Book Image

Threat Modeling

By : Adam Shostack
Book Image

Threat Modeling

By: Adam Shostack

Overview of this book

As more software is delivered on the Internet or operates on Internet-connected devices, the design of secure software is critical. This book will give you the confidence to design secure software products and systems and test their designs against threats. This book is the only security book to be chosen as a Dr. Dobbs Jolt Award Finalist since Bruce Schneier?s Secrets and Lies and Applied Cryptography! The book starts with an introduction to threat modeling and focuses on the key new skills that you'll need to threat model and lays out a methodology that's designed for people who are new to threat modeling. Next, you?ll explore approaches to find threats and study the advantages and disadvantages of each approach. Moving ahead, you?ll manage threats and learn about the activities involved in threat modeling. You?ll also focus on threat modeling of specific technologies and find out tricky areas and learn to address them. Towards the end, you?ll shift your attention to the future of threat modeling and its approaches in your organization. By the end of this book, you?ll be able to use threat modeling in the security development lifecycle and in the overall software and systems design processes.
Table of Contents (15 chapters)
Free Chapter
1
Cover
7
Glossary
8
Bibliography
10
End User License Agreement

Chapter 12
Requirements Cookbook

Important threats violate important security requirements. Ideally, those requirements are explicit, crisp, agreed-on within the development organization, and understood by customers and the people impacted by the system. Unfortunately, this is rarely the case. In part, that's because requirements are very difficult to do well. That makes requirements a tedious way to start a project, and as the agile folks will tell you, YAGNI (“you ain't gonna need it”)—so we should skip straight to user stories, right? Maybe, but maybe not.

As you discover threats, you'll be forced to decide whether the threat matters. Some of that decision will be based on a risk calculation, and some will be based on a requirements calculation. If your system is not designed to maintain security in the face of hostile administrators, then all effort spent on mitigating hostile administrators will be wasted.

That said, this chapter starts with an...