Upgrade to Pro
— share decks privately, control downloads, hide ads and more …
Speaker Deck
Features
Speaker Deck
PRO
Sign in
Sign up for free
Search
Search
Threat modelling
Search
Apokrupto
November 04, 2017
Programming
1
110
Threat modelling
An introduction to threat modelling for your project.
Apokrupto
November 04, 2017
Tweet
Share
More Decks by Apokrupto
See All by Apokrupto
Code review... done well
apokrupto
0
120
iOS development
apokrupto
0
28
Firebase
apokrupto
0
140
Code Reuse
apokrupto
1
220
Other Decks in Programming
See All in Programming
Architectures with Lightweight Stores: New Rules and Options
manfredsteyer
PRO
0
100
Google's Recipe for Scaling (Web) Security – LocoMocoSec 2024
lweichselbaum
0
170
わかりやすい正解を捨てて、コトに向き合う - スクラムフェス金沢2024 スポンサーセッション
yusukekokubo
0
170
【Go言語】ジェネリクス
tomo1227
0
170
iOSアプリでクリップボードにコピーしたことをユーザーに伝えるちょうど良いフィードバックを探す
ski
0
100
3 Effective Rules for Success with Signals in Angular
manfredsteyer
PRO
0
120
Product Management LT会_クアンド新家
shinshin
0
250
Xcode 16のPreviewModifierと@Previewableを活用した効率的なプレビュー方法の考察
ojun9
2
160
Composing an API the *right* way (Droidcon Berlin 2024)
zsmb
1
450
Webエディタライブラリ 「CodeMirror」から学ぶ Webアプリ開発のテクニック
ryosukeigarashi
0
250
How to use Macrobenchmark
veronikapj
0
160
OpenAI/Gemini APIを使って EPUBを翻訳するCLIツールをつくってみた
tomiyan
0
790
Featured
See All Featured
Atom: Resistance is Futile
akmur
261
25k
Gamification - CAS2011
davidbonilla
78
4.9k
Build your cross-platform service in a week with App Engine
jlugia
227
17k
Side Projects
sachag
451
42k
Building Effective Engineering Teams - LeadDev
addyosmani
47
2.2k
Documentation Writing (for coders)
carmenintech
63
4.2k
Fight the Zombie Pattern Library - RWD Summit 2016
marcelosomers
228
16k
Building a Scalable Design System with Sketch
lauravandoore
458
32k
How To Stay Up To Date on Web Technology
chriscoyier
784
250k
The Art of Programming - Codeland 2020
erikaheidi
48
13k
Music & Morning Musume
bryan
43
5.9k
Clear Off the Table
cherdarchuk
89
320k
Transcript
THREAT MODELING DEVFEST17 - NOVEMBER 2017 WARREN GAVIN (@APOKRUPTO)
None
DANNY
None
WHAT YOU WANTED WHAT YOU WROTE THREAT MODELING - @APOKRUPTO
QUESTIONS THREAT MODELING - @APOKRUPTO
QUESTIONS THREAT MODELING - @APOKRUPTO WHY
QUESTIONS THREAT MODELING - @APOKRUPTO WHY WHO
QUESTIONS THREAT MODELING - @APOKRUPTO WHY WHO WHAT
QUESTIONS THREAT MODELING - @APOKRUPTO WHY WHO WHAT HOW
QUESTIONS THREAT MODELING - @APOKRUPTO WHY WHO WHAT HOW WHEN
None
TERRY
None
WHY? THREAT MODELING - @APOKRUPTO
WHY? THREAT MODELING - @APOKRUPTO BUILD A SECURE SYSTEM
None
None
WHY? THREAT MODELING - @APOKRUPTO BUILD A SECURE SYSTEM
WHY? THREAT MODELING - @APOKRUPTO BUILD A SECURE SYSTEM FOR
A GIVEN VALUE OF ‘SECURE'
MEANWHILE
None
WH0? THREAT MODELING - @APOKRUPTO
WH0? THREAT MODELING - @APOKRUPTO EVERYONE
WH0? THREAT MODELING - @APOKRUPTO EVERYONE YOU DON’T NEED TO
BE AN EXPERT
MEANWHILE
None
SAUL
None
None
WHAT? THREAT MODELING - @APOKRUPTO
WHAT? THREAT MODELING - @APOKRUPTO ASSETS
WHAT? THREAT MODELING - @APOKRUPTO ASSETS - DATA, CONFIDENTIAL INFORMATION
WHAT? THREAT MODELING - @APOKRUPTO ASSETS - DATA, CONFIDENTIAL INFORMATION
- COMPANY REPUTATION
MEANWHILE
None
None
None
HOW? THREAT MODELING - @APOKRUPTO
HOW? THREAT MODELING - @APOKRUPTO PREDICTION IS VERY DIFFICULT, ESPECIALLY
ABOUT THE FUTURE Niels Bohr
HOW? THREAT MODELING - @APOKRUPTO ANALYSE
HOW? THREAT MODELING - @APOKRUPTO ANALYSE DATA FLOW
HOW? THREAT MODELING - @APOKRUPTO ANALYSE DATA FLOW METHODOLOGY
HOW? THREAT MODELING - @APOKRUPTO ANALYSE DATA FLOW METHODOLOGY STRIDE
MEANWHILE
None
None
BRUISER
None
HOW? - DATA FLOW THREAT MODELING - @APOKRUPTO
THREAT MODELING - @APOKRUPTO PROCESS HOW? - DATA FLOW
THREAT MODELING - @APOKRUPTO PROCESS MULTI PROCESS HOW? - DATA
FLOW
THREAT MODELING - @APOKRUPTO PROCESS MULTI PROCESS EXTERNAL ENTITY HOW?
