Risk Centric Threat Modeling: Process for Attack Simulation and Threat Analysis (Hardcover)

Foreword ix

Preface xv

List of Figures xvii

List of Tables xxiii

1 Threat Modeling Overview 1

Definitions 1

Origins and Use 3

Summary 8

Rationale and Evolution of Security Analysis 9

Summary 19

Building A Better Risk Model 19

Summary 31

Threat Anatomy 33

Summary 48

Crowdsourcing Risk Analytics 48

2 Objectives and Benefits of Threat Modeling 63

Defining a Risk Mitigation Strategy 63

Improving Application Security 82

Building Security in the Software Development Life Cycle 92

Identifying Application Vulnerabilities and Design Flaws 104

Analyzing Application Security Risks 118

3 Existing Threat Modeling Approaches 137

Security Software Risk-Based Variants 137

4 Threat Modeling Within the SDLC 195

Building Security in SDLC with Threat Modeling 195

Integrating Threat Modeling Within The Different Types of SDLCs 205

5 Threat Modeling and Risk Management 235

Data Breach Incidents and Lessons for Risk Management 235

Threats and Risk Analysis 259

Risk-Based Threat Modeling 282

Threat Modeling in Information Security and Risk

Management Processes 289

Threat Modeling Within Security Incident Response Processes 306

6 Intro to PASTA 317

Risk-Centric Threat Modeling 317

7 Diving Deeper into PASTA 343

Exploring the Seven Stages and Embedded Threat Modeling Activities 343

Chapter Summary 478

8 PASTA Use Case 479

PASTA Use Case Example Walk-Through 479

Glossary 633

References 653

Index 657