DOUBLE-CLICK TO INSERT SHORT TITLE (50 CHARACTERS OR LESS) 1 DOUBLE-CLICK TO TYPE IN ABBRIEVATED TITLE (50 CHARACTERS OR LESS) 2This Is Your Title: It Should Be Less Than Twelve Words Your Name Course Name College Name Abstract The abstract is on its own page. The first paragraph of the abstract should not be indented. It is typically 150 to 250 words and summarizes the main points of the paper. It should include your thesis and summarize your main points and results. Do not include quotations here. Define any abbreviations and acronyms you use in the paper here. You might want to write it after you’ve written the rest of your paper, so that it’s easy to summarize. In academic publishing, writing a good abstract is important, because it is the first, and sometimes only, bit of information your readers get to help them decide whether they should read or buy your article. After this paragraph, there is a page break that forces the beginning of your paper onto its own page: You will want to keep it there. This Is Your Title: It Should Be Less Than Twelve Words This is your introduction and thesis paragraph. The introduction should be about five or six sentences and provide some background or context for your topic. Do not use I or you in academic writing. When appropriate, include recent events relating to the topic. For example, if you are writing about cyber warfare, you might mention Russia using cyber-attacks to influence the last US presidential election. Your thesis should be one sentence and outline the main points of the paper. Literature Review or Background Summarize and quote the important research on this topic that has gone before you. Define subject-specific vocabulary or related theory. Usually, you want to look at books for background. You might want to use your textbook or an encyclopedia to find the names of researchers or theories that are important to the topic, then, search for those names on the library website. Use keywords when research of your topic in databases (example: cyber warfare or cyber attack) to find related articles and books. Need help? Ask A Librarian. Anytime you summarize what someone else has said, include the author’s last name and year either in the text or in parentheses at the end. If you quote someone else, include the author’s last name, year, and page number either in the text or in parentheses at the end. If an article has three to five authors, write their last names out the first time, then cite only the first author’s last name followed by “et al.” If an article has six or more authors, include only the first author’s last name followed by “et al.” If the source does not have an author, such as a website, put the name of the article or webpage in parentheses at the end. The whole point of in-text citations is so your reader can find the correct source in your References, so make sure authors or titles match both in-text and in References. Find out more about in-text citatio ...

1. DOUBLE-CLICK TO INSERT SHORT TITLE (50
CHARACTERS OR LESS) 1
DOUBLE-CLICK TO TYPE IN ABBRIEVATED TITLE (50
CHARACTERS OR LESS) 2This Is Your Title: It Should Be
Less Than Twelve Words
Your Name
Course Name
College Name
Abstract
The abstract is on its own page. The first paragraph of the
abstract should not be indented. It is typically 150 to 250 words
and summarizes the main points of the paper. It should include
your thesis and summarize your main points and results. Do not
include quotations here. Define any abbreviations and acronyms
you use in the paper here. You might want to write it after
you’ve written the rest of your paper, so that it’s easy to
summarize.
In academic publishing, writing a good abstract is important,
because it is the first, and sometimes only, bit of information
your readers get to help them decide whether they should read
or buy your article. After this paragraph, there is a page break
that forces the beginning of your paper onto its own page: You
will want to keep it there.
This Is Your Title: It Should Be Less Than Twelve Words
This is your introduction and thesis paragraph. The introduction
should be about five or six sentences and provide some
background or context for your topic. Do not use I or you in
academic writing. When appropriate, include recent events
relating to the topic. For example, if you are writing about
cyber warfare, you might mention Russia using cyber-attacks to

2. influence the last US presidential election. Your thesis should
be one sentence and outline the main points of the paper.
Literature Review or Background
Summarize and quote the important research on this topic that
has gone before you. Define subject-specific vocabulary or
related theory. Usually, you want to look at books for
background. You might want to use your textbook or an
encyclopedia to find the names of researchers or theories that
are important to the topic, then, search for those names on the
library website. Use keywords when research of your topic in
databases (example: cyber warfare or cyber attack) to find
related articles and books. Need help? Ask A Librarian.
Anytime you summarize what someone else has said, include
the author’s last name and year either in the text or in
parentheses at the end. If you quote someone else, include the
author’s last name, year, and page number either in the text or
in parentheses at the end. If an article has three to five authors,
write their last names out the first time, then cite only the first
author’s last name followed by “et al.” If an article has six or
more authors, include only the first author’s last name followed
by “et al.” If the source does not have an author, such as a
website, put the name of the article or webpage in parentheses
at the end.
The whole point of in-text citations is so your reader can find
the correct source in your References, so make sure authors or
titles match both in-text and in References. Find out more about
in-text citation on the Hagan Memorial Library Citation Help
page.
Business sources are not standard APA citations; See Purdue
Owl for more information.
Discussion
The discussion should be the largest part of your paper and
include your argument, research, and experiences (for example,
through Service-Learning). Each main point of your paper

