Improving Web Application Security: Threats and - CGISecurity

lxxxImproving Web Application Security: Threats and CountermeasuresAn outline of the threat modeling process covered in the guide is shown in Figure 4.Threat Modeling Process1. Identify Assets2. Create an Architecture Overview3. Decompose the Application4. Identify the Threats5. Document the Threats6. Rate the ThreatsFigure 4The Threat Modeling ProcessThe steps shown in Figure 4 are described below:1. Identify assets.Identify the assets of value that your systems must protect.2. Create an architecture overview.Use simple diagrams and tables to document the architecture of your application,including subsystems, trust boundaries, and data flow.3. Decompose the application.Decompose the architecture of your application, including the underlying networkand host infrastructure design, to create a security profile for the application. Theaim of the security profile is to uncover vulnerabilities in the design,implementation, or deployment configuration of your application.4. Identify the threats.Keeping an attacker’s goals in mind, and with knowledge of your application’sarchitecture and potential vulnerabilities, you identify the threats that couldimpact the application.5. Document the threats.Document each threat using a common threat template that defines a core set ofattributes that you should capture for each threat.