A descriptive study of assumptions in STRIDE security threat modeling

Author(s):  
Dimitri Van Landuyt ◽  
Wouter Joosen
Author(s):  
Laurens Sion ◽  
Koen Yskout ◽  
Dimitri Van Landuyt ◽  
Alexander van den Berghe ◽  
Wouter Joosen

2013 ◽  
Vol 20 (2) ◽  
pp. 163-180 ◽  
Author(s):  
Riccardo Scandariato ◽  
Kim Wuyts ◽  
Wouter Joosen

2021 ◽  
Author(s):  
Jide Ebenezer Taiwo Akinsola ◽  
Samuel Akinseinde ◽  
Olamide Kalesanwo ◽  
Moruf Adeagbo ◽  
Kayode Oladapo ◽  
...  

In recent years, Cyber Security threat modeling has been discovered to have the capacity of combatting and mitigating against online threats. In order to minimize the associated risk, these threats need to be modelled with appropriate Intelligent User Interface (IUI) design and consequently the development and evaluation of threat metrics. Artificial Intelligence (AI) has revolutionized every facet of our daily lives and building a responsive Cyber Security Threat Model requires an IUI. The current threat models lack IUI, hence they cannot deliver convenience and efficiency. However, as the User Interface (UI) functionalities and User Experience (UX) continue to increase and deliver more astonishing possibilities, the present threat models lack the predictability capacity thus Machine Learning paradigms must be incorporated. Meanwhile, this deficiency can only be handled through AI-enabled UI that utilizes baseline principles in the design of interfaces for effective Human-Machine Interaction (HMI) with lasting UX. IUI helps developers or designers enhance flexibility, usability, and the relevance of the interaction to improving communication between computer and human. Baseline principles must be applied for developing threat models that will ensure fascinating UI-UX. Application of AI in UI design for Cyber Security Threat Modeling brings about reduction in critical design time and ensures the development of better threat modeling applications and solutions.


2021 ◽  
Author(s):  
Ying Su ◽  
Bohyun Ahn ◽  
Syed R. B. Alvee ◽  
Taesic Kim ◽  
Jinchun Choi ◽  
...  

Author(s):  
Wenjun Xiong ◽  
Emeline Legrand ◽  
Oscar Åberg ◽  
Robert Lagerström

AbstractEnterprise systems are growing in complexity, and the adoption of cloud and mobile services has greatly increased the attack surface. To proactively address these security issues in enterprise systems, this paper proposes a threat modeling language for enterprise security based on the MITRE Enterprise ATT&CK Matrix. It is designed using the Meta Attack Language framework and focuses on describing system assets, attack steps, defenses, and asset associations. The attack steps in the language represent adversary techniques as listed and described by MITRE. This entity-relationship model describes enterprise IT systems as a whole; by using available tools, the proposed language enables attack simulations on its system model instances. These simulations can be used to investigate security settings and architectural changes that might be implemented to secure the system more effectively. Our proposed language is tested with a number of unit and integration tests. This is visualized in the paper with two real cyber attacks modeled and simulated.


Sign in / Sign up

Export Citation Format

Share Document