glossaries

PenTesting/threat_modeling.md

@@ -0,0 +1,39 @@
+# Threat Modeling (Design Review)
+
+1. Information Collection:
+    * Assets
+    * Entry points
+    * External entities
+    * External trust levels
+    * Major components
+    * User Scenarios
+
+    - Developer interviews
+    - Developer documentation
+    - Standards documentation
+    - Sources profiling
+    - System profiling: File system layout, code reuse, import/exports, sandboxing, scanning.
+
+2. Application architecture modeling:
+    - UML
+    - Data flow diagrams (DFD)
+
+3. Threat identification:
+    - Attack trees: each subnode states an attack methodology that could be used to achieve the goal in the root node. Arc between nodes are AND connectors. Circular nodes are mitigation. Dashed lines indicated unlikely attack vector.
+    - Textual representation.
+
+4. Documentation of findings:
+    - Thread, Affected Component, Description, Result, Mitigation strategy.
+    - DREAD Risk Ratings (damage potential, reproducibility, exploitability, affected users, discoverability), with scores from 1 to 10.
+
+
+5. Prioritizing the implementation review
+
+
+### Application access:
+* Source only (static analysis)
+* Binary only (live analysis and reverse engineering)
+* Both source and binary access
+* Checked build: an binary with no source code but with debugging information.
+* Source black box: black box and fuzz testing (example: web applications). Example: auditing a web server with entry point at TCP port 80, you use a HTTP protocol fuzzer.
+