Downloaded 10 times
![(without introducing more risk)
$ curl -s https://api.github.com/users/<username>/events/public
| jq '.[].payload.commits[0].author.email'
| sort
| uniq
| grep -v "null"
Email from GitHub user](https://image.slidesharecdn.com/thinkingevilthoughts-160905083401/85/Thinking-Evil-Thoughts-74-320.jpg)
Uploaded byGareth Rushgrove
Thinking Evil Thoughts
This document discusses threat modeling and how to properly scope security assessments. It provides examples of how threat modeling can be applied, including getting the full scope of the system correct and identifying risks. The document warns that developer laptops and conferences pose security risks and outlines some mitigation approaches like two-factor authentication and separation of duties. The overall message is that modern development approaches require keeping security top of mind.
More Related Content
Similar to Thinking Evil Thoughts
![[DSBW Spring 2009] Unit 08: WebApp Security](https://cdn.slidesharecdn.com/ss_thumbnails/unit08-web-security-090513110418-phpapp02-thumbnail.jpg?width=640&height=640&fit=bounds)
Thinking Evil Thoughts
- 1. (without introducing morerisk) Thinking Evil Thoughts Puppet Gareth Rushgrove A taste of threat modeling
- 2. (without introducing morerisk) @garethr
- 3. (without introducing morerisk) Gareth Rushgrove
- 4. (without introducing morerisk) This Talk What to expect
- 5. - What isthreat modeling? - Getting the scope right - Identifying risks - Using conferences to hack people Gareth Rushgrove
- 6. Introduce some securitylanguage to help you navigate the domain Gareth Rushgrove
- 7. Dive straight intoexamples Gareth Rushgrove
- 8. Empower you toask questions more than provide easy answers Gareth Rushgrove
- 9. (without introducing morerisk) Threat modeling A brief introduction
- 10. Gareth Rushgrove a procedurefor optimizing network security by identifying objectives and vulnerabilities THREAT MODELING
- 11. - Determine scope -Identify threat agents and attacks - Understand existing countermeasures - Identify vulnerabilities - Prioritise risks - Identify countermeasures Gareth Rushgrove https://www.owasp.org/index.php/Category:Threat_Modeling
- 12. Inside each ofus, there is the seed of both good and evil. It's a constant struggle as to which one will win. Gareth Rushgrove “ ”Eric Burdon
- 13. (without introducing morerisk) Think evil.
- 14. (without introducing morerisk) Getting the scope rights Avoiding gaps in your threat model
- 15. Ignoring part ofyour system when considering security is a common mistake Gareth Rushgrove
- 16. Gareth Rushgrove the attacksurface of a software environment is the sum of the different points (the "attack vectors") where an unauthorized user (the "attacker") can try to enter data to or extract data from an environment. ATTACK SURFACE
- 17. (without introducing morerisk) Example What is Production? Gareth Rushgrove
- 18. LOAD BALANCER FRONT END BACKEND DATABASE PRODUCTION?
- 19. LOAD BALANCER FRONT END BACKEND DATABASE PRODUCTION? PEOPLE DESKTOPS CI SERVER
- 20. LOAD BALANCER FRONT END BACKEND DATABASE PRODUCTION? PEOPLE DESKTOPS CI SERVER HYPERVISOR MANAGEMENT MONITORING
- 21. Do you protectyour CI stack as well as your production database? Gareth Rushgrove
- 22. Could I executea query on your production database if I compromised your CI server? Gareth Rushgrove
- 23. Example Third party services GarethRushgrove
- 24. Gareth Rushgrove an entitywhich facilitates interactions between two parties who both trust the third party TRUSTED THIRD PARTY
- 25. Gareth Rushgrove a termin computer science and security used to describe a boundary where program data or execution changes its level of "trust". The term refers to any distinct boundary within which a system trusts all sub-systems (including data). TRUST BOUNDARY
- 26.
