October 2005 - Posts

High ROI Security Activities
You can create effective security activities based on the high ROI engineering activities : Security design guidelines Security architecture and design review Security code review Security testing Security deployment review Rather than interspersing security Read More...
Posted 11 October 05 06:58 by J.D. Meier | 5 Comments   
Filed under
Security Approaches That Don't Work
If it’s not broken, then don’t fix it ... The problem is, you may have an approach that isn’t working, or it’s not as efficient as it could be, but you may not even know it. Let’s take a quick look at some broken approaches and get to the bottom of why Read More...
Posted 11 October 05 06:50 by J.D. Meier | 3 Comments   
Filed under
Context Precision
A Web application is not a component is not a desktop application is not a Web service. If I gave you an approach to threat model a Web application, you can probably stretch the rubber band to fit Web services too. You could probably even bend it to work Read More...
Posted 10 October 05 07:36 by J.D. Meier | 4 Comments   
Filed under ,
Threat Modeling Terms and How To Use Them
I see a lot of confusion over terms when it comes to threat modeling. The terms matter because they shape focus. For example if you confuse threats with attacks, you've limited what you're looking for. There are the terms we used when we created our How Read More...
Posted 10 October 05 06:10 by J.D. Meier | 1 Comments   
Filed under

Search

This Blog

Syndication

Page view tracker