{"id":1888,"date":"2008-03-14T19:11:12","date_gmt":"2008-03-15T02:11:12","guid":{"rendered":"http:\/\/marcbook.local\/wds\/playground\/cybertrust\/2008\/03\/14\/training-people-on-threat-modeling\/"},"modified":"2023-08-10T14:27:53","modified_gmt":"2023-08-10T21:27:53","slug":"training-people-on-threat-modeling","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/","title":{"rendered":"Training People on Threat Modeling"},"content":{"rendered":"

 <\/p>\n

Adam Shostack here. Blogger Ian Grigg has an interesting response<\/a> to my threat modeling blog series, and I wanted to respond to it. In particular, Ian says “I then would prefer to see the threat – property matrix this way:” <\/p>\n

I wanted to share an additional table from our training, and talk about repudiation a bit more. <\/p>\n

Actually, I’d like to repudiate the term “repudiation.” It’s an awful name that most people never run into in day-to-day life. It doesn’t hit the simplification bar the way say, “denial,” would. Unfortunately, STDIDE (Spoofing, Tampering, Denial, Information Disclosure, Denial of Service, Elevation of Privilege) doesn’t make a very memorable acronym. Memorable is important when training people. Our reviewers have raised this as an issue, and ’d love to get feedback from our readers. How can we ensure that the software we build has the right level of logging and audit-ability? What evocative words can we use, and can you help us come up with a word or phrase that starts with R? Let us know! <\/p>\n

And then, here’s the chart:<\/p>\n\n\n\n\n\n\n\n\n\n
Threat<\/td>\nProperty<\/td>\nDefinition<\/td>\nExample<\/td>\n<\/tr>\n
Spoofing<\/b><\/td>\nAuthentication<\/td>\nImpersonating something or someone else.<\/td>\nPretending to be any of billg, microsoft.com or ntdll.dll<\/td>\n<\/tr>\n
T<\/b>ampering<\/td>\nIntegrity<\/td>\nModifying data or code<\/td>\nModifying a DLL on disk or DVD, or a packet as it traverses the LAN.<\/td>\n<\/tr>\n
R<\/b>epudiation<\/td>\nNon-repudiation<\/td>\nClaiming to have not performed an action.<\/td>\n“I didn’t send that email,” “I didn’t modify that file,” “I certainly<\/i> didn’t visit that web site, dear!”<\/td>\n<\/tr>\n
I<\/b>nformation Disclosure<\/td>\nConfidentiality<\/td>\nExposing information to someone not authorized to see it<\/td>\nAllowing someone to read the Windows source code; publishing a list of customers to a web site.<\/td>\n<\/tr>\n
D<\/b>enial of Service<\/td>\nAvailability<\/td>\nDeny or degrade service to users<\/td>\nCrashing Windows or a web site, sending a packet and absorbing seconds of CPU time, or routing packets into a black hole.<\/td>\n<\/tr>\n
E<\/b>levation of Privilege<\/td>\nAuthorization<\/td>\nGain capabilities without proper authorization<\/td>\nAllowing a remote internet user to run commands is the classic example, but going from a limited user to admin is also EoP.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n

 <\/p>\n

(Ian’s post is here https:\/\/financialcryptography.com\/mt\/archives\/001013.html<\/a> . IE users will see a warning about certificate authorities when visiting this site.  As I wrote this, Gunnar Peterson added commentary at “Threats, Mechanisms and Standards<\/a>.”)<\/p>\n","protected":false},"excerpt":{"rendered":"

