Skip to content

Instantly share code, notes, and snippets.

@michaellihs

michaellihs/security-cheatsheet.md

Last active November 6, 2019 15:17
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save michaellihs/67e0476cf18d70ccf8be4baf73173cd6 to your computer and use it in GitHub Desktop.
Save michaellihs/67e0476cf18d70ccf8be4baf73173cd6 to your computer and use it in GitHub Desktop.
Download ZIP
Security Cheatsheet
Raw
security-cheatsheet.md

STRIDE

STRIDE is a method to categorize security threats:

  • Spoofing identity. Can someone spoof an identity and then abuse its authority? Spoofing identity allows attackers to do things they are not supposed to do.

  • Tampering with data. How hard is it for an attacker to modify the data they submit to your system? Can they break a trust boundary and modify the code which runs as part of your system?

  • Repudiation (Nichtanerkennung). How hard is it for users to deny performing an action? What evidence does the system collect to help you to prove otherwise? Non-repudiation refers to the ability of a system to ensure people are accountable for their actions.

  • Information disclosure. Can someone view information they are not supposed to have access to? Information disclosure threats involve the exposure or interception of information to unauthorised individuals.

  • Denial of service. Can someone break a system so valid users are unable to use it? Denial of service attacks work by flooding, wiping or otherwise breaking a particular service or system.

  • Elevation of privilege. Can an unprivileged user gain more access to the system than they should have? Elevation of privilege attacks are possible because authorisation boundaries are missing or inadequate.

Resources & Further Readings

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment