Web application security - the fast guide 1.1 | Page 53

Chapter 3- Vulnerabilities and threat models P a g e | 53

3.5.5 Denial of service:

one of the main threats is related to affecting the availability of the service itself so it is about bringing the( site, application or service down). This threat realizes by simply consuming application available resources by heavy requests for big files, Queries or searches or even depending on the generation of big number of requests if the application does not provide facet to run individual heavy requests.

3.5.6 Elevation of privileges:

in an application each user will have a specific role with specific privileges. The malicious acts for a user to elevate his / her privileges considered to be one of the big threats as it will give potential attackers the ability sometimes to totally control and takeover the application.

3.6 Threats and vulnerabilities models- DREAD

Another effective method commonly used to classify threat is to depend on finding a quantitative value that represents the risk. The risk value is calculated based on the estimated values of the following factors:

Damage potential: refers to the level of caused damage if the threat was exploited. Level is estimated as follow:

Reproducibility: This factor is related to how easy is to reproduce the threat exploit:

Exploitability: needed tools, knowledge, techniques for the threat exploit.

Affected user: refers to users that are affected by the threat.