Module 1 - Threat Modeling Overview

Module 1 - Threat Modeling Overview

• Threat modeling is a strategic process for identifying potential attack scenarios and vulnerabilities in applications, used to clearly identify risk and impact levels.
• Each function in the threat modeling process requires careful consideration of multiple risk factors influenced by threat, vulnerability, and impact levels.
• A key characteristic of threat modeling is its strategic approach, anticipating threats via calculated and simulated attack patterns.
• Threat modeling is a chain-like reaction of tactical events across multiple domains (e.g., business objectives, system/database administration, vulnerability management).

Threat Modeling Overview - Definition, Origin, and Use (Process)

• Threat modeling's process is a key distinguishing quality.
• It involves a chain-like reaction of tactical events across multiple domains, with input and contributions from other stakeholders related to a protected application environment.

Threat Modeling Overview - Definition, Origin, and Use (Attack)

• Attack reflects a major science in threat modeling.
• The discipline involves researching how attack patterns may exploit software vulnerabilities;
• Threat modeling techniques dissect attacks, exposing faults in design and development, and unveiling attacker motivations.

Threat Modeling Overview - Definition, Origin, and Use (Vulnerabilities)

• Vulnerabilities are more prevalent in other IT security efforts.
• Threat modeling uses vulnerabilities at platform and software levels to aggregate and correlate with possible attack scenarios.

Threat Modeling Overview - Definition, Origin, and Use (Application Environment)

• The application environment is the object of the threat modeling process.
• Other security procedures typically address single aspects of an application, lacking a holistic approach.
• Threat modeling's value is in encompassing benefits of isolated procedures to secure the entire application environment.

Threat Modeling Overview - Definition, Origin, and Use (Risk)

• Risk is the key interest in threat modeling, a supportive role in achieving business objectives.
• Threat modeling identifies risks from evolving threats, compounded by software/network vulnerabilities, and driven by attack motives in business information within an application environment.

Threat Modeling Overview - Definition, Origin, and Use (Threat Modeling)

• Threat modeling provides precise risk communication by clarifying how a business application environment could be compromised and the probability of actual risk.
• Risk unifies security and business professionals for collaborative enterprise protection.

Threat Modeling Overview - Definition, Origin, and Use (Impact)

• Impact is the ability to properly answer the question "How bad is it?".
• Security professionals must consider all possible threat scenarios for a prioritized risk-based analysis to provide an effective and credible answer.

Threat Modeling Overview - Definition, Origin, and Use (Art of Espionage)

• Surveying internal readiness is similar to gathering information about an enemy's intent and capabilities.
• Threat models must also account for attack motives, capabilities, vulnerabilities, and available information.
• Threat modeling process complexity lies in expedient analysis and process development, as reconnaissance (information gathering) efforts may be inconclusive.
• Misinformation and an incorrect attack-scenario set can derail threat modeling and mislead defense efforts from creating effective countermeasures.

Threat Modeling Overview - Definition, Origin, and Use (External information sources)

• External sources include application/platform vulnerabilities and attack libraries containing current and past exploits.

Threat Modeling Overview - Definition, Origin, and Use (Attack library)

• Attack libraries consist of exploits required to successfully attack an application and are critical for maintaining flexibility in software products when facing evolving threat scenarios.
• Maintaining threat modeling requires continuous updating. While threat models may initially seem rigid, they should have the flexibility to incorporate the latest threat intelligence.

Threat Modeling Overview - Definition, Origin, and Use (Designing Countermeasures)

• Designing effective countermeasures for software is crucial to differentiate application threat modeling from other traditional efforts.
• Good countermeasures consider not only perceived threats but also potential threat evolution or adaptation to historical forms, thus avoiding a false sense of security.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Cyber warfare)

• Terms like "cyber warfare", "zero-day botnets" describe complex challenges for information security professionals.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Environmental Threat Factors)

• Attack motives can be influenced by environmental factors, which impacts attack characteristics such as intensity, sophistication, the possibility of successful exploitation or ability to distort/eliminate forensic evidence.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Product of the Environment)

• The environment encompasses social, political, economic, belief-based, and financial factors that drive software adversaries.
• Motives such as revenge, spite, espionage and fraud may be influenced by external conditions such as war, layoffs, or economic hardship.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Environmental factors)

• Environmental factors influence attack windows of opportunity.
• Social, political, environmental, and economic events can create conditions ripe for attacks.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Figure 1.1 Relating Environmental Factors to Attacks)

• A diagram showing the relationship between environmental factors, motives, vulnerabilities, and attack types.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Table 1.1 Correlating Environmental Factors to Attack Motives - Sample)

• This table correlates industry types, environments ("factor"), and potential attack motives
• A sample table from the presentation.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Judging by Motives)

• All threats have motives.
• Attack designs have an objective.
• Reconnaissance efforts can have motives.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Table 1.2 Correlating Motives to Application Threat Vectors)

• A table correlating threat targets, motives, and attack vectors.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Table 1.3 Recommended Frequency for Environmental Threat Factor Analysis)

• Presents various frequencies and scopes for analyzing environmental threat factors related to business units of varying impact levels.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Sources of information)

• Information sources for periodic security assessments include HR meetings, personnel surveys, and threat intelligence feeds.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Threat Feeds)

• Data reflecting recent attacks on similar companies, industries, and cultures.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Third-Party Assessments)

• External assessments performed by outside parties identify environmental factors and possible insider attack motives not found through internal means.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Ingress Traffic Analysis)

• Comprehensive reviews of ingress traffic, correlated by geographic source, time, protocol, and IP sources (authorized/unauthorized), help identify attack patterns.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Access Audits)

• Sensitive applications with logs track successful and failed logins for effective correlation.

