Threat Modeling

Index

A

• Abi-Antoun, Marwan, 213
• ability, challenge and, 410
• About Face 3: The Essentials of Interaction Design (Cooper), 480
• abstraction versus detail, attack libraries, 102
• ACCE. See authenticated and confidential channel establishment
• accept risks
  • business acceptance, 184–185
  • described, 13, 169
  • user acceptance, 185
• accepting threats, 13
• account names, 283–284
• account recovery, 271–282
  • attacker-driven analysis, 280
  • checklist, 281–282
  • e-mail authentication, 273–274
  • knowledge-based authentication, 274–278
  • multi-channel authentication, 281
  • social authentication, 278–280
  • time factor, 272–273
  • types, 271–272
• account takeover subtree, 451
• account trustees, 256, 279–280
• accounts, 253–291
  • authentication, 259–271
  • authentication checklist, 271
  • close relationship, 254–255, 273
  • creation, 254–257
  • factory, 255
  • federated, 255–256
  • free, 255
  • identity versus, 253–254
  • incorrect account or password, 262
  • life cycles, 236, 254–259
  • life-cycle checklist, 258–259
  • login process, 260–263
    • account lockout, 263
    • failures, 262–263
    • server spoofing, 261–262
  • maintenance, 257–258
  • nominee, 256
  • overview, 216
  • several, 256
  • shared, 256–257
  • subordinate, 256
  • summary, 290–291
  • termination, 258
  • threats, 263–271
  • UIDs, 6, 27, 50, 141
• ACFE. See Association of Certified Fraud Examiners
• ACLs, 14, 15, 16, 17, 18, 19
• Acme’s operational network, 519–525
  • denial of service, 525
  • diagram, 46–47, 520–521
  • elevation of privilege, 525
  • e-mail system, 172–173
  • information disclosure, 524–525
  • repudiation, 524
  • security requirements, ...