PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Continuous TRAIL

blog.trailofbits.com | blog | #application-security | #sdlc | #threat-modeling | #risk-analysis | #trail-of-bits | #trail
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Trail of Bits explains how to keep TRAIL threat models current as systems evolve—updating trust zones and threat actors and using the model to spot missing security controls.
Published
Collected

Related coverage

blog · bishopfox.com
The Evolution of the Red Team
Bishop Fox argues TTP-based red teaming has reached its natural limit, and proposes integrating red team services with risk analysis and threat modeling into one coherent program.
blog · netspi.com
How to Build a Layered Approach to Application Security Testing
Learn best practices from top AppSec experts to help you build a world-class, layered application security testing program.
blog · netspi.com
Three Threat Modeling Automation Conjectures
If you are buying or building threat modeling automation, here are three conjectures to take into consideration.
blog · netspi.com
Getting Started on Your Application Security Journey
Four myths hold back application security programs, from 'AppSec teams are optional' to 'DevOps shops do not need one'; successful journeys start with a central governing team and defect discovery.
blog · netspi.com
Mobile Application Threat Modeling
Mobile platforms carry users' most intimate data, yet security is often an afterthought. NetSPI offers a threat modeling framework to evaluate mobile apps at design time or retroactively.
blog · netspi.com
Outsourcing application development – what is missing?
Outsourcing guides rarely address security: require secure coding training, put security reviews in contracts, and demand a penetration test plus code review with mitigation before release.
Back