Threat Modeling: Diving into the Deep End

Ingalsbe, Jeffrey A.; Kunimatsu, L.; Baeten, T.; Mead, Nancy R.

doi:10.1109/ms.2008.25

Cited by 24 publications

(10 citation statements)

References 0 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…It connects system components with threat types. With this information on hand, one can extract the parts, which affect communication, and use a DREAD related technique similar to that proposed in [47] to assign numerical values to specific vulnerabilities, which can then be normalized to probabilities. For example, Discoverability, w d , Reproducibility, w r , and Exploitability, w e , would denote the likelihood of threats, and Affected users, au, and Damage potential, dp-their severity, leading to a numerical risk assessment, according to the following formula: risk = (w d + w r + w e ) * (au + dp)…”

Section: Resultsmentioning

confidence: 99%

“…The model of a cyberphysical system assumed, as presented in Figures 3-6 (for a generic system and a case study, respectively), maps very nicely onto the thread modeling process discussed in [45,47], which uses data flow diagrams. Principles of creating data flow diagrams correspond nearly identically to our representation of cyberphysical systems and do not need additional discussion.…”

Section: Outline Of Threat Modelingmentioning

confidence: 89%

“…The essential process has been described in [45] and discussed in practice [47], and includes the following five steps: (1) Understand the Adversary's View; (2) Create a System Model; (3) Determine and Investigate the Threats; (4) Mitigate the Threats; and (5) Validate the Mitigations.…”

Section: Outline Of Threat Modelingmentioning

confidence: 99%

“…Step 3, the traditional way of determining and investigating threats is split into three phases: (1) Identifying/defining threats using the STRIDE method; (2) Using threat trees to assess vulnerabilities; and (3) Characterizing risks associated with vulnerabilities using the DREAD method, where STRIDE, which stands for Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege, and DREAD, which stands for Damage potential, Reproducibility, Exploitability, Affected users, and Discoverability, are relatively well described techniques of dealing with threats and corresponding risks [45,47].…”

Section: Outline Of Threat Modelingmentioning

confidence: 99%

See 3 more Smart Citations

A Framework for Measuring Security as a System Property in Cyberphysical Systems

et al. 2016

View full text Add to dashboard Cite

This paper addresses the challenge of measuring security, understood as a system property, of cyberphysical systems, in the category of similar properties, such as safety and reliability. First, it attempts to define precisely what security, as a system property, really is. Then, an application context is presented, in terms of an attack surface in cyberphysical systems. Contemporary approaches related to the principles of measuring software properties are also discussed, with emphasis on building models. These concepts are illustrated in several case studies, based on previous work of the authors, to conduct experimental security measurements.

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Outline Of Threat Modelingmentioning

confidence: 89%

Section: Outline Of Threat Modelingmentioning

confidence: 99%

Section: Outline Of Threat Modelingmentioning

confidence: 99%

See 2 more Smart Citations

A Framework for Measuring Security as a System Property in Cyberphysical Systems

et al. 2016

View full text Add to dashboard Cite

show abstract

“…The traditional way of determining and investigating threats is done using attack trees, supported with methods like STRIDE or DREAD as tools for general security analysis [57][58]. In this paper, because of the need for more quantitative approach, an alternative method is suggested, based on assessing the vulnerabilities as per the Common Vulnerability Scoring System (CVSS) [59][60].…”

Section: A Outline Of Establishing a Security Measurement Processmentioning

confidence: 99%

Position Papers of the 2014 Federated Conference on Computer Science and Information Systems

2014

Annals of Computer Science and Information Systems

View full text Add to dashboard Cite

EAR Reader, it is our pleasure to present to you Position Papers of the 2014 Federated Conference on Computer Science and Information Systems (FedCSIS), which took place in Warsaw, Poland, on September 7-10, 2014. This is the second year when position papers have been introduced as a separate category of contributions. They represent emerging research papers and challenge papers. The former present preliminary research results from work-inprogress based on sound scientific approach but presenting work not completely validated as yet. The latter propose and describe research challenges in theory or practice of computer science and information systems. viii HE AAIA'14 will bring researchers, developers, practitioners, and users to present their latest research, results, and ideas in all areas of artificial intelligence. We hope that theory and successful applications presented at the AAIA'14 will be of interest to researchers and practitioners who want to know about both theoretical advances and latest applied developments in Artificial Intelligence. As such AAIA'14 will provide a forum for the exchange of ideas between theoreticians and practitioners to address the important issues.T TOPICS Papers related to theories, methodologies, and applications in science and technology in this theme are especially solicited. Topics covering industrial issues/applications and academic research are included, but not limited to:• Knowledge Management PROFESSOR ZDZISLAW PAWLAK BEST PAPER AWARDS We are proud to announce that we will continue the tradition started during the AAIA'06 Symposium and award two "Professor Zdzislaw Pawlak Best Paper Awards" for contributions which are outstanding in their scientific quality. The two award categories are:• Best Student Paper -for graduate or PhD students. Papers qualifying for this award must be marked as "Student full paper" to be eligible for consideration.• Best Paper Award for the authors of the best paper appearing at the Symposium. Candidates for the awards can come from AAiA and all workshops organized within its framework (i.e. AIMA, ASIR, CEIM, TAIE, WCO)In addition to a certificate, each award carries a prize of 300 EUR provided by the Mazowsze Chapter of the Polish Information Processing Society. Abstract-I will analyze Pawlak's rough sets and extend the usual setting of characterization via an equivalence relation to any arbitrary relation, or a full relation. I extract the specification of rough sets by two operators: probable operator and sure operator. This would provide a general framework to analyze full rough sets and to compare them with Pawlak's rough sets. It also facilitates all the computation and further expansion. This paper extends Pawlak's approximation approach to any arbitrary relations and explicitly defines several computational operators to study the closeness regarding the characterization of operations on sets.

show abstract