Threat Modeling for Dummies
•
1 like•272 views
The document discusses threat modeling and provides an overview of the threat modeling process. It describes documenting assets and entry points, identifying threats using techniques like STRIDE and attack trees, assessing risk with DREAD, and resolving threats by mitigating them in stages from quick reductions to complete mitigation. An example threat of an insider attack on a database is analyzed in detail. The document concludes by recommending starting with the OWASP Top 10, incorporating threat modeling into the SDLC, and improving skills through resources like books and games.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to Threat Modeling for Dummies
Similar to Threat Modeling for Dummies (20)
More from Adam Englander
More from Adam Englander (20)
Recently uploaded
Recently uploaded (20)
Threat Modeling for Dummies
- 1. @adam_englander Building Secure Applications: Threat Modeling for Dummies Adam Englander Manager of Engineering, TransUnion
- 2. @adam_englander What Are We Going to Cover • An overview of threat modeling • The process of threat modeling • Some common tools to assist you • An example from start to finish • Action items for now, near future, and beyond
- 3. @adam_englander What is threat modeling?
- 4. @adam_englander –Wikipedia “Threat modeling is a process by which potential threats … can be identified, enumerated, and prioritized – all from a hypothetical attacker’s point of view.”
- 5. @adam_englander –Wikipedia “Threat modeling is a process by which potential threats … can be identified, enumerated, and prioritized – all from a hypothetical attacker’s point of view.”
- 7. @adam_englander Document All the Things!
- 8. @adam_englander Map Out Your Application
- 9. @adam_englander Internet Internal DMZ System: Big Picture Firewall Load Balancer MySQL MySQL App Server Firewall DNS SMTPCDN Alerting Stats Bastion Logs Consumer Payment CA
- 10. @adam_englander Process: Microscope User Logs In Views Product Catalog Adds Item to Cart Initiates Checkout Confirms Billing Info Selects Payment Method Confirms Shipping Info/ Method Confirmation Email Sent Payment Authorized
- 11. @adam_englander Identify Assets Commerce Site DB Credentials SMTP Credentials Payment GW Creds Encryption Keys SSL Certs SSL Private Keys Access to SMTP Database Cust Emails Cust Billing Data Cust PII Payment Data Order History User Credentials User Emails Shopping Carts Sessions Inventory/Pricing Transaction Logs SMTP DKIM Creds Mail Logs Payment Gateway Purchase History Charge/Refund Authority Log Server Raw Logs Host Names Stack Traces Client IPs User Behavior Internal Network DB Admin Creds Hosting Creds DNS Admin Creds Payment GW Admin Creds Encryption Keys SSL Certs SSL Private Keys
- 12. @adam_englander Identify Entry Points Firewall App Server Database HTTPS Unrestricted Internal Network Internet Firewall
- 13. @adam_englander Identify Entry Points Firewall App Server Database HTTPS Unrestricted Internal Network Internet Firewall
- 14. @adam_englander Identify Entry Points Firewall App Server Database HTTPS Unrestricted Internal Network Internet Firewall
- 15. @adam_englander Identify Entry Points Firewall App Server Database HTTPS Unrestricted Internal Network Internet Firewall
- 17. @adam_englander Out-of-Band Dependencies CI/CD Server Library RepositoryCode Repository Configuration Management Build Tools 3rd Party Code 3rd Party Libraries
- 18. @adam_englander Internet Internal DMZ Critical Dependencies Firewall Load Balancer MySQL MySQL App Server Firewall DNS SMTPCDN Alerting Stats Bastion Logs Consumer Payment CA
- 19. @adam_englander Internet Internal DMZ Secondary Dependencies Firewall Load Balancer MySQL MySQL App Server Firewall DNS SMTPCDN Alerting Stats Bastion Logs Consumer Payment CA
- 22. @adam_englander What about fully mitigated threats?
