Amateur Security Archaeologists, trying not to break things.

Tag: Threat Modeling (Page 6 of 7)

Thwart APTs and unveil secrets with ATT&CK’s Threat Intelligence

As you saw in the previous post, ATT&CK is loaded with potential to hit a lot of use cases. Most CTI organizations are at least considering the use of ATT&CK to structure their reports and feeds. It provides analysts with a common language and structure. ATT&CK fosters better collaboration and easier consumption of the findings for all, including you and your tools.

old-school picture of an OSS spy with his radio in the mountains
I’ve gotta get my inputs back to HQ before they publish ATT&CK v15!
Continue reading

Worry less and know your enemy with MITRE ATT&CK!

AI depiction of barbarians waiting at the fiery gates of something ominous
Our last penetration test was a little too obvious – maybe we should specify “don’t burn it all down”?

If you’ve known me for a while, you know I love talking about MITRE’s ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge). I probably have an unhealthy addiction to discussing it, but I do think it is helpful to understand why it is both cool and has limits. So let’s discuss!

Continue reading

Don’t worry, AppDev can Threat Model like a champ!

A bunch of WASPs trying to penetrate a laptop's screen because they are after the web application
What some call a penetration test, others call a bug scrub…

If you are landing here after reading earlier posts, you might be thinking “this is great, but what I REALLY need is to avoid being the next <insert bad breach company here>. Well, our friends at OWASP (Open Web Application Security Project) are an organization that focuses on improving the security of software. Like any good David Letterman fan, they are famous for their Top 10 list of web application threats, and have followed that up with an API version! Threat modeling for software applications are essential not only to the end customers, but with the sheer complexity of today’s typical environments, the legal ramifications of a breach or attack can spell disaster for the hosting company, the software vendor, business partners, ecosystem partners, and the end users alike. It should be no surprise then that OWASP has its own approach to application threat modeling.

Continue reading

Ally with attack trees to threat model more effectively

To be clear, I don’t want you to raze the Amazon Rainforest here. What I am referring to for this blog post is another visualization technique. Where as DFDs focused on understanding the flow of information through your systems, Attack Trees are another graphical representation to uncover how an attacker might exploit weaknesses in a system to achieve specific malicious objectives.

Weird tree-borne monster getting ready to attack something.
Larry in accounting is tired of being scapegoated as the #1 most common threat vector
Continue reading

Get with the Flow

We’ve talked about Microsoft’s view of threat modeling, but this next one might appeal to folks with a background in software that doesn’t crash – sorry, I jest, i jest! (or do I?) Well in this useful method, we’re all about understanding the flow of data across our systems. We’re talking Data Flow Diagrams (DFDs) used in software engineering and systems analysis.

Continue reading
« Older posts Newer posts »
Verified by MonsterInsights