« Web application firewalls primer | Main | Archive of Amit Klein's Work »

Threat Modelling Resources

Posted by ivanr on January 26, 2006.

I will be at the Institute of Directors tomorrow, giving a talk on threat modelling for the White Hats user group (full title of the talk: "Threat Modelling for Web Application Deployment"). As I was preparing for the talk I thought it would be a good idea to post the list of threat modelling resources online, for myself and for the others.

• Part I of Improving Web Application Security, Threats and Countermeasures, from Microsoft:

• Attack Modeling for Information Security and Survivability (PDF)
  
  
• OCTAVE (risk-based
  strategic assessment and planning technique for security)

• Collaborative Attack Modeling
  
  
• Attack Trees
  
  
• Systematic Network Vulnerability Analysis based on Attack Graphs (PDF)

• Book Managing Information Security Risks: The OCTAVE Approach
  
  
• Chapter 4 in Writing Secure Code

• Book Threat Modeling, also from Microsoft

• Free Threat Modelling Tool from Microsoft

• Threat Modeling Portal @ MSDN
  

Posted by ivanr at January 26, 2006 09:40 PM