  Adam Shostack here. Blogger Ian Grigg has an interesting response to my threat modeling blog series, and I wanted to respond to it. In particular, Ian says “I then would prefer to see the threat – property matrix this way:” I wanted to share an additional table from our training, and talk about repudiation […]<\/p>\n","protected":false},"author":61,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"ep_exclude_from_search":false,"_classifai_error":"","footnotes":""},"content-type":[3659],"topic":[],"products":[],"threat-intelligence":[],"tags":[3825,3822],"coauthors":[1973],"class_list":["post-1888","post","type-post","status-publish","format-standard","hentry","content-type-best-practices","tag-developers","tag-microsoft-security-insights"],"yoast_head":"\nTraining People on Threat Modeling | Microsoft Security Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Training People on Threat Modeling | Microsoft Security Blog\" \/>\n<meta property=\"og:description\" content=\"  Adam Shostack here. Blogger Ian Grigg has an interesting response to my threat modeling blog series, and I wanted to respond to it. In particular, Ian says “I then would prefer to see the threat – property matrix this way:” I wanted to share an additional table from our training, and talk about repudiation […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/\" \/>\n<meta property=\"og:site_name\" content=\"Microsoft Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2008-03-15T02:11:12+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-08-10T21:27:53+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-microsoft_logo_element.png\" \/>\n\t<meta property=\"og:image:width\" content=\"512\" \/>\n\t<meta property=\"og:image:height\" content=\"512\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Microsoft Security\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Microsoft Security\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/\"},\"author\":[{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/mssecurity\/\",\"@type\":\"Person\",\"@name\":\"Microsoft Security\"}],\"headline\":\"Training People on Threat Modeling\",\"datePublished\":\"2008-03-15T02:11:12+00:00\",\"dateModified\":\"2023-08-10T21:27:53+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/\"},\"wordCount\":416,\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"keywords\":[\"Developers\",\"Microsoft Security Insights\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/\",\"name\":\"Training People on Threat Modeling | Microsoft Security Blog\",\"isPartOf\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\"},\"datePublished\":\"2008-03-15T02:11:12+00:00\",\"dateModified\":\"2023-08-10T21:27:53+00:00\",\"breadcrumb\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Training People on Threat Modeling\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"name\":\"Microsoft Security Blog\",\"description\":\"Expert coverage of cybersecurity topics\",\"publisher\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization\",\"name\":\"Microsoft Security Blog\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"contentUrl\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png\",\"width\":512,\"height\":512,\"caption\":\"Microsoft Security Blog\"},\"image\":{\"@id\":\"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Training People on Threat Modeling | Microsoft Security Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/","og_locale":"en_US","og_type":"article","og_title":"Training People on Threat Modeling | Microsoft Security Blog","og_description":"  Adam Shostack here. Blogger Ian Grigg has an interesting response to my threat modeling blog series, and I wanted to respond to it. In particular, Ian says “I then would prefer to see the threat – property matrix this way:” I wanted to share an additional table from our training, and talk about repudiation […]","og_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/","og_site_name":"Microsoft Security Blog","article_published_time":"2008-03-15T02:11:12+00:00","article_modified_time":"2023-08-10T21:27:53+00:00","og_image":[{"width":512,"height":512,"url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-microsoft_logo_element.png","type":"image\/png"}],"author":"Microsoft Security","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Microsoft Security","Est. reading time":"2 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/#article","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/"},"author":[{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/author\/mssecurity\/","@type":"Person","@name":"Microsoft Security"}],"headline":"Training People on Threat Modeling","datePublished":"2008-03-15T02:11:12+00:00","dateModified":"2023-08-10T21:27:53+00:00","mainEntityOfPage":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/"},"wordCount":416,"publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"keywords":["Developers","Microsoft Security Insights"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/","name":"Training People on Threat Modeling | Microsoft Security Blog","isPartOf":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website"},"datePublished":"2008-03-15T02:11:12+00:00","dateModified":"2023-08-10T21:27:53+00:00","breadcrumb":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2008\/03\/14\/training-people-on-threat-modeling\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/"},{"@type":"ListItem","position":2,"name":"Training People on Threat Modeling"}]},{"@type":"WebSite","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#website","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","name":"Microsoft Security Blog","description":"Expert coverage of cybersecurity topics","publisher":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#organization","name":"Microsoft Security Blog","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","contentUrl":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-content\/uploads\/2018\/08\/cropped-cropped-microsoft_logo_element.png","width":512,"height":512,"caption":"Microsoft Security Blog"},"image":{"@id":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/#\/schema\/logo\/image\/"}}]}},"msxcm_display_generated_audio":false,"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"Microsoft Security Blog","distributor_original_site_url":"https:\/\/www.microsoft.com\/en-us\/security\/blog","push-errors":false,"_links":{"self":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/1888"}],"collection":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/users\/61"}],"replies":[{"embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/comments?post=1888"}],"version-history":[{"count":0,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/posts\/1888\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/media?parent=1888"}],"wp:term":[{"taxonomy":"content-type","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/content-type?post=1888"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/topic?post=1888"},{"taxonomy":"products","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/products?post=1888"},{"taxonomy":"threat-intelligence","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/threat-intelligence?post=1888"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/tags?post=1888"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/wp-json\/wp\/v2\/coauthors?post=1888"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}