Things to know before developing your cyber security solution
Tags: cybersecurity, security
Published: 2021-11-08 16:16:46

<!-- wp:paragraph -->
<p>According to the Cybersecurity and Infrastructure Security Agency(CISA)," Cybersecurity is the art of protecting networks, devices, and data from unauthorized access or criminal use and the practice of ensuring confidentiality, integrity, and availability of information.". A few terms to know before going ahead,</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>Privacy means maintaining confidentiality.</li><li>Anonymity means no body knows who you are?</li><li>Pseudonymity means using an alias.</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>How much of your daily life relies on technology? How much of your personal information is stored on a device or a server?</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>There are many risks, some more serious than others. Among these dangers is malware erasing your entire system, an attacker breaking into your system and altering files, an attacker using your computer to attack others, or an attacker stealing your credit card information and making unauthorized purchases. There is no guarantee that even with the best precautions some of these things won't happen to you, but there are steps you can take to minimize the chances.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","id":5732,"width":521,"height":490,"sizeSlug":"large","linkDestination":"none"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://programmerprodigycode.files.wordpress.com/2021/10/image-1.png?w=651" alt="" class="wp-image-5732" width="521" height="490"/><figcaption>Credits: https://res.cloudinary.com/dnlarfkn3/image/upload/v1587704215/quasarops/Risk_Triad_Vulnerability_Impact_Threat_ajundu.png</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>Here we classify risk being a combination of three factors,</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>Assets are items having value to the firm such as data, servers, software, network equipment, ...</li><li>Threats are conditions that can cause damage to an asset such as cyber attack, breach of integrity attack, malware, disclosure of confidential data, natural disasters,...</li><li>Vulnerabilities are weakness in the system design, implementation, software code or lack of preventive mechanism such as bugs, physical security, ...</li></ol>
<!-- /wp:list -->

<!-- wp:syntaxhighlighter/code -->
<pre class="wp-block-syntaxhighlighter-code">Risk= Vulnerablity * threat * Consequences</pre>
<!-- /wp:syntaxhighlighter/code -->

<!-- wp:paragraph {"align":"center"} -->
<p class="has-text-align-center"><strong>Our goal should be to minimise risk to an acceptable level, as eliminating all risks is not feasible.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":4} -->
<h4 id="how-to-make-sure-our-data-is-secure">How to make sure our data is secure?</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>We usually use the CIA Triad where, </p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>C stands for Confidentiality("How secure is your data?"):  <ol><li>You could use encryption(at rest and at transit) or firewalls or Two factor authentication. </li><li>Failure of confidentiality occurs if someone can obtain and view the data.</li></ol></li><li>I stands for Integrity("How correct is the information?"): <ol><li>You could use hashing of information or checksum technique during data transmission. </li><li>Failure of integrity occurs if someone modifies the data being stored in or transit.</li></ol></li><li>A stands for Availability("How much up time and latency is the system providing?") :<ol><li>You could use better system design and data points or a better disaster recovery plan. </li><li>Failure of availability occurs if the data cannot be accessed by the end user.</li></ol></li></ol>
<!-- /wp:list -->

<!-- wp:image {"align":"center","width":472,"height":395,"sizeSlug":"large"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://blog.jamestyson.co.uk/wp-content/uploads/2019/09/CIA-triad.png" alt="" width="472" height="395"/><figcaption>Credits: https://blog.jamestyson.co.uk/wp-content/uploads/2019/09/CIA-triad.png</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph {"align":"center"} -->
<p class="has-text-align-center"><strong>Usually, we have to make a trade-off between the usability of a system and the security of the system.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:heading {"textAlign":"center","level":3} -->
<h3 class="has-text-align-center" id="what-do-you-mean-by-cyber-attacks"><strong>What do you mean by cyber attacks?</strong></h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>A&nbsp;cyber attack&nbsp;targets&nbsp;computer information systems,&nbsp;computer networks,&nbsp;infrastructures, or personal computer devices. &nbsp;An attacker is a person or process that attempts to access data, functions, or other restricted areas of the system without authorisation, potentially with malicious intent.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Cyberattacks can range from installing&nbsp;spyware&nbsp;on a personal computer to attempting to destroy the infrastructure of entire nations. We could categorise cyber attacks into 2 types,</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>Web based Attack, attacks on an web application. These are done using,</li><li>System based attack, attacks to compromise a computer or a computer network. These are done using,</li></ol>
<!-- /wp:list -->

