protection poker james walden northern kentucky university
TRANSCRIPT
Protection Poker
James Walden
Northern Kentucky University
CSC 666: Secure Software Engineering
What is Protection Poker?
Collaborative, informal risk analysis technique based on planning poker.
Evaluate requirements Ease of attack. Impact of attack. Risk = Ease * Impact
CSC 666: Secure Software Engineering
Highest Priority
Lowest Priority
Difficult to Exploit Easy to Exploit
High Impact
Low Impact
Ease
Val
ueSoftware Security Risk
Assessment via Protection Poker
CSC 666: Secure Software Engineering
Players
1. Programmers
2. Testers
3. Customer representatives
4. Security team representative
5. Specialists (UI, DB, etc.)
CSC 666: Secure Software Engineering
Procedure
1. Calibrate value of system assets.
2. Calibrate ease of attack for requirements.
3. Compute security risk (value, ease) for each requirement.
4. Security risk ranking and discussion.
CSC 666: Secure Software Engineering
Calibrate Value of Assets
1. Examine assets listed in Table 1.
2. Identify least valuable asset in Table 1. Discuss. Assign a value of 1 in Table 1 to asset.
3. Identify most valuable asset in Table 1. Use cards to achieve consensus about how
much more valuable asset is. Assign consensus value in Table 1 to asset.
CSC 666: Secure Software Engineering
Calibrate Ease of Attack
1. Identify easiest requirement to attack. Find one that modify data, allow reads of
sensitive data, have weak auth, etc. Use cards to find consensus value.
2. Identify hardest requirement to attack. Find one that doesn’t modify data, allow
reads of sensitive data, has strong auth, etc. Use cards to find consensus value.
3. Record ease points in Table 3.
CSC 666: Secure Software Engineering
Compute Security Risk
For each requirement1. Identify relevant assets.2. If values have already been assigned, document
assets with values in Table 2.3. If values have not been assigned, use cards to
achieve consensus value. Record value in Tables 1 and 2.
4. Record max value in Table 2.
For each requirement1. Use cards to achieve consensus on ease of attack.
Record value in Table 3.2. Compute risk by multiplying value by ease. Record
the value for risk in Table 3.
CSC 666: Secure Software Engineering
Security Risk Ranking
1. Rank requirements by risk from 1 to 4.
2. Place value in security risk ranking Table 3.
3. If any rankings are a surprise, discuss and iterate with cards if necessary.
CSC 666: Secure Software Engineering
Why does it work?
1. Brings together multiple expert opinions with different perspectives on project.
2. Ratings focus on attack resistance analysis.
3. Discussions enable ambiguity analysis.
References
1. Laurie Williams, Michael Gegick and Andy Meneely. Protection Poker: Structuring Software Security Risk Assessment and Knowledge Transfer. Engineering Secure Software and Systems. 2009
2. Laurie Williams. Protection Poker Tutorial. http://collaboration.csc.ncsu.edu/laurie/Security/ProtectionPoker/, 2008.