SlideShare a Scribd company logo
Running head: TITLE OF ESSAY
1
TITLE OF ESSAY
2
Title of Essay
Author’s Name
University of the Cumberlands
Abstract
Abstracts are research tools that can help you readers determine
if the scope of your article/essay will help them in their own
research. In APA, abstracts are typically 150-250 words in
length and provide an evaluative summary of the essay to
follow. The personal opinion of the author is strictly prohibited
in abstracts. Unlike a body paragraph, the first line of an
abstract is not tabbed-in. For many student essays, especially in
lower-numbers courses, an abstract will not be required; still, it
is good to practice this skill.
Title of Essay
In APA style, the introduction of the essay should begin here,
followed by the body paragraphs. APA is typically a more
formal style than most students are accustomed to using in a
writing course. For the purposes of this course, the level of
formality should be based on the assignment. For example:
APA asks that students always write in third person (avoiding
words such as I, me, we, our(s), you, your(s), etc). Certain
rhetorical modes, however, don’t cater well to third person
(narrative and reflection writing are two such examples). In
these situations, first person (I, me, we, our(s)) may be, and
should be employed; second person (you, your(s)) should be
avoided in all academic writing unless an essay is specifically
designed to relay instructions (there are few assignments that
will employ second person).
Like any essay, students should make sure their essays are
formatted with one inch margins, with their text exclusively in
Times New Roman 12-point font, and students should double
space their lines. This document can be downloaded and used
as a template wherein students may simply replace names, titles,
dates, and so on with their own information.
The final page of this document will demonstrate a References
page. If a student uses information from any source, that source
must be identified within the text and listed on a References
page. These citations should be listed in alphabetical order and,
opposite to the way a normal paragraph works, the first line
should be flush left and each following line should be tabbed in.
Though there is really no substitute for a good APA Style
Manual, students can refer to a citation generator such as
www.citationmachine.net to ensure proper formatting. Any
further questions should be directed to the instructor of the
course.
References
Badley, G. (2009). A place from where to speak: The university
and academic freedom. British
Journal of Educational Studies, 57(2), 146-163.
doi:10.1111/j.1467-
8527.2009.00429.x
Baumanns, M., Biedenkopf, K., Cole, J. R., Kerrey, B., & Lee,
B. (2009). The future of
universities and the fate of free inquiry and academic freedom:
Question and answer
session. Social Research, 76(3), 867-886. Retrieved from
EBSCOhost.
Berthoff, A. E. (2009). Learning the uses of chaos. In S. Miller
(Ed.), The Norton Book of
Composition Studies (pp. 649). New York: W. W. Norton &
Company.
Carroll, L. (2000) The Annotated Alice: The Definitive Edition.
M. Gardner (Ed.) NY: Norton. Elbow, P. (2000). Getting along
without grades—and getting along with them too. Everyone Can
Write: Essays Toward a Hopeful Theory of Writing and
Teaching Writing. NY: Oxford University Press.
APA Formatting
This document has the summarized, high points of the APA
format that all students need to be aware in writing papers
academically. There are many more details and requirements in
the APA than in this condensed version. If the item needed is
not included here, please refer to the APA manual or visit the
Purdue University Online Writing Lab (OWL) website for more
specific information in APA formatting.
Your essay should be typed, double-spaced on standard-sized
paper (8.5" x 11") with 1" margins on all sides. Indent 5 spaces
or ½ inch on the first line of every paragraph. You should use a
clear font that is highly readable. APA recommends using 12 pt.
Times New Roman font. There are two aspects of essay formats
that you should keep in mind:
· Every other line in the entire paper will have text.
· Consistency and uniformity is essential. Every essay from
each student will appear generally the same, except for specific
letters and words are different.
APA Title Page
The title page should contain the title of the paper, the author's
full name, and the school’s name. Include in the header of the
first page, the Running Head: and title of the paper in all
capitals are placed toward the left margin, and the page number
is placed toward the right margin. On the subsequent pages, the
header contains the title and page number. Please note that your
page number must be created with the word processor’s page
number feature. If the page number is entered in manually, it
will be the same number on every page rather than a page
number.
APA Citations
Anytime a writer borrows an idea or quote from other source, a
citation must be included in the essay. Whether it is
paraphrasing or quoting, credit must be given to avoid
plagiarism. APA requires the author’s name, year of
publication, and page or paragraph number must be included as
a citation in the paper. These three requirements can be
provided in two main options:
1. The requirements are provided at the end of the material
cited, and it is included in one simple parenthetical citation.
(author’s last name, year, page no.) Be sure to place the period
for the end of the sentence after the parenthetical citation.
For example:
The study indicated the patients recovered 47% of the time
without any harmful side effects (Hunter, 2004, pp. 365).
2. The author’s name is included in the body of the sentence.
The year follows the name in parentheses, and the page or
paragraph number is in parentheses at the end of the material
cited. For example:
Dr. Hunter (2004) performed two major clinical trials on breast
cancer. The studies indicated the patients recovered 47% of the
time without any harmful side effects (pp. 365).
3. When a personal interview, lecture, or seminar is used as a
source in a paper, APA only requires a citation to be included in
the body of the paper. Normally, the interviewee or lecturer
name is included in the body of the sentence, followed by the
parenthetical citation (Personal communication, date of
communication). For example:
Mr. Wayne Smith (Personal communication, June 25, 2012)
stated in an interview that each sample from the experiment
were handled and processed separated to prevent any potential
compromise of the study.
4. When using a direct quote (less than 40 words), usually the
author is used in the attributive tag with date cited after the
author. For example:
Wayne Smith (2012) explains, “Each sample from the
experiment were handled and processed separated to prevent
any potential compromise of the study.”
5. If using a block quotation (40 words or more), cite the quoted
source in parentheses after the final punctuation mark. Please
keep these points of block quotation in mind:
· Indent the block quote five spaces or half an inch.
· Do not use quotation marks.
· Double space the quote unless your school has a rule about
single spacing block quotes.
· Do not include any additional lines or spaces before or after
the block quote.
· Notice that in block quotes, the period goes before the
parentheses, not after.
For example:
Students at Nova Southeastern University have faced challenges
in learning how to use APA formatting. When discussing the
challenges, Strunk (1922) stated:
Use quotes around an article title or book chapter, but italicize
the title of a book, journal, brochure, or report when used in
the body of the paper. Use a short title in the parenthetical
citation or complete title if the title is short. NOTE Non-
periodical titles like books and book titles have all the
important words capitalized in the text citations, but these same
book titles do not have all the important words capitalized in
the reference list. (p. 342)
Continue here with your explanation or interpretation of the
block quote. Please write how the quote supports your thesis
specifically. This portion is a continuation of the original
paragraph that started with Students at Nova Southeastern
University.
APA References
Major points of the reference page(s) to keep in mind:
· Arrange entries in alphabetical order.
· An anonymous source is alphabetized by the word
“Anonymous.”
· A source that has no author is arranged, alphabetically by the
first significant word of the title.
· Do not indent the first line of the reference. Indent all
subsequent lines.
· Double space the entire references page.
· If references take up more than one page, do not retype the
word “References” on subsequent pages.
Unknown Author
If your source has an unknown author, the title of the article or
webpage is put in its place. Review the samples below for
reference and citation.
A place from where to speak: The university and academic
freedom. (2009). British
Journal of Educational Studies, 57(2), 146-163.
doi:10.1111/j.1467-
8527.2009.00429.x
NOTE: When your essay includes parenthetical citations of
sources with no author named, use a shortened version of the
source's title instead of an author's name. Use quotation marks
and italics as appropriate. For example, parenthetical citations
of the source above would appear as follows: (“A place from
where”, 2009).
Sample References
1. A magazine:
Last Name, F. (Publication Date). Article Title. Magazine
Name, Volume Number (Issue Number) Page Numbers.
Smith, J. (2009, January 21). Obama inaugurated as President.
Time, 171 (5) 21-23.
2. A Book:
Last Name, F. (Year Published). Book Title. Publisher City:
Publisher Name.
Brown, D. (2004). The DaVinci code. New York: Scholastic.
3. A journal from an online database:
Last Name, F. (Year Published). Article Title. Journal name,
Volume number, (Issue number)Page Numbers. Retrieved from
Web Address
Ayyamperumal, A., Parveen, B., Ravindran, V., & Tharini, G.
(2012). Cutaneous manifestations of internal malignancy. Indian
Journal of Dermatology, 57(4), 260. Retrieved from
http://go.galegroup.com/ps/i.do?id=GALE%7CA295455160&v
=2.1&u=pho38373&it=r&p=AONE&sw=w
4. A document or news website:
Last Name, F. (Year Published). Page title. Website title.
Retrieved from Web Address
Smith, J. (2009, January 21). Obama inaugurated as President.
CNN.com. Retrieved from http://www.cnn.com/POLITICS/
01/21/obama_inaugurated/index.html
5. A journal:
Last Name, F. (Year Published). Article Title. Journal name,
Volume number, (Issue number)Page Numbers.
Smith, J. (2009). Studies in pop rocks and Coke. Weird Science,
12 (1). 78-93.
6. A video weblog:
Video Title. (video file) Retrieved from Web Address
Preventive benefits-better health is in your hands. (video file).
Retrieved from
http://www.youtube.com/user/CMSHHSgov?v=Z5bjUYgfqhw
7. A radio/TV:
EPISODE OF PROGRAM: Last Name, F. (Writer), & Last
Name, F. (Director). (Year Broadcast). Episode [Program Type
series episode]. In F. Last Name (Producer), Program. Network
City: Network.
INDIVIDUAL BROADCAST: Last Name, F. (Producer). (Date
Broadcast). Program [Program Type broadcast]. Network City:
Network.
Crystal, L. (Executive Producer). (1993, October 11). The
McNeil Lehrer news hour. [Television broadcast]. New York
and Washington DC: Public Broadcasting Service.
8. An encyclopedia/dictionary:
Last Name, F. (Year Published). Article Title. In
Encyclopedia/Dictionary name (Vol. Volume Number, Page
Numbers). Publication City: Publisher Name.
Smith, J. (2009). Internet. In Encyclopaedia Britannica (Vol.
20, pp. 81-82). Chicago: Encyclopaedia Britannica.
Please note: these are the most common examples of sources
used by students, please use the APA manual or Purdue’s OWL
website.
The information collected in this handout is based on the
Publication Manual of the American Psychological Association,
6th Edition (July 2009) Washington, D.C.
ISOL536
Security Architecture
and Design
Threat Modeling
Week 1
Agenda
• About this course
• About threat modeling
About this course
About this course
About threat modeling
Threat Modeling in Depth
• 8 weeks
• 8 weeks of deep material
• 8 Lectures
• 5 Quizzes (Drop lowest grade)
• 2 Exams (Mid-term and Final)
• Text: Threat Modeling: Designing for Security (Wiley, 2014)
Course Description
• This course discusses useful models used to address
potential threats in software systems and how to apply
such models in developing secure software and systems.
Areas of study focus on threat modeling strategies,
including finding threats, addressing threats, and threat
modeling technologies.
Major Instructional Areas
• Understanding threat modeling
• Strategies for finding threats
• Techniques for managing threats
• Validating threat handling activities
• Understanding environment-specific threats
Course Objectives