<!-- wp:heading {"level":5} -->
<h5 id="1-denial-of-service-attack-dos">1.<strong>Denial-of-service attack</strong>&nbsp;(DoS)</h5>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The attacker seeks to make a machine or network resource unavailable to its intended&nbsp;users&nbsp;by temporarily or indefinitely disrupting&nbsp;services&nbsp;of a&nbsp;host&nbsp;connected to the&nbsp;Internet. &nbsp;Typically accomplished by flooding the targeted machine or resource with superfluous requests in an attempt to overload systems and prevent some or all legitimate requests from being fulfilled.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","width":475,"height":270,"sizeSlug":"large"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="http://programmerprodigycode.files.wordpress.com/2021/11/346ce-new2bdoc2b14_1.jpg" alt="" width="475" height="270"/><figcaption>Credits: https://www.pinterest.co.uk/pin/80853755788506712/</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:heading {"level":5} -->
<h5 id="2-distributed-denial-of-service-attack-ddos">2.<strong>Distributed denial-of-service attack</strong>&nbsp;(<strong>DDoS</strong>)</h5>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>The incoming traffic flooding the victim originates from many different sources. This effectively makes it impossible to stop the attack simply by blocking a single source.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>There are 3 types of DDos Attacks:</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","width":545,"height":256,"sizeSlug":"large"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://www.thousandeyes.com/img/blog-legacy/2016/11/Table-1-Types-of-DDoS-attacks.png" alt="" width="545" height="256"/><figcaption>Credits: https://www.thousandeyes.com/blog/three-types-ddos-attacks</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>What are the signs of a DOS/DDOS attack:</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>Degradation in network performance due to drastic increase in requests sent to server.</li><li>Loss of Information from the server</li><li>Unavailability of the server</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph {"align":"center"} -->
<p class="has-text-align-center"><strong>A DoS or DDoS attack is analogous to a group of people crowding the entry door of a shop, making it hard for legitimate customers to enter, thus disrupting trade.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>For more information on DOS/DDOS attack,</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li><a href="https://www.cloudflare.com/en-gb/learning/ddos/glossary/denial-of-service/" target="_blank" rel="noreferrer noopener">https://www.cloudflare.com/en-gb/learning/ddos/glossary/denial-of-service/</a></li><li><a href="https://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attack" target="_blank" rel="noreferrer noopener">https://searchsecurity.techtarget.com/definition/distributed-denial-of-service-attack</a></li></ol>
<!-- /wp:list -->

<!-- wp:heading {"level":5} -->
<h5 id="3-brute-force-attack">3.Brute force attack</h5>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Used to obtain private information such as usernames, passwords, passphrases etc by repeatedly submitting different combinations of credentials, attackers can ultimately guess them correctly, and gain access to the data those credentials protect.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Common targets for brute force attacks are cracking passwords and encryption keys as well as API keys and SSH logins.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://www.imperva.com/learn/wp-content/uploads/sites/13/2018/01/hydra-brute-force-attack.png.webp" alt=""/><figcaption>Credits: https://www.imperva.com/learn/wp-content/uploads/sites/13/2018/01/hydra-brute-force-attack.png.webp</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p>The success of a brute force attack is measured in the time it takes to successfully crack a password/credential. As password length increases, the time it takes to brute force it increases as well.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>As a key with 128-bit encryption will have 2<sup>128</sup>&nbsp;combinations and 256-bit encryption will have 2<sup>256</sup>&nbsp;combinations.</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>For more information on brute force attacks,</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li><a href="https://securitytrails.com/blog/brute-force-attacks" target="_blank" rel="noreferrer noopener">https://securitytrails.com/blog/brute-force-attacks</a></li><li><a href="https://www.imperva.com/learn/application-security/brute-force-attack/" target="_blank" rel="noreferrer noopener">https://www.imperva.com/learn/application-security/brute-force-attack/</a></li></ol>
<!-- /wp:list -->

<!-- wp:heading {"level":5} -->
<h5 id="4-session-hijacking">4. Session hijacking</h5>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Also known as&nbsp;cookie hijacking&nbsp;is the exploitation of a valid&nbsp;computer session sometimes also called a&nbsp;<em>session key</em>, to gain unauthorised access to information or services in a computer system. There are four main methods used to perpetrate a session hijack,</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","width":252,"height":328,"sizeSlug":"large"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://developer.mozilla.org/en-US/docs/Glossary/Session_Hijacking/session_hijacking_3.jpg" alt="" width="252" height="328"/><figcaption>Credits: https://developer.mozilla.org/en-US/docs/Glossary/Session_Hijacking/session_hijacking_3.jpg</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>1. Session fixation</strong>: where the attacker sets a user's session id to one known to them. For example: by sending the user an email with a link that contains a particular session id.&nbsp;The attacker now only has to wait until the user logs in.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>2. Session side jacking: </strong>where the attacker uses&nbsp;packet sniffing&nbsp;to read network traffic between two parties to steal the session&nbsp;cookie.&nbsp;Many web sites use&nbsp;<strong>SSL&nbsp;encryption for&nbsp;login&nbsp;pages </strong>to prevent attackers from seeing the password.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Unsecured&nbsp;Wi-Fi&nbsp;hotspots&nbsp;are particularly vulnerable, as anyone sharing the network will generally be able to read most of the web traffic between other nodes and the&nbsp;access point.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>3. Cross-site scripting</strong>: where <strong>the attacker tricks the user's computer into running code </strong>which is treated as trustworthy because it appears to belong to the server, allowing the attacker to obtain a copy of the cookie or perform other operations.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>4. Malware</strong>&nbsp;and&nbsp;unwanted programs&nbsp;can use&nbsp;browser hijacking&nbsp;to steal a browser's cookie files without a user's knowledge, and then perform actions (like installing Android apps) without the user's knowledge.</p>
<!-- /wp:paragraph -->

