Questions tagged [threat-modeling]

The process of describing possible threats and analyzing their possible affect on target systems.

Filter by
Sorted by
Tagged with
1
vote
0answers
46 views

Threat Modeling and Risk Assessment Effort Estimation [closed]

is there any way to have a good effort time estimation of a Threat Modeling and Risk Assessment activity for an internal infrastructure (about 30 active nodes)? In general, is it possible to find a &...
0
votes
0answers
39 views

Threat model for recently connected device on my network

I have a macbook pro work device (work has root access) connected to my local network. It is the only machine on my network at the time I'm working. After work, I disconnect the macbook, I factory ...
2
votes
1answer
153 views

What is the difference between ATT&CK and CAPEC?

My question is on Cyber Threat Intelligence (CTI). I want to know the difference between Attack Patterns (as in MITRE CAPEC) and Tactics, Techniques and Procedures (as in MITRE ATT&CK). They both ...
0
votes
0answers
32 views

Is there anyone that provide live cyber attacks happening using API?

There are alot of vendors that provide live cyber attacks happening with the attack geolocation I.e Kaspersky, fireeye, sonicwall and etc... but I couldn't find either of these to have an API to ...
2
votes
1answer
74 views

Password salting vs. length extension attacks

I read that when salting passwords, it is advised to use a h(pwd||salt) construction instead of h(salt||pwd), the latter being vulnerable to a length extension attack. What are possible scenarios in ...
3
votes
0answers
38 views

Threat / Adversary / Trust / Security model, what is the difference?

In order to design and develop a secure system it is important to formulate a threat/adversary/trust/security model for the corresponding system to be able to evaluate the proposed system and help ...
0
votes
1answer
65 views

Are security controls themselves considered assets (e.g., cryptographic keys)

Looking at a plain system (there are no security controls implemented yet), we need to think about its functions and derive appropriate assets which we'd like to protect in order to ensure the system ...
0
votes
0answers
46 views

MITRE ATT&CK ICS Machine readable

Could you please help me in finding a repository for MITRE ATT&CK ICS? I was wondering if the matrix, along with labels, assets and tactics was available smewhere online, perhaps in a STIX format ...
0
votes
1answer
201 views

What is the difference between “local” and “Adjacent” threat agents?

I am using CVSS to do the vulnerability assessment for my project. As per documentation here is the definition of local and adjacent Adjacent (A) The vulnerable component is bound to the network ...
0
votes
0answers
39 views

Threat Modeling : deduct threats from OWASP ASVS

Is it at all possible to deduct Threats (as in Threat Modeling) from each (or at least) most of the items in OWASP ASVS ? I heard in a webinar that for each item of this list, there is an implicit ...
5
votes
1answer
157 views

What questions are useful to scope a mobile app pen test?

When arranging a pen test it's common practice to ask the client a set of questions, and use the answers either as the basis for further discussions, or to directly provide a test plan and quotation. ...
2
votes
1answer
162 views

What is the purpose of anti-rollback protection in IoT devices?

The OWASP IoT top 10 and the ASVS appendix C warn to protect against firmware rollbacks: C.22 - Verify that the device cannot be downgraded to old versions (anti-rollback) of valid firmware. What is ...
0
votes
1answer
72 views

IT security audit : is threat modelling key to reproducible success of just following a methodology (ex : ethical hacking)

To sum up the methodology of ethical hacking, what you do is : Information gathering (gets the IP, domains, etc...) Fingerprint the IP (what OS, what services are running, etc...) Vulnerability ...
1
vote
1answer
105 views

Threat modeling for visitor access control

I am trying to understand threat modeling but it seems too elasti from restrictive requirements to general requirements. Now i am trying to understand it with some realistic examples. The first ...
61
votes
4answers
6k views

What is a threat model, and how do I make one?

