Application Security

  1. Secure Design and Architecture
    1. Security Requirements Engineering
      1. Functional Security Requirements
        1. Authentication Requirements
          1. Authorization Requirements
            1. Data Protection Requirements
              1. Audit and Logging Requirements
              2. Non-Functional Security Requirements
                1. Performance Security Trade-offs
                  1. Scalability Security Considerations
                    1. Compliance Requirements
                      1. Privacy Requirements
                    2. Threat Modeling Methodologies
                      1. STRIDE Methodology
                        1. Spoofing Identity
                          1. Tampering with Data
                            1. Repudiation
                              1. Information Disclosure
                                1. Denial of Service
                                  1. Elevation of Privilege
                                  2. DREAD Assessment
                                    1. Damage Potential
                                      1. Reproducibility
                                        1. Exploitability
                                          1. Affected Users
                                            1. Discoverability
                                            2. PASTA Framework
                                              1. Process Overview
                                                1. Attack Simulation
                                                  1. Threat Analysis Steps
                                                  2. VAST Approach
                                                    1. Visual Modeling
                                                      1. Agile Integration
                                                        1. Scalable Threat Modeling
                                                      2. Threat Modeling Process
                                                        1. Application Decomposition
                                                          1. Data Flow Diagrams
                                                            1. Trust Boundaries
                                                              1. Entry and Exit Points
                                                                1. Data Stores
                                                                2. Threat Identification
                                                                  1. Threat Enumeration
                                                                    1. Attack Trees
                                                                      1. Misuse Cases
                                                                      2. Risk Assessment
                                                                        1. Likelihood Determination
                                                                          1. Impact Analysis
                                                                            1. Risk Scoring
                                                                            2. Countermeasure Selection
                                                                              1. Mitigation Strategies
                                                                                1. Risk Acceptance
                                                                                  1. Risk Transfer
                                                                                2. Secure Architecture Patterns
                                                                                  1. Authentication Patterns
                                                                                    1. Single Sign-On
                                                                                      1. Multi-Factor Authentication
                                                                                        1. Federated Identity
                                                                                        2. Authorization Patterns
                                                                                          1. Role-Based Access Control
                                                                                            1. Attribute-Based Access Control
                                                                                              1. Policy-Based Access Control
                                                                                              2. Session Management Patterns
                                                                                                1. Stateless Sessions
                                                                                                  1. Secure Session Storage
                                                                                                    1. Session Lifecycle Management
                                                                                                    2. Data Protection Patterns
                                                                                                      1. Encryption at Rest
                                                                                                        1. Encryption in Transit
                                                                                                          1. Key Management Patterns
                                                                                                          2. Input Handling Patterns
                                                                                                            1. Input Validation
                                                                                                              1. Output Encoding
                                                                                                                1. Parameterized Queries

                                                                                                            Previous

                                                                                                            3. Secure Software Development Lifecycle

                                                                                                            Go to top

                                                                                                            Next

                                                                                                            5. Secure Coding Practices