Threat Modelling - Revision history

NKirnbauer: NKirnbauer moved page Thread Modelling to Threat Modelling: misspelling

2024-08-28T18:38:55Z

NKirnbauer moved page Thread Modelling to Threat Modelling: misspelling

← Older revision	Revision as of 18:38, 28 August 2024
(No difference)

NKirnbauer: gendering

2024-08-27T18:34:28Z

gendering

← Older revision		Revision as of 18:34, 27 August 2024
Line 41:		Line 41:

	*'''Information disclosure:''' The exposure of information to unauthorized individuals.		*'''Information disclosure:''' The exposure of information to unauthorized individuals.
	''Example: If a user can read files, he should not have access to or if an attacker can read transit between computers where ~~he is~~ not supposed to.''		''Example: If a user can read files, they should not have access to or if an attacker can read transit between computers where they are not supposed to.''

	*'''Denial of service:''' A DoS attack denies service to a valid user.		*'''Denial of service:''' A DoS attack denies service to a valid user.
Line 47:		Line 47:

	*'''Elevation of privilege:''' An unprivileged user gains enough privileged access to destroy the entire system.		*'''Elevation of privilege:''' An unprivileged user gains enough privileged access to destroy the entire system.
	''Example: An Attacker has effectively penetrated system defense to the point where ~~he becomes~~ part of the trusted system.''		''Example: An Attacker has effectively penetrated system defense to the point where they become part of the trusted system.''

	=== OCTAVE ===		=== OCTAVE ===

Bnagl: Changed a typo

2022-01-30T14:20:39Z

Changed a typo

← Older revision		Revision as of 14:20, 30 January 2022
Line 1:		Line 1:
	== Summary ==		== Summary ==
	~~Thread~~ modelling is a process used to systematically identify potential threats to products, applications or any other system. It helps to figure out the possible vulnerabilities of a system that are most desired by attackers. There is hardly any product which who threat modeling can´t be used. It helps with the security of software, applications, networks, IoT, business processes and many more.		Threat modelling is a process used to systematically identify potential threats to products, applications or any other system. It helps to figure out the possible vulnerabilities of a system that are most desired by attackers. There is hardly any product which who threat modeling can´t be used. It helps with the security of software, applications, networks, IoT, business processes and many more.

	The reasons to use threat modeling are mainly to build secure design and to document threats and mitigations. It helps to identify threats and compliance requirements and to evaluate their risks to the system as well as is helps to efficient invest given resources. An important part is to document the threats and mitigations found.		The reasons to use threat modeling are mainly to build secure design and to document threats and mitigations. It helps to identify threats and compliance requirements and to evaluate their risks to the system as well as is helps to efficient invest given resources. An important part is to document the threats and mitigations found.

Cskallak at 11:53, 3 March 2020

2020-03-03T11:53:38Z

← Older revision		Revision as of 11:53, 3 March 2020
Line 172:		Line 172:


	[[Category:~~Documentation~~]]		[[Category:Basic]]

Sprochazka: /* References */

2020-02-17T22:22:04Z

References

← Older revision		Revision as of 22:22, 17 February 2020
Line 169:		Line 169:
	* https://technology.ku.edu/octave-method-security-assessment		* https://technology.ku.edu/octave-method-security-assessment
	* Introducing OCTAVE Allegro:Improving the Information Security Risk Assessment Process"; Richard A. Caralli		* Introducing OCTAVE Allegro:Improving the Information Security Risk Assessment Process"; Richard A. Caralli
			*"Real World Threat Modeling Using the PASTA Methodology"; Tony Uceda Valez


	[[Category:Documentation]]		[[Category:Documentation]]

Sprochazka: /* Methodologies */

2020-02-17T22:17:06Z

Methodologies

@@ Line 69: / Line 69: @@
 There are two attack types in the Trike model, an elevation of privilege attack or a denial of service attack and the actions taken are divided into one of four groups called CRUD: ''Create, Read, Update, Delete''. The threats are rated in a rating chart that shows the risk of either attack type to a five-point scale for each CRUD action.
 Trike starts with the creation of a requirements model and continues with the creation of a DFD, a Data Flow Diagram. From this point on the risk values are assigned to the threats and an attack graph is created. The Trike model requires a view of the entire system, therefore it can be hard to scale it for larger systems.
 == OWASP Tools ==

Akrischan at 21:48, 17 February 2020

2020-02-17T21:48:18Z

@@ Line 72: / Line 72: @@
 == OWASP Tools ==
-The Open Web Application Security Project is a NGO whose aim is to improve the security of software. Their main focus are Applications within the World Wide Web, to enable organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. The programm includes:
+The Open Web Application Security Project is a NGO whose aim is to improve the security of software. Their main focus are applications within the World Wide Web, to enable organizations to conceive, develop, acquire, operate, and maintain applications that can be trusted. The programm includes:
 * Community-led open source software projects
@@ Line 94: / Line 94: @@
 === Top 10 Web Application Security Risks ===
 === OWASP Threat Dragon ===
@@ Line 99: / Line 122: @@
 [[File:Owaspthreatdragon1.PNG|thumbnail|upright]]
-Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web application. Threat Dragon is capable of:
+Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web platform. Threat Dragon is capable of:
 * designing data flow diagrams

Akrischan at 20:52, 17 February 2020

2020-02-17T20:52:25Z

← Older revision		Revision as of 20:52, 17 February 2020
Line 96:		Line 96:

	=== OWASP Threat Dragon ===		=== OWASP Threat Dragon ===

			[[File:Owaspthreatdragon1.PNG\|thumbnail\|upright]]

	Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web application. Threat Dragon is capable of:		Threat Dragon is a free and open-source threat modeling application which is available on multiple plattforms including linux and windows. The application can also be used as a web application. Threat Dragon is capable of:
Line 107:		Line 109:

	* Download and install node.js latest lts version: https://nodejs.org/en/download/		* Download and install node.js latest lts version: https://nodejs.org/en/download/
	* Download and install git: https://gitforwindows.org/		* Download and install git for windows: https://gitforwindows.org/

	Open a powershell (with administrator privileges) and run:		Open a powershell (with administrator privileges) and run:
Line 120:		Line 122:
	npm run start		npm run start

			To get familiar with the threat modeling process with Threat Dragon you can open a Demo Model and start to edit it:

			[[File:Owaspthreatdragon2.PNG]]

	== References ==		== References ==

Akrischan at 20:36, 17 February 2020

2020-02-17T20:36:52Z

← Older revision		Revision as of 20:36, 17 February 2020
Line 106:		Line 106:
	To install it on windows proceed as follows:		To install it on windows proceed as follows:

	* Download node.js latest lts version: https://nodejs.org/en/download/		* Download and install node.js latest lts version: https://nodejs.org/en/download/
	* ~~Install~~ git: https://gitforwindows.org/		* Download and install git: https://gitforwindows.org/

	Open a powershell (with administrator privileges) and run:		Open a powershell (with administrator privileges) and run:

Akrischan at 20:36, 17 February 2020

2020-02-17T20:36:07Z

← Older revision		Revision as of 20:36, 17 February 2020
Line 111:		Line 111:
	Open a powershell (with administrator privileges) and run:		Open a powershell (with administrator privileges) and run:

			cd C:\
	git clone https://github.com/mike-goodwin/owasp-threat-dragon-desktop		git clone https://github.com/mike-goodwin/owasp-threat-dragon-desktop
			cd .\owasp-threat-dragon-desktop\
	npm install		npm install