1

I would like to know if anyone of you has already read about some models that would classify a set of possible countermeasures against a family of vulnerabilities.

What I mean by a 'family of vulnerabilities' is, for example, vulnerabilities that would allow an attacker to realize a denial of service. The countermeasure to such vulnerabilities is generally the same, or at least in the same class of countermeasure. Of course, this requires a bit of abstraction and generalization, but I believe this to exist, even if I didn't find anything yet.

This could be presented in very high level way such as: software vulnerabilities are solved by this kind of countermeasures and hardware vulnerabilities by this kind. Or in more in-depth ways.

STRIDE is the closet of what I am looking for so far, but there is no discussion on what countermeasure can be used against a particular threat. So if you guys know anything that is a serious track (scientific publication) or that is well used (standard?), I would appreciate some sharing :)

0

As far as generic classification of countermeasures can be practiced, you can follow any secure coding guidelines (such as owasp secure coding guideline Reference #1 ) and rest of the countermeasures will be taken care by the generic modern compilers and interpreters.

To know more about the family of vulnerability being exploited MITRE ATT&CK Framework looks a great option as is "a very granular model of what attackers do after they break in" Reference #2 , it can provide you the context for your vulnerability so that the developer can understand the bug and build specialized countermeasures.

  • I didn't know about this MITRE framework. I didn't retain OWASP because it is very unformal. – Ecterion Jan 15 at 6:38
  • Please elaborate on how did you found OWASP to be unformal ? – Aayush Jan 15 at 11:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.