CH10 Threat Modelling

Question 1

Developers must consider in Threat Modelling

Answer 1

The valuability of the asset being secured
The strength/durability of the encryption/security used on the asset
Where on the asset the protection is provided (what attack vectors are being covered)

Threat modelling is often a structured way of brain-storming

Question 2

STRIDE in Threat Modelling

Answer 2

expansion of CIA (confidentiality, integritt, availability) threat types

Spoofing Identity
Tampering with data
Repudiation
Information Disclosure
Denial of Service
Elevation of Privelege

Question 3

Spoofing Identity

Answer 3

example: illegally accessing (like shoulder surfing) and then using another user’s authentication information

Question 4

Tampering with Data

Answer 4

involves the malicious modification of data. Examples include unauthorised changes made to persistent (stored) data, such as held in a database

Question 5

Repudiation

Answer 5

associated with users who deny performing an action without other parties having any way to prove otherwise

Question 6

Information Disclosure

Answer 6

involve the exposure of information to individuals who are not supposed to have access to it

Question 7

Denial of Service (DoS)

Answer 7

deny service to valid users - e.g. by making a web server temporarily unavailable or unusable

overload requests
ISP throttling
Persistent XSS

Question 8

Elevation of Privilege

Answer 8

an unprivileged user gains privileged access and thereby has sufficient access to compromise or destroy the entire system.

Question 9

(Qualitative/) Risk calculation

Answer 9

Risk = (1/easiness-of-attack) * impact

Question 10

Subjective RIsk Model: DREAD

Answer 10

Damage
Reproducibility
Exploitability
Affected Users
Discoverability

Question 11

What is needed in threat modelling

Answer 11

business: knowledge what the system should do
- scenarios
- use cases
Architectural: knowledge how information/data “flows” in the system
- block/component diagrams
- data-flow diagrams
Functional Security: how to defeat an attack
- planned security technologies/checks/processes
Attacker Goals
A team of experts
structered process

Question 12

for each identified threat, the following should be documented

Answer 12

threat category
description of the threat
likelihood of the threat (easiness of attack)
impact/severity of the threat
either a mitigation strategy or an explicit acceptance of the threat (sign-off)
If a mitigation has been defined, a strategy for validating its implementation