Threat Modelling Flashcards
When is Thread Modelling conducted?
In the early stages of the development lifecycle.
Are security measures implemented to the same level in all systems? Explain answer…
No. Some systems are less likely to be targetted, hold less valuable information, or are smaller. Thus they do
not need as extensive threat modelling and security systems implemented into them.
What are the 4 questions asked when threat modelling?
What do we want to protect?
Who are we protecting against?
What countermeasures should be put in place?
What are the weak points of the system?
From what perspective are security measures implemented? Why is this so?
Security is implemented from the attacking perspective rather than defence minded. This means developers can
implement countermeasures in a more specific and preventative way, with better defined countermeasures to
security breaches.
Define the STRIDE acronym…
Spoofing identity : Illegally accessing user authentication information.
Tampering with data : Data integrity, confidentially or availability being compromised.
Repudiation : The denial of something that can’t be disproved.
Information Disclosure : Unauthorised disclosure of confidential information.
Denial of Service : System requesting to compromise availability.
Elevation of privileges : User accessing higher privileges that their roles is entitled to.
Define Vulnerability Disclosure?
The way in which parties who find vulnerabilities report it back to the System Owner.
When a vulnerability is found, what are the 4 main locations they can be reported to?
Black Market, National Security Market, Internet, Vendor of system.
If the vulnerability researcher opts for Full Disclosure, who do they report the bug to? What about Responsible Disclosure?
The internet, for all to see.
The vendor of the analysed software. This means the vendor can patch and release back to the public.
What is the difference between Security Experts and Vendors perspective on vulnerability disclosure?
Security Expert : Felt full disclosure is important to bring awareness and advance knowledge of vulnerabilities.
Vendors : Spectrum of didn’t care, or wanted no disclosure due to highly confidential information or reputation damage.
Define Full Disclosure…
Immediate and public posting of vulnerabilities found. This puts pressure on vendors to fix.
Define Responsible Disclosure…
Given vendors a mitigation period to fix bug, after that, release to public if not fixed.
