1. Copyright © The OWASP Foundation Permission is granted to copy, distribute and/or modify this document under the terms of the OWASP License. The OWASP Foundation OWASP http://www.owasp.org Threat Modeling - Overview Megha Anand itsmeghaanand-at-gmail-dot-com

2. OWASP 2 Agenda  Terminology  Terminology Example  Threat Modeling  Benefits  Who  Process Overview  Business Security Objectives  Model the System  Application Decomposition  Threat Profile  STRIDE & its Relation  Threat Tree  Risk Assessment  Example

3. OWASP Terminology  Asset: Things to protect (tangible or intangible)  Entry/Exit Points: Ways to get at an asset  Threat: Risks to an asset  Attack / exploit: An action taken that harms an asset  Vulnerability: Specific ways to execute the attack  Risk: Likelihood that vulnerability could be exploited  Mitigation / Countermeasure: Something that addresses a specific vulnerability We can mitigate vulnerabilities… …but the threat still exists!!! 3

4. OWASP Terminology Example 4 Asset – ATM Machine

5. OWASP Terminology Example Use Case  Customer withdraws cash from ATM  Checks balance in his/her account  Transfers cash to some other account 5

6. OWASP Terminology Example 6 Attacker – Burglar

7. OWASP Terminology Example 7 Threat – Denial of Service Attack – Physically tempered Vulnerability – Plastic made Closed

8. OWASP Terminology Example Security Controls  Guard  CCTV Cameras  ATM Machine should be made of Steel/Iron But threat still persists!!! 8

9. OWASP Take Away!!! Key Point: We can reduce the risk but cannot rid of completely!!! Assumption: Lets engage in repetitive penetration testing Question: During Development? At deployment? After deployment? 9

10. OWASP Threat Modeling Its an iterative process which helps in  Simplifies qualitative risk assessment  Identify security objective  Create security profile of application  Identify & prioritize threats  Visualizing & documenting threats 10

11. OWASP Benefits 11 CostTime Quality

12. OWASP Cost 12 Less Very High

13. OWASP Time 13 Requirement Gathering or Early stages of SDLC

14. OWASP Post Production 14

15. OWASP Quality 15

16. OWASP Who 16  Developers  Security Consultants  Architects  IT Project Managers

17. OWASP Process Overview  Identify business security objectives  Decompose Application  Understand attacker & abuse cases  Threat Analysis  Risk Analysis  Security controls 17

18. OWASP Business Security Objective  It’s a high level overview of what security issues need to be addressed in order to maintain business objective.  Generate security objective with help of - Confidentiality - Integrity - Availability 18

19. OWASP Model the System  Entry Points  Assets  Roles & Identities  Trust Levels 19

20. OWASP Decompose Application DFD Components 20 Web Server Request Response External Entity - Entry point of application

21. OWASP Decompose Application DFD Components 21 Web Server Request Response Process - Perform an Action

22. OWASP Decompose Application DFD Components 22 Web Server Request Response Data store - Where data is stored

23. OWASP Decompose Application DFD Components 23 Web Server Request Response Data Flows - Direction of Data Movement

24. OWASP Decompose Application DFD Components 24 Web Server Request Response Trust Boundary – Physical or Logical

25. OWASP Example 25

26. OWASP Simple Approach - Threat Profile  Where to BEGIN??? 26 Confidentiality (who can read) Integrity (who can write) Availability (who can access) Network Server Application

27. OWASP STRIDE - Threat categories  Spoofing  Tempering  Repudiation  Information Disclosure  Denial of Service  Escalation of Privileges 27

28. OWASP Threat Categories & Security Control  Spoofing Authentication  TemperingIntegrity  Repudiation Non – repudiation  Information DisclosureConfidentiality  Denial of Service Availability  Escalation of PrivilegeAuthorization 28

29. OWASP Threat – Element Relation 29 DFD ComponentSTRIDE Entity Process Data Flow Data Store

30. OWASP Threat Tree 30

31. OWASP Risk Assessment Simplest Approach  Low, Medium, High  Impact/Likelihood Matrix 31 LowMediumHigh Low Medium LowMediumHigh MediumHigh

32. OWASP Practical Example 32

33. OWASP 33