• Explain threat modeling and its importance to secure
architecture.
• Explore strategies for threat modeling.
• Understand how techniques, such as STRIDE, are useful in
finding
threats.
• Find threats using attack trees.
• Identify threats with attack libraries.
• Explore privacy tools.
• Show how to process and manage threats.
• Employ defensive tactics and technologies.
Course Objectives
• Consider key tradeoffs when addressing threats.
• Validate that threats are addressed.
• Survey common threat modeling tools.
• Develop a repository of requirements.
• Examine web and cloud threats.
• Understand user accounts and identity.
• Explore how human factors and usability affect threat
modeling.
SCANS Objectives
• SCANS is an acronym for Secretary’s Commission on
Achieving Necessary Skills. The committee, appointed by
the National Secretary of Labor in 1990, created a list of
skills and competencies that continue to be a valuable
resource for individuals developing their careers in a high-
tech job market. For more information on the SCANS
objectives, visit The U.S. Department of Labor
Employment andTraining Administration:
www.doleta.gov.
http://www.doleta.gov/
Required and Recommended
Resources
• Required Resources
• Shostack, Adam. Threat Modeling: Designing for Security,
Indianapolis, IN: Wiley, 2014
• Recommended Resources
• Please use the following author’s names, book/article titles,
Web
sites, and/or keywords to search for supplementary information
to
augment your learning in this subject.
• Tony UcedaVelez and Marco M. Morana. Rick CentricThreat
Modeling: Process for Attack Simulation andThreat Analysis
Information Search
• Use the following keywords to search for additional
online resources that may be used for supporting your
work on the course assignments:
• Threat modeling, Security architecture, STRIDE,
Countermeasure, Attack tree, Computer security, Information
security, Threat, Vulnerability, Software security assurance
Tentative Course Outline
Tentative Course Outline
Tentative Course Outline
Tentative Course Outline
Evaluation Criteria
Grade Conversion
Class Participation
• Students are expected to:
• Be fully prepared for each class session by studying the
assigned
reading material and preparation of the material assigned.
• Participate in group discussions, assignments, and panel
discussions.
• Complete specific assignments when due and in a professional
manner.
• Take exams when specified on the attached course schedule.
Academic Integrity
• At a Christian liberal arts University committed to the pursuit
of truth and
understanding, any act of academic dishonesty is especially
distressing and
cannot be tolerated. In general, academic dishonesty involves
the abuse and
misuse of information or people to gain an undeserved academic
advantage or
evaluation.The common forms of academic dishonesty include:
• cheating - using deception in the taking of tests or the
preparation of written work, using
unauthorized materials, copying another person’s work with or
without consent, or assisting
another in such activities
• lying—falsifying, fabricating, or forging information in either
written, spoken, or video
presentations
• plagiarism—using the published writings, data,
interpretations, or ideas of another without
proper documentation
• Episodes of academic dishonesty are reported to theVice
President for Academic
Affairs. The potential penalty for academic dishonesty includes
a failing grade on
a particular assignment, a failing grade for the entire course, or
charges against
the student with the appropriate disciplinary body.
Students with Disabilities
• Students who may have a disability meriting an academic
accommodation should contact Dr. Tom Fish in LIB 21 to
ensure that their needs are properly evaluated and that
documentation is on file. Any accommodations for
disabilities must be re-certified each semester by the
Academic Affairs Office before course adjustments are
made by individual instructors.
Student Responsibilities
• Students are expected to login several times per week to
participate in class discussions.
• Students are expected to find out if any changes have
been made in the class or assignment schedule.
• Students are expected to be self-motivating in an online,
asynchronous course.
Schedule & Grading
• Due date/time: Sunday 11:59 PM
• NOTTHE FINAL EXAM
• Quizzes 10%
• Mid-term exam 10%
• Final exam 10%
• Discussions 30%
• Homework Assignments 40%
Administrative Notes
• Read the course syllabus
• Check your email and course announcements
• Be proactive
• Check course announcements
• Read the text (don’t just fake it)
• Apply the material to what you already know
About threat modeling
About this course
About threat modeling
Wouldn’t it be better
to find security issues
before you write or
deploy a line of code?
So how can you do that?
How DoYou Find
Security Issues?
Ways to Find Security Issues
• Static analysis of code
• Fuzzing or other dynamic testing
• Pen test/red team
• Wait for bug reports after release
Ways to Find Security Issues (2)
• Threat modeling!
• Think about security issues early
• Understand your requirements better
• Don’t write bugs into the code
• And the subject of this lesson
So…how do you threat
model?
Definitions
• What is a threat?
• How is it different from a
• vulnerability,
• risk,
• or just a problem?
• What is a model?
So…how do you threat
model?
What are the problems
associated with the
“Think like an Attacker”
mentality?
Think Like an Attacker?
• Like thinking like a professional chef!
• Even if you cook well, are you the chef at a popular
restaurant?
• Thinking like an attacker – or focusing on them is risky
• What do they know? What will they do?
• If you get these wrong, your threat modeling will go astray
• So don’t start from attackers!
What are the problems
associated with starting from
assets as an approach to
threat
modeling?
What do you learn by making an asset list?
Focus on Assets?
• Assets: valuable things – the business cares!
• But what’s an asset?
• Something an attacker wants?
• Something you want to protect?
• A stepping stone?
Engineering Real Technology
• Need an engineering approach
• Predictable
• Reliable
• Scalable to a large product
• Can’t be dependent on one brilliant person
Focus on What You’re Building!
• Ideally, you understand it
• Concrete and testable?
“HowToThreat Model”
How to Threat Model
• What are you building?
• What can go wrong?
• What are you going to do about it?
• Check your work on 1-3
• The course will teach you practical skills for each of these
What Are You Building?
• Create a model of the software/system/technology
• A model abstracts away the details so you can look at the
whole
• Diagraming is a key approach
• Mathematical models of software are rare in commercial
environments
What Are You Building?
• Whiteboard diagrams are a great way to start
• Software models for threat modeling usually focus on
data flows and boundaries
• DFDs, “swim lanes”, state machines can all help (next
slides)
What Are Some Modeling
Methods?
• Whiteboard diagrams
• Brainstorming
• Structured (“formal”) diagrams
• Data flow diagrams
• Swim lanes
• State machines
• Mathematical representations of code
Trust Boundaries
• Sometimes left implicit in development
•
• Effective threat modeling requires making boundaries explicit
A trust boundary is everywhere two (or more) principals
interact
• Principals are UIDs (unix)/SIDs (Windows) etc.
• Apps on mobile platforms
• (Two or more)
• Need to be enforced in some way
• Best to rely on the OS
• Sometimes not possible (e.g., building a database)
Trust Boundaries
• All interesting boundaries are semi-permeable
• Air gaps
• Firewalls
• Require policy mechanisms (which are hard)
• Formal methods help build boundaries
• Isolation
• Type safety
• Policy languages
• Reference monitors/kernels
DFD (Data Flow Diagram)
• Developed in the early 70s, and still useful
• Simple: easy to learn, sketch
• Threats often follow data
• Abstracts programs into:
• Processes: your code
• Data stores: files, databases, shared memory
• Data flows: connect processes to other elements
• External entities: everything but your code & data Includes
people &
cloud software
• Trust boundaries (now made explicit)
Data Flow Diagram (Example)
Swim Lane Diagrams
• Show two or more entities communicating,
each “in a lane”
• Useful for network communication
• Lanes have implicit boundaries between
them
State Machines
• Helpful for considering what changes security state
• For example, unauthenticated to authenticated
• User to root/admin
• Rarely shows boundaries
How to Threat Model (Summary)
• What are you building?
• What can go wrong?
• What are you going to do about it?
• Check your work on 1-3
What Can Go Wrong?
• Fun to brainstorm
• Mnemonics, trees, or libraries of threats can all help
structure thinking
• Structure helps get you towards completeness and
predictability
What Can Go Wrong?
• STRIDE is a mnemonic
• Spoofing
• Tampering
• Repudiation
• Information Disclosure
• Denial of Service
• Elevation of Privilege
• Easy, right?
Spoofing
By Lego Envy,
http://www.eurobricks.com/forum/index.php?showtopic=64532
Spoofing
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
http://www.eurobricks.com/forum/index.php?showtopic=64532
Tampering
http://pinlac.om/LegoDSTractorBeam.html
Tampering
http://pinlac.om/LegoDSTractorBeam.html
Repudiation
By Seb H
http://www.flickr.com/photos/[email protected]/8531040850/
Repudiation
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
http://www.flickr.com/photos/[email protected]/8531040850/
Information DisclosureInformation Disclosure
Denial of Service
Model by Nathan Sawaya
http://brickartist.com/gallery/han-solo-in-carbonite/
Denial of
Service
http://brickartist.com/gallery/han-solo-in-carbonite/
Elevation of Privilege
http://www.flickr.com/photos/prodif sion/
Elevation of Privilege
http://www.flickr.com/photos/prodif
STRIDE
Threat Property
Violated
Definition Example
Spoofing Authentication Impersonating
something or someone
else.
Pretending to be any of Bill Gates, Paypal.com or
ntdll.dll
Tampering Integrity Modifying data or code Modifying a DLL
on disk or DVD, or a packet as it
traverses the network
Repudiation Non-repudiation Claiming to have not
performed an action.
“I didn’t send that email,” “I didn’t modify that
file,” “I certainly didn’t visit that web site, dear!”
Information
Disclosure
Confidentiality Exposing information
to someone not
authorized to see it
Allowing someone to read the Windows source
code; publishing a list of customers to a web site.
Denial of Service Availability Deny or degrade
service to users
Crashing Windows or a web site, sending a
packet and absorbing seconds of CPU time, or
routing packets into a black hole.
Elevation of Privilege Authorization Gain capabilities
without proper
authorization
Allowing a remote Internet user to run
commands is the classic example, but going from
a limited user to admin is also EoP.
Using STRIDE
• Consider how each STRIDE threat could impact each part
of the model
• “How could a clever attacker spoof this part of the
system?...tamper with?… etc.”
• Easier with aids
• Elevation of Privilege game
• Attack trees (see Threat Modeling: Designing for Security,
Appendix B)
• Experience
What Can Go Wrong?
• Track issues as you find them
• “attacker could pretend to be a client & connect”
• Track assumptions
• “I think that connection is always over SSL”
• Both lists are inputs to “what are you going to do about
it?”
Recap
• What are you building?
• Diagrams of various sorts
• Trust boundaries
• What can go wrong?
• STRIDE
What’s next?
• For next week
• Read chapters 3, 4, and 5
Slide Number 1AgendaSlide Number 3Threat Modeling in
DepthCourse DescriptionMajor Instructional AreasCourse
ObjectivesCourse ObjectivesSCANS ObjectivesRequired and
Recommended
ResourcesInformation SearchTentative Course OutlineTentative
Course OutlineTentative Course OutlineTentative Course
OutlineEvaluation CriteriaGrade ConversionClass
ParticipationAcademic IntegrityStudents with
DisabilitiesStudent ResponsibilitiesSchedule &
GradingAdministrative NotesSlide Number 24Slide Number
25Slide Number 26Ways to Find Security IssuesWays to Find
Security Issues (2)Slide Number 29DefinitionsSlide Number
31Slide Number 32Think Like an Attacker?What are the
problems associated with starting from assets as an approach to
threatFocus on Assets?Engineering Real TechnologyFocus on
What You’re Building!Slide Number 38How to Threat
ModelWhat Are You Building?What Are You Building?What
Are Some Modeling
Methods?Trust BoundariesTrust BoundariesDFD (Data Flow
Diagram)Data Flow Diagram (Example)Swim Lane
DiagramsState MachinesHow to Threat Model (Summary)What
Can Go Wrong?What Can Go
Wrong?SpoofingTamperingRepudiationSlide Number 55Slide
Number 56Slide Number 57Slide Number 58Using
STRIDEWhat Can Go Wrong?RecapWhat’s next?
Running head  TITLE OF ESSAY1TITLE OF ESSAY 2Title .docx

