Socializing Attack/Defense Trees to Prevent Misuse Özgür Kafalı Postdoctoral Researcher

Security Threat Modeling Attack/defense trees Misuse case diagrams

Current Approaches Informal Focus mainly on technical vulnerabilities Written in natural language Cannot formalize how nodes relate to each other Focus mainly on technical vulnerabilities Less attention to human misuse Intentional or unintentional

Goals I fixed 100+ vulnerabilities today, great! How many humans did you fix though? Enhance attack/defense trees with social factors to understand and prevent misuse Picture credit to http://www.outsidethebeltway.com/nuclear-planet-engineers-want-us-to-know-theyre-not-homer-simpson/

Towards Happy Little Attack/Defense Trees Bob Ross on trees and their significance: Picture credit to “http://do210.com/p/internships” “Trees don't grow even, they don't grow straight ... Just however it makes them happy”

How Prevalent are Misuses? Investigated 1,600 breaches from HHS Common misuses: Improper disposal Incorrect emails

HHS Breach Categories Vulnerabilities Misuses 44%

Are Policies Enough to Prevent Misuse? HIPAA clause: Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored Breach: failure to erase patient data on disposed photocopiers’ hard drives

How Good is HIPAA? very few Vulnerabilities Misuses

Normative Formalization Commitments Authorizations Prohibitions

Representing Requirements Parents are authorized to access minor’s medical records if they are legal representatives.

Representing Breaches Breach: failure to erase patient data on disposed photocopiers’ hard drives Healthcare workers are committed to erasing any media that might contain sensitive patient data

Social Factors Norms regulate interactions of users State who is accountable to whom, and for what Picture credit to https://www.reddit.com/r/TheSimpsons/comments/19jygj/rolling_rolling_rolling_toxic_barrel_rolling/

Normative Reasoning Having a normative model enables formal relations among norms Understand conflicts Pairwise comparison of norms Understand what desired security properties our threat models support

Normative Attack/Defense Trees Asset Misuse Malware Phishing Norm Norm Violation Sanction Refine

Efforts to Improve Threat Models Collaborative games for identification and risk based prioritization of vulnerabilities Protection Poker Elevation of Privilege

Norm Defense Game Strategy card game for security Attacker and defender teams New elements: Accountability Forensics Logging Forensics Acc Logging

Evaluation Different game modes: experts, novices Introduce random elements to simulate realistic scenarios Novelty: Outcome holds clues about security of the subject system

Benefits For us: More papers For you: Less misuse For the greater good: raise awareness regarding social factors

Collaboration Investigation of breaches Game design and evaluation Seeking breach reports from organizations Game design and evaluation Seeking players to be involved in our game Our approach will improve your threat models, or your money back!