..rough sketch .. work in progress..
This is a general workflow when creating a threat model for a Drupal 7 contrib module.
-
Make a threat model
-
What are the modules dependencies? Drupal, etc.
-
Does it except inputs; are there entry points for an attack?
-
Is secure information needed, ie User credentials/personal info
-
What permissions does the module operate under?
-
-
List found problems in code
-
Rank threats
TODO