Development Lifecycle & Security Requirements Flashcards
STRIDE
Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privilege
Spoofing
Pretending to be something or someone other than yourself.
Tampering
Modifying something on disk, on a network, or in memory.
Repudiation
Claiming that you didn’t do something, or were not responsible.
Information Disclosure
Providing information to someone not authorized to see it.
Denial of Service
Absorbing resources needed to provide service.
Elevation of Privilege
Allowing someone to do something they’re not authorized to do.
Defense in depth
If they break into this, they can’t get any farther.
Least privilege
Every user or module is given the least amount of privilege it
needs.
Fail securely
Take care of exceptions properly! To prevent error message info leak and putting the system on a weird state.
Security by obscurity
Don’t rely on obscurity as security.
Detect and Record
Useful for post-mortem analysis.
Dont trust [input | environment | dependencies | *]
Know what, whom and how to trust.
KISS
Keep It Simple Stupid to minimize attack surface.
What should use cases include?
Actors, preconditions, main flow of primary scenario, alternative scenarios and how the system reacts to use cases.
Misuse vs Abuse Cases
Misuse is unintentional but still security related.
Abuse is intentional and implies the actor is actively looking for vulnerabilities.
