Presentation for the Adidas Testing Day in Zaragoza.

2. 2
CTO @ Continuum Security
Security Architect @ WH
SGSI (ISO-27001) & Pen test & dev @ Universitat Jaume I
https://www.linkedin.com/in/paul-santapau-a9953a4/

3. 3
Threat Modeling.
Modeling with Patterns.
Including verification and testing into a CI/CD pipeline.

4. 4

5. 5

6. 6

7. 7

8. 8

12. 12
- component: Web UI
id: web-ui
data:
- name: PII
- name: Public Data
implements:
- authentication: user_password_form
- session_management: cookie_based
dataflows:
- sends_to: web-app
- receives_from: web-app
trust_zones:
- name: Internet
trust: 1
- component: Web Application
id: web-app
data:
- name: PII
- name: Public Data
implements:
- channel_encryption: tls_v1.3
- session_management: framework_generated_session_id
dataflows:
- sends_to: web-ui
- receives_from: web-ui
trust_zones:
- name: DMZ
trust: 40

13. 13

14. 14
THREAT VIOLATES
Spoofing Authentication
Tampering Integrity
Repudiation Non-repudiation
Information Disclosure Confidentiality
Denial of Service Availability
Elevation of Privilege Authorization

15. 15

16. 16
CAPEC
...

17. 17
STRIDE
OWASP Top 10
CAPEC
Checklists
+++ Abstraction
+++ Detail

18. 18
Without Patterns and Templates
With Patterns and Templates

19. 19
- Default passwords.
- Password database access.
- Dictionary-based brute force.
- Username guessing / enumeration.
- Credentials captured by a man in the middle attack.
- Password reset abuse.
- Authentication replay.
- Session id prediction.
- Session hijacking.
- Session fixation.
- Shoulder surfing.
- …

20. 20
¿Web form username
and password-based
authentication?
Attack Threat
- Default passwords. Attackers gain access to the system using default passwords.
- Password database access. Attackers gain access to user accounts by accessing the password
database
- Dictionary-based brute force. Attackers gain access to user accounts by performing a
dictionary-based brute force attack.
- Username guessing. Attackers gain access to user accounts by performing a username
guessing attack.
- Username enumeration. Attackers gain access to user accounts by performing a username
enumeration attack.
... ...

21. 21

22. 22
Security team experience.
Standards: OWASP, NIST, CIS, etc.
Regulations: PCI, EUGDPR, ISO-27001...

23. 23
OWASP ASVS 3.0.1
Authentication

24. 24
¿Web form
username and
password-based
authentication?
Threat Countermeasure(s)
Attackers gain access to the system using default
passwords.
Remove default credentials and role-based accounts
from the application
Attackers gain access to user accounts by accessing the
password database
Store passwords in unrecoverable form to prevent
disclosure
Attackers gain access to user accounts by performing a
dictionary-based brute force attack.
Require the use of strong passwords
Attackers gain access to user accounts by performing a
username guessing attack.
Implement application and network rate limiting on the
login function
Attackers gain access to user accounts by performing a
username enumeration attack.
Ensure failed login timings do not reveal account status
Ensure application errors do not reveal account status
... ...

25. 25
¿Web form
username and
password-based
authentication?
Threat Countermeasure(s) Standard Req
Attackers gain access to the system using
default passwords.
Remove default credentials and role-based
accounts from the application
OWASP-ASVS Level 1 r2.19
Attackers gain access to user accounts by
accessing the password database
Store passwords in unrecoverable form to
prevent disclosure
OWASP-ASVS Level 2 r2.13
Attackers gain access to user accounts by
performing a dictionary-based brute force
attack.
Require the use of strong passwords OWASP-ASVS Level 2 r2.7
Attackers gain access to user accounts by
performing a username guessing attack.
Implement application and network rate
limiting on the login function
OWASP-ASVS Level 1 r2.20
Attackers gain access to user accounts by
performing a username enumeration
attack.
Ensure failed login timings do not reveal
account status
Ensure application errors do not reveal
account status
OWASP-ASVS Level 3 r2.28
OWASP-ASVS Level 1 r2.18
... ... ...

26. 26

27. 27
¿Web form
username and
password-based
authentication?
Threat Countermeasure(s) Standard Req
Attackers gain access to the system using
default passwords.
Remove default credentials and role-based
accounts from the application
OWASP-ASVS Level 1 r2.19
Attackers gain access to user accounts by
accessing the password database
Store passwords in unrecoverable form to
prevent disclosure
OWASP-ASVS Level 2 r2.13
Attackers gain access to user accounts by
performing a dictionary-based brute force
attack.
Require the use of strong passwords OWASP-ASVS Level 2 r2.7
Attackers gain access to user accounts by
performing a username guessing attack.
Implement application and network rate
limiting on the login function
OWASP-ASVS Level 1 r2.20
Attackers gain access to user accounts by
performing a username enumeration
attack.
Ensure failed login timings do not reveal
account status
Ensure application errors do not reveal
account status
OWASP-ASVS Level 3 r2.28
OWASP-ASVS Level 1 r2.18
... ... ...