- 23. @adam_englander Identifying Threats with STRIDE • Spoofing - The attacker presents themselves as another user • Tampering - Altering code, data, processes • Repudiation - Providing ability to deny who performed an action • Information disclosure - Attacker discloses secret information • Denial of Service - Your system is partially or fully unavailable • Elevation of Privilege - Accessing items for higher level user
- 24. @adam_englander Mapping Attacks with Attack Trees Enter House Through Window Through Door Break Window Force Open Stolen Credentials Authorized User
- 25. @adam_englander Quantifying Risk with DREAD • Damage – how bad would an attack be? • Reproducibility – how easy is it to reproduce the attack? • Exploitability – how much work is it to launch the attack? • Affected users – how many people will be impacted? • Discoverability – how easy is it to discover the threat?
- 27. @adam_englander Mitigate Large Threats in Stages Terrible Bad Okay Complete
- 28. @adam_englander There Is No Absolute Terrible Bad Okay Complete
- 29. @adam_englander Quick Reduction of Threat Terrible Bad Okay Complete
- 30. @adam_englander Acceptable Reduction Terrible Bad Okay Complete
- 31. @adam_englander Complete Mitigation Terrible Bad Okay Complete
- 33. @adam_englander Actor Lone Gunman Competitor Organized Crime Nation State Hactivist Internal Attacker
- 34. @adam_englander Asset Commerce Site DB Credentials SMTP Credentials Payment GW Creds Encryption Keys SSL Certs SSL Private Keys Access to SMTP Database Cust Emails Cust Billing Data Cust PII Payment Data Order History User Credentials User Emails Shopping Carts Sessions Inventory/Pricing Transaction Logs SMTP DKIM Creds Mail Logs Payment Gateway Purchase History Charge/Refund Authority Log Server Raw Logs Host Names Stack Traces Client IPs User Behavior Internal Network DB Admin Creds Hosting Creds DNS Admin Creds Payment GW Admin Creds Encryption Keys SSL Certs SSL Private Keys
- 35. @adam_englander Entry Point Firewall App Server Database HTTPS UnrestrictedMySQL/TLS Internal Network Internet Firewall
- 38. @adam_englander Inside attackers can access all customer PII and PC data from databases using credentials from code repositories on any computer on the internal network and not be discovered via logging
- 39. @adam_englander DREAD • Damage: Liability for stolen credit card transactions, loss of credibility, loss of revenue • Reproducibility: The skills necessary would be knowing how to copy down the git repo and execute queries via mysql • Exploitability: There are no considerations beyond install git and mysql-client to perform the attack
- 40. @adam_englander DREAD • Affected Users: All user PII and billing data would be accessible • Discoverability: Any user with minimal knowledge of the framework would know how to find configs containing DB credentials and connection information.
- 41. @adam_englander Quick Reduction • Database access and query logging for non- repudiation • Restrict read access to the git repo
- 42. @adam_englander Mitigation Phase 1 • Have credentials setup on servers by admins • Remove database credentials from git repo • Change credentials to prevent leaked credentials from being utilized going forward
- 43. @adam_englander Phase 2 • Restrict access for users to appropriate data • Restrict access to appropriate IP addresses
- 44. @adam_englander Phase 3 • Encrypt PII and PC data in the database • Develop and implement key rotation strategy for application secrets
- 45. @adam_englander Completely Mitigate • Anonymize link between PC data and PII • Create honey pots for credentials still in git repos that will allow users to see what appears to be real data. These logins will be recorded and alerts will be sent to security personnel to apprehend the culprit
- 46. @adam_englander How do I get started?
- 47. @adam_englander Right Now: Knock out the OWASP Top 10!
- 48. @adam_englander OWASP Top 10 https://www.owasp.org/index.php/Category:OWASP_Top_Ten_2017_Project
- 49. @adam_englander Near Term: Incorporate threat modeling into your Software Development Lifecycle
- 50. @adam_englander Threat Modeling in SDLC Design Threat Model Build Threat Model Release Test
- 51. @adam_englander Long Term: Map out and model your applications.
- 52. @adam_englander Long Term: Improve your skills!
- 53. @adam_englander Elevation of Privilege Card Game https://www.microsoft.com/en-us/SDL/ adopt/eop.aspx https://www.microsoft.com/en-us/SDL/adopt/eop.aspx
- 54. @adam_englander Threat Modeling: Designing for Security By Adam Shostack ISBN-13: 978-1118809990
- 55. @adam_englander Red/Blue Team Field Manual