Introduction to Threat Modelling in cyber security

Introduction to Threat Modelling in cyber security

1. 9

C3 SECURITY

2. C3 SECURITY

WHAT IS A
THREAT MODEL?

CYBER SECURITY HYGIENE

3. WHAT IS A THREAT MODEL? S
C3 SECURITY

OBJECTIVES OF A THREAT MODEL

IDENTIFY

» potential vulnerabilities and/or threats

DESCRIBE

» counter-measures to mitigate risk

PRIORITISE
» resources to maximise system security

O C3 SECURITY LTD 2020 https;

4. WHAT IS A THREAT MODEL? S

C3 SECURITY

OBJECTIVES OF A THREAT MODEL

DOCUMENTING RISK

5. WHAT IS A THREAT MODEL? S
C3 SECURITY

THE VALUE PROPOSITION: RISK MITIGATION

REPUTATION
» loss of customer confidence and trust; a weakened brand
OPERATIONS
» disruption of business operations
FINANCIAL
» loss of earnings, fines & restitution
GOVERNANCE & COMPLIANCE

> GDPR, Data Protection Act 2008, ISO27001 et. al.

O C3 SECURITY LTD 2020 https;

6. C3 SECURITY

JUST LIKE THE FUNCTIONAL, DESIGN AND TEST
SPECS, A THREAT MODEL IS A LIVING DOCUMENT —
AS YOU CHANGE THE DESIGN,

TO SEE IF ANY
NEW THREATS HAVE ARISEN SINCE YOU STARTED.

7. C3 SECURITY

THREAT
MODELLING

DOCUMENTING RISK

8. O C3 SECURITY LTD 2020

CREATING A THREAT MODEL S

C3 SECURITY

FUNDAMENTAL QUESTIONS: ASK YOURSELF

» What are we working on?

» What can go wrong?

» What are we going to do about it?

» Did we do a good job?

Adapted from “Application Threat Modelling” by OWASP
hutps:/owasp.ore/www-community/Application Threat "3

9. CREATING A THREAT MODEL S

C3 SECURITY

THREAT MODELLING: A PROCESS

IDENTIFY

» Using DATA FLOW DIAGRAMS

CLASSIFY

» Using S.T.R.I.D.E and ATTACK TREES

QUANTIFY

» Using D.R.E.A.D methodology

10. CREATING A THREAT MODEL S

C3 SECURITY

THREAT MODELLING: A PROCESS

IDENTIFY

» Using DATA FLOW DIAGRAMS

11. 9

C3 SECURITY

\ 1. STORE
SN

DATA BUCKET
eam
1e)

e
A

>
E
S

+
ae | sess
=
5 DATA
| ©

z. /

GATEWAY

3. FE TCH DATA

4. RETURN

DATA

12. CREATING A THREAT MODEL S

C3 SECURITY

THREAT MODELLING: A PROCESS

IDENTIFY

» Using DATA FLOW DIAGRAMS

CLASSIFY

» Using S.T.R.I.D.E and ATTACK TREES

13. CREATING A THREAT MODEL S

C3 SECURITY

THE S.T.R.I.D.E. METHODOLOGY

» SPOOFING

» TAMPERING

» REPUDIATION

> INFORMATION (disclosure)
> DENIAL (of service)

» ELEVATION (of privilege)

14. CREATING A THREAT MODEL S

C3 SECURITY

THE S.T.R.I.D.E. METHODOLOGY

» SPOOFING

15. C3 SECURITY

S.T.R.1.D.E.

SPOOFING

16. CREATING A THREAT MODEL S

C3 SECURITY

THE S.T.R.I.D.E. METHODOLOGY

» SPOOFING

» TAMPERING

17. C3 SECURITY

S.T.R.1.D.E.

TAMPERING

18. CREATING A THREAT MODEL S

C3 SECURITY

THE S.T.R.I.D.E. METHODOLOGY
» SPOOFING
» TAMPERING

» REPUDIATION

19. S.T.R.1.D.E.

REPUDIATION

20. CREATING A THREAT MODEL S

C3 SECURITY

THE S.T.R.I.D.E. METHODOLOGY

» SPOOFING
» TAMPERING
» REPUDIATION

> INFORMATION (disclosure)

21. C3 SECURITY

S.T.R.I.D.E.