28. 28
¿Web form username
and password-based
authentication?
Countermeasure(s) Implemented
Remove default credentials and role-based accounts from the
application
Store passwords in unrecoverable form to prevent disclosure
Require the use of strong passwords
Implement application and network rate limiting on the login function
Ensure failed login timings do not reveal account status
Ensure application errors do not reveal account status
...

29. 29

30. 30
¿Web form username
and password-based
authentication?
Countermeasure(s)
Remove default credentials and role-based accounts from the application
Store passwords in unrecoverable form to prevent disclosure
Require the use of strong passwords
Implement application and network rate limiting on the login function
Ensure failed login timings do not reveal account status
Ensure application errors do not reveal account status
...

31. 31
Remove default credentials and role-based
accounts from the application
@authentication
Feature: Authentication
Verify that the authentication system is robust
Scenario: Default passwords should not be used
Given a web form based authentication
When the default user logs in
Then the password in not in the default passwords list

32. 32
Store passwords in unrecoverable form to
prevent disclosure
@authentication
Feature: Authentication
Verify that the authentication system is robust
Scenario: Passwords should be stored in unrecoverable format
Given a web form based registration
When a user registration happens
And the password is provided and stored
Then the password cannot be reverted back to its original form

33. 33
Require the use of strong passwords
@authentication
Feature: Authentication
Verify that the authentication system is robust
Scenario: Passwords should be strong
Given a web form based authentication
When a user registration happens
Then the password is asked
When a weak password is provided
Then the user cannot register

34. 34
Implement application and network rate
limiting on the login function
@authentication
Feature: Authentication
Verify that the authentication system is robust
Scenario: authentication attempts should be limited
Given a web form based authentication
When a user tries to log in
And uses invalid passwords
And the time between tries is less than X seconds
Then the source is locked down

35. 35

36. 36
@app_scan
@cwe-89
@cwe-79
@cwe-22
@cwe-98
@cwe-97
@cwe-94
@cwe-78
@cwe-113
@cwe-601
@cwe-541
@cwe-78
@cwe-90
@cwe-91
@cwe-611
@cwe-209-poodle
@cwe-200
@authentication
@cwe-178-auth
@cwe-295-auth
@cwe-319-auth
@cwe-525-repost
@cwe-525-autocomplete-form
@cwe-525-autocomplete-password
@auth_lockout
@authorisation
@cwe-639
@cwe-306
@cors
@cwe-942-cors_allowed
@cwe-942-cors_disallowed
@data_security
@cwe-525
@host_config
@open_ports
@http_headers
@cwe-693-clickjack
@cwe-693-x-xss-protection
@cwe-693-strict-transport-security
@cwe-942-cors_permissive
@cwe-693-nosniff
@nessus_scan
@passive_scan
@session_management
@cwe-664-fixation
@cwe-613-logout
@cwe-613
@cwe-614
@wasc-13
@ssl
@ssl_perfect_forward_secrecy
@ssl_crime
@ssl_client_renegotiations
@ssl_heartbleed
@ssl_strong_cipher
@ssl_disabled_protocols
@ssl_support_strong_protocols
@ssl_perfect_forward_secrecy

37. 37
Business Need
Design
PO
Architects
Threat
Model
Implement
Verify
Test
Deploy
Security

38. 38
Business Need
Secure
Design /
Threat
Model
PO
Architects / DevOps / QA
Risk
Patterns
/ Tests
Implement
Verify
Test
Deploy
Security

39. 39
Verify
Test
Deploy

40. 40

41. 41
● Threat Modeling: Designing for Security:
https://books.google.es/books/about/Threat_Modeling.html?id=asPDAgAAQBAJ&source=kp_cover&redir_esc=y
● Scaling Threat Modeling with Tools: https://continuumsecurity.net/scaling-threat-modeling-with-tools/
● BDD-Security: https://github.com/continuumsecurity/bdd-security/wiki
● OWASP Top 10: https://www.owasp.org/index.php/Top_10-2017_Top_10
● Common Attack Pattern Enumeration and Classification: https://capec.mitre.org/
● OWASP Application Security Verification Standard:
https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project
● Mobile Application Security Verification Standard: https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide