Threat Modelling & Analysis

Question 1

Protecting software system security

What do we want to protect?

How? Types of protection

Answer 1

What do we want to protect?

• Software system assets: anything that is valuable in these systems
• E.g., software, hardware, data, communication networks

How? Types of protection:

• Prevention – “taking measures that prevent your assets from being damaged”
• Detection – “taking measures that allow you to detect when an asset has been
  damaged, how it has been damaged, and who has caused the damage”
• Reaction – “taking measures that allow you to recover your assets or to
  recover from damage to your assets”

Question 2

What is a Threat?

Answer 2

Any circumstance or event with the potential to cause the security of the system to be compromised

Question 3

What computer security aspect (properties) can be compromised?

Answer 3

Confidentiality
Integrity
Availability

Question 4

CIA Triad

Answer 4

Confidentiality – prevention of unauthorized disclosure of information

Integrity – prevention of unauthorized modification of information

Availability – prevention of unauthorized withholding of information
or resources

Question 5

What is Threat Modelling?

Answer 5

Threat Modelling is about using models to find security problems

Question 6

Four key questions for Threat Modelling

Answer 6

Q1. What are we working on (developing)?
Q2. What can go wrong?
Q3. What are we going to do about it?
Q4. Did we do a good job of threat analysis

Question 7

Three types of structure approaches to threat modelling

Answer 7

1) Asset-centric:

Focuses on the assets you want to
protect

2) Attacker-centric:

Focuses on different attacker types

3) Software-centric

Focusses on software itself, on
how it works

Question 8

Data-Flow Diagram

Answer 8

DFD is a model that shows a flow of data through a process or a system

Question 9

STRIDE

Answer 9

• Spoofing - Impersonating something or
  someone else
• Tampering - Modifying data or code
• Repudiation - Claiming to have not
  performed an action.
• Information disclosure - Exposing information to someone not authorized to see it
• Denial of Service - Deny or degrade service to users
• Elevation of Privilege - Gain capabilities without proper authorization

Question 10

Attack Trees

Answer 10

Attack trees can be used:
1. As a way to find threats
2. As a way to organize threats found with other methods

Question 11

Attack Tree Modification: Attack-Defense Tree

Answer 11

Attack–defense tree (ADTree) is a “graphical
representation of possible measures an attacker might take in order to attack a system and the defenses that a defender can employ to protect the system