threat modeling part 2 - stride

Threat Modeling Part 2 – STRIDE Brad Andrews , CISSP, CSSLP North Texas Cyber Security Conference 2015

Upload: north-texas-chapter-of-the-issa

Post on 07-Aug-2015

373 views

Category:

Internet

0 download

Report

Download

Embed Size (px):

TRANSCRIPT

Threat ModelingPart 2 – STRIDE

Brad Andrews , CISSP, CSSLPNorth Texas Cyber Security Conference

2015

Long time in the tech field Wide range of jobs – Defense, Online,

Banking, Airlines, Doc-Com, Medical, etc. 20+ Years software development

experience 10+ in Information Security M.S. and B.S. in Computer Science from the

University of Illinois Active Certifications – CISSP, CSSLP, CISM

Who Am I?

Work for one of the largest providers of pharmacy software and services in the country

Serve as Lead Faculty-Area Chair and for Information Systems Security for the University of Phoenix Online Campus

Carry out independent reading and research for my own company, RBA Communications

My Work

The views and opinions expressed in this session are mine and mine alone. They do

not necessarily represent the opinions of my employers or anyone associated with

anything!

My Opinions and Ideas Alone

Part 1 – Threat Modeling Overview Part 2 – Applying STRIDE to a System Part 3 – Applying DREAD to a System

Sessions Today

Types of Exploits / Motivations of Attacker A Guide, not a Firm Taxonomy

SpoofingTamperingRepudiation

Information DisclosureDenial of Service

Elevation of Privelege

What is STRIDE

Pretending to Be Something You are Not

Spoofing

Making Unauthorized Modifications

Tampering

Denying A Past ActionAvoiding Consequences

Repudiation

Page 10: Threat Modeling Part 2 - STRIDE

Unauthorized Data Exposure

Information Disclosure

Page 11: Threat Modeling Part 2 - STRIDE

Preventing Expected Access

Denial of Service

Page 12: Threat Modeling Part 2 - STRIDE

Unauthorized Rights

Elevation of Privilege

Page 13: Threat Modeling Part 2 - STRIDE

Be Involved Don’t Monopolize Work Together

Interactive Time

Page 14: Threat Modeling Part 2 - STRIDE

Find Risks for Chosen Systems

Note Some Risks

Page 15: Threat Modeling Part 2 - STRIDE

Questions?

Threat Modeling (Part 1)

Threat Modeling (Part 5)

STRIDE-based Threat Modeling for Cyber-Physical Systems · STRIDE-based Threat Modeling for Cyber-Physical Systems ... (focuses on hazard, risk and ... The rest of the section performs

Threat modeling

Threat Modeling For Web Applications Using The Stride Model

Threat Modeling (Part 3)

Threat Modeling with STRIDE - Concordia Universityusers.encs.concordia.ca/~clark/courses/1601-6150/scribe/L04c.pdf · Threat Modeling with STRIDE Slides adapted from Threat Modeling:

Reverse Threat Modeling

Threat Modeling - ISACA

Threat Modeling - GBV

threat modeling - SecAppDev Peeters/threat... · threat modeling Johan Peeters ... threat model looks out: adversaries ... assignment I who are the potential adversaries?

Defending Against Attacks by Modeling Threat Behaviorstransvasive.com/wp-content/uploads/2012/09/btm-isc2-20120910.pdf · Threats Identify Vulnerabilities Address Risks . ... STRIDE

Defending Against Attacks by Modeling Threat Behaviors · Defending Against Attacks by Modeling Threat Behaviors ... possible threats • Identify potential ... STRIDE addresses some

Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Threat Modeling And Analysis

Threat Modeling (Part 4)

DNS Threat Modeling - OWASP · Threat Modeling Using STRIDE By: Girindro Pringgo Digdo, ... Threat Modeling Diagram Identify Threats Identify Threats Mitigate Validate STRIDE Trike

Threat Modeling & Simulation

Threat Modeling for Automotive Security Analysisonlinepresent.org/proceedings/vol139_2016/68.pdf · Threat Modeling for Automotive Security Analysis ... threat modeling STRIDE method

Adam Shostack Microsoft - LayerOne...Threat Modeling (Swiderski and Snyder, Microsoft Press) "Guerilla Threat Modeling" (Torr) Patterns and Practices (J.D. Meier) Threat modeling for

Threat Modeling / iPad

STRIDE-based Threat Modeling for Cyber-Physical Systems · STRIDE-based threat modeling can be performed in two possible ways [22]: (i) STRIDE-per-element and (ii) STRIDE-per-interaction

Tactical Threat Modeling - SAFECode · Tactical Threat Modeling

Developing a Threat Modeling Mindset - Robert Hurlbut · Developing a Threat Modeling Mindset SOURCE Boston 2016 May 18, ... Identify threats through answers ... STRIDE Framework

Hickman threat modeling

Using and Customizing Microsoft Threat Modeling Tool … · Using and Customizing Microsoft Threat Modeling Tool 2016 ... Identify threats through answers ... Mapping STRIDE to OWASP

Threat Modeling with STRIDE - Concordia Universityclark/courses/1601-6150/scribe/L... · Threat Modeling with STRIDE ... Some threats are listed by STRIDE, ... Using STRIDE • Consider

Threat Modeling - Overview

Application Threat Modeling

Cloud Threat Modeling

Threat Modelling - hacking the design - OWASP€¢ Identify threats —> STRIDE threat analysis ... • scale AppSec capabilities, ... • Practical exercise of threat modelling a

STRIDE Variants and Security Requirements-based Threat ... · STRIDE-per-Element • Apply to STRIDE elements of DFD to find threats –The elements are Process, Data Flow, etc.,

Online Banking Security Analysis based on STRIDE Threat … · identify the threats, ... STRIDE [3, 4] model derive from an acronym for the following six threat categories: Spoofing

02 Threat Modeling

RESEARCH Open Access Risk-driven security testing using ... · Risk-driven security testing using risk analysis with threat modeling approach ... risk analysis results using STRIDE