slides from OWASP EEE 2015 talk

1. Introduction to
threat modeling
OWASP EEE 2015

2. About me
Audrius Kovalenko | @slicklash
NOT Computer Security Expert
Just a developer

3. Prelude

4. Princess
in your possession

5. You’ve built a castle
for a princess

6. Thieves
want to take her away

7. Your castle has a weakness
“dead” zones

8. You guard them
mitigation

9. Threat modeling
software project

10. What are you building?
data flow diagram

11. Decomposition
roles
User Roles
Name Description Authentication
Admin Administrators have complete and unrestricted access to Notices, Partner Accounts and Logs. Windows
Partner Partners can create, read and update Notices. Basic
User Users can read and update Notices. Forms
Service Roles
Name Description Authentication
APP Role Identity APP is running as. Windows Integrated (ApplicationPoolIndentity)
SVC Role Identity SVC is running as. Windows Integrated (Local System)
MSMQ Role Identity MSMQ is running as. Windows Integrated (Network Service)

12. Decomposition (2)
components
Components
Name Roles Type Run As Communication Channel Technology Uses
APP Admin
User
Website APP Role HTTPS C#, ASP.NET MVC 5 Cryptography,
File I/O
API Partner Website API Role HTTPS C#, ASP.NET MVC 5 Cryptography,
File I/O
SVC MSMQ Windows
Service
SVC Role TCP/IP C# Cryptography,
File I/O

13. Decomposition (3)
data
Data
Name Description Data Elements Data Stores
Form Defines structure of a Notice Fields Database
Access Control
Role Access Control Remarks
Admin C R U D
Partner R Limited information. Form must be published.
User

14. What can go wrong?
card games

15. What can go wrong? (2)
checklists
CAPEC
https://capec.mitre.org/data/index.html
OWASP ASVS
https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification...
OWASP AppSensor
https://www.owasp.org/index.php/AppSensor_DetectionPoints

16. How to prioritize?
convert threat to risk
Risk
Loss event
frequence
Loss
magnitude
Threat event
frequence
prob. Threat agent actions
result in loss

17. How to mitigate?
raise the cost
Time
Skills
Money
etc.
capability

18. How to make it work for you?
Practice
Experience
Reflection
Theory
find your own way

19. Books
FAIR STRIDE PASTA

20. Resources
OWASP Cornucopia
https://www.owasp.org/index.php/OWASP_Cornucopia
EoP Card Game
https://www.microsoft.com/en-us/SDL/adopt/eop.aspx
STRIDE
http://blogs.microsoft.com/cybertrust/2007/09/11/stride-chart
FAIR
http://www.risklens.com/what-is-fair
SAFECode
http://www.safecode.org/publications

21. QA