What security engineers work on outside application code: security principles, threat modelling, cryptography, identity and network controls. It also covers finding vulnerabilities, detecting attacks, responding to incidents, and how malware and social engineering work.
You’re reading a free preview. Sign up to see every topic and question — and to play this deck as games.
How to look at a system design and work out what could go wrong: data flow diagrams, trust boundaries, STRIDE, attack trees and scoring risk.
40 total questions
Card #1
Threat modelling
Card #2
Trust boundary
Card #3
Data flow diagram (DFD)
1. An attacker replays a stolen session cookie and the app treats them as another customer. Which STRIDE category is this?
2. A user edits the price field in a checkout request and pays 1 dollar for a 500 dollar item. Which STRIDE category fits best?
3. A user deletes a customer record, and because nothing was logged, nobody can show who did it. Which STRIDE category is this?
1. OWASP Threat ___ is a free, open-source tool for drawing threat model diagrams.
Hint: A mythical creature
2. Applying all six STRIDE categories to each element of a diagram in turn is called STRIDE-per-___.
Hint: One part of the diagram at a time
3. Data at ___ is stored data, as opposed to data in transit between systems.
Hint: Not moving
