STRIDE – Based Risk Assessment for Web Application

Abstract:

This paper proposes a lightweight model as an alternative methodology of risk assessment for web applications. The assessment model presented in this paper takes into account not only the threats to the web applications but also the environments where they are hosted. STRIDE model is used as a measure to identify the threats by analyzing dataflow, data store and process presented in dataflow diagram. Moreover, DREAD is used to calculate the security risk of each threat, which is extended with the consideration of the assets’ criticalities and their application environments.

• Periodical: Applied Mechanics and Materials (Volumes 58-60)
• Pages: 1323-1328
• DOI: https://doi.org/10.4028/www.scientific.net/AMM.58-60.1323
• Online since: June 2011
• Authors: Hui Guan, Wei Ru Chen, Han Li, Jun Wang
• Keywords: Dataflow, Risk Assessment, Threat, Vulnerability, Web Application

References

[1] CERT/CC. Available: http: /www. cert. org/stats/cert_stats. html.

[2] D. Cotroneo, A. Mazzeo, L. Romano and S. Russo. Implementing a CORBA-Based Architecture for Leveraging the Security Level of Existing Applications, Lecture Notes In Computer Science; Vol. 2519, On the Move to Meaningful Internet Systems, (2002).

DOI: 10.1007/3-540-36124-3_49

[3] R. Brunil, M.H. Hisham and M. Jorge. A Mehodological Tool for Asset Identification in Web Applications,. 2009 Fourth International Conference on Software Engineering Advances, 2009, Pages(s): 413-418.

[4] Web Application Security Trends Report [Online], Available: http: /www. cenzic. com/downloads/Cenzic_AppSecTrends_Q3-Q4-2008. pdf.

[5] H. Guan, W. Chen, L. Liu and H. Yang. Environment-driven Threat Elicitation for Web Applications,. 5th International KES Conference on Agents and Multi-agent Systems – Technologies and Applications, 2011 (Accepted).

DOI: 10.1007/978-3-642-22000-5_31

[6] Risk Management Guide for Information Technology Systems [Online]. Available: http: /csrc. nist. gov/publications/nistpubs/800-30/sp800-30. pdf.

[7] Ministerio de Administraciones Públicas. Methodology for Information Systems Risk Analysis and Management – MAGERIT (version2),. Book I: The method, 2006. http: /www. csi. map. es/csi/pdf /magerit_v2/magerit_methode_en_v11. pdf.

[8] A Complete Guide to the Common Vulnerability Scoring System Version 2. 0,. Available: http: /www. first. org/cvss/cvss-guide. html#i2. 2. 1.

[9] OCTAVE. Available: http: /www. cert. org/octave.

[10] D. De Cock, K. Wouters, D. Schellekens, D. Singelee, and B. Preneel. Threat modelling for security tokens in web applications, Eighth IFIP TC-6 TC-11 Conference on Communications and Multimedia Security (CMS 2004), September 2004, UK, pp.213-223.

DOI: 10.1007/0-387-24486-7_14

[11] L. Jiang, H. chen and F. Deng. A security evaluation method based on STRIDE model for web service, 2010 2nd International Workshop on Intelligent Systems and Applications (ISA), (2010).

DOI: 10.1109/iwisa.2010.5473445

[12] J. P. Jesan. Threat modeling web-applications using STRIDE average model,. Computer Security Conference, (2008).

[13] S. Al-Fedaghi and A.A. Alrashed. Threat Risk Modeling". ICCSN , 10. Second International Conference on Communication Software and Networks, 2010, Page(s): 405 – 411.

DOI: 10.1109/iccsn.2010.29

[14] M. Howard and D. LeBlanc, Writing Secure Code, 2nd ed. Redmond: Microsoft Corporation, (2003).

[15] Threat risk modeling. Available: http: /www. owasp. org/index. php/Threat_Risk_Modeling.