This presentation was by John Steven who is the Senior Director of Advanced Technology Consulting at Cigital, Inc.<\/p>\n
What is a threat?<\/strong><\/span><\/p>\n What is a threat model?<\/strong><\/span><\/p>\n Elements of a threat model<\/strong><\/span><\/p>\n Threat<\/strong><\/span><\/p>\n A Few Words on STRIDE<\/strong><\/span><\/p>\n Attack Trees<\/strong><\/span><\/p>\n Threat Modeling as a Process<\/strong><\/span><\/p>\n Leading Up to Threat Modeling<\/strong><\/span><\/p>\n Input: Goals, Doomsday Scenarios<\/p>\n Misuse\/Abuse Cases (use case view and component view)<\/p>\n Inputs: Security Requirements (specified security features – “128 bit encryption”, “software security != security software”)<\/p>\n Anchor in Software Architecture<\/strong><\/span><\/p>\n Consider where attacks occur:<\/p>\n Output: Security Assessment & Test Design.\u00a0 Threat models drive assessments, Test design.\u00a0 Establish rules of engagement.\u00a0 Prioritize areas of interest.\u00a0 Manage a team in risk-based fashion.\u00a0 Establish a single tie between vulnerability and control.<\/p>\n Application Structure: No “One Size Fits All”<\/p>\n Application Structure: Topology – Coloration shows authorization by role.\u00a0 Arrows indicate resolution of principal\/assertion propagation.\u00a0 Use structure to separate privilege.<\/p>\n Application Structure: Components – Component diagrams show critical choke points for security controls (input validation, authentication, output encoding).<\/p>\n Application Structure: Frameworks – Showing frameworks indicates where important service contracts exist “up” and “down”.<\/p>\n Assets: Flow – Assets exist not only in rest, but also flow through the system.\u00a0 Use different types of flags to represent data flow of assets.<\/p>\n Use different colored arrows to represent each different attack vector.<\/p>\n Target Using Layered Attacks: Bootstrap later attacks with those that “deliver”.\u00a0 Use one layer to exploit another (net, app).\u00a0 Combine attacks to reach desired target.<\/p>\n Take Homes<\/strong><\/span><\/p>\n This presentation was by John Steven who is the Senior Director of Advanced Technology Consulting at Cigital, Inc. What is a threat? An agent who attacks you? An attack? An attack’s consequence? A risk? What is a threat model? Depiction of the system’s attack surface, threats who can attack the system, and assets threats may […]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[127,4],"tags":[183,76,128,185,12,622,184],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-owasp-appsec-nyc-2008","category-web-app-sec","tag-advanced","tag-application","tag-appsec","tag-modeling","tag-owasp","tag-security","tag-threat"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n
\n
\n
\n
\n
\n
\n
\n
\n
\n