This document discusses the importance of threat modeling and security testing. It recommends starting threat modeling early in the development process when writing user stories. Threat modeling involves identifying threats, vulnerabilities, assets, and trust boundaries. Common threats like spoofing, tampering and information disclosure should be considered. Threat modeling should be automated and included in the definition of done and continuous integration pipelines. Security testing tools can help identify vulnerabilities and should be used to complement threat modeling. Retrofitting security involves prioritizing risks and dealing with critical issues first.

1. Be your own
Threatbuster!
Natalia Oskina,
Giovanni Asproni

2. It is not just about banks!
We do a hard job to make systems work,
but, often, do not have time to think about an important aspect . . .
What impact?
● Cost
● Reputational damage
Security!
● Legal
● Missed deadlines

3. It is not just about banks!
Think if it was your data
● Credit cards
● Medical data
Internal threats are even riskier than external ones.
You are defending against bad people no matter where they are
● Financial data
● Addresses
● Phone numbers

4. It is not just about banks!

5. “
“Security is an aspect of
reliability that most
customers expect and
all customers want”

6. It is about the law
● GDPR
● Nis regulation

7. How big is the problem?
2018 only...
1) 1.1 billion records breached, Aadhar, January 3
2) 340 million records breached, Exactis, June 26
3) 150 million records breached, Under Armour, May 25
4) 92 million records breached, MyHeritag, June 4
5) 87 million (at least) records breached (though likely many more), Facebook, March 17
6) 37 million records breached, Panera, April 2
7) 27 million records breached, Ticketfly, June 7
8) 19.5 million records breached, Sacramento Bee, June 7
9) 6 million records breachedm PumpUp, May 31
10) 3, 5 million records breached, Saks, Lord & Taylor, April

8. How big is the problem?
2018 only...
http://breachlevelindex.com/

9. How big is the problem?
2018 only...
http://breachlevelindex.com/

10. Can security be retrofitted?
● It is not easy. Can be impossible in
complicated systems
● It is expensive
Security is a system quality, not a feature

11. How should we start?
● You are not aiming for 100% security
System considered to be secure when the cost
of hacking is higher than the value of data
● Start early
● Start when writing user stories

12. How should we start?
Threat modelling is a risk assessment of the application.
Introduce Threat Modelling for every story in your
backlog!

13. How should we start?
Threat: What an adversary may try to do to
the system
Vulnerability: Security flaw in the system
that an adversary can use to realize the
threat

14. 1.
Know what you are building!
● Entry points
● Trust levels
● Assets
● Trust boundaries

15. 2.
Know what can go wrong (STRIDE)
Spoofing
Authenticity
Tampering
Integrity
Repudiation
Non-repudiability
Information -
disclosure
Confidentiality
Denial of
Service
Availability
Elevation of
privilege
Authorization

16. 3.
How to model a threat?
Bring service down
Internet access is
down
Service is shut
down
DoS attack Get root access
Access to port 21
Exploit FTP
vulnerability

17. 4.
Document it
Microsoft Threat Modelling Tool

18. Trade offs
Effort
Impact
1 2
3

19. What is definitely needed?
Start from low effort, high impact things:
● Encrypt communication channels ( Https, MQTTs...)
● Hash passwords
● Encrypt sensitive data
● Do not log security sensitive data. No passwords!
● Do not put your production credentials ...
In your GIT repository...

20. Validate your inputs!
What is definitely needed?

21. Encrypt in tests
● No self-signed certificates in production
● When testing, test with HTTPS
● Use Let’s encrypt . It is easy and….free….
Hope you are already using HTTPS in production …

22. Encrypt in tests
● But it is slow...isn’t? No, it isn’t!
https://www.httpvshttps.com/
● Be careful with GET requests

23. It is not just about the software
● Log off your laptop!
● How and where you deploy it?
● How will your software be used?

24. So, is threat modelling good?
Yes:
● It is a practical view of potential attackers
● If started early it will help you create a more secure system

25. So, is threat modelling good?
Are there any disadvantages?
● You may miss some weaknesses
● Good threat modelling sessions don’t make good software on their
own
“Complex systems break in complex ways”
Peter G. Neumann

26. Make it a part of your development
● Start from the very beginning
● Make it a part of your development
● Make it a part of your Definition Of Done
● Software itself can have vulnerabilities. It is more than
Threat modelling
● Catch security flaws before something else is built on top
● Do code inspections. Regularly!
● Have a security champion Be your own security champion!

27. Isn’t it boring?
Automate it. There are tools for that:
○ SonarQube
○ Contrast
○ Detestify
○ Acunetix
○ Clair
○ SSLlabs
○ Sysdig
○ Mozilla Observatory
○ Scan My Server
○ Sucuri
○ https://github.com/docker/docker
-bench-security

28. Automate it!
Automate security testing in your CI pipeline with every commit

29. Be careful!
● Think about dependencies of dependencies
● Check it in Common Vulnerabilities and Exposures https://cve.mitre.org
● Don’t implement security libraries yourself!
● Use trusted libraries
● The same with Docker. Check Dockerhub

30. What should I do … to retrofit security?
● Use reporting tools (e.g., SonarQube)
● Deal with the critical risks first
● Prioritise risks and put bugs in stories
● When fixing a bug, write tests for it. Make them part of your
integration testing
If you do that, you haven’t been listening…

31. penetration testing has a goal - get into your system
It is ethical hacking
To find vulnerabilities to remove (or mitigate)
Anyone in this room can do a vulnerability check!
Penetration testing
It is a complement to threat modelling and testing
often confused with vulnerability checks

32. Summing up
● No system is 100% secure
● Think about the potential risks
● Thinking about security won’t guarantee you will catch every issue
but you will be in a much better position

33. Effort
Impact
1 2
3
Summing up

34. Summing up
● Make it part of your development
● Security is a system quality, not a feature
● Think about security as a whole
● It is not just about your software

35. Thank you!
...for your data ;P
@Gasproni giovanni.asproni@zuhlke.com @CurlyN natalia.oskina@zuhlke.com
Any questions?