GRC Keamanan Siber 13 butir

Threat Modeling (STRIDE) Review

Daftar periksa ini dalam bahasa Inggris.

Reviews the threat modeling practice for a system or feature using STRIDE, covering scoping, decomposition, threat identification, mitigation, and integration into the SDLC.

OWASPNIST 800-154Microsoft SDL

PDF atau Word gratis · masukkan email Anda untuk mengunduh.

Scope & Decomposition

Is the system decomposed with a data flow diagram showing components, flows, and trust boundaries? *
Are external dependencies, entry points, and assets identified? *
Are the security objectives and in-scope assets defined for the model? *

Threat Identification (STRIDE)

Are Spoofing threats analyzed for each authentication boundary? *
Are Tampering threats analyzed for data in transit and at rest? *
Are Repudiation risks assessed against logging and non-repudiation controls? *
Are Information Disclosure, Denial of Service, and Elevation of Privilege threats enumerated? *

Risk & Mitigation

Is each identified threat rated by risk (e.g., likelihood and impact)? *
Is a mitigation, acceptance, or transfer decision recorded for each threat? *
Are mitigations tracked to closure with owners? *

SDLC Integration

Is threat modeling performed during design, before implementation? *
Are models updated when architecture changes materially? *
Do resulting security requirements feed into test cases and code review?

Unduh daftar periksa Threat Modeling (STRIDE) Review lengkap

Dapatkan secara gratis sebagai PDF yang rapi dan siap cetak atau dokumen Word yang dapat diedit.