Paco Hope #resist

Looking at some #AI generated #threatmodel output and it listed stealing a user's credentials and using them in the "Spoofing" category. I was uncertain. Is that spoofing or elevation of privilege. So I wander over to a #microsoft page on #stride.

They say it's spoofing, which is fine. It's reasonable. I don't care as long as we all agree.

But in that table, that's literally the only example of spoofing. There are a LOT of other kinds of things that could be called spoofing. If you're gonna have only one example of spoofing, I don't think stealing credentials is the best example.

Claudius Link

@adamshostack
Valid question.
I would say that it feels a bit more real, offers a bit more hints and at the same time is slightly more generic. That it doesn't create the impression #EoP or #STRIDE only works for web applications.

Oh, and ad more variations. My target group doesn't solely develop web applications but also mobile applications, servers, device firmware, OT products, ...

But you are right, maybe it would be already the right level if I would replace the concrete components (most of them i don't know, at least in detail) with more general placeholders

E.g.

G -> authentication service
Angular/material -> web framework (cliente)
Express -> web framework (backend)
Sequelize -> orm mapper
SQLite -> database (server)
Content folder -> file storage

I struggle a bit with D3/nosql
I thought D3 is for visualization, and I'm not sure how nosql comes into play

Nov 01, 2024, 04:26 · · · 0 · 0
Joe Wynne 🌻 🚗 ⛰️

#MusicWomenWednesday

Brilliant #MaryLouWilliams was asked to arrange for Duke Ellington, Benny Goodman, and Louis Armstrong, but for unfortunate factors we know, her genius was mostly lost to history until recently.

🎹 Here's a standard you've probably heard - that she wrote. Decades afterwards, check out her rocking piano playing skills as she switches styles a few times.

Roll Em
- Mary Lou Williams

#Jazz #Stride

youtube.com/watch?v=dJ7A0bnJkE

- YouTube

Enjoy the videos and music you love, upload original…

www.youtube.com
davidnewman

Bud Powell, the great #bebop pianist, was born 100 years ago today. Despite rough treatment throughout his life and struggles with mental illness, Powell played with a deft touch that weaved in elements of #swing, #stride, #ragtime, and #classical, and influenced generations of pianists. His life was also the inspiration for “Round Midnight,” one of my favorite #jazz films. #budpowell

youtu.be/Djbcr_mR4EE?si=BEed2S

- YouTube

Enjoy the videos and music you love, upload original…

youtu.be
Simon Flett

So long then Mel.
Wish we could say we'd miss you. You rallied to the cause of English Nationalism with bland enthusiasm. #Stride off into obscurity. Bye...

Claudius Link

I'm not completely clear how to map this model to #Cybersecurity and how to integrate an attacker. But you could see #STRIDE as possible Data Plan Hazards:

Spoofing
Tampering
Repudiation
Information disclosure
Denial of service
Elevation of privilege

So you "just" need hazards lists for the other planes and interaction points ;-)

vvvv - a multipurpose toolkit

This weeks #vvvv workshop on February 22nd at The NODE Institute:

Unlocking Shader Artistry: A Journey through ‘The Book of Shaders’ with FUSE

Details and Registration: thenodeinstitute.org/courses/w

#visualprogramming #creativecoding #fuse #stride #shaders