Threat Modeling Overview - Rationale and Evolution of Security Analysis (Socioeconomic Analysis)

• Review of external factors impacting employees' rational behavior regarding their job function and use of application environments.

Threat Modeling Overview - Building a Better Risk Model (The Inherent Problem)

• Risk assessment today is clouded by fear and misconceptions.

Threat Modeling Overview - Building a Better Risk Model (Table 1.4 Key Reasons App_Sec Fails Today)

• Ten key reasons for application security failures today.

Threat Modeling Overview - Building a Better Risk Model (Business Case for Threat Modeling)

• Key benefits of developing and sustaining threat modeling within an enterprise.

  • Software applications are a low-hanging-fruit target for attackers.
  • Reduced time and effort to remediate risks equated as additional cost savings.
  • Collaborative approach benefits through adversarial perspectives for better threat identification and mitigation efforts.

Threat Modeling Overview - Building a Better Risk Model (Building Security In)

• Security requirements are becoming more integral to software development.

Threat Modeling Overview - Building a Better Risk Model (Improved Application Design)

• Application design often centers on conceptual ideas rather than consistent development efforts.
• Application design considerations frequently focus too narrowly on application features, instead of integrating security, business, and IT objectives in a holistic approach.

Threat Modeling Overview - Building a Better Risk Model (Scalability)

• Application design needs to be adaptable to changing business and security requirements, requiring code changes affecting scalability.

Threat Modeling Overview - Building a Better Risk Model (Developing Metrics in Threat Modeling)

• A step-by-step process for creating and utilizing threat-modeling metrics based on a baseline.

Threat Modeling Overview - Building a Better Risk Model (Development Factors Affecting Scalability)

• Identifies the factors impacting software scalability. Design, Code tuning, and product/hardware tuning have less impact than initial design.

Threat Modeling Overview - Building a Better Risk Model (Support)

• Software support must directly align with business objectives to minimize deviation from application features.
• Key support personnel roles are depicted, enabling insight into their related work efforts and the benefits from the threat modeling process.

Threat Modeling Overview - Threat Anatomy (Threat Wrapper)

• Threats, vulnerabilities, and varying impact levels encompass all types of application environments.

Threat Modeling Overview - Threat Anatomy (Trust Boundaries)

• Trust boundaries delineate client and application contexts in threat models.

Threat Modeling Overview - Threat Anatomy (Motives)

• Malicious motives drive threats against target assets or information sources.
• Threats rely on intelligence to exploit vulnerabilities and misconfigurations.

Threat Modeling Overview - Threat Anatomy (Threat Classification Models)

• Brief introductions to Microsoft-originated STRIDE and DREAD models, and the WASC technical threat classification model.

Threat Modeling Overview - Threat Anatomy (Open Web Application Security Project (OWASP) Top 10)

• Descriptions of the OWASP top 10 prevalent web application threats for creating threat models.

Threat Modeling Overview - Threat Anatomy (Vulnerabilities - The Never-Ending Race)

• Vulnerability analysis as a continuous challenge.
• The evolving number of vulnerabilities impacting applications greatly impacts risk management.

Threat Modeling Overview - Threat Anatomy (Figure 1.8 Incorporating Vulnerabilities within the Threat Model)

• A workflow to incorporate vulnerability data into a threat model based on attack library data, and their risks.

Threat Modeling Overview - Threat Anatomy (Data Sources for Vulnerability and Attack Analysis)

• Sources include external feeds and internal data.

Threat Modeling Overview - Threat Anatomy (Vulnerabilities in smart card)

• Hypothetical example of vulnerability in smart card technology during employee access to control rooms.

Threat Modeling Overview - Threat Anatomy (Vulnerability Mapping)

• Diagram for vulnerability mapping.

Threat Modeling Overview - Threat Anatomy (Attacks)

• Attack predictions are difficult; motives and information sources drive attacks, often at planning stages; proactive measures are advantageous.

Threat Modeling Overview - Threat Anatomy (Counter-hacking units)

• Counter-hacking units are used by governments to thwart attacks by profiling attackers.

Threat Modeling Overview - Threat Anatomy (Identifying Attacks)

• Threat models break down attacks into components and classify attack types for comprehensive understanding.

Threat Modeling Overview - Threat Anatomy (Taxonomy of Attack Terms)

• Table outlining terms like attack tree, attack vector, attack surface, attack library, vulnerability as well as threat landscape for a better understanding.

Threat Modeling Overview - Threat Anatomy (Technical Threats)

• Examples of technical threats such as vishing attacks which use deception of email and phone calls.

Threat Modeling Overview - Crowdsourcing Risk Analytics

• Models leverage input from developers, QA engineers, governance leaders, project managers, business analysts, system administrators, security personnel, network engineers, and risk/IT personnel for practical application, process-wise, and a more comprehensive understanding of risk, probability, impact, and mitigation.

Threat Modeling Overview - Crowdsourcing Risk Analytics (Quality Assurance Testing)

• QA engineers identify bugs, validating newly developed features and testing outcomes.

Threat Modeling Overview - Crowdsourcing Risk Analytics (Tools for testing)

• A table listing tools for discovery and vulnerability identification.

Threat Modeling Overview - Crowdsourcing Risk Analytics (Elements of Risk)

• Key elements in assessing risk, including scope of assets, business impact analysis, identified vulnerabilities, attack patterns, counter-measures, residual risk, training, and monitoring.

Threat Modeling Overview - Crowdsourcing Risk Analytics (Figure 1.11 Deriving Risks via Application Threat Model)

• Diagram demonstrating relationship between attack complexity, ease of exploitation and vulnerability probability, and resulting consequences relating them to applications and systems.