威胁建模
Threat modeling
Adam Shostack · 初版 2014 年
1人推荐
2位读者提及
2次提及
“Adam Shostack 在 Microsoft 负责 security development lifecycle 的 threat modeling，是全球屈指可数的 threat modeling 专家之一。如今，他在这本独一无二的著作中倾囊相授其丰富的专业知识。书中满是具体可行的建议，详细阐述了如何从一开始就将更出色的安全性融入系统、软件或服务的设计之中。你将探索各种 threat modeling 方法，了解如何针对威胁测试你的设计，并学习在 Microsoft 及其他顶尖公司中得到验证的有效应对威胁之道。”——
Hacker News 上怎么说
正在加载完整评论……
……被提及了。Stuart McClure 的《Hacking Exposed 7》、Kim Zetter 的《Countdown to Zero Day》、Kevin Mitnick 的《Ghost in the Wires》、Brian Krebs 的《Spam Nation》、Michael Sikorski 的《Practical Malware Analysis》、Adam Shostack 的《Threat Modeling》、Christopher Hadnagy 的《Social Engineering》、Peter Kim 的《The Hacker Playbook 3》、Richard Bejtlich 的《The Practice of Network Security Monitoring》、Fred Kaplan 的《Dark Territory》、The Code……
…were mentioned. Hacking Exposed 7 by Stuart McClure Countdown to Zero Day by Kim Zetter Ghost in the Wires by Kevin Mitnick Spam Nation by Brian Krebs Practical Malware Analysis by Michael Sikorski Threat Modeling by Adam Shostack Social Engineering by Christopher Hadnagy The Hacker Playbook 3 by Peter Kim The Practice of Network Security Monitoring by Richard Bejtlich Dark Territory by Fred Kaplan The Code…
……沟通的方式。微软在 2000 年代初通过 TwC（可信计算）倡议在内部孵化了不少这类想法，并围绕威胁建模（threat modeling）和安全意识构建了一套协议——以及开发工作流。他们内部以安全为导向的协议大部分都免费公开了：https://www.microsoft.com/en-us/sdl/ 一些工具也是免费的。对于想要……的独立开发者来说
…ways to communicate Microsoft developed quite a few of these ideas internally with the TwC (Trustworthy Computing) initiative in the early 2000s, and built a protocol - and development workflow - around threat modeling and security awareness. Most of their internal security-oriented protocol is listed for free: https://www.microsoft.com/en-us/sdl/ As are some of their tools. For individual developers wanting to have…