حوكمة ومخاطر وامتثال الأمن السيبراني (GRC) 13 بند

Threat Modeling (STRIDE) Review

قائمة التحقق هذه باللغة الإنجليزية.

Reviews the threat modeling practice for a system or feature using STRIDE, covering scoping, decomposition, threat identification, mitigation, and integration into the SDLC.

OWASPNIST 800-154Microsoft SDL

PDF أو Word مجانًا · أدخل بريدك الإلكتروني للتنزيل.

Scope & Decomposition

Is the system decomposed with a data flow diagram showing components, flows, and trust boundaries? *
Are external dependencies, entry points, and assets identified? *
Are the security objectives and in-scope assets defined for the model? *

Threat Identification (STRIDE)

Are Spoofing threats analyzed for each authentication boundary? *
Are Tampering threats analyzed for data in transit and at rest? *
Are Repudiation risks assessed against logging and non-repudiation controls? *
Are Information Disclosure, Denial of Service, and Elevation of Privilege threats enumerated? *

Risk & Mitigation

Is each identified threat rated by risk (e.g., likelihood and impact)? *
Is a mitigation, acceptance, or transfer decision recorded for each threat? *
Are mitigations tracked to closure with owners? *

SDLC Integration

Is threat modeling performed during design, before implementation? *
Are models updated when architecture changes materially? *
Do resulting security requirements feed into test cases and code review?

نزّل قائمة تحقق Threat Modeling (STRIDE) Review كاملة

احصل عليها مجانًا بصيغة PDF أنيقة قابلة للطباعة أو مستند Word قابل للتعديل.