23 matches found
stride-gpt
STRIDE GPT는 STRIDE 방법론을 기반으로 특정 애플리케이션에 대한 위협 모델과 공격 트리를 생성하기 위해 대규모 언어 모델LLM을 활용하는 AI 기반 위협 모델링 도구입니다. 사용자는 애플리케이션 유형, 인증 방법, 인터넷 노출 여부, 민감 데이터 처리 여부 등 애플리케이션 세부 정보를 제공합니다. 그러면 모델은 제공된 정보를 기반으로 출력을 생성합니다. 목차 프로젝트 지원하기 기능 엔터프라이즈 배포 Open Security Summit 발표 변경 로그 설치 저장소 구조 사용법 대화형 REPL 치트 시트 출력 예시 ...
security-culture
OWASP Security Culture これは、アプリケーションセキュリティプログラムを構築する際にセキュリティ文化を確立することの重要性と利点を説明する ドキュメントプロジェクトです。このガイドは、ソフトウェア開発ライフサイクル（SDLC）の各段階でセキュリティを考慮し、 安全な開発プラクティスの作成に役立ちます。 取り上げられるトピックは次のとおりです。成熟度目標の定義、セキュリティチームと開発 チームの連携、セキュリティチャンピオン、Capture the Flag などのアクティビティ、脅威モデリング、セキュリティテスト、 メトリクス。これらはすべて、関連する有用な OWA...
OdTM
OWASP オントロジー駆動型脅威モデリング OdTM フレームワーク オントロジー駆動型脅威モデリング OdTM フレームワークは、 コンピュータシステムの自動脅威モデリングにオントロジー的アプローチを実装するための手段の集合です。 これは OWASP Incubator Project です。 OdTM フレームワークが提供するオントロジー的アプローチには、2つの一般的な利点があります。 第一に、セキュリティ関連知識（ アーキテクチャコンポーネントと関連する脅威および対策） を、さまざまなコンピュータシステムタイプ（アーキテクチャドメイン）ごとに、ドメイン固有の脅威モデル（...
Backchaining Loss of Control Mitigations from Mission-Specific Benchmarks in National Security
Affordances and permissions are promising and timely safety levers for mitigating Loss of Control LoC threats in high-stakes deployment contexts, such as national security. Deployers in defense and intelligence could rely on several approaches to identify which affordances and permissions should ...
Threat Modelling Using Domain-Adapted Language Models: Empirical Evaluation and Insights
Large Language ModelsLLMs are increasingly explored for cybersecurity applications such as vulnerability detection. In the domain of threat modelling, prior work has primarily evaluated a number of general-purpose Large Language Models under limited prompting settings. In this study, we extend th...
ATLAS: AI-Assisted Threat-To-Assertion Learning for System-On-Chip Security Verification
This work presents ATLAS, an LLM-driven framework that bridges standardized threat modeling and property-based formal verification for System-on-Chip SoC security. Starting from vulnerability knowledge bases such as Common Weakness Enumeration CWE, ATLAS identifies SoC-specific assets, maps...
Towards a Blockchain-Based CI/CD Framework to Enhance Security in Cloud Environments
Security is becoming a pivotal point in cloud platforms. Several divisions, such as business organisations, health care, government, etc., have experienced cyber-attacks on their infrastructures. This research focuses on security issues within Continuous Integration and Deployment CI/CD pipelines...
EUVD-2024-48645
Malicious code in bioql PyPI...
EUVD-2023-57853
Malicious code in bioql PyPI...
Threat Modeling for Enhancing Security of IoT Audio Classification Devices under a Secure Protocols Framework
The rapid proliferation of IoT nodes equipped with microphones and capable of performing on-device audio classification exposes highly sensitive data while operating under tight resource constraints. To protect against this, we present a defence-in-depth architecture comprising a security protoco...
The CryptoNeo Threat Modelling Framework (CNTMF): Securing Neobanks and Fintech in Integrated Blockchain Ecosystems
The rapid integration of blockchain, cryptocurrency, and Web3 technologies into digital banks and fintech operations has created an integrated environment blending traditional financial systems with decentralised elements. This paper introduces the CryptoNeo Threat Modelling Framework CNTMF, a...
CVE-2024-7784
CVE-2024-7784 affects Axis OS: a flaw in the Secure Boot/device-tampering protection could allow bypass of protection mechanisms. Public details consistently state no known exploits at this time; Axis has released patched AXIS OS versions addressing the flaw. The CVE notes a physical attack vecto...
CVE-2024-7784
During internal Axis Security Development Model ASDM threat-modelling, a flaw was found in the protection for device tampering commonly known as Secure Boot in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the...
CVE-2024-7784
During internal Axis Security Development Model ASDM threat-modelling, a flaw was found in the protection for device tampering commonly known as Secure Boot in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the...
Preparing for Unknown Risks: How to Better Prepare for Risks You Can't See Yet
As security professionals we’re used to dealing with unknowns and unpredictability. We understand that it's impossible to always know what's around the corner. It's not just about external threats and the big breaches splashed across the news headlines. On one hand, we’re combating threat actors...
CVE-2023-5553
During internal Axis Security Development Model ASDM threat-modelling, a flaw was found in the protection for device tampering commonly known as Secure Boot in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the...
Design/Logic Flaw
During internal Axis Security Development Model ASDM threat-modelling, a flaw was found in the protection for device tampering commonly known as Secure Boot in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the...
CVE-2023-5553
During internal Axis Security Development Model ASDM threat-modelling, a flaw was found in the protection for device tampering commonly known as Secure Boot in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the...
CVE-2023-5553
During internal Axis Security Development Model ASDM threat-modelling, a flaw was found in the protection for device tampering commonly known as Secure Boot in AXIS OS making it vulnerable to a sophisticated attack to bypass this protection. To Axis' knowledge, there are no known exploits of the...
IoT Secure Development Guide
Introduction This guide deals with threat modelling and early stages of development so that security issues and controls are identified before committing to manufacturing. Current attack methods, and the pitfalls we find in embedded designs, have been highlighted so that a finished product is as...