Main Menu

Daily using/supporting

Get Firefox browser!
Get Thunderbird!
Get Opera browser!
Get The Gimp!
Get Inkscape!
Get LibreOffice!
Get Videolan!
Get Linux!
Get Mandriva!
Get Joomla!
Hacker Emblem

Popular Tags

Archives

Which topics would you like us to cover more?

Latest comments

Latest tweets

about 1 day ago Using REDIPS.drag to add drag and drop to your .Net webapplication #li #dib0 http://t.co/n8zY3s7d
about 7 days ago http://t.co/cknQcDbo #Kindle
about 15 days ago Freedom isn't the ability to choose what to do or say, but the ability to choose what not to do or say #freedom
about 29 days ago http://t.co/61KTQknI #Kindle
12 Apr 2012 Force the use of a networking adapter using C# #li #dib0 http://t.co/ZTJOPzOz
9 Apr 2012 http://t.co/k9yliR2t #Kindle
9 Apr 2012 Mandriva 2010.2 and USB devices in Virtualbox http://t.co/fwq9gbHB
9 Apr 2012 Execute a http request to you own site with PHP http://t.co/DIvWPrpd
Twitter
Prev Next
Home Architecture, security and coding Making a threatmodel, part 3: Used technologies
Making a threatmodel, part 3: Used technologies
Written by Division by Zero   
Wednesday, 16 February 2011 07:23

In step one and two of this threat-model howto we looked at the use cases and the attack surface of our application landscape. The third step is to identify the technology used with each component and take a look at vulnerabilities that these technologies have. In this case it is possible to dive as deep as you wish. I won't dive too deep, I just want to give an impression on how to do this. The technology is also relevant in the choice of mitigations that are available to you.

1. Web-shop

  • .Net (C#)
  • Utilizes Http
  • Uses Sql-database
  • Hosted on IIS 7 (Windows Server 2008R1)
  • Uses LDAP

2. Order information

  • Standard application
  • Hosted on Windows Server 2008
  • Communicates through webservices (Http)
  • Uses LDAP
  • Uses Sql-database

3. CRM

  • Hosted on Windows Server 2008
  • Uses Sql-database
  • Communicates through webservices (Http)
  • Uses LDAP

Now we know what technology is used. For example: the web-shop is a public web-application using a database. This means we know we need to worry about input validation, especially check on sql-injection. The main business of our fictional company is their web-shop. We must make sure we handle possible vulnerabilities the right way. With the information listed here we know the type of possible problems we can expect. We also know what data is communicated between which components. The next step is to take the STRIDE approach and classify the risks and determine what to do about them.

Tags:

Related Articles
 

Add comment


Security code
Refresh

Only put off until tomorrow what you are willing to die having left undone. - Pablo Picasso


© 2009 - 2012, Division by Zero

Template based on the empire template by joomlashack 

Valid XHTML 1.0 Strict  Valid CSS!  Creative Commons License
This work by Division by Zero is licensed under a Creative Commons Attribution-Noncommercial-Share Alike 3.0 Netherlands License.