Application Security

4.

Secure Design and Architecture

4.1.

Security Requirements Engineering

4.1.1.

Functional Security Requirements

4.1.1.1.

Authentication Requirements

4.1.1.2.

Authorization Requirements

4.1.1.3.

Data Protection Requirements

4.1.1.4.

Audit and Logging Requirements

4.1.2.

Non-Functional Security Requirements

4.1.2.1.

Performance Security Trade-offs

4.1.2.2.

Scalability Security Considerations

4.1.2.3.

Compliance Requirements

4.1.2.4.

Privacy Requirements

4.2.

Threat Modeling Methodologies

4.2.1.

STRIDE Methodology

4.2.1.1.

Spoofing Identity

4.2.1.2.

Tampering with Data

4.2.1.3.

4.2.1.4.

Information Disclosure

4.2.1.5.

Denial of Service

4.2.1.6.

Elevation of Privilege

4.2.2.

DREAD Assessment

4.2.2.1.

Damage Potential

4.2.2.2.

Reproducibility

4.2.2.3.

4.2.2.4.

4.2.2.5.

Discoverability

4.2.3.

PASTA Framework

4.2.3.1.

Process Overview

4.2.3.2.

Attack Simulation

4.2.3.3.

Threat Analysis Steps

4.2.4.

4.2.4.1.

Visual Modeling

4.2.4.2.

Agile Integration

4.2.4.3.

Scalable Threat Modeling

4.3.

Threat Modeling Process

4.3.1.

Application Decomposition

4.3.1.1.

Data Flow Diagrams

4.3.1.2.

Trust Boundaries

4.3.1.3.

Entry and Exit Points

4.3.1.4.

4.3.2.

Threat Identification

4.3.2.1.

Threat Enumeration

4.3.2.2.

4.3.2.3.

4.3.3.

Risk Assessment

4.3.3.1.

Likelihood Determination

4.3.3.2.

Impact Analysis

4.3.3.3.

4.3.4.

Countermeasure Selection

4.3.4.1.

Mitigation Strategies

4.3.4.2.

Risk Acceptance

4.3.4.3.

4.4.

Secure Architecture Patterns

4.4.1.

Authentication Patterns

4.4.1.1.

4.4.1.2.

Multi-Factor Authentication

4.4.1.3.

Federated Identity

4.4.2.

Authorization Patterns

4.4.2.1.

Role-Based Access Control

4.4.2.2.

Attribute-Based Access Control

4.4.2.3.

Policy-Based Access Control

4.4.3.

Session Management Patterns

4.4.3.1.

Stateless Sessions

4.4.3.2.

Secure Session Storage

4.4.3.3.

Session Lifecycle Management

4.4.4.

Data Protection Patterns

4.4.4.1.

Encryption at Rest

4.4.4.2.

Encryption in Transit

4.4.4.3.

Key Management Patterns

4.4.5.

Input Handling Patterns

4.4.5.1.

Input Validation

4.4.5.2.

Output Encoding

4.4.5.3.

Parameterized Queries

Previous

3. Secure Software Development Lifecycle

Go to top

Next

5. Secure Coding Practices