Threat Modeling: Methods and Steps

Why do Threat Modeling?

• To identify potential vulnerabilities early, ideally during design stages, to influence design and build before it's too late
• To include input from all stakeholders, ensuring all angles, both technical and non-technical, are considered
• To drive security controls based on business priorities, taking inputs from product owners and business representatives
• To encourage a security mindset which influences the selection and design of future IT services

Threat Modeling – Main Steps

• Need to understand the system or application and its business purpose, including what information is being processed
• Need to consider what could go wrong
• What can be done about threats?
• Need to evaluate how well threat mitigation went

Threat Models, Methods, and Diagrams

• STRIDE
• PASTA
• CVSS
• Attack Trees
• Security Cards
• Trike
• DREAD

STRIDE Model

• Spoofing Identity violates Authenticity, defined as pretending to be someone or something other than yourself
• Tampering with data violates Integrity, modifying data at rest, in transit, or in memory
• Repudiation violates Non-repudiation, denying that you did something
• Information Disclosure violates Confidentiality, giving sensitive information to someone not authorized
• Denial of Service violates Availability, exhausting computing resources needed to support the service
• Elevation of Privilege violates Authorization, allowing someone to do something they are not authorized to perform

Diagramming the System

• Use structured diagrams like DFD
• Add trust boundaries that intersect data flows
• Identify surfaces where an attacker can intrude, such as network boundaries and cloud boundaries
• Encrypting network traffic is an 'instinctive' mitigation, but does not address everything, like tampering or spoofing

Data Flow Diagrams (DFD)

• Helps define the scope of threat modeling
• Aids in understanding data flows within the system
• Provides a structure for assessing risks
• Data Flow Diagrams (DFD) are the most common for threat modeling

STRIDE Threat Categories

• Spoofing Identity is when someone uses your password and authenticating as you, violating Authentication
• Tampering with data includes modification of data, either at rest or sent over a network, violating Integrity
• Repudiation is when users deny having performed an action, violating Non-repudiation
• Information disclosure is when a user reads data without granted access, or eavesdrops on a communication channel, violating Confidentiality
• Denial of service is related to the availability of a system, violating Availability
• Elevation of privilege is when a less privileged user gets higher privileges; normal users obtaining root privileges, violating Authorization

STRIDE Mitigation

• Spoofing threat can be mitigated through Authentication using Passwords, MFA and Digital Signatures
• Tampering threat can be mitigated through Integrity using Permissions/ACLs and Digital Signatures
• Repudiation threat can be mitigated through Non-Repudiation using Secure Logging and auditing, and Digital Signatures
• Information Disclosure can be mitigated through Confidentiality using Encryption and Permissions/ACLs
• Denial of Service threat can be mitigated through Availability using Permissions/ACLs and Filtering
• Elevation of Privileges threat can be mitigated through Authorization using Permissions/ACLs and Input Validation

STRIDE Validation

• Validating the whole threat model involves verifying that the diagram matches the system
• Ensures all threats are enumerated
• Minimum STRIDE per element that touches a trust boundary is ensured
• Each threat is properly mitigated
• Mitigation measures are implemented correctly

Attack Trees

• Method commonly combined with other techniques like STRIDE
• Show attacks on a system in tree form
• The root represents the goal of an attack, and the leaves are the ways to achieve that goal
• Each attack goal is represented as a separate tree

PASTA

• Process for Attack Simulation and Threat Analysis (PASTA) is an attacker-centric methodology with seven steps
• PASTA aligns business objectives with technical requirements
• PASTA considers business impact analysis
• PASTA provides threat management, enumeration, and scoring

Threat Modeling Manifesto - Four Key Questions

• What are we working on? Needs support using a diagram such as a DFD
• Having a clear boundary to define the scope of the application, decomposing large and complex applications, identifies key assets
• What can go wrong? This involves threats that could impact the security or privacy of the application and a list of potential weaknesses in the design or implementation
• What are we going to do about it? Actions need to mitigate the impact of the threats identified, countermeasures or additional security controls, and prioritization of actions
• Did we do a good enough job? Have threats been identified? Have risks been reduced through effective countermeasures? and have lessons learned been taken, e.g., new recommended “standard” security controls for the organization