threat model: malicious users
implies that message traffic is safe and there is no need to encrypt communications
threat model: snooping attackers
implies that message traffic is visible, and encrypted wifi and network layers are needed
threat model: co-located user
implies that local files and memory are accessible, and so nothing can be stored unencrypted; implies that server can be compromised
assumptions in threat modeling
are potential holes the adversary can exploit; assuming one threat model over another leaves you susceptible to the other
the best approach to building secure software is to
incorporate security-minded thinking into all phases of development; do not just add after functional requirements are met
security requirements
security-related goals or policies + required mechanisms for enforcing them
abuse cases
describe what a system should not do; a case in which a security breach occurs
threat modeling
to make explicit the adversary’s assumed powers; build software assuming that someone can do x, then add something to keep them from doing it
best practice for threat modeling
compare against similar systems, understand past attacks, challenge assumptions and prepare for someone to get past a defense
flaws
problems in the design of a program; works as intended, but didn’t anticipate certain cases
bugs
problems in implementation; design may be strong, but doesn’t work as intended
50% of security problems are:
design flaws; didn’t anticipate certain cases
prevention
aim to eliminate siftware defects entirely
mitigation
aim to reduce the harm from exploitation of unknown defects; if an abuse case becomes real, reduces the harm able to be done
detection & recovery
identify and understand an attack, undo damage
default-deny policy
a program denies all access, and only allows that which has been explicitly permitted
separation of responsibility
privilege is split up so no one person/program has total power; multi-factor authentication
reference monitor
code that checks for permission to access a resource
account for human factors
security measures must be easy to use and have instructions if not intuitive
Kerkhoff’s principle
a cryptosystem should be secure, even if everything about the system but the key is public knowledge;
threat model: malicious users
implies that message traffic is safe and there is no need to encrypt communications
threat model: snooping attackers
implies that message traffic is visible, and encrypted wifi and network layers are needed
threat model: co-located user
implies that local files and memory are accessible, and so nothing can be stored unencrypted; implies that server can be compromised
assumptions in threat modeling
are potential holes the adversary can exploit; assuming one threat model over another leaves you susceptible to the other
