Questions tagged [threat-modeling]

The process of describing possible threats and analyzing their possible affect on target systems.

Filter by
Sorted by
Tagged with
14
votes
2answers
10k views

How easy/difficult is it to spoof DNS? Are some scenarios safer/more risky than others?

Practically speaking, how easy difficult is it to spoof DNS? What scenarios are more risky than others? For example: A phishing email or twitter link that attracts users to click a hyperlink A ...
0
votes
4answers
2k views

Is it bad practice to use the same password on different sites?

Is it considered bad practice to use the same password on separate sites, if so why? Even if the passwords to a site are compromised the attacker still doesn't know the user names or sites the same ...
5
votes
2answers
852 views

Secure Software Development

I'm researching models on building security into the SDLC and so far have come across: BSIMM Microsoft SDL Open SAMM Are there any other documents and resources to look into? Specific tools that ...
28
votes
7answers
4k views

When do honest people need privacy or anonymity? (e.g. they have nothing to hide) [closed]

I'm having a discussion with someone who thinks they don't need technical measures of privacy or anonymity. Common arguments against needing to care about privacy or anonymity include: Everything ...
10
votes
3answers
1k views

What use does a BIOS/EFI password have?

I have become quite a password-obsessed individual. I password-protect my HDDs, my files, and now even the BIOS/EFI on the various systems I own. But I have discovered that if you forget your BIOS ...
138
votes
12answers
32k views

Is public Wi-Fi a threat nowadays?

In my opinion, arguments we have been using for years to say that public Wi-Fi access points are insecure are no longer valid, and so are the recommended remedies (e.g. use VPN). Nowadays, most sites ...
122
votes
8answers
21k views

Why is storing passwords in version control a bad idea?

My friend just asked me: "why is it actually that bad to put various passwords directly in program's source code, when we only store it in our private Git server?" I gave him an answer that ...
55
votes
3answers
5k views

What is a threat model, and how do I make one?

I asked a question on what I need to do to make my application secure, when somebody told me: That depends on your threat model. What is a threat model? How do I make a threat model for my ...
59
votes
1answer
4k views

What's the Impact of the CloudFlare Reverse Proxy Bug? (“#CloudBleed”)

In Project Zero #1139, it was disclosed that CloudFlare had a bug which disclosed uninitialized memory, leaking private data sent through them via SSL. What's the real impact?
6
votes
2answers
641 views

Threat modeling

During the design phase, which is better, identifying the security mechanisms and techniques that will be used to protect the system (such as selecting the suitable encryption algorithm) before ...
51
votes
5answers
5k views

Should the average user with no special access rights be worried about SMS-based 2FA being theoretically interceptable?

Security experts are constantly discouraging users from using SMS-based 2FA systems, usually because of worries the auth code could be intercepted by an attacker, either through a SIM swap or a MitM ...
7
votes
1answer
5k views

Can a malicious Tor exit node perform a HTTPS man-in-the-middle attack to see/modify your HTTPS traffic?

Let's say I am browsing the Internet using Tor - visiting https://example.com/login.php - and the NSA is operating the Tor exit node which I am currently routed to use. Can that NSA exit relay swap ...
9
votes
5answers
1k views

Can I improve website security by storing SSL Keys in DNS? Is DNSSec required? Are threat models available?

In light of recent attacks on SSL/TLS communication, people have been asking about ways to improve the security of SSL webserver communication. Several great solutions have been mentioned in the ...
3
votes
1answer
211 views

How and where to begin on the Return of Web Application Security Investment?

While there is a vast trove of vulnerabilties, threats and their corresponding countermeasures, the amount of information on Infosec Economics (Specifically for web applications) seems scarce. What ...
3
votes
1answer
485 views

Is There a Library of Well Known Threat/Attack Trees?

[I'm surprised that my searches didn't find this questions before, but then I may just not be asking it "the right way."] A project I am on is starting to look a threat trees for a connected piece of ...
3
votes
2answers
2k views

Difference between STRIDE and Mitre ATTACK

When looking at threat models I came across STRIDE (from Microsoft) and then came across Mitre ATT&CK, they seem to be different - one is a threat model and the other is a threat intelligence ...
3
votes
2answers
878 views

Can malicious phone software mount a MITM attack on a phone call?

Suppose my smartphone has been compromised and there is malicious software running on it. You can assume that the malicious software has broken out of any sandboxes and is running as root. If I'm on ...