Threat Modeling 101 Jozsef Ottucsak OWASP Santa Barbara 12/07/18

What will you learn from this presentation? What threat modeling is. Why threat modeling is useful. Good tools for threat modeling. Challenges you will face during threat modeling. … other things? Ask questions!

Speaker Bio Jozsef Ottucsak @fuzboxz Senior Security Engineer at LogMeIn Former developer, former penetration tester SBCTF #1 Place 2018 Passionate about everything security related Cert hoarder: OSCP, MCP, CCSK, CPPT, eMAPT…

Disclaimer Everyone does threat modeling differently, there is no right or wrong. Doing threat modeling “wrong” is probably better than not doing it at all.

Application Security at LogMeIn Lot of offices and products. Very diverse tech stack. Custom SDL based on MS SDL for Agile. “Satellite” based approach. Heavy emphasis on threat modeling.

What is threat modeling? Threat modeling is an activity that helps you identify, enumerate and understand various threats and mitigations within a defined scope.

Why do threat modeling? Doing it early makes vulnerabilities easier/cheaper to fix. Fast security feedback. Teaches security mindset to participants. Works well with business logic vulnerabilities.

What’s in scope? Depends on the application. Could be the same thing on multiple platforms. May contain cloud environment, APIs, infrastructure, etc. Not everything must be in scope.

How does threat modeling work? The development team and the security team sits down, they discuss how the application works, what assets are there and how they are protected. The goal of the session is to identify threats.

Who attends a threat modeling session? Architects, developers (maybe QA) and the security team. If you are doing it alone, you are doing it wrong. Works best with roughly six (∓2) participants. May include members from multiple component teams.

How should you prepare? Request documentation from the dev team and read it. Look up the tech stack and known threats. Understand the business angle. Clarify the scope.

Threat modeling time!

What to do first? Explain the purpose of threat modeling. Walk through the process, so everyone is on the same page. Clarify what actions will be taken based on the findings. Answer any questions before you start. Ask someone to take notes.

Mapping out the application Project the architecture diagram during the session. Clarify changes between the docs and implementation. Ask for a high level overview on what the application does.

Diagram from Netflix Techblog: Findings threats Assume the role of an attacker/fraudster. Go through user flows. Focus on mitigations. Rule out vulnerability categories. Diagram from Netflix Techblog: https://medium.com/netflix-techblog/netflix-billing-migration-to-aws-451fba085a4

Ways to find threats STRIDE Attack Libraries (CAPEC, CWE) Elevation of Privilege / Cornucopia

Threat Modeling Session Security Engineer Attack Tree Documentation Threat Modeling Session Data Flow Diagram Security Bugs Dev Team Wiki Page

Contains only the threats. Useful for security requirements. Attack Tree Example Contains only the threats. Useful for security requirements. Hard to visualize. Gets complex really fast. Diagram from O’Reilly: https://www.oreilly.com/library/view/building-secure-servers/0596002173/ch01s03.html

Data Flow Diagram Example Components, connections and data. Threats are NOT included. Have to find the right level of granularity. Gets complex with lot of components/connections.

Wiki Page Custom templates are very useful! Contains all the notes, follow up items, etc. Threats – JIRA Security Bug tickets. Notifications on changes.

Security Bugs / Follow Up Items Find owner(!) and set deadline for follow up tasks. Assign severity to the vulnerabilities. Handle security bugs according to SLA. Track progress and follow up if necessary.

Remote Threat Modeling Remote meeting challenges still apply. Threat modeling is fast paced and interactive. Online whiteboarding is far from perfect. Non-verbal communication translates poorly.

Gamification Can be used to improve engagement/reward, EoP/OWASP Cornucopia. Reward for findings. Doesn’t mix well with remote sessions.

Threat Modeling Tools Microsoft Threat Modeling Tool OWASP Threat Dragon Draw.io, Lucidchart LibreOffice Draw

Would you like to know more? Adam Shostack - Threat modeling (!!!) Lot of hands-on practice Everything about agile AppSec: J. Bird, L. Bell, ... – Agile Application Security

Questions?

Thank you!