Downloaded 25 times
![Toolkit component:
Simplified Risk Rating
• Risk = Exposure * Impact
• Impact = [LOW, MED, HIGH]
• Exposure = [INTERNET, DMZ, INTRANET]
• Just ask people to rate [1,2,3] for each
• Multiply, adjust result ±1 and note why
• That’s it you now have risk rating](https://image.slidesharecdn.com/threatmodelingtookit-owasp-quebec-publish-170606210850/85/OWASP-Quebec-Threat-Modeling-Toolkit-Jonathan-Marcil-15-320.jpg)
OWASP Québec: Threat Modeling Toolkit - Jonathan Marcil
- 1. Threat Modeling Toolkit parJonathan Marcil OWASP Québec Juin 2017
- 2. Sommaire • Qui suis-je? •Qu’est-ce que la Sécurité Applicative? • Qu’est-ce que la Modélisation de Menaces? • Modèles existants • Toolkit component: Simplified Risk Rating • Toolkit component: Attack Tree • Toolkit component: Data Flow Diagram • Conclusion et Ouverture
- 3. Qui suis-je? • Youmay remember me from such things as.. – OWASP Montreal, Chapter Leader 2013-2015 – NorthSec, Challenge designer 2012-2014 – HackFest, Animation CTF 2005,2015
- 4. Qui suis-je? • Youmay remember me from such things as.. – OWASP Montréal, Chapter Leader 2013-2015 – NorthSec, Challenge designer 2012-2014 – HackFest, Animation CTF 2005,2016 • Now living in beautiful Irvine, California • Application Security at Blizzard Entertainment
- 5. Ma définition dela Sécurité Applicative • Un mélange de – Un livre: Building Security In – Un standard: ISO/IEC 27034 Application Security – Une direction: Trustworthy Computing, Microsoft • Security Development Lifecycle – Un désordre collaboratif: Wikipedia • Se résume à – Cycle de vie et activités
- 6. Ma définition dela Sécurité Applicative
- 7. La Modélisation deMenaces • Une activité de Sécurité Applicative pour une analyse de la sécurité lors du développement logiciel • Structurer systématiquement –Attaques –Agents de menace –Contre-mesures
- 8. Threat Intelligence • Isnot threat modeling – It’s half of it! • Threat actors – And what they have to gain • Knowledge base of threats – Modeling is a methodology
- 9. Threat Modeling: Forwho? And why? • Common method for – Security practitioners – Software engineers • Design Review • Clarify what the system is for reviewers • Highlight ameliorations or requirements • Help to catch important things despite the chaos
- 10. Modeling must becollaborative • Communication is key in a project • If you do it alone in a corner – You are doing it wrong! • You can still start the modeling alone and then review the model with stakeholders
- 11. Previously at OWASPQuébec 9 mai 2017 La modélisation des menaces – Vincent Goulet
- 12. Previously at OWASPQuébec
- 13.
- 14. Toolkit Components • Thisis what you came for! – At slide #14, not bad..
- 15. Toolkit component: Simplified RiskRating • Risk = Exposure * Impact • Impact = [LOW, MED, HIGH] • Exposure = [INTERNET, DMZ, INTRANET] • Just ask people to rate [1,2,3] for each • Multiply, adjust result ±1 and note why • That’s it you now have risk rating
- 16. Toolkit Component: AttackTree • Organize the Threat Intelligence • Simple tree – Root node is goal – Leaf nodes are ways to reach it – Other nodes are sub-goals • Can be flexible – And logic gates
- 17.
- 18. Attack Tree: IoT •Let’s take an example of a device
- 19.
- 42. Trick: code itinstead of drawing! • PlantUML @startuml skinparam monochrome true agent "Mass mining" as mine agent "Mass scan" as scan agent "DDoS" as ddos agent "Control many devices n(Botnet)" as botnet mine --> botnet scan --> botnet ddos --> botnet agent "Use legit command" as legitcmd agent "Exploit device flaws" as flaws agent "Obtain device access" as access botnet --> legitcmd botnet --> flaws botnet --> access agent "Get WiFi LAN access" as wifi agent "Get Physical access" as phys agent "Place Factory Backdoor" as factory agent "Hack cloud server" as cloud access --> wifi access --> phys access --> factory access --> cloud agent "Make my life miserable" as life agent "Randomware" as ransomware agent "Invade my privacy" as privacy agent "Mess with the lights" as mess life --> ransomware life --> privacy life --> mess agent "View my habits" as habits agent "Spy me live" as spy privacy --> habits privacy --> spy agent "Steal cloud data" as data habits --> data spy --> data data ---> cloud agent "Sniff network" as sniff habits ---> sniff spy ---> sniff access --> sniff sniff --> wifi sniff --> phys @enduml
- 45. habits ---> access spy---> access PlantUML!
