Application Security Architecture and Threat Modelling

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Ad

Security Architecture and
Threat Modelling
Nilanjan De
Devesh Bhatt

95% of attacks
are against “Web
Servers and Web
Applications”

Average 35
No of vulnerabilities in a
website
52%of data
breaches happen through Web
Applications
of Application
has atlea...

Security Architecture and
SDLC

USER AGENTS
User Agent / Client.
Browser, BOT,
Program Sends
Requests like GET,
POST, HEAD, PUT,
DELETE
WEB SERVERS
● Web ...

Web App Architecture – Data View
Web
Client Data Store
Web Server
Trusted
Code
Running on
server
Web
Service
Un-trusted In...

Would you trust the code?
Operating System and Shell
Web Server + Interpreter
(PHP/ASP.net)
Trusted Code

Traditional SDLC
It’s too late!!
We won’t meet our security standards..
Production
Deadline
Development + QA
Pen Testing
1...

Secure SDLC
Production
Deadline
Development + QA + Security
Pen Testing
12 Vulnerabilities
Security is implemented during ...

Enabling S-SDLC
Source
Repository
Build
Management
System
Static Analysis
Tool
Team City
Jenkins
Hudson
Bamboo
TFS
SVN
GIT...

Cost to find/fix a
defect during
integration/system
test is 15-90 times
higher than at
design/coding
Time &
Cost
Code Insp...

SAST vs. DAST
 Dynamic Application Security Testing (DAST)
- Can be performed only at the end of dev.
- More layers cover...

SAST vs. DAST
 So what is better, DAST or SAST?
 For good security both SAST and DAST are
necessary and complete each ot...

SAST Scanning
 SAST vendors scan binaries
- Need compilation environment
- Need compliable code..  have to wait
 SAST v...

Threat Modelling

Threat Modelling

Common Types of Attack
Connection Fails
Organizational
Attacks
Restricted Data
Accidental Breaches
in Security
Automated
A...

Types of Threats
Spoofed packets, etc.
Buffer overflows, illicit paths, etc.
SQL injection, XSS, input tampering, etc.
Net...

Threats Against the Network
Threat Examples
Information gathering Port scanning
Using trace routing to detect network topo...

Threats Against the Host
Threat Examples
Arbitrary code execution Buffer overflows in ISAPI DLLs (e.g., MS01-033)
Director...

Threats Against the Application
Threat Examples
SQL injection Including a DROP TABLE command in text typed
into an input f...

Threat Modeling
 Structured approach to identifying, quantifying, and
addressing threats
 Essential part of development ...

The Threat Modeling Process
Identify assets
Document architecture
Decompose application
Identify threats
Document threats
...

Identifying Assets
 What is it that you want to protect?
 Private data (e.g., customer list)
 Proprietary data (e.g., i...

Documenting Architecture
 Define what the app does and how it's used
 Users view pages with catalog items
 Users perfor...

Example
Bob
Alice
Bill
Asset #4
Asset #1 Asset #2 Asset #3
Asset #5 Asset #6
IIS ASP.NET
Web Server
Login
State
Main
Datab...

Decomposing the App
 Refine the architecture diagram
 Show authentication mechanisms
 Show authorization mechanisms
 S...

Example
Bob
Alice
Bill
IIS ASP.NET
Web Server Database Server
Trust
Forms Authentication URL Authorization
DPAPI Windows A...

Identifying Threats
 Method #1: Threat lists
 Start with laundry list of possible threats
 Identify the threats that ap...

STRIDE
S
T
R
I
D
Tampering
Repudiation
Information disclosure
Denial of service
Can an attacker gain access using a false ...

Documenting Threats
Theft of Auth Cookies by Eavesdropping on Connection
Threat target Connections between browsers and We...

Rating Threats
 Simple model
 DREAD model
 Greater granularization of threat potential
 Rates (prioritizes) each threa...

DREAD
D
R
E
A
D
Reproducibility
Exploitability
Affected users
Discoverability
What are the consequences of a successful ex...

Example
Threat D R E A D Sum
Auth cookie theft (eavesdropping) 3 2 3 2 3 13
Auth cookie theft (XSS) 3 2 2 2 3 12
Potential...

 Produce software that’s secure by design
 Improve designs the same way we’ve improved code
 Because attackers think di...

Diagram Elements - Examples
•People
•Other systems
•Microsoft.com
•etc…
•Function call
•Network traffic
•Etc.…
•DLLs
•EXEs...

 Add trust boundaries that intersect data flows
 Points/surfaces where an attacker can interject
 Machine boundaries, p...

 Context Diagram
 Very high-level; entire component / product / system
 Level 1 Diagram
 High level; single feature / ...

Castle
Service
Local
User
Castle Config
Feedback
Join/Leave
Castle
Remote
Castle
A Real Context Diagram

Castle
Service
Explorer
(or rundll32)
SSDP SSDP
Remote
Castle
Service
Registry
LSA
SAM
Local User
Shacct
Get acct info
Fee...

Understanding the threats
Threat Property Definition Example
Spoofing Authentication Impersonating
something or
someone el...

Different threats affect each type of element
Process
Data Store
S T R I D E
 
     
  
  
Element
?
Dataflo...

Castle
Service
Explorer
(or rundll32)
SSDP SSDP
Remote
Castle
Service
Registry
LSA
SAM
Local User
Shacct
Get acct info
Fee...

 Address each threat
 Four ways to address threats:
 Redesign to eliminate
 Apply standard mitigations
 Invent new mi...

 Validate the whole TM
 Does diagram match final code?
 Are threats enumerated?
 Minimum: STRIDE per element that touc...

End exercise

 Uncover Security Design Flaws Using the STRIDE Approach
http://msdn.microsoft.com/msdnmag/issues/06/11/ThreatModeling/de...

Something to think about
Password analysis from the rockyou.com data revealed
 The most common password was; 123456
 30%...

Thank You!!

Share Slideshare

LinkedIn
Facebook
Twitter

Embed

Size (px)

Show related Slideshows at end

WordPress Shortcode

Link

Share
Email

Network Forensics and Practical Pac... by Priyanka Aash 5596 views
Practical Applications of Block Cha... by Priyanka Aash 11750 views
SOC Architecture - Building the Nex... by Priyanka Aash 4914 views
Security Strategy and Tactic with C... by Priyanka Aash 4120 views
Workshop on Endpoint Memory Forensics by Priyanka Aash 2492 views
Enterprise Security Architecture by Priyanka Aash 2496 views

View on Slideshare

1 of 50 Ad

View on Slideshare

1 of 50 Ad