Preface

I guess you could call this book the missing manual for Elevation of Privilege (EoP). It explains how to play the game and is a reference guide, with example threats for the cards in the EoP card game, enabling threat modeling beginners to better understand what they might look for in their design.

Using Elevation of Privilege cards with the example threats in this book, you will discover the threats that could affect your software design through gameplay.

Each chapter covers a suit in the Elevation of Privilege card deck (a threat category), and for each card, example threats, references, and suggested mitigations are given. You’ll cover the STRIDE with Privacy deck and the TRIM extension pack. STRIDE is a methodology for threat modeling and stands for Spoofing, Tampering, Repudiation, Information Disclosure and Elevation of Privilege, while TRIM is a framework for privacy and stands for Transfer, Retention/Removal, Inference, and Minimization. You’ll learn what these terms refer to and how they should be applied.

You’ll be able to recognize threats, understand privacy regulations, use the in-line references provided in the chapters to find out more, and learn what techniques you can use to protect against these threats and minimize your risk. Each threat is not necessarily one you will find in your design but is included to help you understand and consider what similar threats there could be in your design.