- 27. Why Serverless isa bad name Gareth Rushgrove
- 28. (without introducing morerisk) There are still servers somewhere Gareth Rushgrove
- 29. How you thinkabout the servers changes, and the respective risks and mitigations change. But servers still exist. Gareth Rushgrove
- 30. Why NoOps isa bad name Gareth Rushgrove
- 33. How you thinkabout operations changes, and the respective risks and mitigations change. But operations still exist. Gareth Rushgrove
- 34. Your attack surfaceis bigger than you think Gareth Rushgrove
- 35. (without introducing morerisk) Identifying risks The need to understand your system
- 36. Differences in howyou perceive a system and how it actually works can be used to exploit it Gareth Rushgrove
- 37.
- 38. Out systems areimmutable, we don’t need runtime file integrity checking Gareth Rushgrove “ ”A possibly naive developer
- 39. Gareth Rushgrove unchanging overtime or unable to be changed. synonyms: unchangeable, fixed IMMUTABLE
- 40. (without introducing morerisk) Containers are not immutable by default Gareth Rushgrove
- 41. (without introducing morerisk) Containers are not immutable by default Gareth Rushgrove
- 42. (without introducing morerisk) Gareth Rushgrove $ docker run -d alpine /bin/sh -c "while true; do echo hello world; sleep 1; done"
- 43. (without introducing morerisk) Gareth Rushgrove $ docker exec a7a01beb14de touch /tmp/surprise
- 44. (without introducing morerisk) Gareth Rushgrove $ docker diff a7a01beb14de C /tmp A /tmp/surprise
- 45. (without introducing morerisk) Gareth Rushgrove $ docker run --read-only -d alpine /bin/sh -c "while true; do echo hello world; sleep 1; done"
- 46. (without introducing morerisk) Gareth Rushgrove $ docker exec 379150b2cf05 touch /tmp/surprise touch: cannot touch '/tmp/surprise': Read-only file syste
- 47. (without introducing morerisk) Do your immutable EC2 instances have read-only filesystems? Gareth Rushgrove
- 48. (without introducing morerisk) Most Immutable Infrastructure isn’t Gareth Rushgrove
- 49. (without introducing morerisk) Without technical controls you only have social guarantees of immutability Gareth Rushgrove
- 50. (without introducing morerisk) Hacking conferences Looking for vulnerabilities
- 51. Let’s assume yourapplications and infrastructure are super secure* Gareth Rushgrove * This probably isn’t true. You should worry about that as well.
- 52. - Penetration testing -Intrusion detection system - Web application firewall - Network firewalls - Malware scanning - Configuration management Gareth Rushgrove
- 53. Gareth Rushgrove How secureis your laptop?
- 54. - Hand maintainedconfiguration - Updated whenever - No central monitoring - Administrative access - Single factor authentication Gareth Rushgrove
- 55. Can you pushnew Docker images from your laptop? Gareth Rushgrove
- 56. Can you createjobs on your Jenkins instance from your laptop? Gareth Rushgrove
- 57. Can you launchnew replication controllers from your laptop? Gareth Rushgrove
- 58. Can you releasenew functions to Lambda from your laptop? Gareth Rushgrove
- 59.
- 60. (without introducing morerisk) As a hacker how do I own your laptop? The fun stuff
- 61. Where can Ifind hundreds of developer laptops… Gareth Rushgrove
- 62. Developer Conferences area Target Rich Environment Gareth Rushgrove
- 63. Gareth Rushgrove More Internet SomeInternet Marks iPhone FREE CONFERENCE WIFI Hacked Android CONFERENCE VENUE Private Software Circus Company next door Coffee shop downstairs Software Circus II Docker Corp Avengers Tower FON My Blackberry Nokia4ever ABANK
- 64. Gareth Rushgrove More Internet SomeInternet Marks iPhone FREE CONFERENCE WIFI Hacked Android CONFERENCE VENUE Private Software Circus Company next door Coffee shop downstairs Software Circus II Docker Corp Avengers Tower FON My Blackberry Nokia4ever ABANK This is the official conference wifi right?
