The process of describing possible threats and analyzing their possible affect on target systems.

learn more… | top users | synonyms

0
votes
1answer
33 views

Threat Modelling Examples (Distributed Systems)

I have threat modelled applications in the past, but I'd like to threat model a distributed system. However for other people I'm with, who have never done it at all, I'd like to check out some ...
0
votes
1answer
25 views

Threat modeling a network monitoring software

Assume a network fault monitoring tools is deployed to monitor a subset of routers. What an attacker can do by exploiting a network monitoring system like OpenNMS? Can they learn about the topology ...
5
votes
2answers
140 views

Mitigating forensic memory acquisition when an attacker has physical access to a workstation

My question regards whether or not the mitigations I use are appropriate for my threat model. Please don't jump to conclusions and say "you need to use locks" or "you can't leave your computer ...
1
vote
1answer
37 views

Threat modeling: why would a https remote endpoint be prone to privilege escalation?

I'm currently creating a threat model for a web application and have a http proxy at the edge of the trusted network. It's communicating with Google Maps via the API, using a https connection; so this ...
1
vote
0answers
36 views

Identifying recon in web

I recently deployed mod_security module in my Apache Web Server. I know the OWASP CRS rules include tags to categorize attacks but I want to make higher level categories, particularly to identify ...
5
votes
2answers
657 views

Dataflow diagram - how far do I need to drill down?

I'm trying to create a DFD for a threat modeling exercise. How much detail should I get into? The SDL Threat Modeling guidelines state that I know that my DFD needs more detail when there is still ...
3
votes
2answers
113 views

How can i demonstrate remote file inclusion via get methods

I have been testing my PHP web application for RFI vulnerabilities. While performing scan I was able perform RFI in my web application. Scenario: In my web application RFI works only when the user's ...
4
votes
3answers
282 views

What use does a BIOS/EFI password have?

I have become quite a password-obsessed individual. I password-protect my HDDs, my files, and now even the BIOS/EFI on the various systems I own. But I have discovered that if you forget your BIOS ...
1
vote
0answers
27 views

Informational security model models and life-cycle

NSM model from sans.org is vendor neutral,that's good, but I need more detail and complexity model. Don't want to invent a bicycle and looking for complete solution in this field.Looking not for blog ...
3
votes
1answer
83 views

Is There a Library of Well Known Threat/Attack Trees?

[I'm surprised that my searches didn't find this questions before, but then I may just not be asking it "the right way."] A project I am on is starting to look a threat trees for a connected piece of ...
36
votes
3answers
2k views

Evaluating the security of home security cameras

My parents have a vacation home out in the country and are looking to setup a home surveillance system for remote viewing. I've heard that there can be serious vulnerabilities in these products. What ...
0
votes
2answers
78 views

Modular security for a photography UAV?

Is modular security possible? In the context of an embedded device, is it possible to create an add-in module that will be responsible for both communications and security, with his role being ...
1
vote
1answer
45 views

Security evaluation terminology

I'm learning about Protection Profiles, Security Targets and Target of Evaluations, and these all seem like very abstract ideas to me. Could someone explain with examples how these work in practice? ...
6
votes
2answers
98 views

Is there a formal common Internet threat model?

I'm looking for a common Internet threat model that describes active attacks formally. By active attacks I mean attacks of an attacker with literally unlimited resources and full control over the ...
1
vote
3answers
208 views

Why would a replay attack be considered a threat to integrity and not confidentiality?

I came across a test where the instructions were to circle all the correct answers. I'm looking for an explanation to the answer for this question: Question: a replay attack is a threat against ...
5
votes
2answers
127 views

Threat modeling

During the design phase, which is better, identifying the security mechanisms and techniques that will be used to protect the system (such as selecting the suitable encryption algorithm) before ...
2
votes
2answers
144 views

Connection between “Security Requirements Engineering”, “Risk Analysis” and “Threat Modeling”

I am trying to figure out how the above concepts fit in together. As i understood it Security Requirements Engineering (SRE), Risk Analysis (RA) and Threat Modeling (TM) are methods that ultimately ...
3
votes
2answers
507 views

What is a threat tree in threat modeling?

The OWASP Application Threat Modeling, quoting step 2 says specifically: These threats can be identified further as the roots for threat trees; there is one tree for each threat goal. what is ...
4
votes
3answers
63 views

Is there a process to identify threats related to a deployments?

I read about application threat modeling which makes a software products secure from its initial stages (SDLC). But if we do something wrong in the deployment phase still that will be an issue. For ...
23
votes
7answers
3k views

When do honest people need privacy or anonymity? (e.g. they have nothing to hide) [closed]

I'm having a discussion with someone who thinks they don't need technical measures of privacy or anonymity. Common arguments against needing to care about privacy or anonymity include: Everything ...
1
vote
1answer
166 views

Why doesn't TLS have a threat model?

