Набір інженерії безпеки
Моделі загроз (STRIDE, LINDDUN), дерева атак, архітектура безпеки, безпечне кодування, ланцюг постачання (SLSA, SBOM), перевірка ASVS 5.0 і звіт пентесту.
Моделювання загроз
Threat Model Template (STRIDE)
ПовнийSTRIDE threat model: scope, DFD with trust boundaries, assets, threats per element, L x I rating, mitigations, risk acceptance
STRIDEPrivacy Threat Model Template (LINDDUN)
ПовнийPrivacy threat model by LINDDUN category: DFD with trust boundaries, data inventory, elicitation matrix, register, PETs, DPIA link
LINDDUN (threat categories)Attack Tree Analysis Template
СтандартAttack tree for one attacker goal: AND/OR tree as list and Mermaid, leaf cost/skill/likelihood, path analysis, countermeasures
Schneier attack trees
Проєктування
Security Architecture Document Template (NIST SP 800-160, STRIDE)
ПовнийSecurity architecture: assets, trust boundaries, STRIDE threat register, requirements, IAM, data protection, detection, residual risk
NIST SP 800-160 Vol. 1, STRIDESecure Coding Standard Template
СтандартSecure coding rules by area with do/don't code examples, SAST/DAST/secret scanning tooling and an exceptions process
Software Supply Chain Security Assessment Template (SLSA)
ПовнийSupply chain assessment: SLSA 1.2 Build/Source levels, SBOM (SPDX, CycloneDX), provenance, Sigstore, Scorecard, VEX, CI/CD
SLSA 1.2
Верифікація
Security Design Review Template (OWASP ASVS 5.0)
ПовнийDesign-time security review by the 17 OWASP ASVS 5.0 chapters: scope, DFD, threats, level, findings, remediation, sign-off
OWASP ASVS 4.0Penetration Test Report Template (PTES, OWASP WSTG)
ПовнийPentest report: executive summary, scope and rules of engagement, PTES phases, WSTG coverage, CVSS ratings, findings, retest
PTES; OWASP Web Security Testing Guide