- 65. Gareth Rushgrove More Internet SomeInternet Marks iPhone FREE CONFERENCE WIFI Hacked Android CONFERENCE VENUE Private Software Circus Company next door Coffee shop downstairs Software Circus II Docker Corp Avengers Tower FON My Blackberry Nokia4ever ABANK Or is it this one? Whatever, both work
- 66. Devices exist toman-in-the-middle wireless networks Gareth Rushgrove
- 67. Who has everpicked up a USB memory stick at a conference? Gareth Rushgrove
- 68.
- 69. USB devices existwhich will run a script on connect (normally by impersonating a keyboard) Gareth Rushgrove
- 70. (without introducing morerisk) DELAY 1000 COMMAND SPACE DELAY 500 STRING Terminal DELAY 500 ENTER DELAY 800 STRING echo 'RSA_PUB_ID' >> ~/.ssh/authorized_keys ENTER DELAY 1000 STRING killall Terminal ENTER Add my public key https://github.com/hak5darren/USB-Rubber-Ducky/wiki/Payload---OSX-Passwordless-SSH-access-%28ssh-keys%29
- 71.
- 72. Lots of peoplehere are on Twitter and using the conference hashtag Gareth Rushgrove
- 73. Lots of peoplehere are on GitHub with the same username Gareth Rushgrove
- 74. (without introducing morerisk) $ curl -s https://api.github.com/users/<username>/events/public | jq '.[].payload.commits[0].author.email' | sort | uniq | grep -v "null" Email from GitHub user
- 75. an e-mail spoofingfraud attempt that targets a specific organization or individual, seeking unauthorized access to confidential data. Gareth Rushgrove SPEAR PHISHING
- 76. Hi <your name> Greatto see you at <conference name here> last week. I thought you’d be interested in the container testing tool I mentioned. http://nothingevilhere.com. Would love to know what you think. Hopefully see you at DockerCon next year too.
- 77. (without introducing morerisk) So you’re saying we’re all doomed? This is quite depressing now I think about it
- 78. Part of threatmodeling is coming up with suitable mitigations to the risks identified Gareth Rushgrove
- 79. - 2 factorauthentication - Time-limited credentials - Separation of duties - Two person rule - Configuration management Gareth Rushgrove
- 80. having more thanone person required to complete a task. In business the separation by sharing of more than one individual in one single task is an internal control intended to prevent fraud and error. Gareth Rushgrove SEPARATION OF DUTIES
- 81. a control mechanismdesigned to achieve a high level of security for especially critical material or operations. Under this rule all access and actions requires the presence of two authorized people at all times. Gareth Rushgrove TWO-PERSON RULE
- 82. Gareth Rushgrove a processthat identifies critical information to determine if friendly actions can be observed by enemy intelligence and determines if information obtained by adversaries could be interpreted to be useful to them. OPERATIONAL SECURITY (OPSEC)
- 83. Once you understandthe threat you can seek out specific guidance Gareth Rushgrove
- 85. - Protect datain transit - Protect data at rest - Authentication - Secure boot - Platform integrity and sandboxing - Application whitelisting Gareth Rushgrove - Malicious code detection - Security policy enforcement - External interface protection - Device update policy - Event collection and analysis - Incident response https://www.cesg.gov.uk/guidance/end-user-devices-security-principles
- 86.
- 87.
- 88. (without introducing morerisk) Conclusions If all you remember is…
- 89. With Cloud Nativeapproaches developers are nearer to production than ever before Gareth Rushgrove
- 90. The efficiency ofmodern tooling introduces new threats, and magnifies existing ones Gareth Rushgrove
- 91. Existing mitigations andsecurity controls won’t be enough. You need to collaborate with security colleagues on new approaches Gareth Rushgrove
- 92. Threat modeling shouldbe part of your development process Gareth Rushgrove
- 93.
- 94.
- 95.
- 96. (without introducing morerisk) Thanks And any questions?