Architecture Risk Analysis

Details

Delivery Format: eLearning

Duration:  1 hour 30 mintues

Level: Advanced

Intended Audience:

• Architects
• Back-End Developers
• Front-End Developers
• QA Engineers

Prerequisites: 

• Principles of Software Security
• OWASP Top 10 or Attack and Defense

Course Outline

ARA Overview

• What Is ARA?
• When Do You Perform ARA?
• Indicators ARA Is Necessary
• Ongoing ARA

Design Flaws and the Techniques That Find Them

• Bugs vs. Flaws
• Examples of Security Flaws at Design Level
• Is There a Tool for That?
• Analysis Types for ARA

ARA Output

• What Do You Get?
• Who Uses It?
• Following Up with Secure Design

Dependency Analysis

• Dependency Analysis Overview
• Analyzing an Application’s Environment and Considerations
• Illuminate Interfaces and Contracts
• Base Security Controls and Limitations

Known Attack Analysis

• What Is Known Attack Analysis?
• Applying Principles
• Commonly Discovered Flaws
• Build an Attack Checklist
• Build a List of Security Controls Common to Design Patterns
• Connections Between Architectural Elements
• Pay Close Attention to Dynamic Code Generation and Interpretation
• APIs Across Stateless Protocols

System-Specific Analysis

• Business Relation
• Discovering Intentions
• Trust
• The Problem with Trust
• Software Security Modeling Techniques
• Trust Modeling
• Data Sensitivity Classification
• Threat Modeling

Guiding Principles for ARA

• Secure the Weakest Link
• Storing Secrets Is Hard
• The Principle of Least Privilege
• Fail and Recover Securely
• Compartmentalize
• Promote Privacy
• Keep It Simple
• Mediate Completely
• Separation of Duties
• Make Security Usable

Models of an ARA System

•  ARA Models Overview
• Component Diagram
• ·Threat Model Diagram

Documenting ARA Findings

• What Is a Traceability Matrix?
• Traceability Matrix
• Documenting Technical Risks
• Customer Credentials Sent to Browser for Support Functionality
• Customer Credentials -  Findings
• Documenting Observations

Security Testing