Threat Modeling Web Applications
•Download as PPTX, PDF•
1 like•173 views
The document discusses threat modeling for web applications. It begins by defining threat modeling as an approach for analyzing security before coding to identify, mitigate, and prioritize threats. It then outlines the threat modeling process, including when to conduct it, who should be involved, how to describe the application, identify threats and potential weaknesses, determine mitigations, and document findings. Key points are that threat modeling finds different flaws than other security activities, involves understanding business objectives and technical details, and provides guidance for further security work.
More Related Content
What's hot
What's hot (20)
Similar to Threat Modeling Web Applications
Similar to Threat Modeling Web Applications (20)
Recently uploaded
Recently uploaded (20)
Threat Modeling Web Applications
- 1. Nadia BENCHIKHA Information Security Analyst Threat Modeling Web Applications
- 2. Nadia BENCHIKHA Speakerinfo - Master degree in Computer Science Security. - 4 years of experience in information security. - Started as Incident Responder within a SOC of the Algerian Internet Service Provider (ISP). - Working currently as Information Security Analyst within Societe Generale Algerie. - Managing security solutions (DLP, strong authentication, Data classification, …). - Other skills: web application security, source code review, vulnerability assessment, developing IT process, web application development. benchikha.nadia@gmail.com https://www.linkedin.com/in/nadia-benchikha-%E3%82%B7-8639976a/ https://nadiabenchikha.blogspot.com
- 4. What does Threat Modeling mean? Introduction Threat Modeling is an approach for analyzing the security of an application before coding. It enables you to identify, mitigate and prioritize your threats. Threat Modeling is not an approach for Reviewing source code. Exploiting vulnerabilities. Finding attackers.
- 5. WhenDoYouDo ThreatModeling? Requirement Design Development Testing Deployment Maintaining
- 6. WhyDoYouDo ThreatModeling? Threat modeling will help you to Find design flaws that are not found through other security activities. Gain time and cost. Understand your system and application.
- 7. « 50% of security flaws will be discovered from Threat Modeling because it finds different threats than those found through code review » [Michael Howard] What DoTheySayAbout Threat Modeling?
- 8. When building a threat model it is critically important to include: WhoIsInvolved in ThreatModeling? People who are building the system. People who are testing the system. People who understand the business goals of the system. Cyber Security Advisors.
- 9. Gain a comprehensive understanding of the business objective and how your application interacts with external entities. 1- Describe your application HowDoYouProceed? Describe your application Functional requirements Technical requirements Diagrams What are their business objectives? What are their protected ressources or Assets? What are their Functionalities (Uses cases)? Who uses it? How is it accessible (internal or external use)? What are their entry points ? What are their external dependencies ? What are their trust boundaries ? Which technologies and architecture are used? What are their security mechanisms (SWAF)? Authentication Session Management Authorization Cryptography Input & data validation Parameter Manipulation Sensitive data Auditing & Logging Configuration Management Exception Management Draw architecture overview Draw DFD (Data Flow Diagram)
- 10. HowDoYouProceed? Identify potential weaknesses and rank them. 2- Identify your threats Authentication Authorization Data input & validation Sensitive data Configuration Management Session Management Cryptography Parameter Manipulation Auditing and Logging Exception Management Security Web Application Frame • Think to identify host and network threats • Think about threats induced naturally by the technology itself
- 11. Determine countermeasures for flaws identified before. 3- Determine mitigations How would you prevent these threats? Use standard mitigations. Use custom mitigations. Accept the risk. HowDoYouProceed? Transfer the issue. Redesign.
- 12. Provide a report containing all your findings . 4- Document your findings HowDoYouProceed?
- 13. Threat Modeling is KeepInMind A proactive approach. Not a replacement for a penetration testing or source code review but a complementary security activities. A guide for the next security activities.
- 14. • Threat Modeling Web Applications – Microsoft https://docs.microsoft.com/en-us/previous-versions/msp-n-p/ff648006(v%3dpandp.10) • Threat Modeling designing for security – Adam Shostack https://news.asis.io/sites/default/files/Threat%20Modeling.pdf • WHITE PAPER - The Case for Building in Web Application Security from the Start http://resources.idgenterprise.com/original/AST0048510_The_case_for_building_in_web_application_se curity_from_the_start.PDF • Tactical Threat Modeling https://safecode.org/wp-content/uploads/2017/05/SAFECode_TM_Whitepaper.pdf • Threat Modeling: Lessons from Star Wars – Adam Shostack https://www.owasp.org/images/archive/6/65/20170626175919!TM-Lessons-Star-Wars-May-2017.pdf • There are other methodologies like Kill chain, STRIDE, PASTA Google is your friend Recommended Readings
- 15. Thank you! / ! شكرا