More Related Content

Similar to Running head TITLE OF ESSAY1TITLE OF ESSAY 2Title .docx

1 Center for Writing Excellence © 2014 Apollo .docx
    1     Center for Writing Excellence © 2014 Apollo .docx    1     Center for Writing Excellence © 2014 Apollo .docx
1 Center for Writing Excellence © 2014 Apollo .docx
ShiraPrater50
 
1 Center for Writing Excellence © 2014 Apollo .docx
    1     Center for Writing Excellence © 2014 Apollo .docx    1     Center for Writing Excellence © 2014 Apollo .docx
1 Center for Writing Excellence © 2014 Apollo .docx
joyjonna282
 
1 Center for Writing Excellence © 2014 Apollo .docx
    1     Center for Writing Excellence © 2014 Apollo .docx    1     Center for Writing Excellence © 2014 Apollo .docx
1 Center for Writing Excellence © 2014 Apollo .docx
hallettfaustina
 
A review for apa fall 2015 1
A review for apa fall 2015 1A review for apa fall 2015 1
A review for apa fall 2015 1
AMDstudentview
 
APA Primer
APA PrimerAPA Primer
APA (7th Edition) Formatting and Style Guide
APA (7th Edition) Formatting and Style GuideAPA (7th Edition) Formatting and Style Guide
APA (7th Edition) Formatting and Style Guide
Hermenio Jr. Cabusog
 
Running head SHORT TITLE1SHORT TITLE 7Please delete .docx
Running head  SHORT TITLE1SHORT TITLE 7Please delete .docxRunning head  SHORT TITLE1SHORT TITLE 7Please delete .docx
Running head SHORT TITLE1SHORT TITLE 7Please delete .docx
SUBHI7
 
Running head WRITING STYLE AND MECHANICS 1 .docx
Running head WRITING STYLE AND MECHANICS     1     .docxRunning head WRITING STYLE AND MECHANICS     1     .docx
Running head WRITING STYLE AND MECHANICS 1 .docx
agnesdcarey33086
 
APA Style Citation (6th edition) Guide 2.0
APA Style Citation (6th edition) Guide 2.0APA Style Citation (6th edition) Guide 2.0
APA Style Citation (6th edition) Guide 2.0
Dania
 
Write a 3-5 page paper in which you1. Candidly assess yourself .docx
Write a 3-5 page paper in which you1. Candidly assess yourself .docxWrite a 3-5 page paper in which you1. Candidly assess yourself .docx
Write a 3-5 page paper in which you1. Candidly assess yourself .docx
ericbrooks84875
 
Apa primer
Apa primerApa primer
Apa primer
Robin Greene
 
APA Citation Style Guide To Bibliographic Citation
APA Citation Style Guide To Bibliographic CitationAPA Citation Style Guide To Bibliographic Citation
APA Citation Style Guide To Bibliographic Citation
Scott Faria
 
1 AMERICAN PSYCHOLOGICAL ASSOCIATION APA GU.docx
1  AMERICAN PSYCHOLOGICAL ASSOCIATION APA GU.docx1  AMERICAN PSYCHOLOGICAL ASSOCIATION APA GU.docx
1 AMERICAN PSYCHOLOGICAL ASSOCIATION APA GU.docx
oswald1horne84988
 
Grading Criteria Argument Paper Revised Rough DraftENG200 Vers
Grading Criteria Argument Paper Revised Rough DraftENG200 VersGrading Criteria Argument Paper Revised Rough DraftENG200 Vers
Grading Criteria Argument Paper Revised Rough DraftENG200 Vers
JeanmarieColbert3
 
APA powerpoint
APA powerpointAPA powerpoint
APA powerpoint
Boutkhil Guemide
 
Apa style basics fa10 sept
Apa style basics fa10 septApa style basics fa10 sept
Apa style basics fa10 septlillypad2008
 

Similar to Running head TITLE OF ESSAY1TITLE OF ESSAY 2Title .docx (20)

1 Center for Writing Excellence © 2014 Apollo .docx
    1     Center for Writing Excellence © 2014 Apollo .docx    1     Center for Writing Excellence © 2014 Apollo .docx
1 Center for Writing Excellence © 2014 Apollo .docx
 
1 Center for Writing Excellence © 2014 Apollo .docx
    1     Center for Writing Excellence © 2014 Apollo .docx    1     Center for Writing Excellence © 2014 Apollo .docx
1 Center for Writing Excellence © 2014 Apollo .docx
 
1 Center for Writing Excellence © 2014 Apollo .docx
    1     Center for Writing Excellence © 2014 Apollo .docx    1     Center for Writing Excellence © 2014 Apollo .docx
1 Center for Writing Excellence © 2014 Apollo .docx
 
Apa primer (rev)
Apa primer (rev)Apa primer (rev)
Apa primer (rev)
 
A review for apa fall 2015 1
A review for apa fall 2015 1A review for apa fall 2015 1
A review for apa fall 2015 1
 
Apa primer (rev)
Apa primer (rev)Apa primer (rev)
Apa primer (rev)
 
