Security Consulting and Strategic Research Threat Modeling Jeffrey A. Ingalsbe Security Consulting and Strategic Research Ford Motor Company (313) 390-9278 jingalsb@ford.com

The Problem(s) Security was viewed as IT’s responsibility Security was viewed as an add-on or a burden Internal Business customers were adversarial Internal Business customers were absent Auditability of the sdlc was poor The same vulnerabilities kept were not going away There was no “dial” for controls It was difficult to talk to lawyers about risk The intranet was considered “safe” Employees were “trusted” NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

One Solution: Threat Modeling Threat Modeling is : A repeatable process Collaborative Proactive Executed during the design phase (mostly) Risk quantifying Business empowering Awareness raising NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

Ford’s Journey Piloted Microsoft’s TAM tool in 2005 Rolled out Threat Modeling as a service in 2007 Launched “Fast Pass” Threat Modeling in 2008 Piloting Microsoft’s SDLTM tool in 2009 NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

Terms Model: Representation of reality constructed using Roles, Data, and Components, used to build Use Cases, generate Threats, and analyze Risk, and develop a Risk response. Use Case: Not a UML use case. A higher level interaction between people and the components of your system involving data to achieve some business objective. Threat: Potential unintended event which may occur within a use case. There are three kinds of threats according to the Microsoft tools: threats to Confidentiality , threats to Integrity, and threats to Availability. NOTE: A threat doesn’t have to be malicious! Risk: The aggregate of discoverability, reproducibility, exploitability, affected users, and damage potential (DREAD). Risk Response: Planned action to address risk. You can Reduce, Transfer, Avoid, Accept. NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

Participants Business owners First and foremost SMEs Architects Developers Application owners Infrastructure owners IT Security Threat modelers CIRT Forensics Encryption Authentication NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

Time Commitment Minimum Maximum 7 calendar days 3 half-day meetings with the entire team 2 full-days of work for security members Maximum 4 to 6 calendar weeks 4 to 6 half day meetings with the entire team 1 or 2 full-days of work for security members NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

Process Identify business objectives Set scope Construct model Roles Data Compnents Use cases Generate threats Analyze threats Determine Risk Responses Report out Improve process NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

Process NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

Results Used threat modeling to reduce risk on strategically important IT projects. Saved significant calendar time on processing launch related IT work. Optimized process and applied to pilots, PoCs, and processes. Raised awareness on risk-based decision making. Taught people to fish. Moved the needle with several important business customers (specifically the OGC). NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).

Security Consulting and Strategic Research Questions Jeffrey A. Ingalsbe Security Consulting and Strategic Research Ford Motor Company (313) 390-9278 jingalsb@ford.com NOTES: Refer to avoidance of re-work (last bullet) is applied at optimal point in development process. Contrast with penetration testing and security assessments (both occurring later in the process).