threat-modeling

Compare original and translation side by side

🇺🇸

Original

English

🇨🇳

Translation

Chinese

Threat Modeling

威胁建模

Identify and mitigate security threats during system design.

在系统设计阶段识别并缓解安全威胁。

STRIDE Methodology

STRIDE方法论

Threat	Description	Mitigation
Spoofing	Pretending to be someone else	Authentication
Tampering	Modifying data	Integrity controls
Repudiation	Denying actions	Audit logging
Information Disclosure	Data exposure	Encryption
Denial of Service	Making service unavailable	Rate limiting
Elevation of Privilege	Gaining higher access	Authorization

威胁类型	描述	缓解措施
Spoofing（身份冒充）	伪装成其他实体	身份认证
Tampering（篡改）	修改数据	完整性控制
Repudiation（抵赖）	否认已执行的操作	审计日志
Information Disclosure（信息泄露）	数据暴露	加密
Denial of Service（拒绝服务）	使服务不可用	速率限制
Elevation of Privilege（权限提升）	获取更高权限	授权

Process

流程

yaml

steps:
  1_scope:
    - Define system boundaries
    - Identify assets
    - Document data flows
    
  2_diagram:
    - Create data flow diagrams
    - Identify trust boundaries
    - Mark entry points
    
  3_identify:
    - Apply STRIDE to each component
    - List potential threats
    - Document attack vectors
    
  4_assess:
    - Rate likelihood and impact
    - Prioritize by risk score
    
  5_mitigate:
    - Design countermeasures
    - Accept/transfer risks
    - Document decisions

yaml

steps:
  1_scope:
    - Define system boundaries
    - Identify assets
    - Document data flows
    
  2_diagram:
    - Create data flow diagrams
    - Identify trust boundaries
    - Mark entry points
    
  3_identify:
    - Apply STRIDE to each component
    - List potential threats
    - Document attack vectors
    
  4_assess:
    - Rate likelihood and impact
    - Prioritize by risk score
    
  5_mitigate:
    - Design countermeasures
    - Accept/transfer risks
    - Document decisions

Data Flow Diagram

数据流图

[External User] --> |HTTPS| --> [Load Balancer]
                                      |
                                      v
                               [Web Server]
                                      |
                              [Trust Boundary]
                                      |
                                      v
                                [App Server] --> [Database]

[External User] --> |HTTPS| --> [Load Balancer]
                                      |
                                      v
                               [Web Server]
                                      |
                              [Trust Boundary]
                                      |
                                      v
                                [App Server] --> [Database]

Threat Cards

威胁卡片

yaml

threat:
  id: T001
  name: SQL Injection
  category: Tampering
  component: Database queries
  likelihood: High
  impact: Critical
  mitigations:
    - Parameterized queries
    - Input validation
    - WAF rules
  status: Mitigated

yaml

threat:
  id: T001
  name: SQL Injection
  category: Tampering
  component: Database queries
  likelihood: High
  impact: Critical
  mitigations:
    - Parameterized queries
    - Input validation
    - WAF rules
  status: Mitigated

Best Practices

最佳实践

Integrate into SDLC
Review on architecture changes
Include development team
Document all decisions
Regular reassessment

集成到SDLC中
在架构变更时进行评审
让开发团队参与
记录所有决策
定期重新评估

threat-modeling

Original

Translation

Threat Modeling

威胁建模

STRIDE Methodology

STRIDE方法论

Process

流程

Data Flow Diagram

数据流图

Threat Cards

威胁卡片

Best Practices

最佳实践

Related Skills

相关技能