Making the Case for Improving Application Security
Giving executives and manager the right information can make the difference between a funded security initiative and another good idea put on the shelf.
One way to convey security issues is with the right kind of reporting. In the case of application development and threat assessment, the Microsoft Threat Analysis and Modeling tool can be a big help.
It provides a wizard driven process for business objectives, application components, use cases, and threats. The attack library is a nice feature. It provides descriptions of common types of attacks, how to test for them and what to do about them. There are visualizations for data flows, trust flows, and attack trees - good ways of generating information rich images to get your case across quickly. There are also reports for different roles, like risk managers, designers, developers and operations staff.
For more details, listen to the Basics of Threat Modeling podcast.
Email This!
Digg it!
Sphere it!
Del.icio.us
Reddit!
Newsvine
