Security

Here you will find all tactics for the quality characteristic Security.

Tactics (77)

Confidentiality

Encryption

Encrypt data during transmission and storage

#Cryptography #DataSecurity #KeyManagement

Authenticity

Authentication

Verify the identity of users and systems

#IdentityManagement #AccessControl #AuthenticationProtocols

Authenticity, Integrity

Two-Factor Authentication

Verify identity using two independent factors

#2FA #Multifactor #Authentication

Integrity, Confidentiality

Authorization

Control access to resources based on permissions

#AuthorizationConcept #LeastPrivilege #AccessControl

Confidentiality

Also supports: Integrity, Analyzability

Authorization Concept

Define access rules for critical data and functions

#AuthorizationConcept #AccessControl #DataProtection

Confidentiality

Also supports: Analyzability

Role-Based Access Control

Control access to application components based on roles

#RBAC #AccessControl #Roles

Integrity

Also supports: Availability

Least Privilege

Equip users and processes with only the minimal necessary rights

#LeastPrivilege #PermissionManagement #Elevation

Accountability

Logging and Monitoring

Log and monitor security-related events

#Logging #Monitoring #SIEM

Integrity

Input Validation

Validate all inputs from users and external systems

#InputValidation #Sanitization #Injection

Authenticity, Integrity

Secure Session Management

Manage sessions based on random, time-limited ids

#SessionManagement #Authentication #Authorization

Integrity

Also supports: Availability

Secure Configuration

Deliver and operate systems with secure default settings

#Hardening #ConfigurationManagement #PatchManagement

Confidentiality

Security Community

Promote secure software design through exchange with experts and peers

#KnowledgeSharing #SecurityPractices #CommunityOfPractice

Integrity, Confidentiality

Also supports: Availability

Security Policies for Users

Define mandatory rules for the secure usage of applications

#SecurityPolicies #Compliance #Governance

Integrity

Also supports: Availability

Security Policies for Development

Define mandatory rules for secure software development

#SecurityPolicies #SecSDLC #Compliance

Integrity, Confidentiality

Also supports: Availability

Security Training

Provide structured, role-specific courses that build deep security expertise

#SecurityTraining #Awareness #SocialEngineering

Integrity, Confidentiality

Also supports: Availability

Raising User Awareness

Deliver continuous lightweight nudges that keep security top-of-mind

#Awareness #Training #SocialEngineering

Integrity

Also supports: Availability

Network Segmentation

Divide the network into security zones with separate trust levels

#NetworkSecurity #Segmentation #Firewalls

Integrity

Also supports: Availability

Secure Software Development

Establish security as an integral part of the development process

#SecSDLC #SecureCoding #SAST #DAST

Integrity

Also supports: Availability

Security by Design

Consider security already in the design of the architecture and implementation

#SecurityByDesign #SecurityArchitecture #ThreatModeling

Confidentiality, Integrity

Security Frameworks

Apply structured frameworks to assess and mitigate security risks

#CybersecurityFramework #NIST #COBIT #OWASP

Confidentiality, Integrity

Security Certification

Introduce a structured framework for assessing and improving security practices

#SecurityCertification #ISO27001 #DataProtection

Integrity, Confidentiality

Also supports: Availability

Security Audits

Regularly check systems and processes for security

#SecurityAudits #Compliance #Certification

Integrity, Confidentiality

Also supports: Availability

Risk Analysis

Identify, assess, and address security risks systematically

