Ravindra BagaleCourses & study guides मराठी

Chapter 3: Threat Modeling on Paper

By Last updated:

Guru-ji unfolds a large sheet. A phone shape. An arrow. A box labeled payment API. A cylinder labeled balances. Raju asks if they will break in. Guru-ji puts the laptop on a far shelf. "We will name one danger in one sentence, and one fix. Pencil only. And only for a system you are allowed to test." Raju sits. The sheet is the whole lab. I am Ravindra Bagale. This chapter stays defensive and conceptual. It is for learning only, and only inside a system you are allowed to test.

What you will learn in this chapter

  • Why a paper model comes first
  • STRIDE as six plain threats
  • PASTA as seven steps
  • A payment picture with four parts
  • One worked threat and three fixes
  • Names that belong to a later book

This is for learning only, and only inside a system you are allowed to test. If you do not own the system, and nobody has told you in writing that you may test it, you stop at the paper story in this chapter. You do not go looking for a live payment API to poke.

Concepts in this chapter

  1. 3.1Why we draw the danger before we code
  2. 3.2STRIDE in six plain threats
  3. 3.3PASTA in seven steps
  4. 3.4A payment gateway on paper
  5. 3.5One worked threat and three fixes
  6. 3.6Names you will meet later, not in this volume
  7. 3.7Takeaways

The chapter recap is at the end of the last concept page.