サイバーセキュリティGRC 13項目

Threat Modeling (STRIDE) Review

このチェックリストは英語版です。

Reviews the threat modeling practice for a system or feature using STRIDE, covering scoping, decomposition, threat identification, mitigation, and integration into the SDLC.

OWASPNIST 800-154Microsoft SDL

無料のPDFまたはWord・メールアドレスを入力してダウンロード。

Scope & Decomposition

Is the system decomposed with a data flow diagram showing components, flows, and trust boundaries? *
Are external dependencies, entry points, and assets identified? *
Are the security objectives and in-scope assets defined for the model? *

Threat Identification (STRIDE)

Are Spoofing threats analyzed for each authentication boundary? *
Are Tampering threats analyzed for data in transit and at rest? *
Are Repudiation risks assessed against logging and non-repudiation controls? *
Are Information Disclosure, Denial of Service, and Elevation of Privilege threats enumerated? *

Risk & Mitigation

Is each identified threat rated by risk (e.g., likelihood and impact)? *
Is a mitigation, acceptance, or transfer decision recorded for each threat? *
Are mitigations tracked to closure with owners? *

SDLC Integration

Is threat modeling performed during design, before implementation? *
Are models updated when architecture changes materially? *
Do resulting security requirements feed into test cases and code review?

Threat Modeling (STRIDE) Reviewチェックリストの完全版をダウンロード

印刷しやすいPDF、または編集可能なWord文書で無料で入手できます。