#RiskAnalysis #RiskManagement #ThreatModeling

Integrity, Accountability

Also supports: Availability

Incident Response Measures

Establish processes and tools for responding to security incidents

#IncidentResponse #CERT #Forensics

Integrity

Also supports: Availability

Backup and Recovery

Ensure regular backup and recoverability of data

#Backup #DataBackup #DisasterRecovery

Integrity, Authenticity

Also supports: Availability

Secure Protocols

Use only secure and current versions of network protocols

#NetworkProtocols #Encryption #TLS

Confidentiality

Also supports: Appropriateness, Correctness, Time-behaviour

Datensparsamkeit

Only collect and store personal data that is necessary for the purpose

#DataMinimization #DataProtection #GDPR

Integrity, Confidentiality

Also supports: Availability

Security Tests

Verify security properties through specialized testing methods

#SecurityTests #PenetrationTesting #Fuzzing

Integrity

Also supports: Availability

Threat Intelligence

Collect and analyze information about current threats and attacks

#ThreatIntelligence #IOC #SIEM

Integrity, Confidentiality

Also supports: Availability

Red Teaming

Conduct comprehensive and realistic attacks on your own systems

#RedTeaming #EthicalHacking #APT

Integrity

Also supports: Availability

Security Architecture Analysis

Examine architecture and design for conceptual security gaps

#SecurityArchitecture #STRIDE #AttackTrees

Non-repudiation

Digital Forensics

Establish methods for investigating security incidents and crimes

#DigitalForensics #IncidentResponse #LawEnforcement

Integrity

Also supports: Availability

Honeypots

Deploy specially secured decoy systems as bait for attackers

#Honeypots #Malware #ThreatIntelligence

Integrity, Confidentiality

Also supports: Availability

Security Metrics

Define, collect, and evaluate metrics to quantify the security status

#SecurityMetrics #KPI #RiskManagement

Integrity, Confidentiality

Also supports: Availability

Threat Modeling

Conduct systematic analysis of threats, attackers, and countermeasures

#ThreatModeling #RiskAnalysis #STRIDE

Integrity, Confidentiality

Also supports: Availability

Abuse Case Definition

Describe undesirable use cases from an attacker's perspective

#AbuseCases #AttackScenario #ThreatModeling

Integrity, Confidentiality

Also supports: Availability

Security Requirements Definition

Elicit and document specific requirements for information security

#SecurityRequirements #RequirementsManagement #ComplianceRequirements

Integrity

Also supports: Availability

Secure by Default

Align default settings and delivery state for maximum security

#SecureByDefault #Hardening #ConfigurationManagement

Integrity, Confidentiality

Also supports: Availability

Trust Boundaries

Define boundaries between systems and components with different trust levels

#TrustBoundaries #SecurityZones #NetworkSegmentation

Integrity, Confidentiality

Data Flow Control

Control and filter data flows between components and systems

#DataFlowControl #InformationFlowModel #FormatValidation

Confidentiality, Integrity, Authenticity

Cryptographic Methods

Use proven and standardized algorithms and protocols for cryptographic functions

#Cryptography #Encryption #PKI

Confidentiality, Integrity, Authenticity

Key Management

Establish procedures for the secure generation, distribution, and storage of cryptographic keys

#KeyManagement #PKI #HSM

Integrity

Also supports: Availability

Secure Coding Guidelines

Define mandatory rules and best practices for secure programming

#SecureCoding #ProgrammingGuidelines #OWASP

Integrity

Also supports: Availability

Static Code Analysis

Automatically check source code for programming errors and security vulnerabilities