<!-- wp:heading {"level":5} -->
<h5 id="5-man-in-the-middle">5. Man in the Middle</h5>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>A man-in-the-middle attack is a type of eavesdropping attack, where attackers interrupt an existing conversation or data transfer. After inserting themselves in the "middle" of the transfer, the attackers pretend to be both legitimate participants.&nbsp;</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>This enables an attacker to intercept information and data from either party while also sending malicious links or other information to both legitimate participants in a way that might not be detected until it is too late.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","width":520,"height":296,"sizeSlug":"large"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://www.preveil.com/wp-content/uploads/2019/11/MITM-Example-768x438.png" alt="" width="520" height="296"/><figcaption>Credits: https://www.preveil.com/wp-content/uploads/2019/11/MITM-Example-768x438.png</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>Ways to prevent Man in the middle attack</strong>,</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>VPN</li><li>Network Security with IDS</li><li>Install active virus and malware protection</li><li>Secure your communication</li><li>Avoid using public wifi networks</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>For more information on man in the middle attack,</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>https://phoenixnap.com/blog/man-in-the-middle-attacks-prevention</li></ol>
<!-- /wp:list -->

<!-- wp:heading {"level":5} -->
<h5 id="6-sql-injection">6. SQL injection</h5>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p><strong>SQL injection</strong>&nbsp;is a&nbsp;code injection&nbsp;technique used to&nbsp;attack&nbsp;data-driven applications, in which malicious&nbsp;SQL&nbsp;statements are inserted into an entry field for execution (e.g. to dump the database contents to the attacker).</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>SQL injection must exploit a&nbsp;security vulnerability&nbsp;in an application's software, for example, when user input is either incorrectly filtered for&nbsp;string literal&nbsp;escape characters&nbsp;embedded in SQL statements or user input is not&nbsp;strongly typed&nbsp;and unexpectedly executed.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>&nbsp;SQL injection is mostly known as an attack&nbsp;vector&nbsp;for websites but can be used to attack any type of SQL database.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","width":348,"height":267,"sizeSlug":"large"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://1tskcg39n5iu1jl9xp2ze2ma-wpengine.netdna-ssl.com/wp-content/uploads/2019/07/SQL-injection-attack-example-300x230.png" alt="" width="348" height="267"/><figcaption>Credits:https://1tskcg39n5iu1jl9xp2ze2ma-wpengine.netdna-ssl.com/wp-content/uploads/2019/07/SQL-injection-attack-example-300x230.png</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>For more information on SQL injection,</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li><a href="https://www.veracode.com/security/sql-injection" target="_blank" rel="noreferrer noopener">https://www.veracode.com/security/sql-injection</a></li></ol>
<!-- /wp:list -->

<!-- wp:heading {"level":5} -->
<h5 id="7-phishing-attacks">7.PHISHING ATTACKS</h5>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Phishing attacks utilize social engineering to induce users to hand up personal information such as passwords or financial information or to complete specific activities such as downloading malware or completing a wire transfer. Giving the hacker access to all vital information or control over the information.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>Human nature allows phishers to take advantage of the fact that most people overlook vital warning warnings. Phishing attacks have been so successful in part due to a lack of information regarding phishing assaults in the general public.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"align":"center","width":524,"height":349,"sizeSlug":"large"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://www.digitaldefense.com/wp-content/uploads/2019/04/Phishing-graphic-3.4.19-Converted.png" alt="" width="524" height="349"/><figcaption>Credits: &nbsp;https://www.digitaldefense.com/wp-content/uploads/2019/04/Phishing-graphic-3.4.19-Converted.png</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>For more information on phishing attacks,</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li><a href="https://programmerprodigy.code.blog/2021/10/12/things-to-know-about-phishing-attacks/" target="_blank" rel="noreferrer noopener">https://programmerprodigy.code.blog/2021/10/12/things-to-know-about-phishing-attacks/</a></li></ol>
<!-- /wp:list -->

