نمذجة التهديدات على مستوى النظام الفرعي

في هذا الدرس

model threats in a way that fits a real subsystem.

الموضوعات المخطط لها

• Four questions: what are we building, what can go wrong, what will we do about it, did we do a good job.
• Draw a data flow diagram with trust boundaries; walk each flow and store with a prompt list such as STRIDE (spoofing, tampering, repudiation, information disclosure, denial of service, elevation of privilege).
• Adapt a checklist to the system: payments, personal data, multi-tenant data, messages, AI components.
• Keep the model alive: update on design changes.