- 47. Toolkit Component: DFDDiagram • Data Flow Diagram –Actually, not! • Connection Flow Diagram –Limit amount of visuals –Focus on attack surface/vectors
- 48. Toolkit Component: DFDdiagram • Provide a security oriented view of the system – Representation of the comprehension – It will evolve with understanding or design/architecture changes! • Not an architecture document – Focus on details relevant to security – Omit what might be important for engineers
- 49. Flow Diagram BasicSet • Square for actor • Circle for process – Double circle for multiple processes • Arrow for connection flow direction • Double line for data store – I won’t blame anyone using a cylinder instead • Red dotted line for boundary • 100% compatible with Microsoft SDL notation
- 50.
- 51.
- 52.
- 53.
- 54.
- 55.
- 56.
- 57.
- 58.
- 59.
- 60.
- 61. Flow Diagram ExtendedSet • Tech stack label on circle • Sticky notes • Table of security controls/mitigations – Include label numbers to place on the graph for positioning • Anything you want! – Cloud for abstraction – Colors/circles for logical links or special meaning – Just keep it visually pleasing and as minimalist as possible
- 62.
- 63. . User Internet Cloud Integration Web Site Social networks, weatherdata, etc. Broadcast UPnP? Cloud API HTTPS Browser Mobile App My Script MySQL database HTTP IoT Device Local API HTTP HTTPS
- 64. . User Internet Cloud Integration Web Site PHP Social networks, weatherdata, etc. Broadcast UPnP? Cloud API Node.js HTTPS Browser Mobile App My Script Python MySQL database HTTP IoT Device Local API HTTP HTTPS
- 65. . REVISED 2/23/2017 THREAT MODEL DIAGRAM IoT DRAWNBY jonathan.marcil@owasp.org VERSION 0.2 User Internet Cloud Integration Web Site PHP Social networks, weather data, etc. Broadcast UPnP? Cloud API Node.js HTTPS Browser Send command Mobile App My Script Python MySQL database HTTP IoT Device Local API HTTP HTTPS Periodically HTTP GET to the API and receive a commands to execute There's no authentication!
- 66. Security Controls Checklist . REVISED 2/23/2017 THREATMODEL DIAGRAM IoT DRAWN BY jonathan.marcil@owasp.org VERSION 0.2 User Internet Cloud Integration Web Site PHP Social networks, weather data, etc. Broadcast UPnP? Cloud API Node.js HTTPS 1 IoT device read only Browser Send command Utilization of proper framework ORM2 Mobile App My Script Python MySQL database HTTP IoT Device Local API HTTP HTTPS 3 Add Authentication and HTTPS 2 1 3 3 Periodically HTTP GET to the API and receive a commands to execute There's no authentication!
- 67. Conclusion • Si vousavez besoin de vérifier la sécurité d’un système complexe, le diagramme de flux est votre outil • Vous pouvez utiliser ce que vous avez appris pour guider d’autres activités de sécurité applicative • Si vous tentez l’expérience durant une réunion et que les gens finissent par clarifier et/ou améliorer le système alors que vous ne dites rien; alors bravo, vous avez gagné à la modélisation de menaces!
- 68. Unified Threat Modeling •Link Attack tree to Flow diagram – Security controls are the way of mitigating the sub- goals and prevent exploitation • Link Flow diagram to Security testing – Identify and direct tests to components • Create Abuse cases and feed the Attack tree – To be sure we have all threat actors
- 69. 1 2 3 Security Controls Checklist 1IoT device read only Utilization of proper framework ORM2 3 Add Authentication and HTTPS
- 70.
- 71. Merci à • OWASPQuébec • OWASP Montréal • OWASP Orange County • Département de Security chez Blizzard • Vous! @jonathanmarcil jonathan.marcil@owasp.org
Editor's Notes
- #4 Pour ceux qui pensait qu’animé un CTF c’était nouveau en 2016…. 2005: https://web.archive.org/web/20051001072018/http://hackfest.centinel.org:80/francais/
- #6 Sources in order: Gary McGraw, Luc Poulin, Bill Gates and 175 random people that know better. And I’m still not sure if it’s lifecycle or life cycle
- #7 And Threat Modeling is one of the arrows!
- #10 Can also be used to reach a maturity level in security, even if you don’t have any formal processes it works just fine.
- #14 Discrimination by algorithm: I’ve searched for “famous models”.
- #15 Picture under CC Attribution 2.0 https://creativecommons.org/licenses/by/2.0/ Source/credits https://www.flickr.com/photos/rustedhammer/2298322271 Did you know that most of OWASP documentation is too CC too?
- #18 https://www.schneier.com/academic/archives/1999/12/attack_trees.html (yup, it’s from 1999!)
- #20 You need to erase a lot because of refactoring/normalization of the tree.
- #34 Yeah Randomware, it’s like ransomware but it just make your file goes random
- #43 http://plantuml.com/ The tool is as great as the web site is ugly.
- #51 Meme source: https://twitter.com/internetofshit