I asked a question on what I need to do to make my application secure, when somebody told me: That depends on your threat model. What is a threat model? How do I make a threat model for my ...
0
votes
1answer
93 views

Household attack vectors and mitigations [closed]

Hopefully this question won't come across too closely to a which product is best as that is not my intention. I am moving into a larger property and I would like to setup some home security now i'm ...
20
votes
7answers
2k views

Could you anonymously upload a file on the internet if the threat model was the entire world trying to find your identity after you do so? [closed]

Thought experiment: You need to upload a file, and the threat model is the entire world trying to find out who you are after you do so. I know this is absurd, but bear with me, it's a thought ...
1
vote
1answer
158 views

Malware Threat Hunting in Airport Systems - KPIs/Metrics to Track [closed]

I am trying to figure out how to detect potential threats from malwares in various systems installed in the airport. To be specific, my focus is on the following systems in airports: Baggage ...
1
vote
0answers
65 views

Threat modelling workshop materials focusing on threat actor profiles [closed]

A while back I went to a threat modelling workshop that had a card deck with various actors, their motivations, and their methods. I found this extremely helpful to frame the discussion around the ...
51
votes
5answers
5k views

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

Security experts are constantly discouraging users from using SMS-based 2FA systems, usually because of worries the auth code could be intercepted by an attacker, either through a SIM swap or a MitM ...
0
votes
2answers
86 views

Password reuse for similar accounts

Assume I have two Github accounts, one for regular use and one for testing purposes. Or two PGP keys, one for pass and the other for encrypted email communication, and my backup scheme is exactly the ...
1
vote
1answer
119 views

Authorization over Internet without storing user details

We have a requirement where we are creating an user generation page over internet for various vendors. This was earlier done by our operations team on intranet. For each vendor to create a unique ID ...
1
vote
1answer
213 views

Is the zero trust approach really so safe? [closed]

Recently, I see so many emerging vendors that are advertising their use of zero-trust. What potential risks are we exposed to if we shift to zero-trust in our bank?
2
votes
2answers
102 views

Security controls around data in motion?

I am an Information Security Analyst, trying to understand the difference between data in transit and data in motion. I found the listed below definitions: Data In Transit is defined as data moving ...
1
vote
2answers
131 views

How to create non-generic security requirements for an idea phase?

Our manager often asks us for a quick understanding of what the risks will be based on some idea that the department has been working on during the ideation phase (the business requirements are ...
2
votes
1answer
89 views

How big is the man in the middle threat from outside the network when communicating on an intranet?

I know that certificates and signatures are really important for preventing Man-in-the-middle attacks, among other things. I am not concerned about a third party reading the transmission, only ...
2
votes
1answer
122 views

What are some attacks to consider in a cloud deployment? [duplicate]

I want to discuss the following scenario: I use a cloud provider like Amazon where every instance of the OS is a VM. The hypervisor launches the VMs as needed. So let's assume there are two VMs ...
-1
votes
2answers
76 views

Verify my scenario of Internet infrastructure security [closed]

I have read a bit about Internet infrastructure recently. I have figured out how the IT crimes are easy to cover and quite confident way to perform any attack without traces. I got suprised that is ...
1
vote
2answers
112 views

When are you done decomposing threats?

Our development teams are getting the hang of STRIDE threat discovery, but one issue that remains is related to threat decomposition. The way we see threat analysis is that it consists of identifying ...
125
votes
8answers
23k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
1
vote
1answer
197 views

Are unbranded home security camera secure? [closed]

I plan on buying a couple of cheap cameras for my home. I plan to put them just inside the doors like the laundry door, I won't be putting them in the bedroom or living room. My major concern is how ...
0
votes
1answer
277 views

What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?

Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational ...
0
votes
2answers
220 views

Security-wise, is an in-browser JavaScript implementation fundamentally different from a server-side language (e.g. Python) implementation?

As I understand it, JavaScript implementations running in browsers need to run untrusted code and operate on untrusted data in a secure manner. Language (e.g. Python) implementations running on a ...
2
votes
1answer
100 views

What are the risks of posting family pictures online without any access control?

What are the risks of posting family pictures online, for example on a blog site, without any access control in place? What should be my threat model? I am weary of posting (recognizable) pictures ...
3
votes
3answers
161 views

Is a threat model totally subjective or can it be based on objective guidelines?

