>_ help
Help & Methodology
How do STRIDE-LM, OWASP ASVS, and the threat-modeling Composer work? An overview of the methodology and frameworks behind these tools.
The Composer
Instead of browsing a knowledge base, you pick your project's assets and features (login, payments, API, ...), optionally the data categories it processes, and its hosting model. The Composer turns that into a risk register without duplicates, split into three layers.
1. Selection
Assets/features, data categories (e.g. health, HR, financial data), and hosting model (on-premise/IaaS/SaaS).
2. STRIDE-LM risks
The relevant threats for each selected asset. Each risk appears only once.
3. ASVS 5.0 requirements (code)
Concrete requirements per OWASP ASVS 5.0. The same list doubles as a developer checklist and as pentest scope.
4. Compensating controls
CIS v8 and NIST CSF controls for infrastructure and operations (WAF, IAM, network segmentation). They add protection but don't replace clean code.
STRIDE-LM
STRIDE is a model for identifying computer security threats. We use the extended STRIDE-LM variant to map modern cloud and network architectures.
Spoofing
Impersonating someone or something else
Tampering
Modifying data or code
Repudiation
Denying an action
Information Disclosure
Exposing sensitive information
Denial of Service
Crashing or slowing down a service
Elevation of Privilege
Gaining unauthorized access
Lateral Movement
Moving through a network
Monitoring Gaps
Gaps in visibility & logging
OWASP ASVS 5.0
The Application Security Verification Standard defines 345 code-level requirements across 17 chapters (authentication, authorization, cryptography, ...), each phrased as "Verify that…" and staged across three cumulative levels. In the Composer, the same list doubles as a developer checklist and as pentest scope.
CIS Controls
The Center for Internet Security (CIS) Controls are a prioritized set of actions that mitigate the most common attacks against systems and networks.
Official website →NIST CSF
The NIST Cybersecurity Framework provides guidance for organizational cybersecurity and risk management.
Official website →NIST AI RMF
The NIST AI Risk Management Framework (AI RMF 1.0, published 2023) is a standalone framework separate from the NIST CSF. It helps organizations identify, assess and reduce risks of AI systems, for example around trustworthiness, fairness, transparency and safety.
GDPR
Rather than listing all 99 articles, we only reference the ones our technical controls actually relate to. This complements legal advice but doesn't replace it. Since the Liechtenstein and Swiss data protection laws (DSG/DSV) closely follow the GDPR, the references apply there too.
Controls Library
The Controls Library contains all security controls on the platform, mapped to CIS v8, NIST CSF 2.0, NIST AI RMF, OWASP ASVS 5.0 and GDPR. Use the framework filter to view controls by standard, grouped by CIS control group (1–18), NIST CSF function (GV · ID · PR · DE · RS · RC), ASVS chapter or GDPR article.
Security assessment methodology
The Security Assessment comes in two variants. The SME check (17 scenario-based questions) is aimed at management and shows the three biggest risks with concrete first steps. The technical check (40 core questions, drill-downs on partial implementation, optionally 44 extended controls) is aimed at IT staff and maps every gap to NIST CSF 2.0, CIS v8 and MITRE ATT&CK.
SME check
About 5 minutes, four maturity levels per question, results in business language
Technical check
Drill-downs on partial gaps, scored per NIST CSF 2.0 function and ATT&CK technique
N/A — Not applicable
Non-applicable questions are excluded from scoring; "Don't know" is reported as needing clarification
Traffic-light scoring
Green ≥ 75 · Yellow 40–74 · Red < 40, per area and weighted overall
TLP 2.0
The Traffic Light Protocol (TLP) is a standard defined by FIRST (Forum of Incident Response and Security Teams) to classify sensitive information. TLP defines who information may be shared with. Version 2.0 comprises five classification levels.
No restriction
Information can be distributed without restriction. Recipients may share this information freely, regardless of source or format.
Community-wide sharing
Information is for the community at large. It may be shared within the community, but not publicly or outside of it.
Limited disclosure
Information may be shared with members of the recipient's own organisation who need to know. It must not be shared outside the organisation.
Direct recipients only
Like TLP:AMBER but more restrictive: information may only be shared with the direct recipients, not further within the organisation.
No disclosure
Information is not for disclosure. It is restricted to direct participants only, including in-person and verbal communications.