Threat Modeling Izar Tarandach, Matthew J. Coles

Threat Modeling Izar Tarandach, Matthew J. Coles - okladka książki

Autorzy:: Izar Tarandach, Matthew J. Coles
Wydawnictwo:: O'Reilly Media (Z chęcią przeczytam książkę w języku polskim)
Ocena:: Bądź pierwszym, który oceni tę książkę
Stron:: 252
Dostępne formaty:: ePub

Mobi

Ebook 29,90 zł najniższa cena z 30 dni

~~219,00 zł~~ (-15%)
186,15 zł

Dodaj do koszyka lub Kup na prezent Kup 1-kliknięciem

29,90 zł najniższa cena z 30 dni

Przenieś na półkę

Do przechowalni

Threat modeling is one of the most essential--and most misunderstood--parts of the development lifecycle. Whether you're a security practitioner or a member of a development team, this book will help you gain a better understanding of how you can apply core threat modeling concepts to your practice to protect your systems against threats.

Contrary to popular belief, threat modeling doesn't require advanced security knowledge to initiate or a Herculean effort to sustain. But it is critical for spotting and addressing potential concerns in a cost-effective way before the code's written--and before it's too late to find a solution. Authors Izar Tarandach and Matthew Coles walk you through various ways to approach and execute threat modeling in your organization.

Explore fundamental properties and mechanisms for securing data and system functionality
Understand the relationship between security, privacy, and safety
Identify key characteristics for assessing system security
Get an in-depth review of popular and specialized techniques for modeling and analyzing your systems
View the future of threat modeling and Agile development methodologies, including DevOps automation
Find answers to frequently asked questions, including how to avoid common threat modeling pitfalls

Wybrane bestsellery

Ebooka "Threat Modeling" przeczytasz na:

czytnikach Inkbook, Kindle, Pocketbook, Onyx Boox i innych
systemach Windows, MacOS i innych

systemach Windows, Android, iOS, HarmonyOS
na dowolnych urządzeniach i aplikacjach obsługujących formaty: PDF, EPub, Mobi

Masz pytania? Zajrzyj do zakładki Pomoc »

Audiobooka "Threat Modeling" posłuchasz:

w aplikacji Ebookpoint na Android, iOS, HarmonyOs
na systemach Windows, MacOS i innych

na dowolonych urządzeniach
i aplikacjach obsługujących format MP3
(pliki spakowane w ZIP)

Masz pytania? Zajrzyj do zakładki Pomoc »

Kurs Video "Threat Modeling" zobaczysz:

Oceny i opinie klientów: Threat Modeling Izar Tarandach, Matthew J. Coles (0)

Szczegóły książki

ISBN Ebooka:: 978-14-920-5650-8, 9781492056508
Data wydania ebooka :: 2020-11-13 Data wydania ebooka często jest dniem wprowadzenia tytułu do sprzedaży i może nie być równoznaczna z datą wydania książki papierowej. Dodatkowe informacje możesz znaleźć w darmowym fragmencie. Jeśli masz wątpliwości skontaktuj się z nami sklep@ebookpoint.pl.
Język publikacji:: angielski
Rozmiar pliku ePub:: 8.8MB
Rozmiar pliku Mobi:: 17.2MB

Zgłoś erratę

Kategorie

Kliknij, aby zgłosić błędnie przypisaną kategorię »

