4 ms·
Hm, currently, this sets of marketing alert bells. It looks pretty, it has good points. I'd like to have some structured approaches to some internal concerns we
by tetha 6y ago
Hm, currently, this sets of marketing alert bells. It looks pretty, it has good points. I'd like to have some structured approaches to some internal concerns we have.
However, there seem to be zero links to tools and approaches to actually do something? Most links are to articles explaining why the manifesto exists... by companies offering consulting in this area.
- alphalima 6y agoIf you're looking for concrete resources with steps on how to perform threat modelling, I've used the Microsoft SDL Threat Modelling tool/process [1]. It's pretty Microsoft skewed (lots of references to Azure resources), but is a reasonable way to start thinking about the topic. [1]: https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling https://www.microsoft.com/en-us/securityengineering/sdl/thre...
- baby 6y agoI really don't like it. Personally, I think it isn't hard to threat model your system: 1. break down your systems into smaller units 2. for each unit, figure out: - what attackers are after (e.g. stealing a database) - what attackers can do (e.g. infiltrate the network) - what's the likelihood of each attack and scenario you can think about, along with the impact - what you've done to prevent it (and is it good enough?) - what you've done to detect it (and is it good enough?) - what you would do to respond to a successful attack (and, is it good enough?)
- abarringer 6y agoMight want to look at https://attack.mitre.org/matrices/enterprise/ https://attack.mitre.org/matrices/enterprise/