Scribd Logo
Upload

Welcome to Scribd!

  • 414 views

    Capstone Project Solution of Threat Modeling

    Uploaded by

    yogesh jangir
    The document outlines tasks to develop an e-commerce application. It discusses objectives, actors, technologies, dependencies, network and logical topologies, threats using STRIDE and DREAD models, and templates for threats and risk ratings. The key tasks are to secure the #1 market position, provide a user-friendly experience, and identify threats such as SQL injection and XSS to the application and database. Network security includes firewalls, WAF, IDS and secure placement of servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd

    Capstone Project Solution of Threat Modeling

    Uploaded by

    yogesh jangir
    414 views6 pages
    The document outlines tasks to develop an e-commerce application. It discusses objectives, actors, technologies, dependencies, network and logical topologies, threats using STRIDE and DREAD models, and templates for threats and risk ratings. The key tasks are to secure the #1 market position, provide a user-friendly experience, and identify threats such as SQL injection and XSS to the application and database. Network security includes firewalls, WAF, IDS and secure placement of servers.

    Original Description:

    capstone project solution of threat modeling , threat model concept

    Original Title

    capstone project solution of threat modeling

    Copyright

    © © All Rights Reserved

    Available Formats

    DOCX, PDF, TXT or read online from Scribd

    Did you find this document useful?

    Is this content inappropriate?

    The document outlines tasks to develop an e-commerce application. It discusses objectives, actors, technologies, dependencies, network and logical topologies, threats using STRIDE and DREAD models, and templates for threats and risk ratings. The key tasks are to secure the #1 market position, provide a user-friendly experience, and identify threats such as SQL injection and XSS to the application and database. Network security includes firewalls, WAF, IDS and secure placement of servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    414 views6 pages

    Capstone Project Solution of Threat Modeling

    Uploaded by

    yogesh jangir
    The document outlines tasks to develop an e-commerce application. It discusses objectives, actors, technologies, dependencies, network and logical topologies, threats using STRIDE and DREAD models, and templates for threats and risk ratings. The key tasks are to secure the #1 market position, provide a user-friendly experience, and identify threats such as SQL injection and XSS to the application and database. Network security includes firewalls, WAF, IDS and secure placement of servers.

    Copyright:

    © All Rights Reserved
    Download as DOCX, PDF, TXT or read online from Scribd
    Download as docx, pdf, or txt
    You are on page 1of 6

    TASK 1

    Objectives :-

    1. Secure #1 market leader position for daily groceries and home requirements.

    2. Provide secure service to existing and prospective customers.

    3. Provide uninterrupted service to existing and prospective customers.

    4. Provide an enhanced user experience to existing and prospective customers.

    TASK 2

    Human actors Of the system :- customers, sales team, administrators.

    Non-human actors of the systems :- batch processes that backup data periodically to a 3rd party DR
    location

    Technologies that will be used to develop the application :- Data elements may include product
    information (product data, catalog of items, product pricing, product images etc.), customer information
    (name, billing address, shipping address etc) and order information (data of order, bill of materials, order
    amount, payment details etc.)

    Technologies that will be used to develop the application include Python language and choice of Oracle
    and MS SQL for database. Nginx is used as the web server.

    External dependencies :- external payment processors and 3rd party backup service provider.

    Threat actors :- Threat actors could be internal (malicious/disgruntled employee) or external (organized
    criminals, hackers etc).

    TASK 3

    Network Topology using the following information

    • By use of Firewall for boundary protection

    • By use of Web application Firewall to protect the application

    • By use of security solutions such as IDS to monitor for malicious traffics

    • Application server is placed in the DMZ

    • Database server is placed in the Internal network


    TASK 4

    Logical Topology by using the following information :-

    • Customers use SSL/TLS to access the web store

    • There is a trust boundary between the web server and application

    • There is a trust boundary between the application and database

    • Connection between application is via a secure VPN

    Logical Topology Diagram :-


    TASK 5

    Threats Identified using STRIDE model

    Spoofing • Session hijacking


    • CSRF
    Tampering • Cross Site Scripting (XSS)
    • SQL Injection
    Repudiation • No audit trails
    Information Disclosure • URL tampering
    • Misconfigured systems
    • Insecure protocols such as HTTP, Telnet, FTP
    Denial of Service • DDoS attack
    • Billion laughs attack
    Elevation of Privilege • SQL Injection

    TASK 6

    Threat Template

    Threat description Injection of SQL commands

    Threat target Database server

    Attack techniques Attacker appends SQL commands to input fields which is used to form a SQL
    query.
    Controls/ Use a regular expression to validate the user inputs, and use a stored procedure
    Countermeasures that uses parameters to access the database.

    TASK 7

    Threat Rating using DREAD model

    Threat D R E A D Total Rating


    XSS 2 1 2 1 2 8 M
    SQL Injection 3 3 3 3 2 14 H
    TASK 8

    Threat Template with Threat Rating

    Threat description SQL Injection

    Threat target Database server

    Attack techniques Attacker appends SQL commands to input fields which is used to form a SQL
    query.
    Controls/ Use a regular expression to validate the user inputs, and use a stored procedure
    Countermeasures that uses parameters to access the database.

    Risk rating High

    You might also like