Module 1 - Threat Modeling Overview

Module 1 - Threat Modeling Overview

• Threat modeling is a strategic process for identifying potential attack scenarios and vulnerabilities in applications, used to clearly identify risk and impact levels.
• Each function in the threat modeling process requires careful consideration of multiple risk factors influenced by threat, vulnerability, and impact levels.
• A key characteristic of threat modeling is its strategic approach, anticipating threats via calculated and simulated attack patterns.
• Threat modeling is a chain-like reaction of tactical events across multiple domains (e.g., business objectives, system/database administration, vulnerability management).

Threat Modeling Overview - Definition, Origin, and Use (Process)

• Threat modeling's process is a key distinguishing quality.
• It involves a chain-like reaction of tactical events across multiple domains, with input and contributions from other stakeholders related to a protected application environment.

Threat Modeling Overview - Definition, Origin, and Use (Attack)

• Attack reflects a major science in threat modeling.
• The discipline involves researching how attack patterns may exploit software vulnerabilities;
• Threat modeling techniques dissect attacks, exposing faults in design and development, and unveiling attacker motivations.

Threat Modeling Overview - Definition, Origin, and Use (Vulnerabilities)

• Vulnerabilities are more prevalent in other IT security efforts.
• Threat modeling uses vulnerabilities at platform and software levels to aggregate and correlate with possible attack scenarios.

Threat Modeling Overview - Definition, Origin, and Use (Application Environment)

• The application environment is the object of the threat modeling process.
• Other security procedures typically address single aspects of an application, lacking a holistic approach.
• Threat modeling's value is in encompassing benefits of isolated procedures to secure the entire application environment.

Threat Modeling Overview - Definition, Origin, and Use (Risk)

• Risk is the key interest in threat modeling, a supportive role in achieving business objectives.
• Threat modeling identifies risks from evolving threats, compounded by software/network vulnerabilities, and driven by attack motives in business information within an application environment.

Threat Modeling Overview - Definition, Origin, and Use (Threat Modeling)

• Threat modeling provides precise risk communication by clarifying how a business application environment could be compromised and the probability of actual risk.
• Risk unifies security and business professionals for collaborative enterprise protection.

Threat Modeling Overview - Definition, Origin, and Use (Impact)

• Impact is the ability to properly answer the question "How bad is it?".
• Security professionals must consider all possible threat scenarios for a prioritized risk-based analysis to provide an effective and credible answer.

Threat Modeling Overview - Definition, Origin, and Use (Art of Espionage)

• Surveying internal readiness is similar to gathering information about an enemy's intent and capabilities.
• Threat models must also account for attack motives, capabilities, vulnerabilities, and available information.
• Threat modeling process complexity lies in expedient analysis and process development, as reconnaissance (information gathering) efforts may be inconclusive.
• Misinformation and an incorrect attack-scenario set can derail threat modeling and mislead defense efforts from creating effective countermeasures.

Threat Modeling Overview - Definition, Origin, and Use (External information sources)

• External sources include application/platform vulnerabilities and attack libraries containing current and past exploits.

Threat Modeling Overview - Definition, Origin, and Use (Attack library)

• Attack libraries consist of exploits required to successfully attack an application and are critical for maintaining flexibility in software products when facing evolving threat scenarios.
• Maintaining threat modeling requires continuous updating. While threat models may initially seem rigid, they should have the flexibility to incorporate the latest threat intelligence.