- DATA FLOW
THREAT MODELING - @APOKRUPTO PROCESS MULTI PROCESS DATA STORE EXTERNAL
ENTITY HOW? - DATA FLOW
DATA FLOW THREAT MODELING - @APOKRUPTO PROCESS MULTI PROCESS DATA
STORE EXTERNAL ENTITY HOW? - DATA FLOW
DATA FLOW THREAT MODELING - @APOKRUPTO PROCESS MULTI PROCESS DATA
STORE TRUST BOUNDARY EXTERNAL ENTITY HOW? - DATA FLOW
THREAT MODELING - @APOKRUPTO DATA STORE USER HOW? - DATA
FLOW
MEANWHILE
None
None
HOW? - STRIDE THREAT MODELING - @APOKRUPTO
THREAT MODELING - @APOKRUPTO SPOOFING HOW? - STRIDE
THREAT MODELING - @APOKRUPTO SPOOFING TAMPERING HOW? - STRIDE
THREAT MODELING - @APOKRUPTO SPOOFING TAMPERING REPUDIATION HOW? - STRIDE
THREAT MODELING - @APOKRUPTO INFORMATION DISCLOSURE HOW? - STRIDE
THREAT MODELING - @APOKRUPTO INFORMATION DISCLOSURE DENIAL OF SERVICE HOW?
- STRIDE
THREAT MODELING - @APOKRUPTO INFORMATION DISCLOSURE DENIAL OF SERVICE ELEVATION
OF PRIVILEGE HOW? - STRIDE
MEANWHILE
None
None
HOW? - STRIDE/ELEMENT THREAT MODELING - @APOKRUPTO
THREAT MODELING - @APOKRUPTO ENTITY: SR HOW? - STRIDE/ELEMENT
THREAT MODELING - @APOKRUPTO ENTITY: SR PROCESS: STRIDE HOW? -
STRIDE/ELEMENT
THREAT MODELING - @APOKRUPTO ENTITY: SR PROCESS: STRIDE DATA STORE:
TRID HOW? - STRIDE/ELEMENT
THREAT MODELING - @APOKRUPTO ENTITY: SR PROCESS: STRIDE DATA STORE:
TRID DATA FLOW: TID HOW? - STRIDE/ELEMENT
MEANWHILE
None
None
THREAT MODELING - @APOKRUPTO HOW? - QUANTIFY
THREAT MODELING - @APOKRUPTO DAMAGE HOW? - QUANTIFY
THREAT MODELING - @APOKRUPTO DAMAGE REPRODUCIBILITY HOW? - QUANTIFY
THREAT MODELING - @APOKRUPTO DAMAGE REPRODUCIBILITY EXPLOITABILITY HOW? - QUANTIFY
THREAT MODELING - @APOKRUPTO DAMAGE REPRODUCIBILITY EXPLOITABILITY AFFECTED USERS HOW?
- QUANTIFY
THREAT MODELING - @APOKRUPTO DAMAGE REPRODUCIBILITY EXPLOITABILITY AFFECTED USERS DISCOVERABILITY
HOW? - QUANTIFY
DREAD
MEANWHILE
None
THREAT MITIGATION THREAT MODELING - @APOKRUPTO
THREAT MODELING - @APOKRUPTO A THREAT WITH NO MITIGATION IS
A VULNERABILITY THREAT MITIGATION
THREAT MITIGATION THREAT MODELING - @APOKRUPTO
THREAT MITIGATION THREAT MODELING - @APOKRUPTO REDESIGN
THREAT MITIGATION THREAT MODELING - @APOKRUPTO REDESIGN STANDARD MITIGATION
THREAT MITIGATION THREAT MODELING - @APOKRUPTO REDESIGN STANDARD MITIGATION CUSTOM
MITIGATION
THREAT MITIGATION THREAT MODELING - @APOKRUPTO REDESIGN STANDARD MITIGATION CUSTOM
MITIGATION ACCEPT
THREAT MITIGATION THREAT MODELING - @APOKRUPTO AUTHENTICATION
THREAT MODELING - @APOKRUPTO AUTHENTICATION INTEGRITY CHECKS THREAT MITIGATION
THREAT MODELING - @APOKRUPTO AUTHENTICATION INTEGRITY CHECKS NON-REPUDIATION THREAT MITIGATION
THREAT MODELING - @APOKRUPTO CONFIDENTIALITY THREAT MITIGATION
THREAT MODELING - @APOKRUPTO CONFIDENTIALITY AVAILABILITY THREAT MITIGATION
THREAT MODELING - @APOKRUPTO CONFIDENTIALITY AVAILABILITY AUTHORISATION THREAT MITIGATION
TERRY’S THREAT MODEL
None
SPOOFING
None
TAMPERING
None
REPUDIATION
None
INFORMATION DISCLOSURE
None
DENIAL OF SERVICE
None
ELEVATION OF PRIVILEGE
WHEN? THREAT MODELING - @APOKRUPTO
WHEN? THREAT MODELING - @APOKRUPTO AT DESIGN TIME IS BEST
WHEN? THREAT MODELING - @APOKRUPTO AT DESIGN TIME IS BEST
BUT KEEP RE-EVALUATING
WHEN? THREAT MODELING - @APOKRUPTO AT DESIGN TIME IS BEST
BUT KEEP RE-EVALUATING IT’S NEVER TOO LATE
WHEN? THREAT MODELING - @APOKRUPTO AT DESIGN TIME IS BEST
BUT KEEP RE-EVALUATING IT’S NEVER TOO LATE UNLESS IT’S TOO LATE
None
TERRY
IDIOT
DON’T BE A TERRY
OBLIGATORY THANK YOU SLIDE THREAT MODELING - @APOKRUPTO