Summary

You’ve now covered the threat types described on the cards from the Denial of Service suit in the Elevation of Privilege card deck. You’ve seen how an attacker doesn’t necessarily need to attack you directly for your application to be affected. You’ve seen how the design of features meant to protect your users can be used against you and how exponential growth can be devastating to resources.

You should now understand the following:

• How a security control, if implemented incorrectly, can itself become a threat
• You should be able to consider the wider interaction of your application
• The application should not allow a single process or user to overwhelm system resources
• If the system is required to run complex tasks simultaneously and remain performant, then it should be able to scale to cater to demand

In the next chapter, we will cover the Elevation of Privilege category of threats from STRIDE and the Elevation of Privilege...