Upload File

threat modeling - nordic testing days · software (or any computer system), one can define a threat...

  • Home
  • Documents
  • THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling
33
1 THREAT MODELING MASK TESTING WITH BIG WORDS AMIT WERTHEIMER

Upload: others

Post on 28-Jun-2020

3 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

1

THREAT MODELINGM A S K T E S T I N G W I T H B I G W O R D S

A M I T W E R T H E I M E R

Page 2: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

2

Once upon a time, a company created a new app. They got the best developers to work on the project.

Once it was done, a testerwas brought on to the team...

security expert

Page 3: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

3

Welcome to a world full of bad people

https://www.cnet.com/news/target-hack-may-have-hit-40-million-accounts/

http://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-

hacked/

http://thehackernews.com/2017/04/Orange-is-the-new-black-season-5-episodes.html

https://en.wikipedia.org/wiki/Dyn_(company)

Page 4: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

4

Public reaction?

https://imgflip.com/memegenerator/Pissed-Off-Obama

Page 5: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

5

Security is also really difficult, right?

http://www.wordclouds.com/

http://static5.businessinsider.com/image/51d6bd25eab8eabb14000013/the-nsa-trained-edward-snowden-to-be-an-elite-hacker.jpg

Page 6: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

6

https://s-media-cache-ak0.pinimg.com/originals/b0/ab/41/b0ab411f8f0a527b3d12362b83246e4f.jpg

Page 7: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

77

Not everything is so grim

Even the basic security activities improve the situation

significantly

The specialized vocabulary can be learned over time

You can do it too

It’s also fun

Source: https://s-media-cache-ak0.pinimg.com/736x/76/03/60/7603601f004a85c52558f77e216a2fe5.jpg

Page 8: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

88

What is Threat Modeling? (The long answer)

Threat modeling the development of attack trees, which are descriptions

of a set of computer security aspects. That is, when looking at a piece of

software (or any computer system), one can define a threat model by

defining a set of possible attacks to consider. (Wikipedia)

Threat modeling is an approach for analyzing the security of an

application. It is a structured approach that enables you to identify,

quantify, and address the security risks associated with an

application. (OWASP)

Page 9: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

99

The short version

Threat modeling is a design review meant to find

security concerns

Page 10: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

1010

What is it good for?

A relatively cheap way to find fundamental

security issues

Addresses architecture security flaws

Providing shared team understanding of risk

Page 11: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

1111

How to do that?

Scope

Get a model

Brainstorm

Wrap-up

Page 12: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

1212

Scoping

What can I put a SEP field1 around ?

Who might want to attack me?

What assets I don’t care about?

…

Threat modeling is NOT about:

Finding actual (working) exploits

Providing solutions

1. SEP = Somebody Else's problem (Douglas Adams)

Image source: https://upload.wikimedia.org/wikipedia/en/c/cb/Marvin_(HHGG).jpg

Page 13: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

1313

Get a model

Software models:

Architecture diagrams

State machine

UML

Data flow diagrams

List of assets

Image source https://s-media-cache-ak0.pinimg.com/originals/81/19/95/811995e69157f870a925e38add0869db.jpg

Page 14: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

14

Unstructured

Mindmaps

Free discussion

Movie plotting

Structured

Attack taxonomies

Regulations and standards

Personas

Categories of attackers

Attack trees

…

Brainstorm

Image source: http://brainstormprintanddesign.com/uploads/3/5/3/8/3538711/7058336.png?253

Page 15: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

15

Learning about attacks broadens

your imagination

Sources of information:

Pentest reports

Training (webinars, books,

pentest courses, etc.)

High-profile breaches

CVE newsletter

Tip – you can’t spot a problem you can’t imagine

https://kevingnunn.files.wordpress.com/2015/06/tips.jpg

Page 16: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

1616

Structured brainstorm: STRIDE

Spoofing

Tampering

Repudiation

Information disclosure

Denial of service

Elevation of privileges

Page 17: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

17

Spoofing

https://s-media-cache-ak0.pinimg.com/736x/ee/4e/07/ee4e0796d6c046ae910c51892775dae3.jpg

Page 18: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

18

Tampering

Picture from this video: https://www.youtube.com/watch?v=X73gXXFPu1I

Page 19: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

1919

Repudiation

http://orig13.deviantart.net/e224/f/2007/001/f/2/innocent__sylvester_by_schuyler_fox_dracul.jpg

Page 20: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

20

Information Disclosure

http://looneytunescaps.blogspot.com/2012/10/buckaroo-bugs.html

Page 21: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

21

Denial of Service

http://likelylooneymostlymerrie.blogspot.co.il/2013/08/295-wild-hare-1940.html

Page 22: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

22

Elevation of Privileges

http://looneytunes.wikia.com/wiki/King_Daffy?file=King_Arthur.png

Page 23: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

2323

Post actions

Put threats in your backlog

Suggest mitigations

Investigate and see if a potential vulnerability can be exploited

Prioritize

Fix

Page 24: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

24

Now

Ideally, design reviews are done at the

beginning.

However, there’s value at threat modeling even

in a later phase.

When to threat Model?

http://villains.wikia.com/wiki/File:Marvin_the_Martian.png

Page 25: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

25

EXAMPLE TIME

Page 26: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

26

Keep it simple – don’t

dive too deep

You don’t have to cover

everything in one

diagram!

