Threat Analysis Lunar Security Services

2 Overview Definitions Representation Challenges “The Unthinkable” Strategies & Recommendations

3 Background What is threat analysis? – Potential Attacks/Threats/Risks – Analysis – Countermeasures – Future Preparations NIST’s “Introduction to Threat Analysis Workshop”, October 2005

4 Stakes People – Voters – Candidates – Poll Workers – Political Groups – Developers – Board of Elections – Attackers – More... Voting: A System of... – IT – American Politics – Duty – Trust – Inclusion – Safety – Process – Precedence...if it works

5 Means of Representation General tactic: – Identify possible attackers – Identify goals of attacker – Enumerate possible ways to achieve goals – Locate key system vulnerabilities – Create resolution plan

6 Bruce Sheneier, Dr. Dobb’s Journal, 1999: – Used to “model threats against computer systems” Continual breaking down of goals and means to achieve them Attack Tree Simple Example Cost propagationMultiple Costs

7 Attack Tree Evaluation Creation – Refining over time – Realistic costs Advantages – Identifies key security issues – Documenting plans of attack and likelihood – Knowing the system Disadvantages – Amount of documentation – Can only ameliorate foreseen circumstances – Difficult to prioritize/quantize factors Shortened version of an Attack Tree for the interception of a message send with a PGP header.

8 Other Means of Representation Threat Catalog – Doug Jones – Attacks -> vulnerabilities -> analysis of defense – Challenges Organization Technology Identity Scale of Attack Fault Tree Analysis – Ensures product performance from software – Attempts to avoid single-point, catastrophic failures

9 Challenges Vulnerabilities – System – Process Variety of possible attacks New Field: Systems Engineering Attack Detection Attack Resolution -> too many dimensions to predict all possibilities, but we’ll try to name a few…

10 “The Unthinkable”, Part 1 1.Chain Voting 2.Votes On A Roll 3.The Disoriented Optical Scanner 4.When A Number 2 Pencil Is Not Enough 5....we found these poll workers where?

11 “The Unthinkable”, Part 2 6.This DRE “fell off the delivery truck”... 7.The Disoriented Touch Screen 8.The Confusing Ballot (Florida 2000 Election) 9.Third Party “Whoopsies” 10.X-ray vision through walls of precinct

Natalie Podrazik – “The Unthinkable”, Part 3 11.“Oops” code 12.Do secure wireless connections exist? 13.I’d rather not have your help, thanks Trojan Horse 15.Replaceable firmware on Optical Scanners

Natalie Podrazik – “The Unthinkable”, Part 4 16.Unfinished vote = free vote for somebody else 17.“I think I know what they meant by...” 18.Group Conspiracy: “These machines are broken.” 19.“That’s weird. It’s a typo.” 20.Denial of Service Attack

Natalie Podrazik – My Ideas... Write-in bomb threat, terrorist attack, backdoor code Swapping of candidate boxes (developers) at last minute on touch-DRE; voters don’t know the difference Children in the voting booth

15 Strategies & Recommendations Create Fault Trees to counter Attack Tree goals using the components set forth in Brennan Study Tamper Tape Use of “independent expert security team” – Inspection – Assessment – Full Access Use of “Red Team Exercises” on: – Hardware design – Hardware/Firmware configuration – Software Design – Software Configuration – Voting Procedures (not hardware or software, but people and process)

16 Conclusions Attack Trees – Identify agents, scenarios, resources, system-wide flaws Challenges: dimensions in system analysis Unforeseen circumstances Independent Team of Experts, but how expert can they be?

17 Works Cited 1.All 20 “The Unthinkable” scenarios available at: Goldbrick Gallery’s 25 Best Editorial Cartoons of Online: Jones, Doug. “Threat Taxonomy Overview” slides, from the NIST Threats to Voting Workshop, 7 October Online: Mell, Peter. “Handling IT System Threat Information” slides, from the NIST Threats to Voting Workshop, 7 October Online: “Recommendations of the Brennan Center for Justice and the Leadership Conference on Civil Rights for Improving Reliability of Direct Recording Electronic Voting Systems”: ndations.pdf: ndations.pdf 6.Wack, John, and Skall, Mark. “Introduction to Threat Analysis Workshop” slides, from the NIST Threats to Voting Workshop, 7 October Online: Wikipedia Entry for fault tree:

18 Attack Tree: Open Safe The goal of the attacker here is to Open Safe. The means by which he/she accomplishes this is described by each subsequent box. The dotted lines denote the most likely possibilities. Attack Tree…

19 Attack Tree: Likelihood by Cost The goal of the attacker here is to Open Safe. The dollar amounts for each box are propagated from the leaf node(s) of each branch, making the most likely estimate along the dotted line, costing $10K to cut open the safe. Note that each parent-child relationship is an implied OR, unless explicitly noted, as in the Eavesdrop action. Attack Tree…

20 Attack Tree: Multiple Factors The goal of the attacker here is to Open Safe. Two factors are considered when calculating the most likely (efficient) approach an attacker would take: the use of special equipment and monetary cost to carry out the job. The dotted lines show the best plan of action. Attack Tree…