1. Socializing Attack/Defense Trees to Prevent Misuse
Özgür Kafalı
Postdoctoral Researcher

2. Security Threat Modeling
Attack/defense trees
Misuse case diagrams

3. Current Approaches Informal Focus mainly on technical vulnerabilities
Written in natural language
Cannot formalize how nodes relate to each other
Focus mainly on technical vulnerabilities
Less attention to human misuse
Intentional or unintentional

4. Goals I fixed 100+ vulnerabilities today, great!
How many humans did you fix though?
Enhance attack/defense
trees with social factors
to understand and
prevent misuse
Picture credit to

5. Towards Happy Little Attack/Defense Trees
Bob Ross
on trees and their significance:
Picture credit to “
“Trees don't grow even, they don't grow straight ... Just however it makes them happy”

6. How Prevalent are Misuses?
Investigated 1,600 breaches from HHS
Common misuses:
Improper disposal Incorrect s

7. HHS Breach Categories
Vulnerabilities
Misuses
44%

8. Are Policies Enough to Prevent Misuse?
HIPAA clause: Implement policies and procedures to address the final disposition of electronic protected health information, and/or the hardware or electronic media on which it is stored
Breach: failure to erase patient data on disposed photocopiers’ hard drives

9. How Good is HIPAA?
very
few
Vulnerabilities
Misuses

10. Normative Formalization
Commitments
Authorizations
Prohibitions

11. Representing Requirements
Parents are authorized to
access minor’s medical records
if they are legal representatives.

12. Representing Breaches
Breach: failure to erase patient data on disposed photocopiers’ hard drives
Healthcare workers are committed to
erasing any media that
might contain sensitive
patient data

13. Social Factors Norms regulate interactions of users
State who is accountable
to whom, and for what
Picture credit to

14. Normative Reasoning
Having a normative model enables formal relations among norms
Understand conflicts
Pairwise comparison of norms
Understand what desired security properties our threat models support

15. Normative Attack/Defense Trees
Asset
Misuse
Malware
Phishing
Norm
Norm
Violation
Sanction
Refine

16. Efforts to Improve Threat Models
Collaborative games for identification and risk based prioritization of vulnerabilities
Protection Poker Elevation of Privilege

17. Norm Defense Game Strategy card game for security
Attacker and defender teams
New elements:
Accountability
Forensics
Logging
Forensics
Acc
Logging

18. Evaluation Different game modes: experts, novices
Introduce random elements to simulate realistic scenarios
Novelty: Outcome holds
clues about security of
the subject system

19. Benefits For us: More papers For you: Less misuse
For the greater good: raise awareness regarding social factors

20. Collaboration Investigation of breaches Game design and evaluation
Seeking breach reports from organizations
Game design and evaluation
Seeking players to be involved in our game
Our approach will improve your threat models, or your money back!