Threat Model - Revision history

Tom: /* Solutions */

2025-11-25T20:36:24Z

‎Solutions

2025-11-25T02:39:48Z

‎Problems

2025-08-02T18:17:46Z

‎Examples

2025-08-02T18:15:39Z

‎Mandatory Access Levels

2025-08-02T18:15:08Z

‎Mandatory Integrity Levels

2025-06-13T01:39:24Z

‎OWASP Threat Dragon

2025-06-12T23:41:35Z

‎References

2025-06-12T23:38:32Z

‎Implications of Object-Free Security Models

2025-06-12T23:29:36Z

‎Examples

2025-06-12T23:23:39Z

‎References

@@ Line 55: / Line 55: @@
 See [[Native App Security]] for a comparison with a set of threat events from NIST NCCoE.
 ===OWASP Threat Modeling Project===
 This is a documentation project to provide information on threat modeling techniques for applications of all types, with a focus on current and emerging techniques.

@@ Line 18: / Line 18: @@
 * Another model that has been promoted by MITRE is the  [[Attack]] mode. (qv)
 ** [https://www.darkreading.com/vulnerabilities-threats/dprk-exploits-mitre-sub-techniques-phantom-dll-hijacking-tcc-abuse DPRK Exploits 2 MITRE Sub-Techniques: Phantom DLL Hijacking, TCC Abuse] 2024-04-11
 ==Solutions==

@@ Line 149: / Line 149: @@
 ==Examples==
 * [https://github.com/TalEliyahu/Threat_Model_Examples TM examples from Tal Eliyahu on GitHub]
 ==References==

@@ Line 74: / Line 74: @@
 ===Mandatory Access Levels===
-As expressed in the Bell-LaPadula Model there are two rules:
+As expressed in the Bell-LaPadula  Mandatory Access Control (MAC) Model there are two rules:
 # The simple security policy that allows no read up to acquire data from a higher privilege process.
 # The star (*) policy that allows no write down to send data to a lower prevailed process (or directory).

@@ Line 80: / Line 80: @@
 ===Mandatory Integrity Levels===
-As expressed in the Bell-LaPadula Model there are two rules:
+As expressed in the Bell-LaPadula Mandatory Integrity Control (MIC) Model there are two rules:
 # no read down
 # no write up

@@ Line 61: / Line 61: @@
 * Did we do a good enough job?
 [https://github.com/OWASP/www-project-threat-model-library/blob/v1.0.0/threat-model.schema.json Threat modeling schema]
 ===OWASP Threat Dragon===

@@ Line 144: / Line 144: @@
 ==References==
 <references />
+===Other Material===
 * [https://www.scitepress.org/Papers/2021/102550/102550.pdf Transforming Data Flow Diagrams for Privacy Compliance] Privacy by Design, Data Flow Diagrams, GDPR. <blockquote>Abstract: Most software design tools, as for instance Data Flow Diagrams (DFDs), are focused on functional aspects and cannot thus model non-functional aspects like privacy. In this paper, we provide an explicit algorithm and a proof-of-concept implementation to transform DFDs into so-called Privacy-Aware Data Flow Diagrams (PA-DFDs). Our tool systematically inserts privacy checks to a DFD, generating a PA-DFD. We apply our approach to two realistic applications from the construction and online retail sectors.</blockquote>
 *Michael Howard, Praerit Garg Loren M. Kohnfelder, RAPID APPLICATION SECURITY THREAT ANALYSIS [https://patentimages.storage.googleapis.com/31/17/7a/1a4fe95d4064c8/US7243374.pdf US Patent 7,243,374 B2] (2007-07-12)  Abstract

@@ Line 135: / Line 135: @@
 ====Implications of Object-Free Security Models====
-Flexibility: Can adapt to unknown objects or changing environments.
+* Flexibility: Can adapt to unknown objects or changing environments.
+* Privacy-Preserving: Reduces reliance on static identity tracking.
-Privacy-Preserving: Reduces reliance on static identity tracking.
+* Resilience: Protects against threats without requiring predefined entity characteristics.
 ==Examples==