We’re rewarding the question askers & reputations are being recalculated! Read more.

Hot answers tagged

5

Microsoft SDL v5 is pretty decent and you have to full paper explaining the whole process that can be downloaded from MSKB: http://www.microsoft.com/download/en/details.aspx?displaylang=en&id=12285 If you need to get just a general grasp of the process, you can read a short and solid intro @ TechSurface: http://techsurface.com/2010/01/microsoft-security-...


4

The thing about security is that it's never a one-size-fits-all sort of deal. Because of that you always have to adapt designs to apply to the threats you're willing to counter. A good security design pattern is just a good software design pattern. If you take a look at Wikipedia it lists a few: http://en.wikipedia.org/wiki/Security_Patterns There is also ...


3

Since you refer to SDL I assume you know it already, but to have it mentioned here: Microsoft provides a SDL Threat Modelling Tool (http://www.microsoft.com/security/sdl/adopt/threatmodeling.aspx) OWASP hosts a primer about Threat Risk Modelling (and recommends the use of Microsoft SDL) And of course NIST has a whole load of docs on this topic, e.g.: http:/...


2

For purposes of mapping to Microsoft's SDL, this is closer to how we* talked about threat modeling. I'm unsure of the purpose of this document, which looks like it took a lot of work, but at a skim, it's unclear why that work was done. we = the MS SDL team, of which I was a member from 2006-2010, responsible for threat modeling and other bits.


1

Select the two processes and right click Bi-directional.


1

As for the ISO 27000 family, it has a list of controls which are part of the management system that you have to specify if they are relevant to your scope of implementation or not. Theses controls specifies the requirements of what you should do but gives you the freedom in how do you do it. Meaning, you have the freedom to inject the requirements of the ISO ...


1

This question is too broad, as the answer is going to depend upon the particular vulnerability/attack. Pretty much any description of a vulnerability or attack will describe its potential impact (= technical impact, in the OWASP terminology). So, if there's a particular vulnerability you want to know about, you should be able to go read any primer on that ...


Only top voted, non community-wiki answers of a minimum length are eligible