Basics of Data-Centric System Threat Modeling
Step 1: Identify and Characterize the System and Data of Interest
l The authorized locations for the data within the system.
Storage: all places where
data may be at rest within the system boundaries;
Transmission: all ways in
which data may transit over networks between system components
and across the system’s boundaries;
Execution environment:
e.g., data held in local memory during runtime, data processed by
virtual CPUs, etc.
Input: e.g., data typed in
using the keyboard; and
Output: e.g., data printed
to a physically attached printer, data displayed on the laptop screen
l A basic understanding of how the data moves within the system
between authorized locations
l The security objectives (e.g., confidentiality, integrity,
availability) for the data
l The people and processes who are authorized to access the data in a
way that could affect the security
objectives.
Example Scenario
|
Summary The data of interest is a spreadsheet containing personally identifiable
information (PII) for employees who have received workers’ compensation. |
|
The system of interest comprises |
|
The authorized locations for the data of
interest are as follows Storage: Transmission: Execution environment: Input: Output: |
|
Description: |
Step 2: Identify and Select the Attack Vectors to Be Included in the
Model
|
Location 1: Stored in a spreadsheet on
the local hard drive. l Vector 1a: Attacker gains unauthorized physical access to the
laptop, uses forensic tools or other utilities to copy the file (without
authenticating to the OS). l Vector 1b: Attacker gains unauthorized physical access to the
laptop, exploits vulnerabilities to gain OS access (impersonating
user/admin). l Vector 1c: Attacker steals and reuses user/admin/service credentials. l Vector 1d: Attacker gains access to/control over user’s
session/device. l Vector 1e: User forwards the file to an unauthorized recipient
(user was tricked via social
engineering, user is malicious, user made a mistake, etc.) l Vector 1f: Attacker accesses unsecured network service (e.g.,
connects to unsecured file share) and gains access to the file. |
|
Location 2: Stored in a spreadsheet on a
flash drive backup. l Vector 2a: Attacker gains unauthorized physical access to the
flash drive, mounts the drive and copies the file l Vector 2b: Attacker steals and reuses user/admin/service
credentials for laptop while flash drive is mounted. l Vector 2c: Attacker gains access to/control over user’s
session/device while flash drive is mounted. l Vector 2d: User forwards the file to an unauthorized
recipient. |
|
Location 3: Printed to a nearby printer
over a wireless network connection. l Vector 3a: Attacker monitors unencrypted or weakly encrypted
wireless network communications and captures the data being sent to the
printer l Vector 3b: Attacker views a printout of the spreadsheet. |
|
Location 4: Processed locally. l Vector 4a: Attacker gains access to/control over user’s
session/device. |
|
Location 5: Input locally l Vector 5a: Attacker watches the information being typed in to the
laptop. l Vector 5b: Attacker uses keystroke logger on laptop to monitor
keystrokes. |
|
Location 6: Output locally. l Vector 6a: Attacker views the information on the laptop screen l Vector 6b: Attacker uses malware on laptop to take screen shots. |
|
Selected attack
vectors (based on the possibility and the likelihood of each attack
vector being used to completely compromise confidentiality) l Vector 1c: Data is stored in a spreadsheet on the local hard
drive; attacker steals and reuses user/admin/service credentials. l Vector 1d: Data is stored in a spreadsheet on the local hard
drive; attacker gains access to/control over user’s session/device. l Vector 2b: Data is stored in a spreadsheet on a flash drive
backup; attacker steals and reuses user/admin/service credentials for laptop
while flash drive is mounted. l Vector 2c: Data is stored in a spreadsheet on a flash drive
backup; attacker gains access to/control over user’s session/device while
flash drive is mounted. l Vector 4a: Data is processed locally; attacker gains access
to/control over user’s session/device. |
Step 3: Characterize the Security Controls for Mitigating the Attack
Vectors
|
Feasible security control alterations: 1.
Require strong password with
strongly encrypted password hash (vectors 1c and 2b). l Effectiveness: Low l Acquisition and implementation costs: Low l Annual management/maintenance costs: Low l Impact on functionality: Low
l Impact on usability: Low l Impact on performance: Low
2.
Require multifactor authentication (vectors 1c and 2b) l Effectiveness: High l Acquisition and implementation costs: Moderate l Annual management/maintenance costs: Moderate l Impact on functionality: Low
l Impact on usability: Moderate
l Impact on performance: Low 3.
Use antivirus software, spam
filtering, real-time blacklists, user awareness, web reputation software, etc.
(vectors 1c, 1d, 2b, 2c, and 4a) l Effectiveness: Moderate l Acquisition and implementation costs: Moderate l Annual management/maintenance costs: Moderate l Impact on functionality: Moderate
l Impact on usability: Moderate
l Impact on performance: Moderate
4.
