Kit Sicherheits-Engineering
Bedrohungsmodelle (STRIDE, LINDDUN), Angriffsbäume, Sicherheitsarchitektur, sicheres Programmieren, Lieferkette (SLSA, SBOM), ASVS-5.0-Review, Pentest.
Bedrohungsmodellierung
Threat Model Template (STRIDE)
VollständigSTRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance
STRIDEPrivacy Threat Model Template (LINDDUN)
VollständigPrivacy threat model by LINDDUN category: DFD with trust boundaries, data inventory, elicitation matrix, register, PETs, DPIA link
LINDDUN (threat categories)Attack Tree Analysis Template
StandardAttack tree for one attacker goal: AND/OR tree as list and Mermaid, leaf cost/skill/likelihood, path analysis, countermeasures
Schneier attack trees
Entwurf
Security Architecture Document Template (NIST SP 800-160, STRIDE)
VollständigSecurity architecture: assets, trust boundaries, STRIDE threat register, requirements, IAM, data protection, detection, residual risk
NIST SP 800-160 Vol. 1, STRIDESecure Coding Standard Template
StandardSecure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process
Software Supply Chain Security Assessment Template (SLSA)
VollständigSupply chain assessment: SLSA 1.2 Build/Source levels, SBOM (SPDX, CycloneDX), provenance, Sigstore, Scorecard, VEX, CI/CD
SLSA 1.2
Verifikation
Security Design Review Template (OWASP ASVS 5.0)
VollständigDesign-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off
OWASP ASVS 4.0Penetration Test Report Template (PTES, OWASP WSTG)
VollständigPentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest
PTES; OWASP Web Security Testing Guide