Hot answers tagged


The thing about security is that it's never a one-size-fits-all sort of deal. Because of that you always have to adapt designs to apply to the threats you're willing to counter. A good security design pattern is just a good software design pattern. If you take a look at Wikipedia it lists a few: There is also ...


For purposes of mapping to Microsoft's SDL, this is closer to how we* talked about threat modeling. I'm unsure of the purpose of this document, which looks like it took a lot of work, but at a skim, it's unclear why that work was done. we = the MS SDL team, of which I was a member from 2006-2010, responsible for threat modeling and other bits.


Select the two processes and right click Bi-directional.


As for the ISO 27000 family, it has a list of controls which are part of the management system that you have to specify if they are relevant to your scope of implementation or not. Theses controls specifies the requirements of what you should do but gives you the freedom in how do you do it. Meaning, you have the freedom to inject the requirements of the ISO ...


This question is too broad, as the answer is going to depend upon the particular vulnerability/attack. Pretty much any description of a vulnerability or attack will describe its potential impact (= technical impact, in the OWASP terminology). So, if there's a particular vulnerability you want to know about, you should be able to go read any primer on that ...

Only top voted, non community-wiki answers of a minimum length are eligible