GRC de ciberseguridad 13 elementos
Threat Modeling (STRIDE) Review
Esta lista de verificación está en inglés.
Reviews the threat modeling practice for a system or feature using STRIDE, covering scoping, decomposition, threat identification, mitigation, and integration into the SDLC.
OWASPNIST 800-154Microsoft SDL
PDF o Word gratuito · introduzca su correo electrónico para descargar.
Scope & Decomposition
- Is the system decomposed with a data flow diagram showing components, flows, and trust boundaries? *
- Are external dependencies, entry points, and assets identified? *
- Are the security objectives and in-scope assets defined for the model? *
Threat Identification (STRIDE)
- Are Spoofing threats analyzed for each authentication boundary? *
- Are Tampering threats analyzed for data in transit and at rest? *
- Are Repudiation risks assessed against logging and non-repudiation controls? *
- Are Information Disclosure, Denial of Service, and Elevation of Privilege threats enumerated? *
Risk & Mitigation
- Is each identified threat rated by risk (e.g., likelihood and impact)? *
- Is a mitigation, acceptance, or transfer decision recorded for each threat? *
- Are mitigations tracked to closure with owners? *
SDLC Integration
- Is threat modeling performed during design, before implementation? *
- Are models updated when architecture changes materially? *
- Do resulting security requirements feed into test cases and code review?
Descargue la lista de verificación Threat Modeling (STRIDE) Review completa
Obténgala gratis como PDF limpio e imprimible o como documento de Word editable.