<!-- wp:heading {"textAlign":"center","level":3} -->
<h3 class="has-text-align-center" id="threat-modelling">Threat Modelling?</h3>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>Threat modelling refers to the process of identifying, understanding, and communicating risks and mitigation to protect something of value. It includes finding your area of vulnerability and post probable types of attacks.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p><strong>It often leads to asking questions like</strong>,</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>Where  am i most vulnerable to attack</li><li>What are the most relevant threats</li><li>what could go wrong?(exception cases)</li><li>Are there any possible bugs, and  what can be done to address these bugs?</li></ol>
<!-- /wp:list -->

<!-- wp:image {"align":"center","width":427,"height":424,"sizeSlug":"large"} -->
<div class="wp-block-image"><figure class="aligncenter size-large is-resized"><img src="https://mobilisationlab.org/wp-content/uploads/2019/03/Your-ThreatModel4.png" alt="" width="427" height="424"/><figcaption>Credits: https://mobilisationlab.org/wp-content/uploads/2019/03/Your-ThreatModel4.png</figcaption></figure></div>
<!-- /wp:image -->

<!-- wp:heading {"level":4} -->
<h4 id="different-threat-modeling-approaches">Different Threat modeling approaches</h4>
<!-- /wp:heading -->

<!-- wp:paragraph -->
<p>1. <strong>Software centric: </strong>Focus is on the software being built and what weaknesses and vulnerabilities are likely to be introduced in design, code, or build integration. A few questions to consider:</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>How is software designed and constructed?</li><li>What are the languages, components and run times used?</li><li>What are the relevant coding practices followed?</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>How is software built and integrated with the use of software architecture diagrams such as data-flow diagrams(DFD),use case diagrams or component diagrams to identify threats to the design of the system</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>2. <strong>Asset centric: </strong>Focus is on assets needing protection and entrusted to a system or software(data processed by the software) &amp; what scenarios might compromise them or lead to non-compliance. A few questions to consider:</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>What are the assets entrusted to the system or software?</li><li>What are the consequences to compromise or loss of the assets?</li><li>How are those assets protected?</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>Involves the use of attack trees patterns by which an asset can be attacked.</p>
<!-- /wp:paragraph -->

<!-- wp:paragraph -->
<p>3. <strong>Attacker centric:</strong> The focus is on profiling an attacker's characteristics, skill set, and motivation to exploit vulnerabilities and what scenarios might attackers use to comprise the application, system, or service. A few questions to consider:</p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li>Who is authorised and who is not?</li><li>What privileges do users have?</li><li>How can the software be abused?</li></ol>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p>This approach also uses attack trees or attack patterns with focus on the specific goals of an attacker, how attacks could be carried out, and how to mitigate such attacks.</p>
<!-- /wp:paragraph -->

<!-- wp:image {"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://www.praetorian.com/wp-content/uploads/2021/02/5eb4472f6e78005b1b947376_Attacker-Exploits.png" alt=""/><figcaption>Credits: https://www.praetorian.com/wp-content/uploads/2021/02/5eb4472f6e78005b1b947376_Attacker-Exploits.png</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph {"align":"center"} -->
<p class="has-text-align-center" id="which-approach-to-use"><strong>Which Approach to use?</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list -->
<ul><li><strong>Software centric approach </strong>is <strong>best in exposing issues in the design of a system</strong>—its focus is on the software being built</li><li>Asset and Attacker centric approaches are important approaches to apply in threat modeling as well, but <strong>its best not to combine approaches to avoid confusion in the process</strong>.</li></ul>
<!-- /wp:list -->

<!-- wp:paragraph -->
<p><strong>A Recommendation would be to start with software centric approach for one release or sprint, and switch to a different approach for the next release or sprint.</strong></p>
<!-- /wp:paragraph -->

<!-- wp:image {"sizeSlug":"large"} -->
<figure class="wp-block-image size-large"><img src="https://161cli18elctkuzva3yluzd6-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/threat-modeling-process.jpeg" alt=""/><figcaption>Credits: https://161cli18elctkuzva3yluzd6-wpengine.netdna-ssl.com/wp-content/uploads/2020/11/threat-modeling-process.jpeg</figcaption></figure>
<!-- /wp:image -->

<!-- wp:paragraph -->
<p><strong>To know more about Threat modelling techniques:</strong></p>
<!-- /wp:paragraph -->

<!-- wp:list {"ordered":true} -->
<ol><li><a rel="noreferrer noopener" href="https://www.eccouncil.org/threat-modeling/" target="_blank">https://www.eccouncil.org/threat-modeling/</a></li></ol>
<!-- /wp:list -->