DFD for testbook – a new online book store

Page 27: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

2727

Drill-down DFD

Mark Trust boundaries

Dive just deep enough to be

useful.

Use colors if they help you

There is a formal notation –

don’t worry about it.

Page 28: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

28

Detailed does not mean messy!

A clean diagram is more

important than a complete one

Keep it clean

Page 29: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

29

For each element, look at the

data flows that cross trust

boundaries

Ask – can something in this

communication:

be spoofed?

Tampered?

Leak information?

etc.

Brainstorming – STRIDE per element

Page 30: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

30

commentsImpactRisk ScoreIssue

There’s legacy code not

using prepared

statements

Might enable SQL injection9- HighCustomer input written

to DB as-is

A user’s session could be

hijacked8 – High

Session cookie is not

changed after login

Did not come up in last,

two audits, can argue for

a business need.

Violates PCI-DSS (req. 3.3)

might fail an audit5 – Medium

Credit card number

reflected on the screen

Data is coming from a

trusted sourceExposes end-users to XSS3 – low

Item description is not

HTML encoded

Results – what it might look like?

Page 31: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

3131

Conclusion

Security testing is mostly simply testing

Especially threat modeling

You now have everything you need to threat model – go and do

it yourselves

Page 32: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

3232

Further reading

Threat Modeling: Designing for Security: http://threatmodelingbook.com/

free chapter of the book: https://books.google.co.il/books?id=asPDAgAAQBAJ

OWASP

threat modeling: https://www.owasp.org/index.php/Threat_Modeling

https://www.owasp.org/index.php/Threat_Risk_Modeling

Cornucopia: https://www.owasp.org/index.php/OWASP_Cornucopia

OCTAVE: http://resources.sei.cmu.edu/asset_files/technicalreport/2007_005_001_14885.pdf

CWE, common weaknesses enumeration: https://cwe.mitre.org/data/graphs/888.html

(some) Security terms and definitions: http://www.threatanalysis.com/2010/05/03/threat-vulnerability-risk-

commonly-mixed-up-terms/

Cybrary: https://www.cybrary.it/video/part-2-explanations-17/

General security:

Katrina Clokie’s blog - http://katrinatester.blogspot.com/2015/09/security-testing-pathway.html

http://threatmodelingbook.com/
https://books.google.co.il/books?id=asPDAgAAQBAJ
https://www.owasp.org/index.php/Threat_Modeling
https://www.owasp.org/index.php/Threat_Risk_Modeling
https://www.owasp.org/index.php/OWASP_Cornucopia
http://resources.sei.cmu.edu/asset_files/technicalreport/2007_005_001_14885.pdf
https://cwe.mitre.org/data/graphs/888.html
http://www.threatanalysis.com/2010/05/03/threat-vulnerability-risk-commonly-mixed-up-terms/
https://www.cybrary.it/video/part-2-explanations-17/
http://katrinatester.blogspot.com/2015/09/security-testing-pathway.html
Page 33: THREAT MODELING - Nordic Testing Days · software (or any computer system), one can define a threat model by defining a set of possible attacks to consider. (Wikipedia) Threat modeling

33

Thank You


Cryptocurrency-based Systems Threat Modeling for · Threat Modeling and Cryptocurrencies Threat modeling is an essential step in secure systems design. Explore the threat space to

Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Secure Design: Threat Modeling

Threat Modeling / iPad

Reverse Threat Modeling

Threat Modeling - CrossCountry Consulting

Threat Modeling (Part 4)

Threat Modeling - ISACA

Adventures in Threat Modeling

Application Threat Modeling - OWASP.pdf

Threat Modeling for Automotive Security Analysisonlinepresent.org/proceedings/vol139_2016/68.pdf · Threat Modeling for Automotive Security Analysis ... threat modeling STRIDE method

Threat Modeling (Part 3)

Threat Modeling: Best Practices

Threat Modeling - GBV

Threat Modeling (Part 2)

Threat Modeling And Analysis

Hickman threat modeling

Threat Modeling (Part 5)

threat modeling - SecAppDev Peeters/threat... · threat modeling Johan Peeters ... threat model looks out: adversaries ... assignment I who are the potential adversaries?

02 Threat Modeling

Threat modeling

Security Threat Modeling

Application Threat Modeling

Threat Modeling - Overview

Threat Modeling (Part 1)

Threat modeling guide - DW.COM

Introduction to Threat Modeling

Threat Modeling - home.eng.iastate.edu

Adam Shostack Microsoft - LayerOne...Threat Modeling (Swiderski and Snyder, Microsoft Press) "Guerilla Threat Modeling" (Torr) Patterns and Practices (J.D. Meier) Threat modeling for

Threat Modeling with STRIDE - Concordia Universityusers.encs.concordia.ca/~clark/courses/1601-6150/scribe/L04c.pdf · Threat Modeling with STRIDE Slides adapted from Threat Modeling:

Why Privacy Matters · 2019. 10. 12. · What is a Threat Model? • Wikipedia: “Threat modeling is a process by which potential threats can be identified … all from a hypothetical

Asset-Oriented Threat Modeling

Cloud Threat Modeling

Threat Modeling & Simulation

Corporate Threat Modeling v2