We all know that in the security field everything depends on the threat model, which basically means you need to define who or what you are protecting from. But who should decide this, and on what ...
1
vote
1answer
191 views

Relationship between threat analysis and attack modeling

What could be the Relationship between threat analysis and attack modeling. Both are pretty close, have different perspectives but I need to know the relationships or in other words, how can they ...
4
votes
2answers
3k views

Difference between STRIDE and Mitre ATTACK

When looking at threat models I came across STRIDE (from Microsoft) and then came across Mitre ATT&CK, they seem to be different - one is a threat model and the other is a threat intelligence ...
1
vote
1answer
386 views

When to model a concept via object vs taxonomy vs galaxy in MISP?

Taxonomies in MISP are a triple of (namespace, predicate, value) referred to as "machinetags". Galaxies seem to be similar. The MISP galaxy docs state that MISP galaxy is a simple method to ...
2
votes
3answers
190 views

Convince an executive to mandate HTTPS use on Intranet web servers

I know someone who works at a medium-sized company (between 1000 and 10,000 employees) and is somewhat chagrined that several intranet Windows web servers (SharePoint, internal apps, etc.) continue to ...
3
votes
1answer
173 views

What is the risk of reusing the ATM Pin elsewhere when they tie to EMV cards?

What is the risk in the following scenario: A bank wants to use an ATM pin (debit card and/or credit card) as an additional form of authentication after the customer logs in to her online/mobile ...
1
vote
0answers
29 views

developing a metrics for prioritizing attack patterns based on a database for attack patterns(CAPEC) [closed]

I have data on attack patterns which has various attributes like severity of attack, attackers skill, attack likelihood all in the form of linguistic values like high, medium and low. I want to ...
3
votes
2answers
188 views

Granularity for data assets when determining risk during software development

We're currently constructing a security development lifecycle in our software development corporation. Our main idea is to have an asset-driven approach, where we: Enter assets into an asset ...
139
votes
12answers
32k views

Is public Wi-Fi a threat nowadays?

In my opinion, arguments we have been using for years to say that public Wi-Fi access points are insecure are no longer valid, and so are the recommended remedies (e.g. use VPN). Nowadays, most sites ...
0
votes
5answers
810 views

What is ideal way to store passwords?

I am wondering what I should do with my passwords. I have divided the accounts by importance into two groups: a) the first one which are accounts like this one I am writing from. I have set them to ...
1
vote
2answers
241 views

What threat model implies any benefit to drug dealers using candy bar dumb phones for business with iPhones for personal use?

I mean if law enforcement or other state actors are surveiling their comms, it makes sense to have it be anonymous, but I just saw a guy who was obviously a drug dealer in the underground with an ...
6
votes
2answers
509 views

How to calculate the risk rating of a feature?

I'm working on a threat modeling/architectural risk analysis (ARA) methodology for the organization I work for. Our business consists of one major product (developed by ~500 developers over a decade). ...
2
votes
0answers
241 views

How do adversary models and security types relate [closed]

Reading some questions in this forum I encountered this answer mentioning IND-CPA as a requirement for ciphers. It got me thinking about this paper I recently read, where a formal model of the Honest-...
2
votes
2answers
145 views

Surveillance threat modeling applied to social categories

I am researching users threat models for a documentary film dedicated to surveillance. The idea is to identify the threat model (asset to protect, attacker, attacker's capabilities, threat, risk of an ...
3
votes
1answer
1k views

Is Threat Risk Assessment the same as Threat Risk Modeling?

I've been asked to help fill out a survey and one of the questions is whether a Threat Risk Assessment has been performed on a blog we're setting up for a charity. The WordPress blog will use a free ...
2
votes
0answers
2k views

Microsoft Threat Modeling tool: how to avoid Spoofing of Destination Data Store

I have a threat model with a Cloud Storage entity an Managed Application which accesses it. Here is the diagram: The Microsoft Threat Modeling Tool says in the report that: Cloud Storage may be ...