Threat Modelling Tools - Powerful & Free

Threat Modeling - Tools & Tips

Threat Modeling Tools:
An effective threat modeling process would require us to document the critical data flows and produce the results in an easy to understand format. Even though threat modeling is often attributed to security assessments, we could leverage some of the tools used by solution architects / developers  in the development sphere. Below are few examples of such tools:

  • Swagger IO - Design, Build, and Document APIs in the Cloud in a collaborative fashion

  • JSON Editor - View and edit JSON files

  • Draw IO – MS Visio clone with easy to use functions and helps save in multiple formats

  • Websequencediagram – UML Sequence Diagram and that which produces whiteboard class brainstorm diagrams 

  • Lucidchart - Another MS Visio type application with mobile support

  • Plant UML - The Swiss Army knife type sequence diagram tool



Comments

Post a Comment

Popular posts from this blog

Remotely start..someone else’s car!

Probably the heading for this post was tricky enough to make anyone read through the following passage. But the truth is that I was able to execute this feat, SUCCESSFULLY! I am not from the hard-core hacker community or a penetration tester who tries his best to break an application. I just had to open the App on my mobile, tap few screens and then viola, the German engine growls underneath the hood. I can Let’s get something straight here, I DID NOT – ·       Reverse engineer the mobile app and manipulate the internal workings ·       Execute a man-in-the middle attack to snoop in the commands that the App was sending to the car ·       Send a phishing email to the actual owner and track down the user credentials ·       Hack the car company’s datacenter to gather sensitive details Of course, the company in question is reputed enough to gain that trus...
Read more

Web Technology - Tools and Tricks

Image
Tags and WebTech Web Technologies Web technologies is a general term referring to the many languages and multimedia packages that are used in conjunction with one another, to produce dynamic web sites such as this one. Each separate technology is fairly limited on it's own, and tends to require the dual use of at least one other such technology . [ Source ] The chrome extensions such as WASP.Inspector, Wappalyzer and Ghostery provide wealth of information that happen behind the scene. Although built for analyzing the performance of a website, security professionals would rather use these tools to track the web tags, technologies and API calls. WASP Inspector -  Web Analytics Solution Profiler Wappalyzer -  Identify technology on   websites Ghostery -  Privacy and security related browser-extension View the below video to see these browser extensions in action:
Read more