Threat Modeling Gameplay with EoP: A reference manual for spotting threats in software architecture

— —

Brett Crawley Adam Shostack

Threat Modeling Gameplay with EoP

A reference manual for spotting threats in software architecture

Brett Crawley, Adam Shostack

$91.95 $78.05

Paperback

Not in-store but you can order this
How long will it take?

Availability Information

We source books from suppliers in Australia and overseas. For books we don't currently have in stock, the time it takes to get them from our suppliers can vary widely - from a few days to a few months - so we check each book with each supplier to determine the expected time it will take to be supplied to us.

We then advise you accordingly. If the time taken to get any book is too long for you, you can let us know and we will cancel or adjust your order, and refund as required.

To find out the anticipated arrival time for specific items prior to ordering, please contact us by phone or email:

Phone +61 2 9264 3111, or 1800 4 BOOKS (1800 4 26657) if outside Sydney:
option 1 Abbey's Bookshop (Crime, History, Science, Kids & more) • info@abbeys.com.au
option 2 Language Book Centre (ESL & Foreign Languages) • language@abbeys.com.au
option 3 Galaxy Bookshop (Sci-fi, Fantasy, Romance, Graphic Novels) • sf@galaxybooks.com.au

QTY:

English

Packt Publishing Limited
09 August 2024

Coding theory & cryptology; Privacy & data protection; Data encryption; Systems analysis & design

Work with over 150 real-world examples of threat manifestation in software development and identify similar design flaws in your systems using the EoP game, along with actionable solutions

Key Features

Apply threat modeling principles effectively with step-by-step instructions and support material Explore practical strategies and solutions to address identified threats, and bolster the security of your software systems Develop the ability to recognize various types of threats and vulnerabilities within software systems Purchase of the print or Kindle book includes a free PDF eBook

Book DescriptionAre you looking to navigate security risks, but want to make your learning experience fun? Here's a comprehensive guide that introduces the concept of play to protect, helping you discover the threats that could affect your software design via gameplay. Each chapter in this book covers a suit in the Elevation of Privilege (EoP) card deck (a threat category), providing example threats, references, and suggested mitigations for each card. You’ll explore the methodology for threat modeling—Spoofing, Tampering, Repudiation, Information Disclosure, and Elevation of Privilege (S.T.R.I.D.E.) with Privacy deck and the T.R.I.M. extension pack. T.R.I.M. is a framework for privacy that stands for Transfer, Retention/Removal, Inference, and Minimization. Throughout the book, you’ll learn the meanings of these terms and how they should be applied. From spotting vulnerabilities to implementing practical solutions, the chapters provide actionable strategies for fortifying the security of software systems. By the end of this book, you will be able to recognize threats, understand privacy regulations, access references for further exploration, and get familiarized with techniques to protect against these threats and minimize risks.

What you will learn

Understand the Elevation of Privilege card game mechanics Get to grips with the S.T.R.I.D.E. threat modeling methodology Explore the Privacy and T.R.I.M. extensions to the game Identify threat manifestations described in the games Implement robust security measures to defend against the identified threats Comprehend key points of privacy frameworks, such as GDPR to ensure compliance

Who this book is forThis book serves as both a reference and support material for security professionals and privacy engineers, aiding in facilitation or participation in threat modeling sessions. It is also a valuable resource for software engineers, architects, and product managers, providing concrete examples of threats to enhance threat modeling and develop more secure software designs. Furthermore, it is suitable for students and engineers aspiring to pursue a career in application security. Familiarity with general IT concepts and business processes is expected.

By: Brett Crawley
Foreword by: Adam Shostack
Imprint: Packt Publishing Limited
Country of Publication: United Kingdom
Dimensions: Height: 235mm, Width: 191mm,
ISBN: 9781804618974
ISBN 10: 1804618977
Pages: 256
Publication Date: 09 August 2024
Audience: General/trade , ELT Advanced
Format: Paperback
Publisher's Status: Active

Table of Contents Game Play Spoofing Tampering Repudiation Information Disclosure Denial of Service Elevation of Privilege Privacy Transfer Retention/Removal Inference Minimization Glossary Further Reading

Brett Crawley is a principal application security engineer, (ISC2) CISSP, CSSLP, and CCSP certified, the project lead on the OWASP Application Security Awareness Campaigns project, and the author of the OSTERING blog on security. He has published a Miro template for threat modeling with the Elevation of Privilege card game and also published the CAPEC S.T.R.I.D.E. mapping mind maps and other resources. With over 10 years of application security experience and over 25 years of software engineering experience, he works with teams to define their security best practices and introduce security by design into their existing SDLC, and as part of this initiative, he trains teams in threat modeling because good design is of key importance. He is also an advocate for using a data-driven approach to AppSec, to help identify the business-critical components, thereby optimizing the reduction of risk to the organization.