#SAST #StaticCodeAnalysis #SecureCoding

Integrity

Also supports: Availability

Dynamic Code Analysis

Test security properties by executing and observing program behavior

#DAST #DynamicTesting #PenetrationTests

Integrity

Also supports: Availability

Secure Programming Interfaces

Use libraries and frameworks with built-in security features

#SecureAPIs #Libraries #Frameworks

Integrity

Also supports: Availability

Prepared Statements

Use parameterized queries to prevent SQL injection

#PreparedStatements #SQLInjection #DatabaseSecurity

Integrity

Also supports: Availability

Output Encoding

Mask outputs to prevent injection attacks

#OutputEncoding #CrossSiteScripting #Injection

Integrity

Also supports: Availability

Canonicalization

Transform input data into a canonical representation

#Canonicalization #Normalization #InputValidation

Integrity

Also supports: Availability

Fuzz-Testing

Feed randomly generated input data to expose unexpected behavior

#Fuzzing #RobustnessTesting #RandomTests

Integrity

Also supports: Availability

Negative Testing

Deliberately test invalid inputs and edge cases to check error handling

#NegativeTesting #EdgeCases #ErrorHandling

Integrity

Also supports: Confidentiality, Non-repudiation

Security Regression Tests

Retest previously fixed security vulnerabilities to prevent their recurrence

#SecurityTesting #VulnerabilityRegression #ContinuousSecurityAssurance

Integrity, Confidentiality

Also supports: Availability

Security Tests by External Parties

Engage independent security experts to test the application

#SecurityReview #CodeReview #RedTeaming

Integrity, Confidentiality

Also supports: Availability

Penetration Tests

Uncover security vulnerabilities through simulated attacks

#PenetrationTests #EthicalHacking #VulnerabilityAnalysis

Integrity, Confidentiality

Also supports: Availability

System Hardening

Improve the security state of systems and components

#Hardening #ConfigurationManagement #HardeningGuides

Integrity, Confidentiality

Also supports: Availability

Patch Management

Apply security updates and patches promptly

#PatchManagement #SecurityUpdates #VulnerabilityManagement

Integrity, Confidentiality

Also supports: Availability

Defense Lines

Implement security mechanisms in multiple layers and levels

#DefenseInDepth #LayeredModel #Redundancy

Integrity

Also supports: Availability

Malware Protection

Detect and defend against malware through technical measures

#Malware #Antivirus #EndpointProtection

Accountability

Also supports: Availability

Security Monitoring

Continuously capture and analyze security-relevant events and data

#SecurityMonitoring #SIEM #LogManagement

Integrity

Also supports: Non-repudiation, Authenticity

Endpoint Detection and Response

Monitor endpoints continuously for threats in real-time

#EndpointSecurity #BehaviorAnalysis #ThreatDetection

Integrity

Also supports: Availability

Vulnerability Scans

Regularly check systems and applications for known vulnerabilities

#VulnerabilityScan #VulnerabilityAssessment #ComplianceCheck

Integrity

Also supports: Availability

Third-Party Dependency Check

Regularly review dependencies on external software

#SecurityCheck #Dependencies #SoftwareReview

Integrity, Accountability

Also supports: Availability

Configuration Checks

Document and regularly review security-relevant settings

#ConfigurationManagement #ComplianceReview #ChangeManagement

Integrity

Also supports: Availability

Emergency Drills

Train incident response behavior and test emergency processes

#EmergencyDrills #IncidentResponse #BusinessContinuity

Confidentiality

Also supports: Availability

Physical Security

Protect IT infrastructure through structural and organizational measures

#PhysicalSecurity #AccessProtection #DataCenter

Integrity, Confidentiality

Also supports: Availability

Security Culture

Embed security as a shared value within the organization

#SecurityCulture #ToneAtTheTop #TrustCulture

Confidentiality, Authenticity

Also supports: Integrity

Zero Trust Architecture

Verify every request regardless of origin or network location

#ZeroTrust #NetworkSecurity #MicroSegmentation

Confidentiality, Integrity

Also supports: Authenticity

API Security

Secure APIs through rate limiting, schema validation, and authentication

#APISecurity #RateLimiting #OAuth

Confidentiality, Integrity

Secret Management

Manage application secrets using dedicated vaults and rotation policies

#SecretManagement #Vault #CredentialRotation

Authenticity, Integrity

Also supports: Non-repudiation

Certificate Management

Manage X.509 certificate lifecycles including revocation and pinning

#CertificateManagement #PKI #X509

Non-repudiation, Integrity

Also supports: Authenticity

Digital Signatures

Apply cryptographic signatures for code signing and document verification

#DigitalSignatures #CodeSigning #Cryptography

Authenticity

Also supports: Accountability

Federated Identity (OAuth/OIDC)

Delegate authentication to trusted external identity providers

#FederatedIdentity #OAuth #OpenIDConnect

Confidentiality

Also supports: Accountability

Privacy by Design

Embed privacy protection into system architecture from inception

#PrivacyByDesign #GDPR #DataProtection

Integrity, Confidentiality

Also supports: Availability

Web Application Firewall

Filter HTTP traffic at the application layer against web attacks

#WAF #OWASP #ApplicationSecurity

Integrity, Authenticity

Supply Chain Security

Secure the software supply chain through SBOMs and provenance checks

#SupplyChainSecurity #SBOM #SoftwareProvenance

Non-repudiation, Accountability

Audit Trail Management

Maintain tamper-proof, cryptographically chained audit records

#AuditTrail #Compliance #CryptographicChaining

Anything missing? Propose a new quality tactic →