Collaborate Disseminate
Software professionals know that the working relationship between developers and security teams can be complicated. Most security professionals feel it’s part of a programmer’s role to write code securely, but most developers get next to no support to … Continue reading How to implement security into software design from the get-go
I am currently making my own password manager as my main project. But of course, I want to make it sturdy, in case I release it to the public.
The password manager follows this simple structure: A field holds key-value pair (like "Pas… Continue reading How would one be able to abuse which fields are linked to which record in a password manager?
83% of companies would suffer business damage during the first 24 hours of an outage and thereafter, which comes as no surprise with recent surges in ransomware and other attacks wreaking havoc across IT infrastructures, a Dimensional Research survey r… Continue reading Security teams need to become more proactive and risk-driven
There are many risk assessment guidelines such NIST800-30 and ISO 27005 that provide a catalogue of known threats as reference. Using a qualitative approach, I selected one threat events catalogue and I tried to select the threats that are… Continue reading How to use pre-existing threat catalogue to determine if a certain system is vulnerable?
MITRE Corporation has released the tenth version of ATT&CK, its globally accessible (and free!) knowledge base of cyber adversary tactics and techniques based on real-world observations. Version ten comes with new Data Source objects, new and chan… Continue reading Released: MITRE ATT&CK v10
I’m trying to apply STRIDE to secure my architecture.
xxx
xxx
xxx
┌──────────┐xx ┌──────────┐
│ node ├─xx──────signals───────► hub │
│ │ x │ │
└───▲… Continue reading How to correctly classify a threats related to Tampering in STRIDE
When reading about mobile security, the attacker is often assumed to have root access to the device, so as to patch the application or proxy all network traffic.
I see that such applications may have generic vulnerabilities, like non-encry… Continue reading What’s the threat model of mobile security?
I’m new to security and I’m trying to create an attack tree based on MITRE ATT&CK techniques.
What is unclear, is how I can incorporate some steps that are optional.
For instance, if the attacker’s goal is to exfiltrate data, they may … Continue reading How to show optional steps in attack trees?
There are several threat modeling methods for software, for instance STRIDE, PASTA, LINDDUN and more. When it comes to threat modeling of a whole network, I can see how attack trees and attack graphs may be used. Are there any well establi… Continue reading Network Threat Modeling
With 5G reshaping the smartphone market, 5G security needs to keep up. Almost one in three smartphones sold in the first quarter of 2021 can connect to a 5G network. That’s just one year after the world’s first commercial 5G network emerged in South Korea. Such growth helped annual shipment numbers of 5G-enabled smartphones exceed […]
The post Threat Modeling: The Key to Dealing With 5G Security Challenges appeared first on Security Intelligence.
Continue reading Threat Modeling: The Key to Dealing With 5G Security Challenges