APA Primer
APA PrimerAPA Primer
APA Primer
 
Apa primer (rev)
Apa primer (rev)Apa primer (rev)
Apa primer (rev)
 
APA (7th Edition) Formatting and Style Guide
APA (7th Edition) Formatting and Style GuideAPA (7th Edition) Formatting and Style Guide
APA (7th Edition) Formatting and Style Guide
 
Running head SHORT TITLE1SHORT TITLE 7Please delete .docx
Running head  SHORT TITLE1SHORT TITLE 7Please delete .docxRunning head  SHORT TITLE1SHORT TITLE 7Please delete .docx
Running head SHORT TITLE1SHORT TITLE 7Please delete .docx
 
Running head WRITING STYLE AND MECHANICS 1 .docx
Running head WRITING STYLE AND MECHANICS     1     .docxRunning head WRITING STYLE AND MECHANICS     1     .docx
Running head WRITING STYLE AND MECHANICS 1 .docx
 
APA Style Citation (6th edition) Guide 2.0
APA Style Citation (6th edition) Guide 2.0APA Style Citation (6th edition) Guide 2.0
APA Style Citation (6th edition) Guide 2.0
 
Write a 3-5 page paper in which you1. Candidly assess yourself .docx
Write a 3-5 page paper in which you1. Candidly assess yourself .docxWrite a 3-5 page paper in which you1. Candidly assess yourself .docx
Write a 3-5 page paper in which you1. Candidly assess yourself .docx
 
Apa primer
Apa primerApa primer
Apa primer
 
Apa primer
Apa primerApa primer
Apa primer
 
APA Citation Style Guide To Bibliographic Citation
APA Citation Style Guide To Bibliographic CitationAPA Citation Style Guide To Bibliographic Citation
APA Citation Style Guide To Bibliographic Citation
 
1 AMERICAN PSYCHOLOGICAL ASSOCIATION APA GU.docx
1  AMERICAN PSYCHOLOGICAL ASSOCIATION APA GU.docx1  AMERICAN PSYCHOLOGICAL ASSOCIATION APA GU.docx
1 AMERICAN PSYCHOLOGICAL ASSOCIATION APA GU.docx
 
Grading Criteria Argument Paper Revised Rough DraftENG200 Vers
Grading Criteria Argument Paper Revised Rough DraftENG200 VersGrading Criteria Argument Paper Revised Rough DraftENG200 Vers
Grading Criteria Argument Paper Revised Rough DraftENG200 Vers
 
APA powerpoint
APA powerpointAPA powerpoint
APA powerpoint
 
Apa style basics fa10 sept
Apa style basics fa10 septApa style basics fa10 sept
Apa style basics fa10 sept
 

More from toddr4

Running head 2.3 - CASE ANALYSIS FUNDING THE RAILROADS 1 .docx
Running head 2.3 - CASE ANALYSIS FUNDING THE RAILROADS 1 .docxRunning head 2.3 - CASE ANALYSIS FUNDING THE RAILROADS 1 .docx
Running head 2.3 - CASE ANALYSIS FUNDING THE RAILROADS 1 .docx
toddr4
 
Running head 50 CHARACTER VERSION OF TITLE IN CAPS 1 .docx
Running head 50 CHARACTER VERSION OF TITLE IN CAPS 1 .docxRunning head 50 CHARACTER VERSION OF TITLE IN CAPS 1 .docx
Running head 50 CHARACTER VERSION OF TITLE IN CAPS 1 .docx
toddr4
 
Running Head YOUTH IN THE CRIMINAL JUSTICE SYSTEMYOUTH IN TH.docx
Running Head  YOUTH IN THE CRIMINAL JUSTICE SYSTEMYOUTH IN TH.docxRunning Head  YOUTH IN THE CRIMINAL JUSTICE SYSTEMYOUTH IN TH.docx
Running Head YOUTH IN THE CRIMINAL JUSTICE SYSTEMYOUTH IN TH.docx
toddr4
 
Running head TITLE1TITLE2Research QuestionHow doe.docx
Running head  TITLE1TITLE2Research QuestionHow doe.docxRunning head  TITLE1TITLE2Research QuestionHow doe.docx
Running head TITLE1TITLE2Research QuestionHow doe.docx
toddr4
 
Running Head VULNERABILITY ASSESSMENT1VULNERABILITY ASSESSMEN.docx
Running Head  VULNERABILITY ASSESSMENT1VULNERABILITY ASSESSMEN.docxRunning Head  VULNERABILITY ASSESSMENT1VULNERABILITY ASSESSMEN.docx
Running Head VULNERABILITY ASSESSMENT1VULNERABILITY ASSESSMEN.docx
toddr4
 
Running head STARBUCKS’ STRATEGY 1 Starbuc.docx
Running head  STARBUCKS’ STRATEGY     1 Starbuc.docxRunning head  STARBUCKS’ STRATEGY     1 Starbuc.docx
Running head STARBUCKS’ STRATEGY 1 Starbuc.docx
toddr4
 
Running head SHORTENED VERSION OF TITLE1Title of Your Rese.docx
Running head  SHORTENED VERSION OF TITLE1Title of Your Rese.docxRunning head  SHORTENED VERSION OF TITLE1Title of Your Rese.docx
Running head SHORTENED VERSION OF TITLE1Title of Your Rese.docx
toddr4
 
Running Head THEMATIC OUTLINE .docx
Running Head  THEMATIC OUTLINE                               .docxRunning Head  THEMATIC OUTLINE                               .docx
Running Head THEMATIC OUTLINE .docx
toddr4
 
Running head TOPIC RESEARCH PROPOSAL .docx
Running head  TOPIC RESEARCH PROPOSAL                          .docxRunning head  TOPIC RESEARCH PROPOSAL                          .docx
Running head TOPIC RESEARCH PROPOSAL .docx
toddr4
 
Running Head VIRTUAL ORGANIZATION .docx
Running Head  VIRTUAL ORGANIZATION                              .docxRunning Head  VIRTUAL ORGANIZATION                              .docx
Running Head VIRTUAL ORGANIZATION .docx
toddr4
 
Running Head THE MARKETING PLAN .docx
Running Head  THE MARKETING PLAN                                 .docxRunning Head  THE MARKETING PLAN                                 .docx
Running Head THE MARKETING PLAN .docx
toddr4
 
Running head Project Type Unit 5 Individual Project3Ty.docx
Running head  Project Type Unit 5 Individual Project3Ty.docxRunning head  Project Type Unit 5 Individual Project3Ty.docx
Running head Project Type Unit 5 Individual Project3Ty.docx
toddr4
 
Rubric Writing Assignment Rubric Criteria Level 3 Level.docx
Rubric Writing Assignment Rubric Criteria Level 3 Level.docxRubric Writing Assignment Rubric Criteria Level 3 Level.docx
Rubric Writing Assignment Rubric Criteria Level 3 Level.docx
toddr4
 
Running Head ON-BOARDING .docx
Running Head  ON-BOARDING                                        .docxRunning Head  ON-BOARDING                                        .docx
Running Head ON-BOARDING .docx
toddr4
 
Running head PERSPECTIVE ON INTEGRATION BETWEEN CHRISTIAN FAITH .docx
Running head  PERSPECTIVE ON INTEGRATION BETWEEN CHRISTIAN FAITH .docxRunning head  PERSPECTIVE ON INTEGRATION BETWEEN CHRISTIAN FAITH .docx
Running head PERSPECTIVE ON INTEGRATION BETWEEN CHRISTIAN FAITH .docx
toddr4
 
RubricThe final for this course is a paper titled Improvement Proj.docx
RubricThe final for this course is a paper titled Improvement Proj.docxRubricThe final for this course is a paper titled Improvement Proj.docx
RubricThe final for this course is a paper titled Improvement Proj.docx
toddr4
 
Running Head LETTER OF ADVICE .docx
Running Head  LETTER OF ADVICE                               .docxRunning Head  LETTER OF ADVICE                               .docx
Running Head LETTER OF ADVICE .docx
toddr4
 
Running head LEADERSHIP PORTFOLIO1LEADERSHIP PORTFOLIO4.docx
Running head  LEADERSHIP PORTFOLIO1LEADERSHIP PORTFOLIO4.docxRunning head  LEADERSHIP PORTFOLIO1LEADERSHIP PORTFOLIO4.docx
Running head LEADERSHIP PORTFOLIO1LEADERSHIP PORTFOLIO4.docx
toddr4
 
Running Head LAB 51LAB 57Lab 5.docx
Running Head  LAB 51LAB 57Lab 5.docxRunning Head  LAB 51LAB 57Lab 5.docx
Running Head LAB 51LAB 57Lab 5.docx
toddr4
 
RubricRubric for Assignment 5a- MetricsMaxYour PointsCommentsTop.docx
RubricRubric for Assignment 5a- MetricsMaxYour PointsCommentsTop.docxRubricRubric for Assignment 5a- MetricsMaxYour PointsCommentsTop.docx
RubricRubric for Assignment 5a- MetricsMaxYour PointsCommentsTop.docx
toddr4
 

More from toddr4 (20)

Running head 2.3 - CASE ANALYSIS FUNDING THE RAILROADS 1 .docx
Running head 2.3 - CASE ANALYSIS FUNDING THE RAILROADS 1 .docxRunning head 2.3 - CASE ANALYSIS FUNDING THE RAILROADS 1 .docx
Running head 2.3 - CASE ANALYSIS FUNDING THE RAILROADS 1 .docx
 
Running head 50 CHARACTER VERSION OF TITLE IN CAPS 1 .docx
Running head 50 CHARACTER VERSION OF TITLE IN CAPS 1 .docxRunning head 50 CHARACTER VERSION OF TITLE IN CAPS 1 .docx
Running head 50 CHARACTER VERSION OF TITLE IN CAPS 1 .docx
 
Running Head YOUTH IN THE CRIMINAL JUSTICE SYSTEMYOUTH IN TH.docx
Running Head  YOUTH IN THE CRIMINAL JUSTICE SYSTEMYOUTH IN TH.docxRunning Head  YOUTH IN THE CRIMINAL JUSTICE SYSTEMYOUTH IN TH.docx
Running Head YOUTH IN THE CRIMINAL JUSTICE SYSTEMYOUTH IN TH.docx
 
Running head TITLE1TITLE2Research QuestionHow doe.docx
Running head  TITLE1TITLE2Research QuestionHow doe.docxRunning head  TITLE1TITLE2Research QuestionHow doe.docx
Running head TITLE1TITLE2Research QuestionHow doe.docx
 
Running Head VULNERABILITY ASSESSMENT1VULNERABILITY ASSESSMEN.docx
Running Head  VULNERABILITY ASSESSMENT1VULNERABILITY ASSESSMEN.docxRunning Head  VULNERABILITY ASSESSMENT1VULNERABILITY ASSESSMEN.docx
Running Head VULNERABILITY ASSESSMENT1VULNERABILITY ASSESSMEN.docx
 
Running head STARBUCKS’ STRATEGY 1 Starbuc.docx
Running head  STARBUCKS’ STRATEGY     1 Starbuc.docxRunning head  STARBUCKS’ STRATEGY     1 Starbuc.docx
Running head STARBUCKS’ STRATEGY 1 Starbuc.docx
 
Running head SHORTENED VERSION OF TITLE1Title of Your Rese.docx
Running head  SHORTENED VERSION OF TITLE1Title of Your Rese.docxRunning head  SHORTENED VERSION OF TITLE1Title of Your Rese.docx
Running head SHORTENED VERSION OF TITLE1Title of Your Rese.docx
 
Running Head THEMATIC OUTLINE .docx
Running Head  THEMATIC OUTLINE                               .docxRunning Head  THEMATIC OUTLINE                               .docx
Running Head THEMATIC OUTLINE .docx
 
Running head TOPIC RESEARCH PROPOSAL .docx
Running head  TOPIC RESEARCH PROPOSAL                          .docxRunning head  TOPIC RESEARCH PROPOSAL                          .docx
Running head TOPIC RESEARCH PROPOSAL .docx
 
Running Head VIRTUAL ORGANIZATION .docx
Running Head  VIRTUAL ORGANIZATION                              .docxRunning Head  VIRTUAL ORGANIZATION                              .docx
Running Head VIRTUAL ORGANIZATION .docx
 
Running Head THE MARKETING PLAN .docx
Running Head  THE MARKETING PLAN                                 .docxRunning Head  THE MARKETING PLAN                                 .docx
Running Head THE MARKETING PLAN .docx
 
Running head Project Type Unit 5 Individual Project3Ty.docx
Running head  Project Type Unit 5 Individual Project3Ty.docxRunning head  Project Type Unit 5 Individual Project3Ty.docx
Running head Project Type Unit 5 Individual Project3Ty.docx
 
Rubric Writing Assignment Rubric Criteria Level 3 Level.docx
Rubric Writing Assignment Rubric Criteria Level 3 Level.docxRubric Writing Assignment Rubric Criteria Level 3 Level.docx
Rubric Writing Assignment Rubric Criteria Level 3 Level.docx
 
Running Head ON-BOARDING .docx
Running Head  ON-BOARDING                                        .docxRunning Head  ON-BOARDING                                        .docx
Running Head ON-BOARDING .docx
 
Running head PERSPECTIVE ON INTEGRATION BETWEEN CHRISTIAN FAITH .docx
Running head  PERSPECTIVE ON INTEGRATION BETWEEN CHRISTIAN FAITH .docxRunning head  PERSPECTIVE ON INTEGRATION BETWEEN CHRISTIAN FAITH .docx
Running head PERSPECTIVE ON INTEGRATION BETWEEN CHRISTIAN FAITH .docx
 
RubricThe final for this course is a paper titled Improvement Proj.docx
RubricThe final for this course is a paper titled Improvement Proj.docxRubricThe final for this course is a paper titled Improvement Proj.docx
RubricThe final for this course is a paper titled Improvement Proj.docx
 
Running Head LETTER OF ADVICE .docx
Running Head  LETTER OF ADVICE                               .docxRunning Head  LETTER OF ADVICE                               .docx
Running Head LETTER OF ADVICE .docx
 
Running head LEADERSHIP PORTFOLIO1LEADERSHIP PORTFOLIO4.docx
Running head  LEADERSHIP PORTFOLIO1LEADERSHIP PORTFOLIO4.docxRunning head  LEADERSHIP PORTFOLIO1LEADERSHIP PORTFOLIO4.docx
Running head LEADERSHIP PORTFOLIO1LEADERSHIP PORTFOLIO4.docx
 
Running Head LAB 51LAB 57Lab 5.docx
Running Head  LAB 51LAB 57Lab 5.docxRunning Head  LAB 51LAB 57Lab 5.docx
Running Head LAB 51LAB 57Lab 5.docx
 
RubricRubric for Assignment 5a- MetricsMaxYour PointsCommentsTop.docx
RubricRubric for Assignment 5a- MetricsMaxYour PointsCommentsTop.docxRubricRubric for Assignment 5a- MetricsMaxYour PointsCommentsTop.docx
RubricRubric for Assignment 5a- MetricsMaxYour PointsCommentsTop.docx
 

Recently uploaded

Palestine last event orientationfvgnh .pptx
Palestine last event orientationfvgnh .pptxPalestine last event orientationfvgnh .pptx
Palestine last event orientationfvgnh .pptx
RaedMohamed3
 
Welcome to TechSoup New Member Orientation and Q&A (May 2024).pdf
Welcome to TechSoup   New Member Orientation and Q&A (May 2024).pdfWelcome to TechSoup   New Member Orientation and Q&A (May 2024).pdf
Welcome to TechSoup New Member Orientation and Q&A (May 2024).pdf
TechSoup
 
Unit 8 - Information and Communication Technology (Paper I).pdf
Unit 8 - Information and Communication Technology (Paper I).pdfUnit 8 - Information and Communication Technology (Paper I).pdf
Unit 8 - Information and Communication Technology (Paper I).pdf
Thiyagu K
 
TESDA TM1 REVIEWER FOR NATIONAL ASSESSMENT WRITTEN AND ORAL QUESTIONS WITH A...
TESDA TM1 REVIEWER  FOR NATIONAL ASSESSMENT WRITTEN AND ORAL QUESTIONS WITH A...TESDA TM1 REVIEWER  FOR NATIONAL ASSESSMENT WRITTEN AND ORAL QUESTIONS WITH A...
TESDA TM1 REVIEWER FOR NATIONAL ASSESSMENT WRITTEN AND ORAL QUESTIONS WITH A...
EugeneSaldivar
 
Thesis Statement for students diagnonsed withADHD.ppt
Thesis Statement for students diagnonsed withADHD.pptThesis Statement for students diagnonsed withADHD.ppt
Thesis Statement for students diagnonsed withADHD.ppt
EverAndrsGuerraGuerr
 
Supporting (UKRI) OA monographs at Salford.pptx
Supporting (UKRI) OA monographs at Salford.pptxSupporting (UKRI) OA monographs at Salford.pptx
Supporting (UKRI) OA monographs at Salford.pptx
Jisc
 
How to Split Bills in the Odoo 17 POS Module
How to Split Bills in the Odoo 17 POS ModuleHow to Split Bills in the Odoo 17 POS Module
How to Split Bills in the Odoo 17 POS Module
Celine George
 
Synthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptxSynthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptx
Pavel ( NSTU)
 
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
Nguyen Thanh Tu Collection
 
The Challenger.pdf DNHS Official Publication
The Challenger.pdf DNHS Official PublicationThe Challenger.pdf DNHS Official Publication
The Challenger.pdf DNHS Official Publication
Delapenabediema
 
Fish and Chips - have they had their chips
Fish and Chips - have they had their chipsFish and Chips - have they had their chips
Fish and Chips - have they had their chips
GeoBlogs
 
Phrasal Verbs.XXXXXXXXXXXXXXXXXXXXXXXXXX
Phrasal Verbs.XXXXXXXXXXXXXXXXXXXXXXXXXXPhrasal Verbs.XXXXXXXXXXXXXXXXXXXXXXXXXX
Phrasal Verbs.XXXXXXXXXXXXXXXXXXXXXXXXXX
MIRIAMSALINAS13
 
The Roman Empire A Historical Colossus.pdf
The Roman Empire A Historical Colossus.pdfThe Roman Empire A Historical Colossus.pdf
The Roman Empire A Historical Colossus.pdf
kaushalkr1407
 
ESC Beyond Borders _From EU to You_ InfoPack general.pdf
ESC Beyond Borders _From EU to You_ InfoPack general.pdfESC Beyond Borders _From EU to You_ InfoPack general.pdf
ESC Beyond Borders _From EU to You_ InfoPack general.pdf
Fundacja Rozwoju Społeczeństwa Przedsiębiorczego
 
The French Revolution Class 9 Study Material pdf free download
The French Revolution Class 9 Study Material pdf free downloadThe French Revolution Class 9 Study Material pdf free download
The French Revolution Class 9 Study Material pdf free download
Vivekanand Anglo Vedic Academy
 
Sha'Carri Richardson Presentation 202345
Sha'Carri Richardson Presentation 202345Sha'Carri Richardson Presentation 202345
Sha'Carri Richardson Presentation 202345
beazzy04
 
Introduction to Quality Improvement Essentials
Introduction to Quality Improvement EssentialsIntroduction to Quality Improvement Essentials
Introduction to Quality Improvement Essentials
Excellence Foundation for South Sudan
 
Language Across the Curriculm LAC B.Ed.
Language Across the  Curriculm LAC B.Ed.Language Across the  Curriculm LAC B.Ed.
Language Across the Curriculm LAC B.Ed.
Atul Kumar Singh
 
Polish students' mobility in the Czech Republic
Polish students' mobility in the Czech RepublicPolish students' mobility in the Czech Republic
Polish students' mobility in the Czech Republic
Anna Sz.
 
How to Create Map Views in the Odoo 17 ERP
How to Create Map Views in the Odoo 17 ERPHow to Create Map Views in the Odoo 17 ERP
How to Create Map Views in the Odoo 17 ERP
Celine George
 

Recently uploaded (20)

Palestine last event orientationfvgnh .pptx
Palestine last event orientationfvgnh .pptxPalestine last event orientationfvgnh .pptx
Palestine last event orientationfvgnh .pptx
 
Welcome to TechSoup New Member Orientation and Q&A (May 2024).pdf
Welcome to TechSoup   New Member Orientation and Q&A (May 2024).pdfWelcome to TechSoup   New Member Orientation and Q&A (May 2024).pdf
Welcome to TechSoup New Member Orientation and Q&A (May 2024).pdf
 
Unit 8 - Information and Communication Technology (Paper I).pdf
Unit 8 - Information and Communication Technology (Paper I).pdfUnit 8 - Information and Communication Technology (Paper I).pdf
Unit 8 - Information and Communication Technology (Paper I).pdf
 
TESDA TM1 REVIEWER FOR NATIONAL ASSESSMENT WRITTEN AND ORAL QUESTIONS WITH A...
TESDA TM1 REVIEWER  FOR NATIONAL ASSESSMENT WRITTEN AND ORAL QUESTIONS WITH A...TESDA TM1 REVIEWER  FOR NATIONAL ASSESSMENT WRITTEN AND ORAL QUESTIONS WITH A...
TESDA TM1 REVIEWER FOR NATIONAL ASSESSMENT WRITTEN AND ORAL QUESTIONS WITH A...
 
Thesis Statement for students diagnonsed withADHD.ppt
Thesis Statement for students diagnonsed withADHD.pptThesis Statement for students diagnonsed withADHD.ppt
Thesis Statement for students diagnonsed withADHD.ppt
 
Supporting (UKRI) OA monographs at Salford.pptx
Supporting (UKRI) OA monographs at Salford.pptxSupporting (UKRI) OA monographs at Salford.pptx
Supporting (UKRI) OA monographs at Salford.pptx
 
How to Split Bills in the Odoo 17 POS Module
How to Split Bills in the Odoo 17 POS ModuleHow to Split Bills in the Odoo 17 POS Module
How to Split Bills in the Odoo 17 POS Module
 
Synthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptxSynthetic Fiber Construction in lab .pptx
Synthetic Fiber Construction in lab .pptx
 
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
GIÁO ÁN DẠY THÊM (KẾ HOẠCH BÀI BUỔI 2) - TIẾNG ANH 8 GLOBAL SUCCESS (2 CỘT) N...
 
The Challenger.pdf DNHS Official Publication
The Challenger.pdf DNHS Official PublicationThe Challenger.pdf DNHS Official Publication
The Challenger.pdf DNHS Official Publication
 
Fish and Chips - have they had their chips
Fish and Chips - have they had their chipsFish and Chips - have they had their chips
Fish and Chips - have they had their chips
 
Phrasal Verbs.XXXXXXXXXXXXXXXXXXXXXXXXXX
Phrasal Verbs.XXXXXXXXXXXXXXXXXXXXXXXXXXPhrasal Verbs.XXXXXXXXXXXXXXXXXXXXXXXXXX
Phrasal Verbs.XXXXXXXXXXXXXXXXXXXXXXXXXX
 
The Roman Empire A Historical Colossus.pdf
The Roman Empire A Historical Colossus.pdfThe Roman Empire A Historical Colossus.pdf
The Roman Empire A Historical Colossus.pdf
 
ESC Beyond Borders _From EU to You_ InfoPack general.pdf
ESC Beyond Borders _From EU to You_ InfoPack general.pdfESC Beyond Borders _From EU to You_ InfoPack general.pdf
ESC Beyond Borders _From EU to You_ InfoPack general.pdf
 
The French Revolution Class 9 Study Material pdf free download
The French Revolution Class 9 Study Material pdf free downloadThe French Revolution Class 9 Study Material pdf free download
The French Revolution Class 9 Study Material pdf free download
 
Sha'Carri Richardson Presentation 202345
Sha'Carri Richardson Presentation 202345Sha'Carri Richardson Presentation 202345
Sha'Carri Richardson Presentation 202345
 
Introduction to Quality Improvement Essentials
Introduction to Quality Improvement EssentialsIntroduction to Quality Improvement Essentials
Introduction to Quality Improvement Essentials
 
Language Across the Curriculm LAC B.Ed.
Language Across the  Curriculm LAC B.Ed.Language Across the  Curriculm LAC B.Ed.
Language Across the Curriculm LAC B.Ed.
 
Polish students' mobility in the Czech Republic
Polish students' mobility in the Czech RepublicPolish students' mobility in the Czech Republic
Polish students' mobility in the Czech Republic
 
How to Create Map Views in the Odoo 17 ERP
How to Create Map Views in the Odoo 17 ERPHow to Create Map Views in the Odoo 17 ERP
How to Create Map Views in the Odoo 17 ERP
 

