book

Threat Modeling

Name: Threat Modeling
Author: Adam Shostack
ISBN: 9781118809990

by Adam Shostack

February 2014

Intermediate to advanced

624 pages

16h 42m

English

Wiley

Read now

Unlock full access

Cover
Table of Contents
Title Page
Copyright Page
Dedication Page
Credits
About the Author
About the Technical Editor
Acknowledgments
Introduction
What Is Threat Modeling?Reasons to Threat ModelWho Should Read This book?What You Will Gain from This BookHow To Use This BookNew Lessons on Threat Modeling

Part I: Getting Started
CHAPTER 1: Dive In and Threat Model!
Learning to Threat ModelThreat Modeling on Your OwnChecklists for Diving In and Threat ModelingSummary
CHAPTER 2: Strategies for Threat Modeling
“What's Your Threat Model?”Brainstorming Your ThreatsStructured Approaches to Threat ModelingModels of SoftwareSummary
Part II: Finding Threats
CHAPTER 3: STRIDE
Understanding STRIDE and Why It's UsefulSpoofing Threats Tampering ThreatsRepudiation ThreatsInformation Disclosure ThreatsDenial-of-Service ThreatsElevation of Privilege ThreatsExtended Example: STRIDE Threats against Acme-DBSTRIDE VariantsExit CriteriaSummary
CHAPTER 4: Attack Trees
Working with Attack TreesRepresenting a TreeExample Attack TreeReal Attack TreesPerspective on Attack TreesSummary
CHAPTER 5: Attack Libraries
Properties of Attack LibrariesCAPECOWASP Top TenSummary
CHAPTER 6: Privacy Tools
Solove's Taxonomy of PrivacyPrivacy Considerations for Internet ProtocolsPrivacy Impact Assessments (PIA)The Nymity Slider and the Privacy RatchetContextual IntegrityLINDDUNSummary
Part III: Managing and Addressing Threats
CHAPTER 7: Processing and Managing Threats
Starting the Threat Modeling ProjectDigging Deeper into MitigationsTracking with Tables and ListsScenario-Specific Elements of Threat ModelingSummary
CHAPTER 8: Defensive Tactics and Technologies
Tactics and Technologies for Mitigating ThreatsAddressing Threats with PatternsMitigating Privacy ThreatsSummary
CHAPTER 9: Trade-Offs When Addressing Threats
Classic Strategies for Risk ManagementSelecting Mitigations for Risk ManagementThreat-Specific Prioritization ApproachesMitigation via Risk AcceptanceArms Races in Mitigation StrategiesSummary
CHAPTER 10: Validating That Threats Are Addressed
Testing Threat MitigationsChecking Code You AcquireQA'ing Threat ModelingProcess Aspects of Addressing ThreatsTables and ListsSummary
CHAPTER 11: Threat Modeling Tools
Generally Useful ToolsOpen-Source ToolsCommercial ToolsTools That Don't Exist YetSummary
Part IV: Threat Modeling in Technologies and Tricky Areas
CHAPTER 12: Requirements Cookbook
Why a “Cookbook”?The Interplay of Requirements, Threats, and MitigationsBusiness RequirementsPrevent/Detect/Respond as a Frame for RequirementsPeople/Process/Technology as a Frame for RequirementsDevelopment Requirements vs. Acquisition RequirementsCompliance-Driven RequirementsPrivacy RequirementsThe STRIDE RequirementsNon-RequirementsSummary
CHAPTER 13: Web and Cloud Threats
Web ThreatsCloud Tenant ThreatsCloud Provider ThreatsMobile ThreatsSummary
CHAPTER 14: Accounts and Identity
Account Life CyclesAuthenticationAccount RecoveryNames, IDs, and SSNsSummary
CHAPTER 15: Human Factors and Usability
Models of PeopleModels of Software ScenariosThreat Elicitation TechniquesTools and Techniques for Addressing Human FactorsUser Interface Tools and TechniquesTesting for Human FactorsPerspective on Usability and CeremoniesSummary
CHAPTER 16: Threats to Cryptosystems
Cryptographic PrimitivesClassic Threat ActorsAttacks Against CryptosystemsBuilding with CryptoThings to Remember About CryptoSecret Systems: Kerckhoffs and His PrinciplesSummary
Part V: Taking It to the Next Level
CHAPTER 17: Bringing Threat Modeling to Your Organization
How To Introduce Threat ModelingWho Does What?Threat Modeling within a Development Life CycleOvercoming Objections to Threat ModelingSummary
CHAPTER 18: Experimental Approaches
Looking in the SeamsOperational Threat ModelsThe “Broad Street” TaxonomyAdversarial Machine LearningThreat Modeling a BusinessThreats to Threat Modeling ApproachesHow to ExperimentSummary
CHAPTER 19: Architecting for Success
Understanding FlowKnowing the ParticipantsBoundary ObjectsThe Best Is the Enemy of the GoodClosing PerspectivesSummary
APPENDIX A: Helpful Tools
Common Answers to “What's Your Threat Model?”
Appendix B: Threat Trees
STRIDE Threat TreesOther Threat Trees
APPENDIX C: Attacker Lists
Attacker ListsPersonas and ArchetypesAucsmith's Attacker PersonasBackground and DefinitionsPersonas
APPENDIX D: Elevation of Privilege: The Cards
SpoofingTamperingRepudiationInformation DisclosureDenial of ServiceElevation of Privilege (EoP)
APPENDIX E: Case Studies
The Acme DatabaseAcme's Operational NetworkPhones and One-Time Token AuthenticatorsSample for You to Model
Glossary
Bibliography
Index
End User License Agreement

404

Not Found

Either this content does not exist or you do not have access to it. Try searching for something new.

Cloud Computing

Data Engineering

Data Science

AI & ML

Programming Languages

Software Architecture

IT/Ops

Security

Design

Business

Soft Skills

Threat Modeling

by Adam Shostack

404

Not Found