Patch vulnerabilities (vectors
1c, 1d, 2b, 2c, and 4a) l Effectiveness: Low l Acquisition and implementation costs: Moderate l Annual management/maintenance costs: Moderate l Impact on functionality: Moderate l Impact on usability: Low l Impact on performance: Moderate |
Step 4: Analyze the Threat Model
|
After much debate, the organization
decides to set the following scores for the characteristics and weigh them
all evenly: l No security control effectiveness = 0 l Security control effectiveness of low = 1 l Security control effectiveness of moderate = 2 l Security control effectiveness of high = 3 l Negative implication of high = 1 l Negative implication of moderate = 2 l Negative implication of low = 3 |
|
Possible Security Controls |
Acquisition
and Implementation
Costs |
Annual
Management/ Maintenance
Costs |
Impact
on Functionality |
Impact
on Usability |
Impact
on Performance |
Total
for Security Control |
|
Require strong password with strongly
encrypted password hash |
3 |
3 |
3 |
3 |
3 |
15 |
|
Require multifactor authentication |
2 |
2 |
3 |
2 |
3 |
12 |
|
Use antivirus software, spam filtering,
real-time blacklists, user awareness, web reputation software, |
2 |
2 |
2 |
2 |
2 |
10 |
|
Patch vulnerabilities |
2 |
2 |
2 |
3 |
2 |
11 |
|
Possible Security Controls |
Security Control Effectiveness Per Attack Vector 每個攻擊媒介的安全控制有效性 |
Negative Implication Total |
Security Control Effectiveness Times Negative Implication Total Per Attack Vector 安全控制有效性 乘以負面影響 每個攻擊媒介的總影響 |
||||||||
|
1c
|
1d |
2b |
2c |
4a |
1c |
1d |
2b |
2c |
4a |
||
|
Require strong password with strongly encrypted password hash |
1 |
0 |
1 |
0 |
0 |
15 |
15 |
0 |
15 |
0 |
0 |
|
Require multifactor authentication |
3 |
0 |
3 |
0 |
0 |
12 |
36 |
0 |
36 |
0 |
0 |
|
Use antivirus software, spam filtering, real-time blacklists, user awareness, web reputation software, etc. |
2 |
2 |
2 |
2 |
2 |
10 |
20 |
20 |
20 |
20 |
20 |
|
Patch vulnerabilities |
1 |
1 |
1 |
1 |
1 |
11 |
11 |
11 |
11 |
11 |
11 |
自訂以數據為中心的系統威脅建模方法
本出版物主要介紹了以數據為中心的系統威脅建模定性方法。定量方法將比定性方法帶來更精確和準確的結果，但定量方法也將更加資源密集，並且除非指標和方法大多是自動化的，否則無法很好地擴展大型複雜系統的建模。 由於這種自動化尚未廣泛使用，如果有的話，本出版物側重於定性
建模，這仍然非常有益。將來，隨著更多自動化定量指標和方法的出現，組織應該重新考慮使用定量建模的可行性。
方法中的大多數操作都可以在內容（捕獲哪些資訊）和格式/結構（如何捕獲資訊）方面以多種方式進行處理。沒有“正確”的方法，這些例子純粹是說明性的。重要的是記錄足夠的資訊，以便為後續步驟提供必要的輸入，併為提出可操作的建議奠定基礎。
該方法靈活性的一個主要例子是步驟2。步驟 2 使用步驟 1 中的授權位置清單來獲取感興趣的數據。在示例中，每個攻擊媒介都以敘述方式定義，例如「攻擊者獲得了對筆記型電腦的未經授權的物理訪問，使用取證工具或其他實用程式複製檔（無需對操作系統進行身份驗證）」。。這個單一的語句實際上傳達了三條數據：1）惡意內容的來源，2）該惡意內容的潛在易受攻擊的處理器，以及3）惡意內容本身的性質。
一些組織可能更喜歡使用更具敘述性的方法來定義攻擊向量，因為其他人更容易理解，而其他組織可能希望採用更徹底或基於技術的方法，因此希望將威脅後果和操作作為識別攻擊向量的分類法。當然，由於現有的流程和工具或其他原因，還有許多其他方法來定義攻擊媒介，各個組織可能更喜歡使用。
另一個要考慮的因素是攻擊媒介的粒度;一個組織可能只有資源在真正高層次上考慮攻擊向量，而另一個組織可能希望進行深入研究，並使攻擊向量盡可能窄。Organizations may also want 確定其威脅建模的範圍，從而減少工作量。以步驟 2 為例，組織可以決定消除任何不值得進一步考慮的攻擊媒介。例如，組織可能決定忽略相對可能性最低的攻擊向量，因為有太多其他攻擊向量需要考慮。
同樣，組織可能只對可能導致機密性、完整性和可用性完全受損的攻擊媒介感興趣（至少在最初階段）。另一種可能性是消除沒有任何可行緩解措施的攻擊媒介。理想情況下，組織應該在篩選出任何攻擊向量之前分析所有攻擊向量 - 例如，一個不太可能的攻擊向量可能變得非常容易且便宜地緩解，或者單個緩解措施可以解決多個攻擊向量 - 但實際上，在某些情況下這可能不可行。
當然，組織可以跳過方法中與特定情況或環境無關的任何元素，同樣，如果其他因素對組織也很重要，組織也可以添加特徵。