3. should start its own paragraph with a strong first sentence.
Again, do not use I or you in academic writing.
Remember to introduce quotations with who said it and/or why
it’s important. Make sure quotes fit seamlessly in your paper.
Include short quotations (40 words or less) in-text with
quotation marks. Use ellipsis (...) when omitting sections from a
quote and use four periods (....) if omitting the end section of a
quote.
This is a longer quote, which is 40 or more words. Indent the
quote a half-inch from the left margin and double-space it with
no quotation marks. To get the right format, just click on
“Quote” in the Styles area on the Word frame above. In
parentheses, include the author’s last name, year, and page
number.
Conclusion
The conclusion restates the thesis and summarizes the main
arguments or points of the article, so that your reader could just
read the conclusion to generally understand the paper. What is
important to learn from reading your paper? If you know of
areas in this topic that need further study, mention them. After
this paragraph, there is a page break that forces References onto
its own page: You will want to keep it there.
References
American Psychological Association. (year). Article title. Name
of Journal, volume, pages.
Author(s). (year). Book title. Where published: Publisher.
Retrieved from URL of book
Author(s) of essay or chapter. (year). In Author (Ed.), Book
title (pages of essay or chapter). Where published: Publisher.
Retrieved from URL of chapter or essay
Freud, S. (year). Article title. Name of Journal, volume (issue),
pages. Retrieved from journal URL
Jung, C., & Freud, S. (year). Article title. Name of Journal,

4. volume (issue), pages. Retrieved from article URL if poor
navigation on site
Neu, J, Lakoff, R., Kamin, J., Green, P. Lessig, L., Brody, E.,
… Prinzker, T. (year). Book title (edition if given). Where
published: Publisher.
Pavlov, I., Jung, C., & Freud, S. (year of last update). Web page
title. Retrieved from URL of Web page
Skinner, B. F. (year). Article title. Name of Journal, volume,
pages. doi:xx.xxxxxxxxxx
ISOL 536
Security Architecture and Design
Threat Modeling
Session 3
“What Can Go Wrong?”
Agenda
• STRIDE (in depth!)
• Reading: Chapter 3
Approach
• “What can go wrong” & “what to do about it”
are often (and reasonably) tied together in
practice

5. • This course splits them because they are
distinct questions & skills
Security mavens Experts in
other areas
STRIDE Trees Libraries
STRIDE
STRIDE Agenda
• Recap: A mnemonic for finding threats
• Details as examples
• Variants
STRIDE (review)
Threat Property
Violated
Definition Example
Spoofing Authentication Impersonating
something or someone
else.
Pretending to be any of Bill Gates, Paypal.com or
ntdll.dll

6. Tampering Integrity Modifying data or code Modifying a DLL
on disk or DVD, or a packet as it
traverses the network
Repudiation Non-repudiation Claiming to have not
performed an action.
“I didn’t send that email,” “I didn’t modify that
file,” “I certainly didn’t visit that web site, dear!”
Information
Disclosure
Confidentiality Exposing information
to someone not
authorized to see it
Allowing someone to read the Windows source
code; publishing a list of customers to a web
site.
Denial of Service Availability Deny or degrade
service to users
Crashing Windows or a web site, sending a
packet and absorbing seconds of CPU time, or
routing packets into a black hole.

7. Elevation of Privilege Authorization Gain capabilities
without proper
authorization
Allowing a remote Internet user to run
commands is the classic example, but going
from a limited user to admin is also EoP.
Spoofing
By Lego Envy,
http://www.eurobricks.com/forum/index.php?showtopic=64532
Spoofing On the Local Machine
Threat Example What the Attacker Does Notes/Examples
Spoofing a process Creates a file before the
real process
Then your process relies on
it
Abuses names Create a version of “sudo”
and alter PATH
Spoofing a filename Creates a file in the local
directory

8. Library, executable or
config file
Creates a link, changes it Also called ‘race condition’
or TOCTOU
Creates many files in a
target directory
Code can easily create all
possible /tmp/foo.random
Spoofing Over a Network
Threat Example What the Attacker Does Notes/Examples
Spoofing a machine ARP spoofing
IP spoofing
DNS spoofing
DNS compromise Can be at the TLD, registrar
or DNS server
IP redirection
Spoofing a person Take over account “Stranded in London”
Set the display name
Spoofing a role Declares themselves to be
that role

