What could possibly go wrong? Threat modelling in the 21st century. – Phil Ashby

What could possibly go wrong? Threat modelling in the 21st century. – Phil Ashby
2019-08-30 Suffolk OWASP Chapter Meeting Talk 1 of 29 What Could Possibly Go Wrong? Threat Modelling in the 21st Century
2019-08-30 Suffolk OWASP Chapter Meeting Talk 2 of 29 TL;DR ● What is a threat model? ● Why should we have one? ● How should we make one? ● When should we do that? ● How do we know when we’re done? ● Does cloud change everything?
2019-08-30 Suffolk OWASP Chapter Meeting Talk 3 of 29 Threat Model(l)ing ● Spot quiz :)
2019-08-30 Suffolk OWASP Chapter Meeting Talk 4 of 29 WAT?
2019-08-30 Suffolk OWASP Chapter Meeting Talk 5 of 29 An Attackers View of Your System ● Their ‘business plan’ to attack your system at lowest risk and highest return on investment.
2019-08-30 Suffolk OWASP Chapter Meeting Talk 6 of 29 In Context.. ● Threat Model → ● Risk Assessment → ● Risk Management → ● System Development Life Cycle (SDLC) → ● Regulatory Compliance (ISO27k, PCI-DSS, GDPR) ● Or because you want to stay in business :)
2019-08-30 Suffolk OWASP Chapter Meeting Talk 7 of 29 AKA.. ● Gartner’s ‘Adaptive Security Architecture’ (BS!) ● Predict, Prevent, Detect, Respond (PPDR) → ● Resilience modelling
2019-08-30 Suffolk OWASP Chapter Meeting Talk 8 of 29 WHY?
2019-08-30 Suffolk OWASP Chapter Meeting Talk 9 of 29 Effective Security ● Well understood ● Managed risks ● Planned responses
2019-08-30 Suffolk OWASP Chapter Meeting Talk 10 of 29 Efficient Security ● Prioritised, cost effective controls ● Estimates of residual risk in business terms ● Ready made evidence for compliance audits
2019-08-30 Suffolk OWASP Chapter Meeting Talk 11 of 29 HOW?
2019-08-30 Suffolk OWASP Chapter Meeting Talk 12 of 29 “Think Like an Attacker” ● Build a model of attacks ● Estimate cost to attacker ● Estimate impact to our business ● Prioritise threats on highest impact/cost ratio ● Take into risk assessment, control design..
2019-08-30 Suffolk OWASP Chapter Meeting Talk 13 of 29 Outside In Modelling ● Threat actors, motivations ● Target data and flows across.. ● Boundaries. ● ‘Crown Jewels’ model
2019-08-30 Suffolk OWASP Chapter Meeting Talk 14 of 29 Inside Out Modelling ● Components ● Weaknesses ● Networks ● Microsoft STRIDE
2019-08-30 Suffolk OWASP Chapter Meeting Talk 15 of 29 Samples!
2019-08-30 Suffolk OWASP Chapter Meeting Talk 16 of 29 Attack Trees ● Created by Bruce Schneier in 1999 ● Common in Outside In models ● Effective when system is a well understood ‘White Box’
2019-08-30 Suffolk OWASP Chapter Meeting Talk 17 of 29
2019-08-30 Suffolk OWASP Chapter Meeting Talk 18 of 29 Iterative Refinement ● Created by NCC during consulting work ● Common in Inside Out models ● ‘Can’t make it worse’ principle :) ● Copes with less well understood ‘Grey Box’ systems
2019-08-30 Suffolk OWASP Chapter Meeting Talk 19 of 29
2019-08-30 Suffolk OWASP Chapter Meeting Talk 20 of 29 WHEN?
2019-08-30 Suffolk OWASP Chapter Meeting Talk 21 of 29 Greenfield: Part of the SDLC ● First model → during first design cycle! ● Refreshed → material changes in… – System functionality or implementation – External threat intelligence
2019-08-30 Suffolk OWASP Chapter Meeting Talk 22 of 29 Brownfield: Introduce to the SDLC ● As soon as possible within SDLC ● Always better to have a model than nothing! ● Provides risk information to system owners ● Incremental modelling reduces impact of introduction
2019-08-30 Suffolk OWASP Chapter Meeting Talk 23 of 29 DONE?
2019-08-30 Suffolk OWASP Chapter Meeting Talk 24 of 29 Model Contains.. ● Quantified risks ● Testable attacks ● Operational impacts
2019-08-30 Suffolk OWASP Chapter Meeting Talk 25 of 29 Model Checking ● Security Testing – Red / Blue teaming – Purple teaming ● Operational feedback – Monitoring behaviour
2019-08-30 Suffolk OWASP Chapter Meeting Talk 26 of 29 CLOUD?
2019-08-30 Suffolk OWASP Chapter Meeting Talk 27 of 29 Can we SEP it? ● Somebody Else’s Problem: AWS/Google/Microsoft? ● Nope! – Your architecture, your choice of components, your code – New actors & risks – New controls though :)
2019-08-30 Suffolk OWASP Chapter Meeting Talk 28 of 29 ME :) ● Phil Ashby (aka Phlash) ● Technical Architect @ GBG Plc. ● Ex-BT security, ex-CEH holder ● AMCIISec, MBCS, MIET ● phil.owasp@ashbysoft.com ● https://twitter.com/phlash909 ● https://dev.to/phlash909
2019-08-30 Suffolk OWASP Chapter Meeting Talk 29 of 29 YOU? ● Questions?

What could possibly go wrong? Threat modelling in the 21st century. – Phil Ashby

What could possibly go wrong? Threat modelling in the 21st century. – Phil Ashby

Recommended

More Related Content

Similar to What could possibly go wrong? Threat modelling in the 21st century. – Phil Ashby

Similar to What could possibly go wrong? Threat modelling in the 21st century. – Phil Ashby(20)

Recently uploaded

Recently uploaded(20)

What could possibly go wrong? Threat modelling in the 21st century. – Phil Ashby