Informatyka » Hacking » Bezpieczeństwo systemów

Spis treści książki

Foreword
Preface
- Why We Wrote This Book
- Who This Book Is For
- What Is (and Isnt!) in This Book
- These Techniques Apply Across Various Systems
- Your Contribution Matters
- Conventions Used in This Book
- OReilly Online Learning
- How to Contact Us
- Acknowledgments
Introduction
- The Basics of Threat Modeling
  - What Is Threat Modeling?
  - Why You Need Threat Modeling
  - Obstacles
  - Threat Modeling in the System Development Life Cycle
    - Developing secure systems
    - No more waterfalling
    - Implementation and testing
    - Documentation and deployment
- Essential Security Principles
  - Basic Concepts and Terminology
  - Calculating Severity or Risk
    - CVSS (severity)
    - DREAD (risk)
      - FAIR Method for risk quantification (risk)
  - Core Properties
    - Confidentiality
    - Integrity
    - Availability
    - Privacy
    - Safety
  - Fundamental Controls
    - Identification
    - Authentication
    - Authorization
    - Logging
    - Auditing
  - Basic Design Patterns for Secure Systems
    - Zero trust
    - Design by contract
    - Least privilege
    - Defense in depth
    - Keeping things simple
    - No secret sauce
    - Separation of privilege
    - Consider the human factor
    - Effective logging
    - Fail secure
    - Build in, not bolt on
- Summary
1. Modeling Systems
- Why We Create System Models
- System Modeling Types
  - Data Flow Diagrams
  - Sequence Diagrams
  - Process Flow Diagrams
  - Attack Trees
    - Identify a target or goal for an attack
    - Identify actions to be taken to achieve the target or goal
    - Rinse and repeat
  - Fishbone Diagrams
- How to Build System Models
- What Does a Good System Model Look Like?
- Summary
2. A Generalized Approach to Threat Modeling
- Basic Steps
- What You Are Looking for in a System Model
  - The Usual Suspects
  - What You Should Not Expect to Discover
- Threat Intelligence Gathering
- Summary
3. Threat Modeling Methodologies
- Before We Go Too Deep
- Looking Through Filters, Angles, and Prisms
- To the Methodologies, at Last!
  - STRIDE
  - STRIDE per Element
  - STRIDE per Interaction
  - Process for Attack Simulation and Threat Analysis
    - Define business objectives
    - Define technical scope
    - Decompose the application
    - Perform threat analysis
    - Detect vulnerabilities
    - Enumerate attacks
    - Perform risk and impact analysis
  - Threat Assessment and Remediation Analysis
  - Trike
    - Requirements model
    - Implementation model
    - The threat model
    - The risk model
- Specialized Methodologies
  - LINDDUN
  - Madness? This Is SPARTA!
  - INCLUDES NO DIRT
- Shall We Play a Game?
  - Game: Elevation of Privilege
  - Game: Elevation of Privilege and Privacy
  - Game: OWASP Cornucopia
  - Game: Security and Privacy Threat Discovery Cards
  - Game: LINDDUN GO
- Summary
4. Automated Threat Modeling
- Why Automate Threat Modeling?
- Threat Modeling from Code
  - How It Works
    - Threatspec
    - ThreatPlaybook
- Threat Modeling with Code
  - How It Works
    - Minimalist architecture description language for threat modeling
    - Elements and collections
    - Ports
    - Data and data flows
    - Other model description languages
    - Analysis of graphs and metadata
  - pytm
  - Threagile
- An Overview of Other Threat Modeling Tools
  - IriusRisk
  - SD Elements
  - ThreatModeler
  - OWASP Threat Dragon
  - Microsoft Threat Modeling Tool
  - CAIRIS
  - Mozilla SeaSponge
  - Tutamen Threat Model Automator
- Threat Modeling with ML and AI
- Summary
5. Continuous Threat Modeling
- Why Continuous Threat Modeling?
- The Continuous Threat Modeling Methodology
- Evolutionary: Getting Better All the Time
- The Autodesk Continuous Threat Modeling Methodology
  - Baselining
  - Baseline Analysis
  - When Do You Know You Did Enough?
  - Threat Model Every Story
  - Findings from the Field
- Summary
6. Own Your Role as a Threat Modeling Champion
- How Do I Get Leadership On-Board with Threat Modeling?
- How Do I Overcome Resistance from the Rest of the Product Team?
- How Do We Overcome the Sense of (or Actual) Failure at Threat Modeling?
- How Should I Choose a Threat Modeling Methodology from Many Similar Approaches?
- How Should I Deliver the Bad News?
- What Actions Should I Take for Accepted Findings?
- Did I Miss Something?
- Summary and Closing
- Further Reading
A. A Worked Example
- High-Level Process Steps
- Approaching Your First System Model
- Leading a Threat Modeling Exercise
- A Sample Exercise: Creating a System Model
  - Identifying Components, Flows, and Assets
  - Identifying System Weaknesses and Vulnerabilities
  - Identifying Threats
  - Determining Exploitability
  - Wrapping Things Up
Index