TMIS Vocabulary Flashcards
Threat Modelling and Information Sharing (17 cards)
Attack Surface
The sum of all possible points where an unauthorized user could try to enter or extract data from a system.
Data Flow (DFD)
Symbolizes the path and direction of data movement between entities, processes, and data stores.
Data Flow Diagram (DFD)
A graphical representation of the data flow through an information system, used to understand the application’s mechanics and identify potential attack surfaces.
Data Store (DFD)
Represents locations where data is stored within the application.
Doomsday Scenarios
Hypothetical worst-case situations used to proactively anticipate and prevent potential catastrophic events for an application and business.
Ecosystem (of applications)
A network of interconnected applications and services that work together to support an organization’s functions.
External Entity (DFD)
Represents any entity outside the application that sends or receives data, interacting with the system.
Mitigation
The process of selecting and implementing security controls to defend against identified threats and reduce risks.
NotebookLM can be inaccurate; please double-check its responses.
Process (DFD)
Represents a task within the application that handles data, potentially modifying or acting upon it.
Secure Development Lifecycle (SDLC)
A framework for integrating security activities into the software development process. Threat modeling is an essential step within this lifecycle.
STRIDE
An acronym used for identifying threats: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, and Elevation of privilege.
Threat Actors
Individuals or groups who pose a threat to an application, categorized by their relationship and trust level with the organization (e.g., Insider trusted, External untrusted).
Threat Modeling
A structured activity for identifying and managing application threats, also known as Architectural Risk Analysis.
Trust Boundary (DFD)
An extension of classical DFDs for threat modeling, representing a change of trust levels as data flows through the application and indicating potential attack surfaces.
Validation
The final step in threat modeling where the effectiveness of mitigations is reviewed, and residual risks are assessed and managed.
Vulnerabilities
Weaknesses or flaws in an application that can be exploited by threats.
