Threat Modeling

Threat Modeling Methodologies

STRIDE

STRIDE is a threat modeling framework developed by Microsoft that categorizes threats into six categories:

• •

  Spoofing: Impersonating something or someone else

  • •Examples: Fake authentication tokens, DNS spoofing, email spoofing
  • •Controls: Strong authentication, certificate validation, anti-spoofing measures
• •

  Tampering: Modifying data or code without authorization

  • •Examples: Man-in-the-middle attacks, code injection, data tampering
  • •Controls: Digital signatures, integrity checks, secure communication channels
• •

  Repudiation: Denying having performed an action

  • •Examples: Denying a transaction, denying access to resources
  • •Controls: Audit logging, non-repudiation services, digital signatures
• •

  Information Disclosure: Exposing information to unauthorized parties

  • •Examples: Data leakage, sensitive information in logs, insecure storage
  • •Controls: Encryption, access controls, data masking, secure logging
• •

  Denial of Service: Making a service unavailable

  • •Examples: DDoS attacks, resource exhaustion, application crashes
  • •Controls: Rate limiting, throttling, redundancy, monitoring
• •

  Elevation of Privilege: Gaining unauthorized higher-level access

  • •Examples: Privilege escalation, bypassing authorization checks
  • •Controls: Principle of least privilege, secure authorization, input validation

PASTA Framework

Process for Attack Simulation and Threat Analysis (PASTA) is a seven-step risk-centric methodology:

1. •Define Objectives: Establish business objectives and compliance requirements
2. •Define Technical Scope: Identify assets, data flows, and technical architecture
3. •Application Decomposition: Analyze application architecture and data flows
4. •Threat Analysis: Identify threats using threat intelligence and attack patterns
5. •Vulnerability Analysis: Identify and assess vulnerabilities in the system
6. •Attack Modeling: Model potential attacks and their impact
7. •Risk Analysis: Assess and prioritize risks based on business impact

LINDDUN Framework

LINDDUN is a privacy-focused threat modeling framework:

• •Linkability: Ability to link data to individuals
• •Identifiability: Ability to identify individuals from data
• •Non-repudiation: Inability to deny actions
• •Detectability: Ability to detect data processing
• •Disclosure of Information: Unauthorized information disclosure
• •Unawareness: Individuals unaware of data processing
• •Non-compliance: Failure to comply with regulations

Attack Tree Analysis

Attack Tree Structure

Attack trees are hierarchical diagrams that represent different ways an attacker might achieve a goal:

• •Root Node: The attacker's ultimate goal
• •Intermediate Nodes: Sub-goals or attack vectors
• •Leaf Nodes: Specific attack techniques or exploits

Attack Tree Analysis Process

1. •Define Attack Goal: Identify what the attacker wants to achieve
2. •Identify Attack Vectors: Brainstorm different ways to achieve the goal
3. •Break Down Vectors: Decompose each vector into smaller steps
4. •Assign Values: Assign difficulty, cost, and risk values to each node
5. •Analyze Paths: Identify the most likely attack paths
6. •Identify Mitigations: Determine controls to block each path

Common Attack Patterns

• •Authentication Attacks: Credential stuffing, brute force, password spraying
• •Authorization Attacks: Privilege escalation, IDOR, broken access controls
• •Injection Attacks: SQL injection, command injection, XSS, LDAP injection
• •Cryptographic Attacks: Weak algorithms, key management issues, padding oracle
• •Network Attacks: MITM, DNS poisoning, ARP spoofing, BGP hijacking
• •Social Engineering: Phishing, pretexting, baiting, tailgating

Common Attack Patterns

OWASP Top 10

1. •Broken Access Control: Restrictions on authenticated users are not properly enforced
2. •Cryptographic Failures: Failures related to cryptography and protection of sensitive data
3. •Injection: Injection flaws allow attackers to execute malicious commands
4. •Insecure Design: Flaws in design and architecture that enable security issues
5. •Security Misconfiguration: Improperly configured security settings
6. •Vulnerable and Outdated Components: Using components with known vulnerabilities
7. •Identification and Authentication Failures: Weaknesses in identity and authentication
8. •Software and Data Integrity Failures: Code and infrastructure without integrity protection
9. •Security Logging and Monitoring Failures: Insufficient logging and monitoring
10. •Server-Side Request Forgery (SSRF): Server makes requests to unintended locations

Common Weakness Enumeration (CWE)

• •CWE-79: Cross-site Scripting (XSS)
• •CWE-89: SQL Injection
• •CWE-200: Information Exposure
• •CWE-352: Cross-Site Request Forgery (CSRF)
• •CWE-400: Uncontrolled Resource Consumption
• •CWE-502: Deserialization of Untrusted Data
• •CWE-732: Incorrect Permission Assignment
• •CWE-798: Use of Hard-coded Credentials
• •CWE-862: Missing Authorization
• •CWE-863: Incorrect Authorization

Risk Assessment Frameworks

CVSS (Common Vulnerability Scoring System)

CVSS provides a standardized way to assess vulnerability severity:

• •Base Score: Intrinsic qualities of the vulnerability (Exploitability, Impact)
• •Temporal Score: Characteristics that change over time (Exploit Code Maturity, Remediation Level)
• •Environmental Score: Characteristics specific to the user's environment

DREAD

DREAD is a risk assessment model:

• •Damage: How much damage could be caused?
• •Reproducibility: How easily can the vulnerability be reproduced?
• •Exploitability: How easy is it to exploit?
• •Affected Users: How many users are affected?
• •Discoverability: How easy is it to discover?

OWASP Risk Rating

OWASP provides a risk rating methodology:

• •Likelihood: Ease of discovery, ease of exploit, awareness, intrusion detection
• •Impact: Technical impact, business impact
• •Risk Score: Likelihood × Impact

Security Architecture Patterns

Defense in Depth

Layered security controls provide multiple levels of protection:

• •Perimeter Security: Firewalls, WAFs, DDoS protection
• •Network Security: Network segmentation, IDS/IPS, VPN
• •Host Security: Endpoint protection, HIDS, application whitelisting
• •Application Security: Input validation, authentication, authorization
• •Data Security: Encryption, access controls, data loss prevention

Zero Trust Architecture

Never trust, always verify:

• •Identity Verification: Strong authentication for all access requests
• •Device Trust: Verify device health and compliance
• •Least Privilege: Grant minimum necessary access
• •Micro-segmentation: Segment networks to limit lateral movement
• •Continuous Monitoring: Monitor and log all access and activity

Secure by Design

Incorporate security from the beginning:

• •Threat Modeling: Identify threats early in design
• •Secure Defaults: Default to secure configurations
• •Principle of Least Privilege: Minimize permissions
• •Defense in Depth: Multiple layers of security
• •Fail Secure: Fail to a secure state
• •Security by Design: Design security into the system