4 ms·
If you're looking for concrete resources with steps on how to perform threat modelling, I've used the Microsoft SDL Threat Modelling tool/process [1]. It's pre
by alphalima 6y ago
If you're looking for concrete resources with steps on how to perform threat modelling, I've used the Microsoft SDL Threat Modelling tool/process [1].
It's pretty Microsoft skewed (lots of references to Azure resources), but is a reasonable way to start thinking about the topic.
[1]: https://www.microsoft.com/en-us/securityengineering/sdl/threatmodeling https://www.microsoft.com/en-us/securityengineering/sdl/thre...
- baby 6y agoI really don't like it. Personally, I think it isn't hard to threat model your system: 1. break down your systems into smaller units 2. for each unit, figure out: - what attackers are after (e.g. stealing a database) - what attackers can do (e.g. infiltrate the network) - what's the likelihood of each attack and scenario you can think about, along with the impact - what you've done to prevent it (and is it good enough?) - what you've done to detect it (and is it good enough?) - what you would do to respond to a successful attack (and, is it good enough?)