Example of an enterprise threat model
Throughout this book, we will build a secure design for an event ticketing system. Envision a software system that allows a box office or a website to sell tickets for a famous musical concert or theatre event. Table 6.3 is a simplified STRIDE model for our ticketing example. In the model, the login method has all the vulnerability types, while the event selection method has the denial of service vulnerability.
|
Function |
S |
T |
R |
I |
D |
E |
|
Login |
X |
X |
X |
X |
X |
X |
|
Event Selection |
X |
|||||
| ... |
