Sometimes, it's just difficult to brainstorm threats during threat modeling analysis. It will be easier to pick up and select threats from the threat list library that fit the existing application design. Card games do help, but they may only present the most common threats. If you find the threats do not fit your projects or you need additional threat libraries to refer to, here are some suggested industry threat libraries:
|
Threat library |
Characteristics |
|
CAPEC |
It lists 508 attack patterns in a tree view. The attack patterns are also available in CSV and XML format. Each attack pattern is labeled with a CAPEC-ID number. |
|
ATT&CK |
The threats are categorized by platform (Linux, Windows, Mac, mobile) with specific attack techniques. Each threat is also discussed with technical mitigation and detection approaches. It includes lots... |
