7 Steps to Threat Modeling

7 Steps to Threat Modeling

• 1.
  7 Steps toThreat Modeling Danny Wong au.linkedin.com/in/chinwhei/
• 2.
  7 Step Approach 1.Identify Assets 2. Create an Architecture Overview 3. Decompose the Application 4. Identify the Threats 5. Document the Threats 6. Rate the Threats 7. Generating a Work Item Report
• 3.
  1. Identify Assets Q:What is your most Valued Digital Assets? Intellectual Property Web Portals Databases
• 4.
  2. Create anArchitecture Overview Q: What people/process/technology components are used to consume the digital asset?
• 5.
  3. Decompose theApplication Q: How many methods are there to consume the digital asset? Identify trust boundaries. Identify data flow. Identify entry points. Identify privileged code. Document the security profile.
• 6.
  4. Identify theThreats (STRIDE Model) Q: For each method of access, what are the possible threats? Spoofing •An example of identity spoofing is illegally accessing and then using another user's authentication information, such as username and password. Tampering •Data tampering involves the malicious modification of data. Examples include unauthorized changes made to persistent data, such as that held in a database, and the alteration of data as it flows between two computers over an open network, such as the Internet. Repudiation •Repudiation threats are associated with users who deny performing an action without other parties having any way to prove otherwise— for example, a user performs an illegal operation in a system that lacks the ability to trace the prohibited operations. Nonrepudiation refers to the ability of a system to counter repudiation threats. Information Disclosure •Information disclosure threats involve the exposure of information to individuals who are not supposed to have access to it— for example, the ability of users to read a file that they were not granted access to, or the ability of an intruder to read data in transit between two computers. Denial of Service •Denial of service (DoS) attacks deny service to valid users—for example, by making a Web server temporarily unavailable or unusable. You must protect against certain types of DoS threats simply to improve system availability and reliability. Elevation of Privilege •In this type of threat, an unprivileged user gains privileged access and thereby has sufficient access to compromise or destroy the entire system. Elevation of privilege threats include those situations in which an attacker has effectively penetrated all system defenses and become part of the trusted system itself, a dangerous situation indeed.
• 7.
  5. Document theThreats Q: For each Threat, list the attack technique and countermeasure required. Threat Description Attacker obtains authentication credentials by monitoring the network Threat target Web application user authentication process Risk High Attack techniques Use of network monitoring software Countermeasures Use SSL to provide encrypted channel Threat Description Injection of SQL commands Threat target Data access component Risk High Attack techniques Attacker appends SQL commands to user name, which is used to form a SQL query Countermeasures Use a regular expression to validate the user name, and use a stored procedure that uses parameters to access the database.
• 8.
  6. Rate theThreats (DREAD Model) Q: For each Threat Documented, Rate the Threat against the impact to the Organization. Rating High (3) Medium (2) Low (1) D Damage potential The attacker can subvert the security system Leaking sensitive information Leaking trivial information R Reproducibility The attack can be reproduced every time and does not require a timing window. The attack can be reproduced, but only with a timing window and a particular race situation. The attack is very difficult to reproduce, even with knowledge of the security hole. E Exploitability A novice programmer could make the attack in a short time. A skilled programmer could make the attack, then repeat the steps. The attack requires an extremely skilled person and in-depth knowledge every time to exploit. A Affected users All users, default configuration, key customers Some users, non-default configuration Very small percentage of users, obscure feature; affects anonymous users D Discoverability The vulnerability is found in the most commonly used feature and is very noticeable. The vulnerability is in a seldom-used part of the product, and only a few users should come across it. The bug is obscure, and it is unlikely that users will work out damage potential. No Threat D R E A D Total Rating 1 Attacker obtains authentication credentials by monitoring the network. 3 3 2 2 2 12 High 2 SQL commands injected into application. 3 3 3 3 2 14 High
• 9.
  7. Generating aWork Item Report. (Mitigate) Q: For each Threat Rated, Prioritize and Fix the Threat then restart the Threat Modeling. Threat Description Attacker obtains authentication credentials by monitoring the network Attack techniques Use of network monitoring software Countermeasures Use SSL to provide encrypted channel Status SSL Implemented Threat Description Injection of SQL commands Attack techniques Attacker appends SQL commands to user name, which is used to form a SQL query Countermeasures Use a regular expression to validate the user name, and use a stored procedure that uses parameters to access the database. Status Code Updated
• 10.
  References Threat Modeling http://msdn.microsoft.com/en- us/library/ff648644.aspx#c03618429_012 Threat ModelingTool http://www.microsoft.com/en- us/download/details.aspx?id=42518