The process of describing possible threats and analyzing their possible affect on target systems.

learn more… | top users | synonyms

20
votes
3answers
1k views

Help me find a lightweight threat modeling framework

We're a small company and we do not have resources that we can dedicate to heavyweight threat modeling. However, if we could find a threat modeling framework that was pretty lightweight I think there ...
8
votes
3answers
183 views

would threat modeling help in scanning code?

threat modeling would definitely help in determining the test cases and where to fuzz but my question is specific to code scanning. Would threat modeling help in focusing/prioritizing or any way ...
8
votes
2answers
4k views

How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?

Practically speaking, how easy difficult is it to spoof DNS? What scenarios are more risky than others? For example: A phishing email or twitter link that attracts users to click a hyperlink A ...
7
votes
5answers
695 views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
6
votes
4answers
342 views

Worst case scenario of having the ability to remotely write files to disk as admin

I'm working on creating a program ("My Program") that will communicate with another program ("Their Program") via XML commands over a raw TCP/IP connection. Their program allows files to be written to ...
5
votes
3answers
667 views

How to use and create attack graphs

I am trying to learn more about attack graphs and how they can be used. I have read a little bit about them from some simple Google searches and believe that they could be a useful tool for work. I ...
5
votes
1answer
92 views

Modeling vectors of an unknown exploit

Looking for a formula and parameters to feed it that will aid in the isolation of relationships within a system when the origin and cause of an exploit within it is unknown. Here's an example of an ...
5
votes
1answer
259 views

Dataflow diagram - how far do I need to drill down?

I'm trying to create a DFD for a threat modeling exercise. How much detail should I get into? The SDL Threat Modeling guidelines state that I know that my DFD needs more detail when there is still ...
4
votes
2answers
277 views

Is there a superior approach for threat modeling?

There are at least three different common approaches to creating a threat model: Attacker-centric Software-centric Asset-centric You can take a look at Wikipedia for a quick overview. I wonder if ...
3
votes
3answers
236 views

Where can I find a collection of Threat Models?

I found a very nice SSL Threat model on this web page and would like to find more on different topics. How would I go about locating more images like these? Is there an organisation or website I ...
3
votes
2answers
370 views

Secure Software Development

I'm researching models on building security into the SDLC and so far have come across: BSIMM Microsoft SDL Open SAMM Are there any other documents and resources to look into? Specific tools that ...
3
votes
2answers
130 views

Need an overview of web service / web site security world, where do I start? [duplicate]

Possible Duplicate: Resources to learn about security I'd like to get a good understanding of modern issues in web security and get insight into what it takes to keep your sites and ...
3
votes
2answers
115 views

Vertical information portal security with a customized web browser

I am creating a SaaS that will be delivered through a Vertical Information Portal (VIP). In my research I have found that by developing a custom lean web browser and installing it on the clients ...
3
votes
1answer
185 views

Finding an up to date website with detailed information on viruses

Is there a website with the ability to search through viruses that will return detailed information on them? I can't seem to find one and I'm tired of only getting forums when I search for a specific ...
3
votes
1answer
92 views

How and where to begin on the Return of Web Application Security Investment?

While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce. What ...
3
votes
1answer
273 views

Does anyone know how to use TRIKE?

TRIKE is an open source threat modeling methodology and tool, as presented by the authors. After i tried several threat modeling tools and methodologies, I have the feeling that it is the only real ...
2
votes
1answer
199 views

Can malicious phone software mount a MITM attack on a phone call?

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root. If I'm on ...
2
votes
2answers
230 views

Security model for datacenters

I have several datacentres and now I want to plan security for it, so it's resilient to external attacks. I need to make a security model which will cover my web servers, auth servers, log servers, ...
2
votes
1answer
484 views

Minimum credential for WMI parameters Monitoring?

I'm developing a big project to monitor a remote machine's performance parameters like CPU, memory, disk space, and etc. through C# WMI. I want to use the minimum possible credentials to connect the ...
1
vote
1answer
134 views

why gmail's phone verification code not encrypted

while using google's phone verification code system, i have noticed that google phone verification code is always 6 digits cant it be brute forced for randomly generating the 6 digits?is it there any ...
1
vote
2answers
279 views

What is the best book on threat modeling that you've read? [closed]

I have been involved with developing threat models for several software products and features, and I'd like to formalize this process a little bit and create some documentation for my company's devs. ...
1
vote
1answer
84 views

Uses of Threat Modeling outside of application development?

Is threat modeling useful outside of application development? Is it a useful tool for doing operational assessments of information systems already in existence? I am confused how threat modeling ...
1
vote
1answer
144 views

Why do we need to differenciate between External Interactor and a Process?

In MS SDL Threat Modeling, there is an External Interactor and Process. While the meaning clearly shows a difference between them, when threat modeling, one can't really threat model an external ...
1
vote
1answer
124 views

What would be good resources to conduct Technical Impact Analysis?

As continuing research in Secure Software Development, I found the OWASP Top 10 project list Technical Impact such as: https://www.owasp.org/index.php/Top_10_2010-A1 Similarly, CAPEC list impact in ...
1
vote
2answers
72 views

Malware for testing [duplicate]

IS there websites and places where you can download all types of malware that you can run and test the security setup of your system? I am currently playing around with UAC+EMET4+MSE and would like ...
1
vote
0answers
32 views

What is the smallest possible Windows shellcode? [duplicate]

Possible Duplicate: Are there any tools that focus on shellcode analysis? Any tools available that is for shellcode analysis? what methods are used in reverse engineering?
0
votes
4answers
94 views

Is it bad practice to use the same password on different sites?

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same ...