'm developing a big project to monitor a remote machine's performance parameters like CPU, memory, disk space, and etc. through C# WMI. I want to use the minimum possible credentials to connect the ...
3
votes
3answers
197 views
Where can I find a collection of Threat Models?
I found a very nice SSL Threat model on this web page and would like to find more on different topics.
How would I go about locating more images like these? Is there an organisation or website I ...
2
votes
2answers
112 views
Need an overview of web service / web site security world, where do I start? [duplicate]
Possible Duplicate:
Resources to learn about security
I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and ...
6
votes
2answers
2k views
How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?
Practically speaking, how easy difficult is it to spoof DNS?
What scenarios are more risky than others? For example:
A phishing email or twitter link that attracts users to click a hyperlink
A ...
5
votes
5answers
446 views
Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?
In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
5
votes
1answer
87 views
Modeling vectors of an unknown exploit
Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an ...
21
votes
3answers
1k views
Help me find a lightweight threat modeling framework
We're a small company and we do not have resources that we can dedicate to heavyweight threat modeling. However, if we could find a threat modeling framework that was pretty lightweight I think there ...
5
votes
3answers
568 views
How to use and create attack graphs
I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I ...