I was looking at the TLS 1.2 RFC and I see no official "threat model". I've looked a bit around and no sign of it. How come TLS has no threat model?
3
votes
2answers
309 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
2
votes
2answers
480 views

Threat modelling tools and alternative threats

From looking at threat modelling tools which are available (Microsoft SDL for Threat Modelling is probably the prime example) they seem to consider only threats at a low level, and I get the feeling ...
0
votes
1answer
130 views

Threat Modelling Application Decomposition

I am doing a piece of work on a imaginary device which allows the user to lock/unlock their vehicle and access a wireless hotspot in their car using an application on their smartphone via bluetooth. ...
1
vote
3answers
357 views

Installed some software over a public insecure wireless network — should I consider myself compromised?

A couple months earlier, I made the mistake of downloading some software over an insecure wireless network and running it without checking its integrity. I am now considering reinstalling my system, ...
4
votes
3answers
645 views

Is there any way of preventing (or punishing) abuse of anonymity networks? [closed]

Anonymity services/networks like Tor, VPNs that don't log etc., seem like very double edged swords. Is there any way to prevent people with bad intentions (like breaking the law) from using them or ...
5
votes
1answer
2k views

Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?

Let's say I am browsing the Internet using Tor - visiting https://example.com/login.php - and the NSA is operating the Tor exit node which I am currently routed to use. Can that NSA exit relay swap ...
6
votes
8answers
462 views

What are the benefits of encryption for everyday people?

In addition to the fact that encryption systems like PGP are notoriously difficult to use, and that encryption doesn't always jive with cloud-based services like webmail, the fact is that most people ...
8
votes
1answer
138 views

What considerations should apply for self service Renewing, Revoking, or Unrevoking a certificate?

I need to design a self service portal for renewing, revoking, and unrevoking a certificate and have come up with the following rules*: Renewal Certificates have a short term validity and need to ...
1
vote
1answer
604 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
2
votes
1answer
208 views

Do heuristics exist for modeling the “harmlessness” of a file?

There's a file processing service that looks for some know attacks and sometimes returns messages like: Probably harmless! There are strong indicators suggesting that this file is safe to use. ...
0
votes
4answers
1k views

Is it bad practice to use the same password on different sites?

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same ...
2
votes
1answer
235 views

Uses of Threat Modeling outside of application development?

Is threat modeling useful outside of application development? Is it a useful tool for doing operational assessments of information systems already in existence? I am confused how threat modeling ...
2
votes
1answer
524 views

Can malicious phone software mount a MITM attack on a phone call?

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root. If I'm on ...
1
vote
2answers
141 views

Malware for testing [duplicate]

IS there websites and places where you can download all types of malware that you can run and test the security setup of your system? I am currently playing around with UAC+EMET4+MSE and would like ...
1
vote
1answer
562 views

Why do we need to differenciate between External Interactor and a Process?

In MS SDL Threat Modeling, there is an External Interactor and Process. While the meaning clearly shows a difference between them, when threat modeling, one can't really threat model an external ...
3
votes
1answer
599 views

Does anyone know how to use TRIKE?

TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real ...
1
vote
0answers
35 views

What is the smallest possible Windows shellcode? [duplicate]

Possible Duplicate: Are there any tools that focus on shellcode analysis? Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
6
votes
4answers
370 views

Worst case scenario of having the ability to remotely write files to disk as admin

I'm working on creating a program ("My Program") that will communicate with another program ("Their Program") via XML commands over a raw TCP/IP connection. Their program allows files to be written to ...
1
vote
2answers
446 views

What is the best book on threat modeling that you've read? [closed]

I have been involved with developing threat models for several software products and features, and I'd like to formalize this process a little bit and create some documentation for my company's devs. ...
3
votes
2answers
133 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
1
vote
1answer
177 views

What would be good resources to conduct Technical Impact Analysis?

As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as: https://www.owasp.org/index.php/Top_10_2010-A1 Similarly, CAPEC list impact in ...
8
votes
5answers
940 views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
3
votes
1answer
151 views

How and where to begin on the Return of Web Application Security Investment?

While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce. What ...
9
votes
3answers
256 views

would threat modeling help in scanning code?

threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
3
votes
2answers
638 views

Secure Software Development

I'm researching models on building security into the SDLC and so far have come across: BSIMM Microsoft SDL Open SAMM Are there any other documents and resources to look into? Specific tools that ...
3
votes
3answers
437 views

Where can I find a collection of Threat Models?

I found a very nice SSL Threat model on this web page and would like to find more on different topics. How would I go about locating more images like these? Is there an organisation or website I ...
22
votes
3answers
2k views

Help me find a lightweight threat modeling framework

We're a small company and we do not have resources that we can dedicate to heavyweight threat modeling. However, if we could find a threat modeling framework that was pretty lightweight I think there ...
4
votes
2answers
550 views

Is there a superior approach for threat modeling?

There are at least three different common approaches to creating a threat model: Attacker-centric Software-centric Asset-centric You can take a look at Wikipedia for a quick overview. I wonder if ...
3
votes
1answer
241 views

Finding an up to date website with detailed information on viruses

Is there a website with the ability to search through viruses that will return detailed information on them? I can't seem to find one and I'm tired of only getting forums when I search for a specific ...