9. Sometimes opening a
special account, setting up
a domain/website, other
“verifiers”
Tampering
http://pinlac.com/LegoDSTractorBeam.html
Tampering with a File
Threat Example What the Attacker Does Notes/Examples
Modifying a file… … which you own and you
rely on
… which they own and you
rely on
Modifying a file on a
server…
…you own
…they own (or take over)
Modifies links or redirects Redirects are super-
common on the web, and
often rot away

10. Tampering with Memory
Threat Example What the Attacker Does Notes/Examples
Modifying code Changes your code to suit
themselves
Hard to defend against if
the attacker is running
code inside the trust
boundaries
Modifying data they’ve
supplied
Supplies data to a pass by
reference API, then
changes it
Works because of TOCTOU
issues
Supplies data into a shared
memory segment, then
changes it
Tampering with a Network
Threat Example What the Attacker Does Notes/Examples
Redirects the flow of data
to their machine
Uses an attack at some

11. network layer to redirect
traffic
Pakistan/YouTube
Modifies data flowing over
the network
Easier (and more fun) with
wireless networks
Uses network tampering to
improve spoofing attacks
RepudiationRepudiation
By Seb H
http://www.flickr.com/photos/[email protected]/8531040850/
Repudiation
Threat Example What the Attacker Does Notes/examples
Repudiating an action Claims to have not
clicked
Maybe they did, maybe they
didn’t, maybe they’re honestly
confused
Claims to not have
received

12. 1. Electronic or physical
2. Receipt is strange; does a client
downloading email mean you’ve
seen it? Did a network proxy pre-
fetch images? Was a package left
on a porch?
Claims to be a fraud
victim
Uses someone else’s
account
Repudiation Attacks on Logs
Threat Example What the Attacker Does Notes/Examples
Discovers there are no logs
Modifies data flowing over
the network
Puts data in the logs to
confuse you
</tr></html>
Information Disclosure

13. Photo by Simon Liu http://www.flickr.com/photos/si-
mocs/6999508124/
Information Disclosure
(and impact)
Information Disclosure (Processes)
Threat Example What the Attacker Does Notes/Examples
Extracts user data Exploits bugs like SQL
injection to read db tables
Can find this by looking to
data stores, but here the
issue is the process
returning data it shouldn’t
Reads error messages
Extracts machine secrets Reads error messages Cannot connect
to
database ‘foo’ as user ‘sql’
with password ‘&IO*(^&’
Exploits bugs “Heartbleed”
Information Disclosure (Data
Stores)
Sub-category What the Attacker Does

14. Permissions Take advantage of missing or inappropriate ACLs
Take advantage of bad database permissions
File files protected by obscurity
Security Find crypto keys on disk or in memory
Get data from logs/temp files
Get data from swap files
See interesting information in filenames/directory names
Network See data traversing a network
Misc Obtain device, boot in new OS
Information Disclosure (Data Flow)
Sub-category What the Attacker Does
Network Read data on a network
Redirects traffics to enable reading data on the network
Metadata Learns secrets by analyzing traffic
Learns who talks to whom by watching the DNS
Learns who talks to whom by analyzing social network
information

15. Denial of Service
Model by Nathan Sawaya
http://brickartist.com/gallery/han-solo-in-carbonite/
Denial of Service
Threat Example What the Attacker Does Notes/Examples
Against a process Absorb memory (ram or disk)
Absorb CPU
Uses a process as an amplifier
Against business logic “Too many login
attempts”
Against a data store Fills the data store
Makes enough requests to slow the
system
Against a data flow Consumes network resources
Can be temporary or
persistent
Elevation of Privilege
http://www.flickr.com/photos/prodiffusion/

16. Elevation of Privilege (“EoP”)
Threat Example What the Attacker Does Notes/Examples
EoP Against process via
corruption
Sends inputs the code
doesn’t handle properly
Very common, usually high
impact
Gains read/write access to
memory
Writing memory more
obviously bad
EoP via misused
authorization checks
EoP via buggy
authorization checks
Centralizing checking
makes consistency,
correctness easier
EoP via data tampering Modify bits on disk

17. STRIDE Variants
• Ways to focus on likely threats
– STRIDE per element
– STRIDE per interaction
• Elevation of Privilege game
– Training, structure and execution
– DESIST
– Dispute
– Elevation of Privilege
– Spoofing
– Information Disclosure
– Service Denial
– Tampering
Spoofing Tamper. Rep. Info.Disc. DoS EoP
Process
Data Store
Dataflow
External Entity

18. STRIDE per Element
This is Microsoft’s chart; it may not be the issues you need to
worry about (privacy)
Next up …
• Attack trees (chapter 4)
• Attack libraries (chapter 5)