Running head TITLE OF ESSAY1TITLE OF ESSAY 2Title .docx

  • 1. Running head: TITLE OF ESSAY 1 TITLE OF ESSAY 2 Title of Essay Author’s Name University of the Cumberlands Abstract Abstracts are research tools that can help you readers determine if the scope of your article/essay will help them in their own research. In APA, abstracts are typically 150-250 words in length and provide an evaluative summary of the essay to follow. The personal opinion of the author is strictly prohibited in abstracts. Unlike a body paragraph, the first line of an abstract is not tabbed-in. For many student essays, especially in lower-numbers courses, an abstract will not be required; still, it is good to practice this skill. Title of Essay In APA style, the introduction of the essay should begin here, followed by the body paragraphs. APA is typically a more formal style than most students are accustomed to using in a writing course. For the purposes of this course, the level of formality should be based on the assignment. For example: APA asks that students always write in third person (avoiding words such as I, me, we, our(s), you, your(s), etc). Certain
  • 2. rhetorical modes, however, don’t cater well to third person (narrative and reflection writing are two such examples). In these situations, first person (I, me, we, our(s)) may be, and should be employed; second person (you, your(s)) should be avoided in all academic writing unless an essay is specifically designed to relay instructions (there are few assignments that will employ second person). Like any essay, students should make sure their essays are formatted with one inch margins, with their text exclusively in Times New Roman 12-point font, and students should double space their lines. This document can be downloaded and used as a template wherein students may simply replace names, titles, dates, and so on with their own information. The final page of this document will demonstrate a References page. If a student uses information from any source, that source must be identified within the text and listed on a References page. These citations should be listed in alphabetical order and, opposite to the way a normal paragraph works, the first line should be flush left and each following line should be tabbed in. Though there is really no substitute for a good APA Style Manual, students can refer to a citation generator such as www.citationmachine.net to ensure proper formatting. Any further questions should be directed to the instructor of the course. References Badley, G. (2009). A place from where to speak: The university and academic freedom. British Journal of Educational Studies, 57(2), 146-163. doi:10.1111/j.1467-
  • 3. 8527.2009.00429.x Baumanns, M., Biedenkopf, K., Cole, J. R., Kerrey, B., & Lee, B. (2009). The future of universities and the fate of free inquiry and academic freedom: Question and answer session. Social Research, 76(3), 867-886. Retrieved from EBSCOhost. Berthoff, A. E. (2009). Learning the uses of chaos. In S. Miller (Ed.), The Norton Book of Composition Studies (pp. 649). New York: W. W. Norton & Company. Carroll, L. (2000) The Annotated Alice: The Definitive Edition. M. Gardner (Ed.) NY: Norton. Elbow, P. (2000). Getting along without grades—and getting along with them too. Everyone Can Write: Essays Toward a Hopeful Theory of Writing and Teaching Writing. NY: Oxford University Press. APA Formatting This document has the summarized, high points of the APA format that all students need to be aware in writing papers academically. There are many more details and requirements in the APA than in this condensed version. If the item needed is not included here, please refer to the APA manual or visit the Purdue University Online Writing Lab (OWL) website for more
  • 4. specific information in APA formatting. Your essay should be typed, double-spaced on standard-sized paper (8.5" x 11") with 1" margins on all sides. Indent 5 spaces or ½ inch on the first line of every paragraph. You should use a clear font that is highly readable. APA recommends using 12 pt. Times New Roman font. There are two aspects of essay formats that you should keep in mind: · Every other line in the entire paper will have text. · Consistency and uniformity is essential. Every essay from each student will appear generally the same, except for specific letters and words are different. APA Title Page The title page should contain the title of the paper, the author's full name, and the school’s name. Include in the header of the first page, the Running Head: and title of the paper in all capitals are placed toward the left margin, and the page number is placed toward the right margin. On the subsequent pages, the header contains the title and page number. Please note that your page number must be created with the word processor’s page number feature. If the page number is entered in manually, it will be the same number on every page rather than a page number. APA Citations Anytime a writer borrows an idea or quote from other source, a citation must be included in the essay. Whether it is paraphrasing or quoting, credit must be given to avoid plagiarism. APA requires the author’s name, year of publication, and page or paragraph number must be included as a citation in the paper. These three requirements can be provided in two main options: 1. The requirements are provided at the end of the material cited, and it is included in one simple parenthetical citation. (author’s last name, year, page no.) Be sure to place the period
  • 5. for the end of the sentence after the parenthetical citation. For example: The study indicated the patients recovered 47% of the time without any harmful side effects (Hunter, 2004, pp. 365). 2. The author’s name is included in the body of the sentence. The year follows the name in parentheses, and the page or paragraph number is in parentheses at the end of the material cited. For example: Dr. Hunter (2004) performed two major clinical trials on breast cancer. The studies indicated the patients recovered 47% of the time without any harmful side effects (pp. 365). 3. When a personal interview, lecture, or seminar is used as a source in a paper, APA only requires a citation to be included in the body of the paper. Normally, the interviewee or lecturer name is included in the body of the sentence, followed by the parenthetical citation (Personal communication, date of communication). For example: Mr. Wayne Smith (Personal communication, June 25, 2012) stated in an interview that each sample from the experiment were handled and processed separated to prevent any potential compromise of the study. 4. When using a direct quote (less than 40 words), usually the author is used in the attributive tag with date cited after the author. For example: Wayne Smith (2012) explains, “Each sample from the experiment were handled and processed separated to prevent any potential compromise of the study.” 5. If using a block quotation (40 words or more), cite the quoted source in parentheses after the final punctuation mark. Please keep these points of block quotation in mind: · Indent the block quote five spaces or half an inch. · Do not use quotation marks.
  • 6. · Double space the quote unless your school has a rule about single spacing block quotes. · Do not include any additional lines or spaces before or after the block quote. · Notice that in block quotes, the period goes before the parentheses, not after. For example: Students at Nova Southeastern University have faced challenges in learning how to use APA formatting. When discussing the challenges, Strunk (1922) stated: Use quotes around an article title or book chapter, but italicize the title of a book, journal, brochure, or report when used in the body of the paper. Use a short title in the parenthetical citation or complete title if the title is short. NOTE Non- periodical titles like books and book titles have all the important words capitalized in the text citations, but these same book titles do not have all the important words capitalized in the reference list. (p. 342) Continue here with your explanation or interpretation of the block quote. Please write how the quote supports your thesis specifically. This portion is a continuation of the original paragraph that started with Students at Nova Southeastern University. APA References Major points of the reference page(s) to keep in mind: · Arrange entries in alphabetical order. · An anonymous source is alphabetized by the word “Anonymous.” · A source that has no author is arranged, alphabetically by the
  • 7. first significant word of the title. · Do not indent the first line of the reference. Indent all subsequent lines. · Double space the entire references page. · If references take up more than one page, do not retype the word “References” on subsequent pages. Unknown Author If your source has an unknown author, the title of the article or webpage is put in its place. Review the samples below for reference and citation. A place from where to speak: The university and academic freedom. (2009). British Journal of Educational Studies, 57(2), 146-163. doi:10.1111/j.1467- 8527.2009.00429.x NOTE: When your essay includes parenthetical citations of sources with no author named, use a shortened version of the source's title instead of an author's name. Use quotation marks and italics as appropriate. For example, parenthetical citations of the source above would appear as follows: (“A place from where”, 2009). Sample References 1. A magazine:
  • 8. Last Name, F. (Publication Date). Article Title. Magazine Name, Volume Number (Issue Number) Page Numbers. Smith, J. (2009, January 21). Obama inaugurated as President. Time, 171 (5) 21-23. 2. A Book: Last Name, F. (Year Published). Book Title. Publisher City: Publisher Name. Brown, D. (2004). The DaVinci code. New York: Scholastic. 3. A journal from an online database: Last Name, F. (Year Published). Article Title. Journal name, Volume number, (Issue number)Page Numbers. Retrieved from Web Address Ayyamperumal, A., Parveen, B., Ravindran, V., & Tharini, G. (2012). Cutaneous manifestations of internal malignancy. Indian Journal of Dermatology, 57(4), 260. Retrieved from http://go.galegroup.com/ps/i.do?id=GALE%7CA295455160&v =2.1&u=pho38373&it=r&p=AONE&sw=w 4. A document or news website: Last Name, F. (Year Published). Page title. Website title. Retrieved from Web Address Smith, J. (2009, January 21). Obama inaugurated as President. CNN.com. Retrieved from http://www.cnn.com/POLITICS/ 01/21/obama_inaugurated/index.html 5. A journal: Last Name, F. (Year Published). Article Title. Journal name, Volume number, (Issue number)Page Numbers. Smith, J. (2009). Studies in pop rocks and Coke. Weird Science, 12 (1). 78-93. 6. A video weblog:
  • 9. Video Title. (video file) Retrieved from Web Address Preventive benefits-better health is in your hands. (video file). Retrieved from http://www.youtube.com/user/CMSHHSgov?v=Z5bjUYgfqhw 7. A radio/TV: EPISODE OF PROGRAM: Last Name, F. (Writer), & Last Name, F. (Director). (Year Broadcast). Episode [Program Type series episode]. In F. Last Name (Producer), Program. Network City: Network. INDIVIDUAL BROADCAST: Last Name, F. (Producer). (Date Broadcast). Program [Program Type broadcast]. Network City: Network. Crystal, L. (Executive Producer). (1993, October 11). The McNeil Lehrer news hour. [Television broadcast]. New York and Washington DC: Public Broadcasting Service. 8. An encyclopedia/dictionary: Last Name, F. (Year Published). Article Title. In Encyclopedia/Dictionary name (Vol. Volume Number, Page Numbers). Publication City: Publisher Name. Smith, J. (2009). Internet. In Encyclopaedia Britannica (Vol. 20, pp. 81-82). Chicago: Encyclopaedia Britannica. Please note: these are the most common examples of sources used by students, please use the APA manual or Purdue’s OWL website. The information collected in this handout is based on the Publication Manual of the American Psychological Association, 6th Edition (July 2009) Washington, D.C.
  • 10. ISOL536 Security Architecture and Design Threat Modeling Week 1 Agenda • About this course • About threat modeling About this course About this course About threat modeling Threat Modeling in Depth • 8 weeks • 8 weeks of deep material • 8 Lectures • 5 Quizzes (Drop lowest grade) • 2 Exams (Mid-term and Final)
  • 11. • Text: Threat Modeling: Designing for Security (Wiley, 2014) Course Description • This course discusses useful models used to address potential threats in software systems and how to apply such models in developing secure software and systems. Areas of study focus on threat modeling strategies, including finding threats, addressing threats, and threat modeling technologies. Major Instructional Areas • Understanding threat modeling • Strategies for finding threats • Techniques for managing threats • Validating threat handling activities • Understanding environment-specific threats Course Objectives • Explain threat modeling and its importance to secure architecture. • Explore strategies for threat modeling. • Understand how techniques, such as STRIDE, are useful in finding threats. • Find threats using attack trees. • Identify threats with attack libraries.
