Improving Web Application Security: Threats and - CGISecurity

Chapter 3: Threat Modeling 49ArchitectureDiagrams andDefinitionsThreat #1IdentifiedThreats andThreatAttributesThreat #2Threat #3Threat #nFigure 3.2Components of the threat modelStep 1. Identify AssetsIdentify the assets that you need to protect. This could range from confidential data,such as your customer or orders database, to your Web pages or Web site availability.Step 2. Create an Architecture OverviewAt this stage, the goal is to document the function of your application, its architectureand physical deployment configuration, and the technologies that form part of yoursolution. You should be looking for potential vulnerabilities in the design orimplementation of the application.During this step, you perform the following tasks:● Identify what the application does.●●Create an architecture diagram.Identify the technologies.