Threat Modeling Overview - Definition, Origin, and Use (Designing Countermeasures)

• Designing effective countermeasures for software is crucial to differentiate application threat modeling from other traditional efforts.
• Good countermeasures consider not only perceived threats but also potential threat evolution or adaptation to historical forms, thus avoiding a false sense of security.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Cyber warfare)

• Terms like "cyber warfare", "zero-day botnets" describe complex challenges for information security professionals.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Environmental Threat Factors)

• Attack motives can be influenced by environmental factors, which impacts attack characteristics such as intensity, sophistication, the possibility of successful exploitation or ability to distort/eliminate forensic evidence.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Product of the Environment)

• The environment encompasses social, political, economic, belief-based, and financial factors that drive software adversaries.
• Motives such as revenge, spite, espionage and fraud may be influenced by external conditions such as war, layoffs, or economic hardship.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Environmental factors)

• Environmental factors influence attack windows of opportunity.
• Social, political, environmental, and economic events can create conditions ripe for attacks.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Figure 1.1 Relating Environmental Factors to Attacks)

• A diagram showing the relationship between environmental factors, motives, vulnerabilities, and attack types.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Table 1.1 Correlating Environmental Factors to Attack Motives - Sample)

• This table correlates industry types, environments ("factor"), and potential attack motives
• A sample table from the presentation.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Judging by Motives)

• All threats have motives.
• Attack designs have an objective.
• Reconnaissance efforts can have motives.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Table 1.2 Correlating Motives to Application Threat Vectors)

• A table correlating threat targets, motives, and attack vectors.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Table 1.3 Recommended Frequency for Environmental Threat Factor Analysis)

• Presents various frequencies and scopes for analyzing environmental threat factors related to business units of varying impact levels.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Sources of information)

• Information sources for periodic security assessments include HR meetings, personnel surveys, and threat intelligence feeds.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Threat Feeds)

• Data reflecting recent attacks on similar companies, industries, and cultures.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Third-Party Assessments)

• External assessments performed by outside parties identify environmental factors and possible insider attack motives not found through internal means.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Ingress Traffic Analysis)

• Comprehensive reviews of ingress traffic, correlated by geographic source, time, protocol, and IP sources (authorized/unauthorized), help identify attack patterns.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Access Audits)

• Sensitive applications with logs track successful and failed logins for effective correlation.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Socioeconomic Analysis)

• Review of external factors impacting employees' rational behavior regarding their job function and use of application environments.

Threat Modeling Overview - Building a Better Risk Model (The Inherent Problem)

• Risk assessment today is clouded by fear and misconceptions.

Threat Modeling Overview - Building a Better Risk Model (Table 1.4 Key Reasons App_Sec Fails Today)

• Ten key reasons for application security failures today.

Threat Modeling Overview - Building a Better Risk Model (Business Case for Threat Modeling)

• Key benefits of developing and sustaining threat modeling within an enterprise.

  • Software applications are a low-hanging-fruit target for attackers.
  • Reduced time and effort to remediate risks equated as additional cost savings.
  • Collaborative approach benefits through adversarial perspectives for better threat identification and mitigation efforts.

Threat Modeling Overview - Building a Better Risk Model (Building Security In)

• Security requirements are becoming more integral to software development.

Threat Modeling Overview - Building a Better Risk Model (Improved Application Design)

• Application design often centers on conceptual ideas rather than consistent development efforts.
• Application design considerations frequently focus too narrowly on application features, instead of integrating security, business, and IT objectives in a holistic approach.

Threat Modeling Overview - Building a Better Risk Model (Scalability)

• Application design needs to be adaptable to changing business and security requirements, requiring code changes affecting scalability.

Threat Modeling Overview - Building a Better Risk Model (Developing Metrics in Threat Modeling)

• A step-by-step process for creating and utilizing threat-modeling metrics based on a baseline.

Threat Modeling Overview - Building a Better Risk Model (Development Factors Affecting Scalability)

• Identifies the factors impacting software scalability. Design, Code tuning, and product/hardware tuning have less impact than initial design.

Threat Modeling Overview - Building a Better Risk Model (Support)

• Software support must directly align with business objectives to minimize deviation from application features.
• Key support personnel roles are depicted, enabling insight into their related work efforts and the benefits from the threat modeling process.

