Application Threat Modeling - Revision history

Adamshostack: Added a link to TM outputs

2018-10-14T16:44:44Z

Added a link to TM outputs

Adamshostack: /* 4 Questions */ defined that as "the technical work"

2018-06-11T15:19:57Z

‎4 Questions: defined that as "the technical work"

Adamshostack: /* 2. What can go wrong? */ added a few words to give more guidance

2018-06-11T15:18:21Z

‎2. What can go wrong?: added a few words to give more guidance

Adamshostack: Pasting in the content from the open security summit meeting of the TM project https://open-security-summit.org/outcomes/tracks/threat-model/working-sessions/tm-website-structure/

2018-06-11T15:04:46Z

Pasting in the content from the open security summit meeting of the TM project https://open-security-summit.org/outcomes/tracks/threat-model/working-sessions/tm-website-structure/

Show changes

Adamshostack: /* DREAD is DEAD.

2018-06-05T15:37:39Z

/* DREAD is DEAD.

Versprite: Kept DREAD changes made by previous editor even though changes under DREAD section where straight from Microsoft - originators of DREAD categorization model. Update Risk Ranking for threats to be more comprehensive. Risk centric section added shortly

2017-05-31T16:16:31Z

Kept DREAD changes made by previous editor even though changes under DREAD section where straight from Microsoft - originators of DREAD categorization model. Update Risk Ranking for threats to be more comprehensive. Risk centric section added shortly

Show changes

Adamshostack: What is described is simply not DREAD, which was a 1-10 scale, but a variant. Putting the same label on different things is a source of confusion, and we should avoid doing so.

2017-05-31T15:03:17Z

What is described is simply not DREAD, which was a 1-10 scale, but a variant. Putting the same label on different things is a source of confusion, and we should avoid doing so.

Show changes

Versprite: /* DREAD */

2017-05-31T03:47:19Z

‎DREAD

Show changes

Sdeleersnyder at 12:04, 8 March 2015

2015-03-08T12:04:49Z

Sdeleersnyder at 11:51, 8 March 2015

2015-03-08T11:51:22Z

@@ Line 43: / Line 43: @@
 === 3. What are we going to do about that? ===
-In this phase you turn your findings into specific actions.
+In this phase you turn your findings into specific actions.  See [[Threat_Modeling_Outputs]]
 === 4. Did we do a good enough job? ===

@@ Line 30: / Line 30: @@
 == 4 Questions ==
-Most threat model methodologies answer one or more of the following questions:
+Most threat model methodologies answer one or more of the following questions in the technical steps which they follow:
 === 1. What are we building? ===

@@ Line 1: / Line 1: @@
-__TOC__Threat modelling works to identify, communicate, and understand threats and mitigations within the context of protecting something of value.
+__TOC__
 Threat modelling can be applied to a wide range of things, including software, applications, systems, networks, distributed systems, things in the internet of things, business processes, etc. There are very few technical products which cannot be threat modelled; more or less rewarding, depending on how much it communicates, or interacts, with the world. Threat modelling can be done at any stage of development, preferably early - so that the findings can inform the design.
@@ Line 38: / Line 40: @@
 === 2. What can go wrong? ===
-This is a research activity in which you want to find the main threats that apply to your application.
+This is a "research" activity in which you want to find the main threats that apply to your application.  There are many ways to approach the question, including brainstorming or using a structure to help think it through.  Structures that can help include STRIDE, Kill Chains, CAPEC and others.
 === 3. What are we going to do about that? ===

@@ Line 674: / Line 674: @@
 ==DREAD==
-*For Damage: How big would the damage be if the attack succeeded?
+Microsoft created a mnemonic called DREAD, but it didn't work well, and they abandoned it by 2008.
 ==Generic Risk Model==

@@ Line 907: / Line 907: @@
 [[Category:OWASP Code Review Project]]
 [[Category:Threat_Modeling]]
-[[Category:SAMM-TM-1]]
+[[Category:SAMM-TA-1]]

← Older revision		Revision as of 11:51, 8 March 2015
Line 907:		Line 907:
	[[Category:OWASP Code Review Project]]		[[Category:OWASP Code Review Project]]
	[[Category:Threat_Modeling]]		[[Category:Threat_Modeling]]
		+	[[Category:SAMM-TM-1]]