Lecture 2 Flashcards
What questions should you ask when you are threat modelling?
What are you building?
What can go wrong?
How can fix or avoid the threats?
Reflect on previous?
How can you potray what you are building and it’s assets?
Design a diagram.
What matters in a system? How can you categories a system and it’s assets?
External entities, proccesses data stores, the flow of data and trust boundaries.
What is an external entity?
Anything that exists outside the system that interacts with the system.
What are proccesses within a system?
It is something a system does or is, an example of this is a program or a code. Or a way of communicating.
What is a data store?
Any form of data information depositry.
What does STRIDE stand for?
Spoofing, tampering, repudiation, information disclosure, denial of service and elevation of privilege.
Spoofing.
.
Tampering.
T
Repudiation.
R
Information disclosure
I
Denial of service.
D
Elevation of privilege.
.
What does META stand for?
Mitigation, eliminate, transfer or accept.
Mitigate.
.
