Security Development Lifecycle

Chapter 22. Threat Tree Patterns

In this chapter:

Spoofing an External Entity or a Process

Tampering with a Process

Tampering with a Data Flow

Tampering with a Data Store

Repudiation

Information Disclosure of a Process

Information Disclosure of a Data Flow

Information Disclosure of a Data Store

Denial of Service Against a Process

Denial of Service Against a Data Flow

Denial of Service Against a Data Store

Elevation of Privilege

In Chapter 9, we mentioned threat trees that reflect common attack patterns and help application designers think about security conditions in the system. This chapter itemizes the threat tree patterns and discusses what you should think about when designing and testing an application.

Chapter 9 presented an important table—Table 9-5 ...