Kit rekayasa keamanan
Model ancaman (STRIDE, LINDDUN), pohon serangan, arsitektur keamanan, pengodean aman, rantai pasok (SLSA, SBOM), tinjauan ASVS 5.0, dan laporan pentest.
Pemodelan ancaman
Threat Model Template (STRIDE)
LengkapSTRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance
STRIDEPrivacy Threat Model Template (LINDDUN)
LengkapPrivacy threat model by LINDDUN category: DFD with trust boundaries, data inventory, elicitation matrix, register, PETs, DPIA link
LINDDUN (threat categories)Attack Tree Analysis Template
StandarAttack tree for one attacker goal: AND/OR tree as list and Mermaid, leaf cost/skill/likelihood, path analysis, countermeasures
Schneier attack trees
Desain
Security Architecture Document Template (NIST SP 800-160, STRIDE)
LengkapSecurity architecture: assets, trust boundaries, STRIDE threat register, requirements, IAM, data protection, detection, residual risk
NIST SP 800-160 Vol. 1, STRIDESecure Coding Standard Template
StandarSecure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process
Software Supply Chain Security Assessment Template (SLSA)
LengkapSupply chain assessment: SLSA 1.2 Build/Source levels, SBOM (SPDX, CycloneDX), provenance, Sigstore, Scorecard, VEX, CI/CD
SLSA 1.2
Verifikasi
Security Design Review Template (OWASP ASVS 5.0)
LengkapDesign-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off
OWASP ASVS 4.0Penetration Test Report Template (PTES, OWASP WSTG)
LengkapPentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest
PTES; OWASP Web Security Testing Guide