Threat Modeling Overview - Threat Anatomy (Threat Wrapper)

• Threats, vulnerabilities, and varying impact levels encompass all types of application environments.

Threat Modeling Overview - Threat Anatomy (Trust Boundaries)

• Trust boundaries delineate client and application contexts in threat models.

Threat Modeling Overview - Threat Anatomy (Motives)

• Malicious motives drive threats against target assets or information sources.
• Threats rely on intelligence to exploit vulnerabilities and misconfigurations.

Threat Modeling Overview - Threat Anatomy (Threat Classification Models)

• Brief introductions to Microsoft-originated STRIDE and DREAD models, and the WASC technical threat classification model.

Threat Modeling Overview - Threat Anatomy (Open Web Application Security Project (OWASP) Top 10)

• Descriptions of the OWASP top 10 prevalent web application threats for creating threat models.

Threat Modeling Overview - Threat Anatomy (Vulnerabilities - The Never-Ending Race)

• Vulnerability analysis as a continuous challenge.
• The evolving number of vulnerabilities impacting applications greatly impacts risk management.

Threat Modeling Overview - Threat Anatomy (Figure 1.8 Incorporating Vulnerabilities within the Threat Model)

• A workflow to incorporate vulnerability data into a threat model based on attack library data, and their risks.

Threat Modeling Overview - Threat Anatomy (Data Sources for Vulnerability and Attack Analysis)

• Sources include external feeds and internal data.

Threat Modeling Overview - Threat Anatomy (Vulnerabilities in smart card)

• Hypothetical example of vulnerability in smart card technology during employee access to control rooms.

Threat Modeling Overview - Threat Anatomy (Vulnerability Mapping)

• Diagram for vulnerability mapping.

Threat Modeling Overview - Threat Anatomy (Attacks)

• Attack predictions are difficult; motives and information sources drive attacks, often at planning stages; proactive measures are advantageous.

Threat Modeling Overview - Threat Anatomy (Counter-hacking units)

• Counter-hacking units are used by governments to thwart attacks by profiling attackers.

Threat Modeling Overview - Threat Anatomy (Identifying Attacks)

• Threat models break down attacks into components and classify attack types for comprehensive understanding.

Threat Modeling Overview - Threat Anatomy (Taxonomy of Attack Terms)

• Table outlining terms like attack tree, attack vector, attack surface, attack library, vulnerability as well as threat landscape for a better understanding.

Threat Modeling Overview - Threat Anatomy (Technical Threats)

• Examples of technical threats such as vishing attacks which use deception of email and phone calls.

Threat Modeling Overview - Crowdsourcing Risk Analytics

• Models leverage input from developers, QA engineers, governance leaders, project managers, business analysts, system administrators, security personnel, network engineers, and risk/IT personnel for practical application, process-wise, and a more comprehensive understanding of risk, probability, impact, and mitigation.

Threat Modeling Overview - Crowdsourcing Risk Analytics (Quality Assurance Testing)

• QA engineers identify bugs, validating newly developed features and testing outcomes.

Threat Modeling Overview - Crowdsourcing Risk Analytics (Tools for testing)

• A table listing tools for discovery and vulnerability identification.

Threat Modeling Overview - Crowdsourcing Risk Analytics (Elements of Risk)

• Key elements in assessing risk, including scope of assets, business impact analysis, identified vulnerabilities, attack patterns, counter-measures, residual risk, training, and monitoring.

Threat Modeling Overview - Crowdsourcing Risk Analytics (Figure 1.11 Deriving Risks via Application Threat Model)

• Diagram demonstrating relationship between attack complexity, ease of exploitation and vulnerability probability, and resulting consequences relating them to applications and systems.

This quiz covers the fundamental concepts of threat modeling, including its definitions, origins, and the strategic processes involved in identifying potential attack scenarios and vulnerabilities in applications. Participants will learn about the chain-like reactions and factors that influence risk and impact levels in a threat modeling framework.