5 Mobile Security Flashcards
What does STRIDE mean
STRIDE is used for security threats
Spoofing Tampering Repudiating Information Disclosure Denial of Service Elevation of Privilage
What does DREAD mean?
DREAD is used to assess threats
Damage Reproducibility Exploitability Affected Users Discoverability
STRIDE. What does SPOOFING mean and how is it mitigated?
Spoofing is when a person/ program masquerades as another.
Gains access with false credentials
Hacks voicemails
You can mitigate with strong authentication
STRIDE. What does TAMPERING mean and how is it mitigated?
Tampering means modifying data or binary code to gain root access ie through a fraudulent jailbreaking site.
Can be used to modify web service request to change delivery of purchase.
Mitigated by ensuring data integrity.
STRIDE. What does REPUDIATION mean and how is it mitigated?
Repudiation is where an attacker modifies the records to hide the attack.
eg sending a payment then wiping the record.
Mitigated with secure logging and digital signatures.
STRIDE. What does INFORMATION DISCLOSURE mean and how is it mitigated?
Information Disclosure is where an attacker gains knowledge they shouldn’t have.
Insecure transport - unencrypted file / databases where credentials accessed via an app
Mitigated with hidden passwords / not showing full CC no.
STRIDE. What does Denial of Service mean and how is it mitigated?
Denial of Service (DoS) is where attackers prevent access to a site. A DDoS is where the malware is distributed through apps so that potentially millions of attacks can happen at once via bots.
Mitigated by access control, filtering and maintaining availability.
STRIDE. What does Elevation of Privilege mean and how is it mitigated?
EoP is where someone gains root access and then elevates their rights to run unauthorised code.
Jailbroken phones vunerable.
Mitigated by requiring kernal mode code to be digitally signed to prevent vertical and horizontal EoP
What are the 4 steps in Threat Modelling?
- Diagram of System
- Identify vunerabilities (via diagram and trust boundaries)
- Mitigate threats (DREAD - work on highest scoring)
- Validate mitigation - has it worked
What does DREAD stand for?
Damage Reproducibility Exploitability Affected Users Discoverability
DREAD. How is Damage scored?
If threat occurs, how much damage?
0 = None 5 = Individual 10 = Company systems/ data destruction
DREAD. How is Reproducibility scored?
How easy to reproduce threat?
0 = very hard/ impossible 5 = few simple steps 10 = Just a web browser
DREAD. How is Exploitability scored?
What is needed to exploit the threat?
0 = Advanced programming knowledge 5 = malware/ tools exist 10 = Just a web browser
DREAD. How is Affected Users scored?
How many affected?
0 = None 5 = Some users 10 = All users
DREAD. How is Discoverability scored?
How easy for attackers to discover threat?
0 = Very hard/ impossible (requires source code or admin access) 5 = Identified by guess work or network monitoring 9 = Details of fault available online 10 = The info is available in the web browser address bar or form
