@xdev-asia/xdev-knowledge-mcp 1.0.38 → 1.0.39

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/01-phan-1-kien-truc-nen-tang/lessons/04-bai-4-threat-modeling-stride-dread.md +35 -59
  2. package/package.json +1 -1
package/content/series/architecture/xay-dung-he-thong-y-te-microservices/chapters/01-phan-1-kien-truc-nen-tang/lessons/04-bai-4-threat-modeling-stride-dread.md CHANGED
@@ -27,19 +27,7 @@ course:
27
27
 
28
28
  ### 1.1. Quy trình Threat Modeling
29
29
 
30
- ```
31
- ┌──────────────────────────────────────────────────────────┐
32
- │ Threat Modeling Process │
33
- │ │
34
- │ 1. Define Scope ──▶ 2. Decompose ──▶ 3. Identify │
35
- │ & Objectives Application Threats │
36
- │ │ │ │
37
- │ │ ┌─────────────────────┘ │
38
- │ │ ▼ │
39
- │ └──────── 6. Validate ◀── 5. Rate ◀── 4. Mitigate │
40
- │ & Iterate Threats Threats │
41
- └──────────────────────────────────────────────────────────┘
42
- ```
30
+ ![Quy trình Threat Modeling 6 bước — từ Define Scope đến Validate & Iterate](/storage/uploads/2026/04/healthcare-threat-modeling-process.png)
43
31
 
44
32
  ### 1.2. Khi nào cần Threat Modeling?
45
33
 
@@ -68,58 +56,46 @@ STRIDE là framework phân loại threats do Microsoft phát triển:
68
56
 
69
57
  #### S - Spoofing (Giả mạo danh tính)
70
58
 
71
- ```
72
- Threat: Attacker giả mạo JWT token để truy cập Patient API
73
- ───────────────────────────────────────────────────────────
74
- Attack Vector:
75
- 1. Steal JWT từ browser localStorage
76
- 2. Forge JWT với modified claims (role: "admin")
77
- 3. Replay expired token
59
+ ![Spoofing Attack — giả mạo JWT token để truy cập Patient API và các biện pháp phòng chống](/storage/uploads/2026/04/healthcare-stride-spoofing-attack.png)
78
60
 
79
- Affected Components:
80
- - API Gateway
81
- - Patient Service
82
- - Clinical Service
61
+ **Threat:** Attacker giả mạo JWT token để truy cập Patient API
83
62
 
84
- Mitigations:
85
- ┌────────────────────────────────────────────┐
86
- │ M1: Keycloak OIDC token validation │
87
- │ → quarkus-oidc auto-verifies signature │
88
- │ │
89
- │ M2: Short-lived access tokens (5 min) │
90
- │ → Reduce token theft window │
91
- │ │
92
- │ M3: DPoP (Proof-of-Possession) │
93
- │ → Token bound to client certificate │
94
- │ │
95
- │ M4: Refresh token rotation │
96
- │ → One-time use refresh tokens │
97
- │ │
98
- │ M5: mTLS between services │
99
- │ → Service identity verification │
100
- └────────────────────────────────────────────┘
101
- ```
63
+ **Attack Vector:**
64
+
65
+ 1. Steal JWT từ browser localStorage
66
+ 2. Forge JWT với modified claims (role: "admin")
67
+ 3. Replay expired token
68
+
69
+ **Affected Components:** API Gateway, Patient Service, Clinical Service
70
+
71
+ **Mitigations:**
72
+
73
+ - **M1:** Keycloak OIDC token validation — quarkus-oidc auto-verifies signature
74
+ - **M2:** Short-lived access tokens (5 min) — giảm token theft window
75
+ - **M3:** DPoP (Proof-of-Possession) — token bound to client certificate
76
+ - **M4:** Refresh token rotation — one-time use refresh tokens
77
+ - **M5:** mTLS between services — service identity verification
102
78
 
103
79
  #### T - Tampering (Giả mạo dữ liệu)
104
80
 
105
- ```
106
- Threat: Insider sửa đổi kết quả xét nghiệm trong lab_db
107
- ───────────────────────────────────────────────────────────
108
- Attack Vector:
109
- 1. DBA trực tiếp UPDATE lab_results table
110
- 2. Khai thác SQL injection để sửa dữ liệu
111
- 3. Intercept và modify API response
81
+ ![Tampering Attack — insider sửa đổi kết quả xét nghiệm và các biện pháp bảo vệ tính toàn vẹn dữ liệu](/storage/uploads/2026/04/healthcare-stride-tampering-integrity.png)
112
82
 
113
- Mitigations:
114
- ┌────────────────────────────────────────────┐
115
- │ M1: pgAudit logging (log all DML) │
116
- │ M2: Database triggers cho change tracking │
117
- │ M3: Digital signatures cho lab results │
118
- │ M4: Immutable audit log (append-only) │
119
- │ M5: Dual control cho critical changes │
120
- │ M6: Row versioning with checksums │
121
- └────────────────────────────────────────────┘
122
- ```
83
+ **Threat:** Insider sửa đổi kết quả xét nghiệm trong lab_db
84
+
85
+ **Attack Vector:**
86
+
87
+ 1. DBA trực tiếp UPDATE lab_results table
88
+ 2. Khai thác SQL injection để sửa dữ liệu
89
+ 3. Intercept và modify API response
90
+
91
+ **Mitigations:**
92
+
93
+ - **M1:** pgAudit logging (log all DML)
94
+ - **M2:** Database triggers cho change tracking
95
+ - **M3:** Digital signatures cho lab results
96
+ - **M4:** Immutable audit log (append-only)
97
+ - **M5:** Dual control cho critical changes
98
+ - **M6:** Row versioning with checksums
123
99
 
124
100
  ```sql
125
101
  -- Integrity protection: Row versioning with checksum
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@xdev-asia/xdev-knowledge-mcp",
3
- "version": "1.0.38",
3
+ "version": "1.0.39",
4
4
  "description": "MCP Server - Toàn bộ kiến thức xDev.asia: 57 series, 1200+ lessons, blog, showcase (AI, Architecture, DevSecOps, Programming)",
5
5
  "type": "module",
6
6
  "main": "dist/index.js",