- Evaluasi sistem, aset, dan sec tools dari informasi yang diperoleh
- Determine potential impacts
- identifikasi attack vectors
- misal six:
- SQL Injection
- FE injection, BE, DB dr DBA compromised
- misal six:
- cara TA: identify, terus squeeze. antara squeeze probability, juga squeee potential impact
- Removal
- Prevention
- Detection
- Response
- Recover
- flow
- Asset identification
- Threat identification
- Threat modelling
- Structuring
- Vuln Analysis
- Decision Making
- Control/Countermeasure design
- technique
- STRIDE
- FYI:
- db plaintext BY DEFAULT
- ASSET
- HUMAN
- Infras → nameserver go.id tumbang (WTF)
- Software
- Hardware
- Data
- Document
TUGAS:
- Juice Shop
- Identifikasi threat dari 3 contoh (Lanjutin tugasnya)