INFORMATION DISCLOSURE

22. CREATING A THREAT MODEL S

C3 SECURITY

THE S.T.R.I.D.E. METHODOLOGY

» SPOOFING

» TAMPERING

» REPUDIATION

> INFORMATION (disclosure)

> DENIAL (of service)

23. C3 SECURITY

S.T.R.I.D.E.

DENIAL OF SERVICE (DOS)

24. CREATING A THREAT MODEL S

C3 SECURITY

THE S.T.R.I.D.E. METHODOLOGY

» SPOOFING

» TAMPERING

» REPUDIATION

> INFORMATION (disclosure)
> DENIAL (of service)

» ELEVATION (of privilege)

25. C3 SECURITY

S.T.R.I.D.E.

ELEVATION OF PRIVILEGE

26. CREATING A THREAT MODEL S

C3 SECURITY

THE S.T.R.I.D.E. METHODOLOGY

» SPOOFING

» TAMPERING

» REPUDIATION

> INFORMATION (disclosure)
> DENIAL (of service)

» ELEVATION (of privilege)

27. CREATING A THREAT MODEL S

C3 SECURITY

THREAT MODELLING: A PROCESS

IDENTIFY

» Using DATA FLOW DIAGRAMS

CLASSIFY

» Using S.T.R.I.D.E and ATTACK TREES

28. 9

C3 SECURITY

Learn

Combination Pick Lock Drill Lock
Code

Get Code from
written down Target

Bribe Blackmail Surveillan
Target Target (Eavesdrop)

Adapted from “Attack Trees” by Bruce Schneier, Dr. Dobb's Journal, 1999

29. CREATING A THREAT MODEL S

C3 SECURITY

THREAT MODELLING: A PROCESS

IDENTIFY

» Using DATA FLOW DIAGRAMS

CLASSIFY

» Using S.T.R.I.D.E and ATTACK TREES

QUANTIFY

» Using D.R.E.A.D methodology

30. CREATING A THREAT MODEL S

C3 SECURITY

THE D.R.E.A.D. RISK ASSESSMENT
» DAMAGE

> R EPRODUCIBILITY

» E XPLOITABILITY

» AFFECTED (users)

> D ISCOVERABILITY

‘© C3 SECURITY LTD 2020

31. CREATING A THREAT MODEL S

C3 SECURITY

THE D.R.E.A.D. RISK ASSESSMENT

» DAMAGE

32. CREATING A THREAT MODEL =]

D.R.E.A.D.

DAMAGE

33. CREATING A THREAT MODEL S

C3 SECURITY

THE D.R.E.A.D. RISK ASSESSMENT
> DAMAGE

> R EPRODUCIBILITY

34. D.R.E.A.D.

REPRODUCIBILITY

35. CREATING A THREAT MODEL S

C3 SECURITY

THE D.R.E.A.D. RISK ASSESSMENT
> DAMAGE
» REPRODUCIBILITY

» E XPLOITABILITY

O C3 SECURITY LTD 2020

36. C3 SECURITY

D.R.E.A.D.

EXPLOITABILITY

37. CREATING A THREAT MODEL S

C3 SECURITY

THE D.R.E.A.D. RISK ASSESSMENT
» DAMAGE

> R EPRODUCIBILITY

» E XPLOITABILITY

> AFFECTED (users)

O C3 SECURITY LTD 2020

38. D.R.E.A.D.

AFFECTED USERS

39. CREATING A THREAT MODEL S

C3 SECURITY

THE D.R.E.A.D. RISK ASSESSMENT
» DAMAGE

> R EPRODUCIBILITY

» E XPLOITABILITY

» AFFECTED (users)

> D ISCOVERABILITY

‘© C3 SECURITY LTD 2020

40. D.R.E.A.D.

DISCOVERABILITY

41. CREATING A THREAT MODEL S

C3 SECURITY

THE D.R.E.A.D. RISK ASSESSMENT
» DAMAGE

> R EPRODUCIBILITY

» E XPLOITABILITY

» AFFECTED (users)

> D ISCOVERABILITY

‘© C3 SECURITY LTD 2020

42. C3 SECURITY

ITIS AND IT IS
TO DOCUMENT RISK. THE
BEST TIME TO THREAT MODEL IS