Threat Modelling with STRIDE/Attack Trees

Question 1

What do vulnerability-threat-control-frameworks do?

Answer 1

Describe how assets may be harmed and how to counter/mitigate that harm

Question 2

Why are threats modelled?

Answer 2

Find issues early
Improve security requirements
Mitigate risks

Question 3

Three Types of Threat Models with examples

Answer 3

• Attacker-centric – starts with attacker/goals (e.g. attack trees)
• System-centric – models system dynamics/logic (e.g. STRIDE)
• Asset-centric – focuses on assets and CIA branches (e.g. ISO27005)

Question 4

What does STRIDE stand for?

Answer 4

Spoofing
Tampering
Repudiation
Information Disclosure
Denial of Service
Elevation of Privileges

Question 5

Spoofing - definition, property, example

Answer 5

Definition - impersonating something/someone else
Property – authentication
Ex – pretending to be Microsoft.com

Question 6

Tampering - definition, property, example

Answer 6

Definition: modifying data/code
Property – integrity
Ex – modifying a DLL on disk

Question 7

Repudiation - definition, property, example

Answer 7

Definition - denying actions Property – non-repudiation
Ex – I didn’t send that email

Question 8

Information disclosure - definition, property, example

Answer 8

Definition - exposing data to unauthorised party
Property – confidentiality
Ex – leaking credit cards

Question 9

Denial of service - definition, property, example

Answer 9

Definition - denying or degrading services to users
Property – availability
Ex – CPU overload

Question 10

Elevation of Privileges - definition, property, example

Answer 10

Definition - gaining capabilities w/o proper authorisation
Property – authorisation
Ex – becoming admin

Question 11

Steps in STRIDE process

Answer 11

Step 1: Model the software system. Use data flow diagram (DFD) for functionality and data flow.

Step 2: Identify the threats. Apply STRIDE to DFD elements

Step 3: Mitigate the threats. Redesign to address threats (generates security requirements)

Step 4: Validate. Ensure threats are removed

Question 12

DFD Elements

Answer 12

External entity = data source/sink (e.g., user, other system)
Process = data action (e.g., transformation)
Data store = storage (e.g., DB file)
Data flow = labelled arrows (uni/bi-directional)

Question 13

DFD Levels

Answer 13

level 0 (context: overview, single process). Level 1+ (detailed processes/stores)

Question 14

What are trust boundaries in DFD?

Answer 14

Dashed lines where control changes (e.g., machine/privilege); ignore threats inside trusted areas

Question 15

DFD validation rules

Answer 15

No magic data
No sinks
Flows through processes
stick to model

Question 16

Application of STRIDE

Answer 16

Process - apply all STRIDE
Data store/data flow - apply TID
Data store with logs - apply TID+R
External entity - apply SR

Question 17

What do you do after STRIDE is applied?

Answer 17

Number each DFD element
Write the set of threats that impact that element

Question 18

What is an attack tree?

Answer 18

A tree data structure modeling attacks from attacker’s view
Root = global goal
Children = sub-goals (AND/OR)

Question 19

Benefits of attack trees

Answer 19

Structured
Visual
Modular
Reusable
Attacker-centric for likely threats

Question 20

Key questions for attacker-centric modelling

Answer 20

Adversaries? Motivations/goals? Inside info? Funding? Risk aversion?

Question 21

Motivation for using attack trees over system-based modelling

Answer 21

Avoids random/incomplete lists
Thinks like attacker for better threat identification

Question 22

Difference between AND and OR nodes in attack trees?

Answer 22

AND: All sub-goals required
OR: Any one sub-goal sufficient.

Question 23

Notation for Nodes AND

Answer 23

Graphical: straight line connecting children
Textual: Goal G0
AND G1
G2
…
Gn

Question 24

Notation for Nodes: OR

Answer 24

Graphical - curved/dotted line
Textual: Goal G0
OR G1
G2
…
Gn

Question 25

Boolean Attrbiutes

Answer 25

Assign to leaf notes (e.g. possible/impossible, easy/hard, expensive/inexpensive, legal/illegal, special equipment/no special equipment) Propagate up: AND = all true; OR = any true

Question 26

How do continuous attributes (e.g., cost) propagate?

Answer 26

AND = value of sum of their children OR = value of their cheapest child

Question 27

Contrast attack trees vs STRIDE

Answer 27

Attack Trees: Attacker goals/paths; STRIDE: System elements via DFD/mnemonic