{"id":122,"date":"2008-09-25T13:53:45","date_gmt":"2008-09-25T18:53:45","guid":{"rendered":"http:\/\/www.webadminblog.com\/?p=122"},"modified":"2008-09-25T14:04:12","modified_gmt":"2008-09-25T19:04:12","slug":"practical-advanced-threat-modeling-owasp-appsec-nyc-2008","status":"publish","type":"post","link":"https:\/\/www.webadminblog.com\/index.php\/2008\/09\/25\/practical-advanced-threat-modeling-owasp-appsec-nyc-2008\/","title":{"rendered":"Practical Advanced Threat Modeling &#8211; OWASP AppSec NYC 2008"},"content":{"rendered":"<p>This presentation was by John Steven who is the Senior Director of Advanced Technology Consulting at Cigital, Inc.<\/p>\n<p><span style=\"text-decoration: underline;\"><strong>What is a threat?<\/strong><\/span><\/p>\n<ul>\n<li>An agent who attacks you?<\/li>\n<li>An attack?<\/li>\n<li>An attack&#8217;s consequence?<\/li>\n<li>A risk?<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>What is a threat model?<\/strong><\/span><\/p>\n<ul>\n<li>Depiction of the system&#8217;s attack surface, threats who can attack the system, and assets threats may compromise.<\/li>\n<li>Some leverage risk management practices.\u00a0 Estimate probability of attack.\u00a0 Weigh impact of successful attack.<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Elements of a threat model<\/strong><\/span><\/p>\n<ul>\n<li>Structural view<\/li>\n<li>Threat actors<\/li>\n<li>Assets<\/li>\n<li>Attack vectors<\/li>\n<li>Privilege\/&#8221;trust&#8221;<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Threat<\/strong><\/span><\/p>\n<ul>\n<li>Capability: Access to the system, able to reverse engineer binaries, able to sniff the network<\/li>\n<li>Skill Level: Experienced hacker, script kiddie, insiders<\/li>\n<li>Resources and Tools: Simple manual execution, distributed bot army, well-funded organization, access to private information<\/li>\n<li>Threats help encourage thorough throught about how intentions for misuse and determine &#8220;out of bounds&#8221; scenarios.<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>A Few Words on STRIDE<\/strong><\/span><\/p>\n<ul>\n<li>A conceptual checklist backed by data flow diagrams<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Attack Trees<\/strong><\/span><\/p>\n<ul>\n<li>Aggregate attack possibilites<\/li>\n<li>Use OR, AND<\/li>\n<li>Allow for decoration (probability, cost, skills required, etc)<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Threat Modeling as a Process<\/strong><\/span><\/p>\n<ul>\n<li>Use threat modeling to identify where potential threats exist relative to the architecture, how threats escalate privilege, specify vectors of attack, identifies components and assets worth protecting.<\/li>\n<\/ul>\n<p><span style=\"text-decoration: underline;\"><strong>Leading Up to Threat Modeling<\/strong><\/span><\/p>\n<ul>\n<li>Identify threats<\/li>\n<li>Enumerate doomsday scenarios<\/li>\n<li>Document misuse\/abuse<\/li>\n<li>Diagram structure, assets<\/li>\n<li>Annotate diagram with threats<\/li>\n<li>Enumerate attack vectors<\/li>\n<li>Iterate<\/li>\n<\/ul>\n<p>Input: Goals, Doomsday Scenarios<\/p>\n<p>Misuse\/Abuse Cases (use case view and component view)<\/p>\n<p>Inputs: Security Requirements (specified security features &#8211; &#8220;128 bit encryption&#8221;, &#8220;software security != security software&#8221;)<\/p>\n<p><span style=\"text-decoration: underline;\"><strong>Anchor in Software Architecture<\/strong><\/span><\/p>\n<p>Consider where attacks occur:<\/p>\n<ul>\n<li>Top-down: enumerate business objects (sensitive data, privileged functionality)<\/li>\n<li>Bottom-Up: enumerate application<\/li>\n<\/ul>\n<p>Output: Security Assessment &amp; Test Design.\u00a0 Threat models drive assessments, Test design.\u00a0 Establish rules of engagement.\u00a0 Prioritize areas of interest.\u00a0 Manage a team in risk-based fashion.\u00a0 Establish a single tie between vulnerability and control.<\/p>\n<p>Application Structure: No &#8220;One Size Fits All&#8221;<\/p>\n<p>Application Structure: Topology &#8211; Coloration shows authorization by role.\u00a0 Arrows indicate resolution of principal\/assertion propagation.\u00a0 Use structure to separate privilege.<\/p>\n<p>Application Structure: Components &#8211; Component diagrams show critical choke points for security controls (input validation, authentication, output encoding).<\/p>\n<p>Application Structure: Frameworks &#8211; Showing frameworks indicates where important service contracts exist &#8220;up&#8221; and &#8220;down&#8221;.<\/p>\n<p>Assets: Flow &#8211; Assets exist not only in rest, but also flow through the system.\u00a0 Use different types of flags to represent data flow of assets.<\/p>\n<p>Use different colored arrows to represent each different attack vector.<\/p>\n<p>Target Using Layered Attacks: Bootstrap later attacks with those that &#8220;deliver&#8221;.\u00a0 Use one layer to exploit another (net, app).\u00a0 Combine attacks to reach desired target.<\/p>\n<p><span style=\"text-decoration: underline;\"><strong>Take Homes<\/strong><\/span><\/p>\n<ul>\n<li>Base threat model in software architecture<\/li>\n<li>When specific use (cases) and high-level architecture are defined: inventory roles, entitlements, if one doesn&#8217;t exist and inventory assets, sensitive data, privileged components<\/li>\n<li>Enumerate initial attack vectors.\u00a0 Use common low hanging fruit.<\/li>\n<li>Elaborate more attacks.\u00a0 Find opportunities for privilege escalation.\u00a0 Layer attacks to target or &#8220;hop&#8221; to assets.\u00a0 Fill in gaps by &#8220;inventing&#8221; attacks.<\/li>\n<li>Use threat modeling to drive security testing<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>This presentation was by John Steven who is the Senior Director of Advanced Technology Consulting at Cigital, Inc. What is a threat? An agent who attacks you? An attack? An attack&#8217;s consequence? A risk? What is a threat model? Depiction of the system&#8217;s attack surface, threats who can attack the system, and assets threats may [&hellip;]<\/p>\n","protected":false},"author":3,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"jetpack_post_was_ever_published":false,"_jetpack_newsletter_access":"","_jetpack_dont_email_post_to_subs":false,"_jetpack_newsletter_tier_id":0,"_jetpack_memberships_contains_paywalled_content":false,"_jetpack_memberships_contains_paid_content":false,"footnotes":"","jetpack_publicize_message":"","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2}},"categories":[127,4],"tags":[183,76,128,185,12,622,184],"class_list":["post-122","post","type-post","status-publish","format-standard","hentry","category-owasp-appsec-nyc-2008","category-web-app-sec","tag-advanced","tag-application","tag-appsec","tag-modeling","tag-owasp","tag-security","tag-threat"],"aioseo_notices":[],"jetpack_publicize_connections":[],"jetpack_featured_media_url":"","jetpack_shortlink":"https:\/\/wp.me\/pfI0c-1Y","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/comments?post=122"}],"version-history":[{"count":4,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/122\/revisions"}],"predecessor-version":[{"id":126,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/posts\/122\/revisions\/126"}],"wp:attachment":[{"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/media?parent=122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/categories?post=122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.webadminblog.com\/index.php\/wp-json\/wp\/v2\/tags?post=122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}