  • 12. • Explore privacy tools. • Show how to process and manage threats. • Employ defensive tactics and technologies. Course Objectives • Consider key tradeoffs when addressing threats. • Validate that threats are addressed. • Survey common threat modeling tools. • Develop a repository of requirements. • Examine web and cloud threats. • Understand user accounts and identity. • Explore how human factors and usability affect threat modeling. SCANS Objectives • SCANS is an acronym for Secretary’s Commission on Achieving Necessary Skills. The committee, appointed by the National Secretary of Labor in 1990, created a list of skills and competencies that continue to be a valuable resource for individuals developing their careers in a high- tech job market. For more information on the SCANS objectives, visit The U.S. Department of Labor Employment andTraining Administration: www.doleta.gov. http://www.doleta.gov/ Required and Recommended
  • 13. Resources • Required Resources • Shostack, Adam. Threat Modeling: Designing for Security, Indianapolis, IN: Wiley, 2014 • Recommended Resources • Please use the following author’s names, book/article titles, Web sites, and/or keywords to search for supplementary information to augment your learning in this subject. • Tony UcedaVelez and Marco M. Morana. Rick CentricThreat Modeling: Process for Attack Simulation andThreat Analysis Information Search • Use the following keywords to search for additional online resources that may be used for supporting your work on the course assignments: • Threat modeling, Security architecture, STRIDE, Countermeasure, Attack tree, Computer security, Information security, Threat, Vulnerability, Software security assurance Tentative Course Outline
  • 14. Tentative Course Outline Tentative Course Outline Tentative Course Outline Evaluation Criteria Grade Conversion Class Participation • Students are expected to: • Be fully prepared for each class session by studying the assigned reading material and preparation of the material assigned. • Participate in group discussions, assignments, and panel discussions. • Complete specific assignments when due and in a professional manner. • Take exams when specified on the attached course schedule.
  • 15. Academic Integrity • At a Christian liberal arts University committed to the pursuit of truth and understanding, any act of academic dishonesty is especially distressing and cannot be tolerated. In general, academic dishonesty involves the abuse and misuse of information or people to gain an undeserved academic advantage or evaluation.The common forms of academic dishonesty include: • cheating - using deception in the taking of tests or the preparation of written work, using unauthorized materials, copying another person’s work with or without consent, or assisting another in such activities • lying—falsifying, fabricating, or forging information in either written, spoken, or video presentations • plagiarism—using the published writings, data, interpretations, or ideas of another without proper documentation • Episodes of academic dishonesty are reported to theVice President for Academic Affairs. The potential penalty for academic dishonesty includes a failing grade on a particular assignment, a failing grade for the entire course, or charges against the student with the appropriate disciplinary body.
  • 16. Students with Disabilities • Students who may have a disability meriting an academic accommodation should contact Dr. Tom Fish in LIB 21 to ensure that their needs are properly evaluated and that documentation is on file. Any accommodations for disabilities must be re-certified each semester by the Academic Affairs Office before course adjustments are made by individual instructors. Student Responsibilities • Students are expected to login several times per week to participate in class discussions. • Students are expected to find out if any changes have been made in the class or assignment schedule. • Students are expected to be self-motivating in an online, asynchronous course. Schedule & Grading • Due date/time: Sunday 11:59 PM • NOTTHE FINAL EXAM • Quizzes 10% • Mid-term exam 10% • Final exam 10% • Discussions 30%
  • 17. • Homework Assignments 40% Administrative Notes • Read the course syllabus • Check your email and course announcements • Be proactive • Check course announcements • Read the text (don’t just fake it) • Apply the material to what you already know About threat modeling About this course About threat modeling Wouldn’t it be better to find security issues before you write or deploy a line of code? So how can you do that? How DoYou Find Security Issues?
  • 18. Ways to Find Security Issues • Static analysis of code • Fuzzing or other dynamic testing • Pen test/red team • Wait for bug reports after release Ways to Find Security Issues (2) • Threat modeling! • Think about security issues early • Understand your requirements better • Don’t write bugs into the code • And the subject of this lesson So…how do you threat model? Definitions • What is a threat? • How is it different from a • vulnerability, • risk, • or just a problem? • What is a model?
  • 19. So…how do you threat model? What are the problems associated with the “Think like an Attacker” mentality? Think Like an Attacker? • Like thinking like a professional chef! • Even if you cook well, are you the chef at a popular restaurant? • Thinking like an attacker – or focusing on them is risky • What do they know? What will they do? • If you get these wrong, your threat modeling will go astray • So don’t start from attackers! What are the problems associated with starting from assets as an approach to threat modeling?
  • 20. What do you learn by making an asset list? Focus on Assets? • Assets: valuable things – the business cares! • But what’s an asset? • Something an attacker wants? • Something you want to protect? • A stepping stone? Engineering Real Technology • Need an engineering approach • Predictable • Reliable • Scalable to a large product • Can’t be dependent on one brilliant person Focus on What You’re Building! • Ideally, you understand it • Concrete and testable? “HowToThreat Model”
  • 21. How to Threat Model • What are you building? • What can go wrong? • What are you going to do about it? • Check your work on 1-3 • The course will teach you practical skills for each of these What Are You Building? • Create a model of the software/system/technology • A model abstracts away the details so you can look at the whole • Diagraming is a key approach • Mathematical models of software are rare in commercial environments What Are You Building? • Whiteboard diagrams are a great way to start • Software models for threat modeling usually focus on data flows and boundaries • DFDs, “swim lanes”, state machines can all help (next slides)
  • 22. What Are Some Modeling Methods? • Whiteboard diagrams • Brainstorming • Structured (“formal”) diagrams • Data flow diagrams • Swim lanes • State machines • Mathematical representations of code Trust Boundaries • Sometimes left implicit in development • • Effective threat modeling requires making boundaries explicit A trust boundary is everywhere two (or more) principals interact • Principals are UIDs (unix)/SIDs (Windows) etc. • Apps on mobile platforms • (Two or more) • Need to be enforced in some way • Best to rely on the OS • Sometimes not possible (e.g., building a database)
  • 23. Trust Boundaries • All interesting boundaries are semi-permeable • Air gaps • Firewalls • Require policy mechanisms (which are hard) • Formal methods help build boundaries • Isolation • Type safety • Policy languages • Reference monitors/kernels DFD (Data Flow Diagram) • Developed in the early 70s, and still useful • Simple: easy to learn, sketch • Threats often follow data • Abstracts programs into: • Processes: your code • Data stores: files, databases, shared memory • Data flows: connect processes to other elements • External entities: everything but your code & data Includes people & cloud software • Trust boundaries (now made explicit) Data Flow Diagram (Example)
  • 24. Swim Lane Diagrams • Show two or more entities communicating, each “in a lane” • Useful for network communication • Lanes have implicit boundaries between them State Machines • Helpful for considering what changes security state • For example, unauthenticated to authenticated • User to root/admin • Rarely shows boundaries How to Threat Model (Summary) • What are you building? • What can go wrong? • What are you going to do about it? • Check your work on 1-3 What Can Go Wrong? • Fun to brainstorm
  • 25. • Mnemonics, trees, or libraries of threats can all help structure thinking • Structure helps get you towards completeness and predictability What Can Go Wrong? • STRIDE is a mnemonic • Spoofing • Tampering • Repudiation • Information Disclosure • Denial of Service • Elevation of Privilege • Easy, right? Spoofing By Lego Envy, http://www.eurobricks.com/forum/index.php?showtopic=64532 Spoofing http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532
  • 26. http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 http://www.eurobricks.com/forum/index.php?showtopic=64532 Tampering http://pinlac.om/LegoDSTractorBeam.html Tampering http://pinlac.om/LegoDSTractorBeam.html Repudiation By Seb H http://www.flickr.com/photos/[email protected]/8531040850/ Repudiation
  • 27. http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ http://www.flickr.com/photos/[email protected]/8531040850/ Information DisclosureInformation Disclosure
  • 28. Denial of Service Model by Nathan Sawaya http://brickartist.com/gallery/han-solo-in-carbonite/ Denial of Service http://brickartist.com/gallery/han-solo-in-carbonite/ Elevation of Privilege http://www.flickr.com/photos/prodif sion/ Elevation of Privilege http://www.flickr.com/photos/prodif STRIDE Threat Property Violated Definition Example Spoofing Authentication Impersonating something or someone else. Pretending to be any of Bill Gates, Paypal.com or ntdll.dll
  • 29. Tampering Integrity Modifying data or code Modifying a DLL on disk or DVD, or a packet as it traverses the network Repudiation Non-repudiation Claiming to have not performed an action. “I didn’t send that email,” “I didn’t modify that file,” “I certainly didn’t visit that web site, dear!” Information Disclosure Confidentiality Exposing information to someone not authorized to see it Allowing someone to read the Windows source code; publishing a list of customers to a web site. Denial of Service Availability Deny or degrade service to users Crashing Windows or a web site, sending a packet and absorbing seconds of CPU time, or routing packets into a black hole. Elevation of Privilege Authorization Gain capabilities without proper authorization Allowing a remote Internet user to run commands is the classic example, but going from a limited user to admin is also EoP.
  • 30. Using STRIDE • Consider how each STRIDE threat could impact each part of the model • “How could a clever attacker spoof this part of the system?...tamper with?… etc.” • Easier with aids • Elevation of Privilege game • Attack trees (see Threat Modeling: Designing for Security, Appendix B) • Experience What Can Go Wrong? • Track issues as you find them • “attacker could pretend to be a client & connect” • Track assumptions • “I think that connection is always over SSL” • Both lists are inputs to “what are you going to do about it?” Recap • What are you building? • Diagrams of various sorts • Trust boundaries
  • 31. • What can go wrong? • STRIDE What’s next? • For next week • Read chapters 3, 4, and 5 Slide Number 1AgendaSlide Number 3Threat Modeling in DepthCourse DescriptionMajor Instructional AreasCourse ObjectivesCourse ObjectivesSCANS ObjectivesRequired and Recommended ResourcesInformation SearchTentative Course OutlineTentative Course OutlineTentative Course OutlineTentative Course OutlineEvaluation CriteriaGrade ConversionClass ParticipationAcademic IntegrityStudents with DisabilitiesStudent ResponsibilitiesSchedule & GradingAdministrative NotesSlide Number 24Slide Number 25Slide Number 26Ways to Find Security IssuesWays to Find Security Issues (2)Slide Number 29DefinitionsSlide Number 31Slide Number 32Think Like an Attacker?What are the problems associated with starting from assets as an approach to threatFocus on Assets?Engineering Real TechnologyFocus on What You’re Building!Slide Number 38How to Threat ModelWhat Are You Building?What Are You Building?What Are Some Modeling Methods?Trust BoundariesTrust BoundariesDFD (Data Flow Diagram)Data Flow Diagram (Example)Swim Lane DiagramsState MachinesHow to Threat Model (Summary)What Can Go Wrong?What Can Go Wrong?SpoofingTamperingRepudiationSlide Number 55Slide Number 56Slide Number 57Slide Number 58Using STRIDEWhat Can Go Wrong?RecapWhat’s next?