Osoby które kupowały "Threat Modeling", wybierały także:

• Learning Java Lambdas 373,75 zÅ‚, (29,90 zÅ‚ -92%)
• The DevOps 2.1 Toolkit: Docker Swarm 332,22 zÅ‚, (29,90 zÅ‚ -91%)
• Securing Network Infrastructure 199,33 zÅ‚, (29,90 zÅ‚ -85%)
• Mastering Linux Security and Hardening 186,88 zÅ‚, (29,90 zÅ‚ -84%)
• Blockchain Development with Hyperledger 175,88 zÅ‚, (29,90 zÅ‚ -83%)

Spis treści

Threat Modeling eBook -- spis treści

• Foreword
• Preface
  • Why We Wrote This Book
  • Who This Book Is For
  • What Is (and Isnt!) in This Book
  • These Techniques Apply Across Various Systems
  • Your Contribution Matters
  • Conventions Used in This Book
  • OReilly Online Learning
  • How to Contact Us
  • Acknowledgments
• Introduction
  • The Basics of Threat Modeling
    • What Is Threat Modeling?
    • Why You Need Threat Modeling
    • Obstacles
    • Threat Modeling in the System Development Life Cycle
      • Developing secure systems
      • No more waterfalling
      • Implementation and testing
      • Documentation and deployment
  • Essential Security Principles
    • Basic Concepts and Terminology
    • Calculating Severity or Risk
      • CVSS (severity)
      • DREAD (risk)
        • FAIR Method for risk quantification (risk)
    • Core Properties
      • Confidentiality
      • Integrity
      • Availability
      • Privacy
      • Safety
    • Fundamental Controls
      • Identification
      • Authentication
      • Authorization
      • Logging
      • Auditing
    • Basic Design Patterns for Secure Systems
      • Zero trust
      • Design by contract
      • Least privilege
      • Defense in depth
      • Keeping things simple
      • No secret sauce
      • Separation of privilege
      • Consider the human factor
      • Effective logging
      • Fail secure
      • Build in, not bolt on
  • Summary
• 1. Modeling Systems
  • Why We Create System Models
  • System Modeling Types
    • Data Flow Diagrams
    • Sequence Diagrams
    • Process Flow Diagrams
    • Attack Trees
      • Identify a target or goal for an attack
      • Identify actions to be taken to achieve the target or goal
      • Rinse and repeat
    • Fishbone Diagrams
  • How to Build System Models
  • What Does a Good System Model Look Like?
  • Summary
• 2. A Generalized Approach to Threat Modeling
  • Basic Steps
  • What You Are Looking for in a System Model
    • The Usual Suspects
    • What You Should Not Expect to Discover
  • Threat Intelligence Gathering
  • Summary
• 3. Threat Modeling Methodologies
  • Before We Go Too Deep
  • Looking Through Filters, Angles, and Prisms
  • To the Methodologies, at Last!
    • STRIDE
    • STRIDE per Element
    • STRIDE per Interaction
    • Process for Attack Simulation and Threat Analysis
      • Define business objectives
      • Define technical scope
      • Decompose the application
      • Perform threat analysis
      • Detect vulnerabilities
      • Enumerate attacks
      • Perform risk and impact analysis
    • Threat Assessment and Remediation Analysis
    • Trike
      • Requirements model
      • Implementation model
      • The threat model
      • The risk model
  • Specialized Methodologies
    • LINDDUN
    • Madness? This Is SPARTA!
    • INCLUDES NO DIRT
  • Shall We Play a Game?
    • Game: Elevation of Privilege
    • Game: Elevation of Privilege and Privacy
    • Game: OWASP Cornucopia
    • Game: Security and Privacy Threat Discovery Cards
    • Game: LINDDUN GO
  • Summary
• 4. Automated Threat Modeling
  • Why Automate Threat Modeling?
  • Threat Modeling from Code
    • How It Works
      • Threatspec
      • ThreatPlaybook
  • Threat Modeling with Code
    • How It Works
      • Minimalist architecture description language for threat modeling
      • Elements and collections
      • Ports
      • Data and data flows
      • Other model description languages
      • Analysis of graphs and metadata
    • pytm
    • Threagile
  • An Overview of Other Threat Modeling Tools
    • IriusRisk
    • SD Elements
    • ThreatModeler
    • OWASP Threat Dragon
    • Microsoft Threat Modeling Tool
    • CAIRIS
    • Mozilla SeaSponge
    • Tutamen Threat Model Automator
  • Threat Modeling with ML and AI
  • Summary
• 5. Continuous Threat Modeling
  • Why Continuous Threat Modeling?
  • The Continuous Threat Modeling Methodology
  • Evolutionary: Getting Better All the Time
  • The Autodesk Continuous Threat Modeling Methodology
    • Baselining
    • Baseline Analysis
    • When Do You Know You Did Enough?
    • Threat Model Every Story
    • Findings from the Field
  • Summary
• 6. Own Your Role as a Threat Modeling Champion
  • How Do I Get Leadership On-Board with Threat Modeling?
  • How Do I Overcome Resistance from the Rest of the Product Team?
  • How Do We Overcome the Sense of (or Actual) Failure at Threat Modeling?
  • How Should I Choose a Threat Modeling Methodology from Many Similar Approaches?
  • How Should I Deliver the Bad News?
  • What Actions Should I Take for Accepted Findings?
  • Did I Miss Something?
  • Summary and Closing
  • Further Reading
• A. A Worked Example
  • High-Level Process Steps
  • Approaching Your First System Model
  • Leading a Threat Modeling Exercise
  • A Sample Exercise: Creating a System Model
    • Identifying Components, Flows, and Assets
    • Identifying System Weaknesses and Vulnerabilities
    • Identifying Threats
    • Determining Exploitability
    • Wrapping Things Up
• Index