a discussion of threat modeling using the elevation of privilege

Example of classmates done this assignment just for your reference to understand what’s need to be done.

 Elevation of Privilege (EOP) GameCOLLAPSE

Threat Modeling Is a Core Element of the Microsoft Security Development Life cycle (SDL). As part of the design phase of the SDL, threat modeling allows software architects to identify and mitigate potential security issues early, when they are relatively easy and cost-effective to resolve.

1)Communicate about the security design of their systems

2)Analyze those designs for potential security issues using a proven methodology

3)Suggest and manage mitigations for security issues

Elevation of Privilege (EoP) Card Game:-Elevation of Privilege (EoP) is the easy way to get started threat modeling, which is a core component of the design phase in the Microsoft Security Development Life cycle(SDL). TheEoP card game helps clarify the details of threat modeling and examines possible threats to software and computer systems.The EoP game focuses on the following threats:

Spoofing

Tampering

Repudiation

Information Disclosure

Denial of Service

Elevation of Privilege

EoP uses a simple point system that allows you to challenge other developers and become your opponent’s biggest threat.

1)Spoofing (S):-SpooFng (S) is the First suit of threats in the STRIDE threat enumeration.Spoofing describes any threat that allows an attacker (or accidentally causes a user) to pretend to be someone or something else. Accordingly, the characters on the cards are masked individuals wearing crowns – unknown attackers, pretending to be royalty.

2)Tampering (T):-Tampering is the second suit of threats in the STRIDE threat enumeration. Tampering describes any threat that allows an attacker (or accidentally causes a user) to alter or destroy data which the application has not allowed them to. Accordingly, the characters on the cards are green gremlins whose open mouths and sharp teeth could indicate either shouting or a desire to eat.

3)Repudiation (R):- Repudiation Users may dispute transactions if there is insufficient auditing or record keeping of their activity. For example, if a user says, “But I didn’t transfer any money to this external account!”, and you cannot track his/her activities through the application, then it is extremely likely that the transaction will have to be written off as a loss.

4)Information Disclosure (I):- Users are rightfully wary of submitting private details to a system. If it is possible for an attacker to publicly reveal user data at large, whether anonymously or as an authorized user, there will be an immediate loss of confidence and a substantial period of reputation loss. Therefore, applications must include strong controls to prevent user ID tampering and abuse, particularly if they use a single context to run the entire application.

5)Denial of Service (D):- Application designers should be aware that their applications may be subject to a denial of service attack. Therefore, the use of expensive resources such as large files, complex calculations, heavy-duty searches, or long queries should be reserved for authenticated and authorized users, and not available to anonymous users.

6)Elevation of Privilege (E):- If an application provides distinct user and administrative roles, then it is vital to ensure that the user cannot elevate his/her role to a higher privilege one. In particular, simply not displaying privileged role links is insufficient. Instead, all actions should be gated through an authorization matrix, to ensure that only the permitted roles can access privileged functionality.

The Game consists of 84 Cards, 6suits, each based on letter of STRIDE:2-10, ACE, KING, QUEEN, JACK. High Card takes the trick unless someone has EOP cardEOP Cards trump all suits and takes the trick. I have selected the card ‘Q’ from spoofing. Card ‘Q’ is an attacker could go after the way credentials are updated or recovered (account recovery doesn’t require disclosing the old password). Elevation of Privilege act as proofs that there is interesting work to be done in helping non-experts approach security.

Calculate your paper price
Pages (550 words)
Approximate price: -

Why Choose Us

Quality Papers

We value our clients. For this reason, we ensure that each paper is written carefully as per the instructions provided by the client. Our editing team also checks all the papers to ensure that they have been completed as per the expectations.

Professional Academic Writers

Over the years, our Acme Homework has managed to secure the most qualified, reliable and experienced team of writers. The company has also ensured continued training and development of the team members to ensure that it keep up with the rising Academic Trends.

Affordable Prices

Our prices are fairly priced in such a way that ensures affordability. Additionally, you can get a free price quotation by clicking on the "Place Order" button.

On-Time delivery

We pay strict attention on deadlines. For this reason, we ensure that all papers are submitted earlier, even before the deadline indicated by the customer. For this reason, the client can go through the work and review everything.

100% Originality

At Essay Writing Help, all papers are plagiarism-free as they are written from scratch. We have taken strict measures to ensure that there is no similarity on all papers and that citations are included as per the standards set.

Customer Support 24/7

Our support team is readily available to provide any guidance/help on our platform at any time of the day/night. Feel free to contact us via the Chat window or support email: support@acmehomework.com.

Try it now!

Calculate the price of your order

We'll send you the first draft for approval by at
Total price:
$0.00

How it works?

Follow these simple steps to get your paper done

Place your order

Fill in the order form and provide all details of your assignment.

Proceed with the payment

Choose the payment system that suits you most.

Receive the final file

Once your paper is ready, we will email it to you.

Our Services

Essay Writing Help has stood as the world’s leading custom essay writing services providers. Once you enter all the details in the order form under the place order button, the rest is up to us.

Essays

Essay Writing Services

At Essay Writing Help, we prioritize on all aspects that bring about a good grade such as impeccable grammar, proper structure, zero-plagiarism and conformance to guidelines. Our experienced team of writers will help you completed your essays and other assignments.

Admissions

Admission and Business Papers

Be assured that you’ll definitely get accepted to the Master’s level program at any university once you enter all the details in the order form. We won’t leave you here; we will also help you secure a good position in your aspired workplace by creating an outstanding resume or portfolio once you place an order.

Editing

Editing and Proofreading

Our skilled editing and writing team will help you restructure you paper, paraphrase, correct grammar and replace plagiarized sections on your paper just on time. The service is geared toward eliminating any mistakes and rather enhancing better quality.

Coursework

Technical papers

We have writers in almost all fields including the most technical fields. You don’t have to worry about the complexity of your paper. Simply enter as much details as possible in the place order section.