1. A short introduction and stories from end user involvement
Threat modelling
A short introduction and stories from end user involvement
SRM Seminar Luxembourg
Per Håkon Meland - SINTEF ICT, Trondheim, Norway

2. Motivation and background

3. Integration and access control of EPRs
Hospital systems (2005 )
Integration and access control of EPRs
Models used to communicate processes and threats
In 2005 we started doing a lot of process and threat modelling related to hospital system integration
Røstad, L. (2006). An extended misuse case notation, including vulnerabilities and the insider threat. REFSQ'06,
Luxembourg.
Easy to read, simple notation, not too complex
Models are a good way of communicating between different people

4. SHIELDS EU project Sharing of security knowledge End user evaluations
8 partners
Sharing of security knowledge
Models
Methods
Tools and tool input
End user evaluations
Sevaral iterations
Real end-users
Case studies and commercial products

5. Threat modelling

6. Threat modelling Misuse cases and attack trees Highly reusable
Understand potential security threats and vulnerabilities
Understand attackers
Find security design issues before code
Determine countermeasures
Guide the code review /testing/configuration /deployment
Highly reusable
Easy to grasp
Today:
Blackboards and incompatible tools
Designers start from scratch for every project
Little knowledge sharing
Provide security knowledge and reusable diagrams to help developers 9

7. Example: Media player

8. Xine media player
[This slide should be skipped, but is kept hidden in case we need to repat how to perform the first step of the activity.] 11

9. Let’s create a model from scratch…
Create use case model from scratch 12

10. Main functionality: Actors: Download data (application, codecs,
skins, ...)
Play local media file
Play media stream
Actors:
Software developer
User 13

11. Add threats 14

12. Add threats 15

13. How about reusing one?
Create use case model from scratch 16

14. Search for existing misuse case diagrams:
[This part should be performed live, but the slide is kept as a summary.]
At the last demo, we also did a search for existing threat models related to media players. We did not find any misuse case diagrams back then, but let’s try again this time.
[search for media using the SVRS user interface]
Ok, we found this model, and by clikcing on it we can get an overview of its contents.
This model definitely seems relevant, so let’s download it and analyse it further using SeaMonster.
[download model with SVRS user interface, open model in SeaMonster]
Ok, this model seems like a very good basis for the Xine application. The funtionality seems to be covered, the model shows typical threats, vulnerabilities I should be aware of, and also a set of possible mitigating security activities I should consider.
[mention some examples from the model]
Search for existing misuse case diagrams:
“Media”, “player”, “Movie” 17

15. [This part should be performed live, but the slide is kept as a summary.]
At the last demo, we also did a search for existing threat models related to media players. We did not find any misuse case diagrams back then, but let’s try again this time.
[search for media using the SVRS user interface]
Ok, we found this model, and by clikcing on it we can get an overview of its contents.
This model definitely seems relevant, so let’s download it and analyse it further using SeaMonster.
[download model with SVRS user interface, open model in SeaMonster]
Ok, this model seems like a very good basis for the Xine application. The funtionality seems to be covered, the model shows typical threats, vulnerabilities I should be aware of, and also a set of possible mitigating security activities I should consider.
[mention some examples from the model] 18

16. Attack trees
[This part should be performed live, but the slide is kept as a summary.]
At the last demo, we also did a search for existing threat models related to media players. We did not find any misuse case diagrams back then, but let’s try again this time.
[search for media using the SVRS user interface]
Ok, we found this model, and by clikcing on it we can get an overview of its contents.
This model definitely seems relevant, so let’s download it and analyse it further using SeaMonster.
[download model with SVRS user interface, open model in SeaMonster]
Ok, this model seems like a very good basis for the Xine application. The funtionality seems to be covered, the model shows typical threats, vulnerabilities I should be aware of, and also a set of possible mitigating security activities I should consider.
[mention some examples from the model] 19

17. Link to attack patterns Used to identify mitigations
Hide the details
Link to attack patterns
Used to identify mitigations
[This part should be performed live, but the slide is kept as a summary.]
At the last demo, we also did a search for existing threat models related to media players. We did not find any misuse case diagrams back then, but let’s try again this time.
[search for media using the SVRS user interface]
Ok, we found this model, and by clikcing on it we can get an overview of its contents.
This model definitely seems relevant, so let’s download it and analyse it further using SeaMonster.
[download model with SVRS user interface, open model in SeaMonster]
Ok, this model seems like a very good basis for the Xine application. The funtionality seems to be covered, the model shows typical threats, vulnerabilities I should be aware of, and also a set of possible mitigating security activities I should consider.
[mention some examples from the model] 20

18. Finally…
[This part should be performed live, but the slide is kept as a summary.]
At the last demo, we also did a search for existing threat models related to media players. We did not find any misuse case diagrams back then, but let’s try again this time.
[search for media using the SVRS user interface]
Ok, we found this model, and by clikcing on it we can get an overview of its contents.
This model definitely seems relevant, so let’s download it and analyse it further using SeaMonster.
[download model with SVRS user interface, open model in SeaMonster]
Ok, this model seems like a very good basis for the Xine application. The funtionality seems to be covered, the model shows typical threats, vulnerabilities I should be aware of, and also a set of possible mitigating security activities I should consider.
[mention some examples from the model] 21

19. Create textual description to accompany the diagram
A document elaborating the diagram
Threat descriptions can be fetched from the SHIELDS SVRS
Gives an understanding of the possible attacker motivation
There can be several different mitigations
Input to risk analysis and security activity planning
Explain that a textual misuse case should accompany the diagram, and show a premade one for XINE (Table 1 of D1.4).
Mention that the model should be uploaded to aid other developers that create similar applications with the same characteristics. 22

20. Case study: eTourism

21. Phase 2: Parallel modelling Phase 3: Serial modelling
Approach
Phase 1: Tutorial
2:Threat
model created
by experts
4:Model
consolidated
by experts
5:Threat
model updated
by developers
6:Threat
model endorsed
by experts
1:Application
description
3:Threat
model created
by developers
Phase 2: Parallel modelling
Phase 3: Serial modelling

22. Pre-visit, plan: Post-visit, share Bad stuff? Hotels Route Experiences
Virtually explore
Post-visit, share
Pictures/videos
Recommendations
Blog
Bad stuff?

23. Case study: WaLDo

24. Warehouse information system
Dock loading
RFID tracking
Picking lists
Advanced shipping notifications
Bad stuff?

26. Case study: eNewsPaper

27. Electronic newspaper Bad stuff? Aimed for the Paris metro
Shared from distribution points
User relays
Bad stuff?

29. Feedback and lessons learned
New threats and mitigations were identified in all case studies
Misuse cases and attack trees: Easy to learn, easy to use
Important with diversity while doing threat modelling
Keep the size of the models down
Need more models from other application areas

30. Share models through the SVRS!
Now contains >200 free security models
18 misuse case models
29 attack trees
Use the free tools, or integrate your own
Add your own, get feedback (and possibly revenue)