Dana Epp's ramblings at the Sanctuary: Understanding Threat Modeling


« Secure programmer: Minimizing privileges \| Main \| Longhorn: Adopting a least privilege stance for users » May 27, 2004 Understanding Threat Modeling I recently stumbled across a couple of resources via some mailing lists describing different aspects of threat modeling. Having it for future reference, I figured I would blog it for everyone: Web: OCTAVE Paper: Attack Modeling for Information Security and Survivability Paper: Collaborative Attack Modeling Paper: Bruce Schneier's Attack Trees Paper: Systematic Network Vulnerability Analysis based on Attack Graphs Book: Managing Information Security Risks: The OCTAVE Approach Book (Chapter 4): Writing Secure Code Book: Threat Modeling Book (Chapter 3): Improving Web Application Security Posted by SilverStr at May 27, 2004 09:21 AM \| TrackBack Comments Dana, you may want to add Chapter 3 of the book "Improving Web Application Security" to the list as well. Online version at: http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnnetsec/html/THCMCh03.asp Posted by: Anil John at May 27, 2004 10:01 AM Good reference Anil. Now added to the list. Thanks! Posted by: SilverStr at May 27, 2004 10:55 AM This is my personal contribution to "Information security management". ( http://seguridad-para-usuarios.blogspot.com). My blog is in spanish, and i read your blog all days with rss reader. I suggest read about MAGERIT It's a Methodology of public organizations for Risks Analysis and Management of Information Systems studies the risks that an information system supports as well as the related environment. A risk is the possibility of damage or injury to ocurr in the system according to the existing threats. MAGERIT recommends the appropriate safeguard functions and mechanisms that should be taken, in order to know, prevent, impede, reduce or control the investigated risks. It's the last metodology developed for "Risk management" and include the best things from Octave, Cramm, ...) Regars, This seminar introduces the main current activities concerning Risks Analysis and Management and in Security of Information Systems. It also presents the MAGERIT methodology and emphasizes in the practical aspects associated to the study, making use of the experience of the teachers in information systems in general, and in the application to actual cases of study with MAGERIT, in particular. Posted by: Javier Cao Avellaneda at May 28, 2004 03:32 AM This is my personal contribution to "Information security management". ( http://seguridad-para-usuarios.blogspot.com). My blog is in spanish, and i read your blog all days with rss reader. I suggest read about MAGERIT. It's a Methodology of public organizations for Risks Analysis and Management of Information Systems studies the risks that an information system supports as well as the related environment. A risk is the possibility of damage or injury to ocurr in the system according to the existing threats. MAGERIT recommends the appropriate safeguard functions and mechanisms that should be taken, in order to know, prevent, impede, reduce or control the investigated risks. It's the last metodology developed for "Risk management" and include the best things from Octave, Cramm, ...) Regars, This seminar introduces the main current activities concerning Risks Analysis and Management and in Security of Information Systems. It also presents the MAGERIT methodology and emphasizes in the practical aspects associated to the study, making use of the experience of the teachers in information systems in general, and in the application to actual cases of study with MAGERIT, in particular. Posted by: Javier Cao Avellaneda at May 28, 2004 03:32 AM You can read about MAGERIT in http://www.csi.map.es/csi/pdf/magerit_ingles.pdf This methodology has been developed based ISO 13335, ITSEC criteria and ISO 17799. Regards Posted by: Javier Cao Avellaneda at September 23, 2004 08:37 AM		My 5 Favorite Books Writing Secure Code Secure Programming Cookbook Security Engineering Secure Coding Principles & Practice Inside the Security Mind My 5 Favorite Papers Smashing the Stack Penetration Studies Covert Channel Analysis of Trusted Systems DoD Trusted Computer System Evaluation Criteria NSA Security Recommendation Guides Archives April 2008 January 2008 December 2007 November 2007 October 2007 September 2007 August 2007 July 2007 June 2007 May 2007 April 2007 March 2007 February 2007 January 2007 December 2006 November 2006 October 2006 September 2006 August 2006 July 2006 June 2006 May 2006 April 2006 March 2006 February 2006 January 2006 December 2005 November 2005 October 2005 September 2005 August 2005 July 2005 June 2005 May 2005 April 2005 March 2005 February 2005 January 2005 December 2004 November 2004 October 2004 September 2004 August 2004 July 2004 June 2004 May 2004 April 2004 March 2004 February 2004 January 2004 December 2003 November 2003 October 2003 September 2003 August 2003 July 2003 June 2003 May 2003 April 2003 March 2003 February 2003 January 2003 December 2002 November 2002 October 2002 September 2002 August 2002 July 2002 GeoURL

May 27, 2004

Understanding Threat Modeling