1. Threat Modeling in the garden of Eden Mano ‘dash4rk’ Paul HackFormers

2. ABC’s about me Author – Official (ISC) 2 Guide to the CSSLP Advisor – (ISC) 2 Software Assurance Advisor Biologist (Shark) Christian CEO, SecuRisk Solutions & Express Certifications

3. Agenda Teach Security: Threat Modeling Teach Christ: In the garden of Eden Discussion

4. Teach Security Threat Modeling

5. Process/Activity – Systematic to determine applicable threats – Iterative to ensure threats are addressed A must-have for companies today – Cannot ignore

6. Why Threat Model? To manage Risk! Risk of what? Disclosure/Alteration/Destruction Risk to what? Assets Why? Threats agents and Vulnerabilities So what do we do? Threat Model  Identify threats & vulnerabilities Then what? Manage risk  apply controls Model threats  Apply controls  Reduce risk

7. ABC of Threat Modeling Step 1: Identify Assets Step 2: Identify Boundaries (Entry/Exit/Flows) Step 3: Identify Controls – But first we need to identify applicable Threats

8. Assets (anything of value) – Financial – Personal – Sensitive – Intellectual property Step 1: Identify Assets

9. Step 2: Identify Boundaries InternalDMZ External

10. Step 3: Identify Controls Oh but first, we need to identify Threats Threat Identification – Attack Trees – Threat Framework

11. STRIDE Threat Framework Spoofing Tampering Repudiation Info. Disclosure Denial of Service Elevation of Privilege Masquerading Alteration Denying Data Loss/Leakage Downtime Admin (root)

12. Identify Controls ThreatControls Secure generation/transmission/storage of credentials (passwords); SSL; Multifactor Authentication Hashing; Digital signatures; Secure Communications; Input validation Digital signatures; Secure audit trails (logging) Cryptographically protection (Encryption/Hashing …); User awareness against Phishing Input validation and filtration; Resource and bandwidth throttling; Load balancing; Disaster Recovery Least privilege (Need to know); Compartmentalization Appropriate INCORPORATION of Controls reduces Risk Spoofing Tampering Info. Disclosure Denial of Service Elevation of Privilege Repudiation

13. Teach Christ In the garden of Eden

14. What is man that thou (God) art mindful of him? – Psalm 8:4 Man - God’s most precious asset – “For you are fearfully and wonderfully made” (Psalm 139:14) – “Created in the image of God” (Genesis 1:27) Man – God’s most prime asset – Dominion was given to man over all the fish, fowl and all living things that moved upon the earth (Genesis 1:28) – Apex of God’s creation; not Ex-Ape of Evolution The Asset

15. The Boundaries Garden of Eden External

16. The threats In the Garden Spoofing Tampering Repudiation Info. Disclosure Denial of Service Elevation of Privilege Prelude to the Garden encounter: Lucifer (the devil) tried to elevate himself above God and was thrown out (Ezekiel 28) Access to the tree of life was denied after man disobeyed (Genesis 3:22-24). The fruit which was bad for the soul (spirit) was pleasing to the eye (flesh) (Genesis 3:6) Adam said (denied): It wasn’t me, but Eve; Eve said (denied): It wasn’t me, but the serpent (Genesis 3:12,13) Devil said: Yea, Hath God said - phishing for information (Genesis 3:1) God said: You shall not eat of the tree of knowledge … (Genesis 2:17) Devil asked: … you shall not eat of any tree? (Genesis 3:1)

17. The Impact Garden of Eden External

18. The Control Garden of Eden External No more boundaries (separation from God); Gift of God is eternal life to all who believe in Jesus Christ – John 3:16 Appropriate INCLUSION of Jesus Christ in our life eliminates the risk of second death

19. Discussion Points What are some of the “threats” in your personal/professional life? How are you addressing these threats?

20. Closing Thoughts try { if (uLikedThisMtg) { getLinkedIn(); subscribeViaEmail(); followAndTweet(); // @hackformers emailUs(); // mano.paul@hackformers.orgmano.paul@hackformers.org } else { giveFeedback(); // mano.paul@hackformers.orgmano.paul@hackformers.org } } catch(Threats t) { applyControl(God JesusChrist); } finally { ThankUandGodBless(); }

21. Want More? Speaker: Michael Howard – Principal Cybersecurity Program Manager, Microsoft – Author, Writing Secure Code and many more … Topic: TBD Date: March 09, 2012 Time: 11:30 a.m. – 1:00 p.m. Venue: Microsoft Technology Center www.hackformers.org @hackformers

22. Backup

23. Identify Control ThreatControls SpoofingSecure generation/transmission/storage of credentials (passwords); SSL; Multifactor Authentication TamperingHashing; Digital signatures; Secure Communications; Input validation RepudiationDigital signatures; Secure audit trails (logging) Information DisclosureLet your ‘Yes’ be ‘Yes’ and your ‘No’ be ‘No’ () Control your tongue (James 3) Denial of ServiceInput validation and filtration; Resource and bandwidth throttling; Load balancing; Disaster Recovery Elevation of PrivilegeLeast privilege (Need to know); Compartmentalization