Hello I need help with this assignment I need to create a threat modeling with t

Question

Hello I need help with this assignment I need to create a threat modeling with the following guidelines that I have listed below. Thank you in advance.

Threat Modeling

Explore the use of threat modeling to communicate threats associated with a software application.

Download: MS Threat Modeling Tool for network DFD

Assigment: Students will do individual work. The deliverable is a short example of a threat model for a webbased internal employee directory. The system will have information on employees – where their desk is, their phone number, what they do, a picture, etc. Using no more than 3 threats, develop and document a threat model.

Explanation / Answer

threat modelling is a process which can be implemented in 3 steps. it is an approach to measurre the security of an application. It is a structured approach that enables you to identify, quantify, and address the security risks associated with an application.

step i -

The first step in the threat modeling process is concerned with gaining an understanding of the application and how it interacts with external entities. It involves extracting the required information for the design , identifying items which the attacker might be interested in, and identifying trust levels which represent the access rights that the application will grant to external entities. This information is documented in the Threat Model document and it is also used to produce data flow diagrams (DFDs) for the application. The DFDs show the different paths through the system, highlighting the privilege boundaries.

step ii -

Determine and rank threats. The goal of the threat categorization is to help identify threats both from the attacker (STRIDE) and the defensive perspective (ASF). DFDs produced in step 1 help to identify the potential threat targets from the attacker's perspective, such as data sources, processes, data flows, and interactions with users. These threats can be identified further as the roots for threat trees; there is one tree for each threat goal

step iii -

Determine countermeasures and mitigation. A lack of protection against a threat might indicate a vulnerability whose risk exposure could be mitigated with the implementation of a countermeasure. Such countermeasures can be identified using threat-countermeasure mapping lists. Once a risk ranking is assigned to the threats, it is possible to sort threats from the highest to the lowest risk, and prioritize the mitigation effort, such as by responding to such threats by applying the identified countermeasures

------------------------------------------------------------------

Related Questions

Navigate

• Browse (All)
• Browse H
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.