Collaborate Disseminate
Amazon Resource Names (ARNs) uniquely identify AWS resources. Amazon requires an ARN when you need to specify a resource unambiguously across all of AWS, such as in IAM policies, Amazon Relational Database Service (Amazon RDS… Continue reading What are the risks of placing Amazon Resource Names (ARNs) in VCS repositories?
I am asking around the security community trying to get different opinions and discover the different methods of how to introduce and implement threat modelling and sec design reviews into an agile SDLC. I would be really gra… Continue reading Agile Security Threat Modelling
Could you please help me in understanding key areas which we need to be concentrated on Secure Design/Architecture reviews?
How Threat Modeling can be achieved ? If there is any examples / scenarios ?
Continue reading What all key areas need to be focused in Secure Design Reviews?
via Luke Kingma & Lou Patrick-Mackay at Futurism Cartoons
Permalink
The post Luke Kingma & Lou Patrick-Mackay’s, ‘Threat Modeling’ appeared first on Security Boulevard.
Continue reading Luke Kingma & Lou Patrick-Mackay’s, ‘Threat Modeling’
As I understand it, JavaScript implementations running in browsers need to run untrusted code and operate on untrusted data in a secure manner. Language (e.g. Python) implementations running on a server, OTOH, run trusted cod… Continue reading Security-wise, is an in-browser JavaScript implementation fundamentally different from a server-side language (e.g. Python) implementation?
What are the risks of posting family pictures online, for example on a blog site, without any access control in place? What should be my threat model?
I am weary of posting (recognizable) pictures of my self and my family o… Continue reading What are the risks of posting family pictures online without any access control?
I understand sequential execution and time-based attacks but how are these used in real life scenarios?
Continue reading What could be a scenario of spectre attack when an attacker gains something private
We all know that in the security field everything depends on the threat model, which basically means you need to define who or what you are protecting from. But who should decide this, and on what objective basis? Since you c… Continue reading Is a threat model totally subjective or can it be based on objective guidelines?
What could be the Relationship between threat analysis and attack modeling.
Analyzing the threat is the steps of
defining the scope of threats/risks
Collecting/gathering necessary information
Analyzing the data (Threat/Vul… Continue reading Relationship between threat analysis and attack modeling
When looking at threat models I came across STRIDE (from Microsoft) and then came across Mitre ATT&CK, they seem to be different – one is a threat model and the other is a threat intelligence methodology.
What’s fuzzy to… Continue reading Difference between STRIDE and Mitre ATTACK