2.2 Threat Modeling Part 2

00:00

welcome to Episode three of Cyber Security Architecture fundamentals.

00:06

Today

00:07

we would carry on on our lesson on track modeling.

00:14

For this session,

00:16

we would focus on three additional trapped models, namely the application tread model,

00:22

the Operation Trap Model

00:25

and the data flow Tretton Mortal. We will begin, for example,

00:30

on how to develop an application track model

00:35

now

00:37

to begin an application trip model. We start with the architectural design diagram

00:44

the security architect do does not start from a vacuum

00:48

we normally come in after at least a skeleton design has been done by the application. Our system architect.

00:57

From the diagram, we will start by identifying our assets on Lee by knowing your assets. Can you start identifying the treads to the assets

01:08

and the right controls to mitigate those trends.

01:15

Now, after identifying your assets, it's time to think about what are the threats to those assets. The treads can come in many forms, and it might take a few alterations to identify all the trends

01:30

most of us come with. Certain bias Is either a system view infrastructure viewer application view to be complete. It's good to bounce off the ideas around other members of the team to get a more complete view off potential threats.

01:47

Now that you have the treads identified,

01:49

make a list off the track factors.

01:53

The track factors include Who are the tread actors

01:57

and what is the trap vector that the tread will come from.

02:01

So

02:02

sit down with the team and start listing out the different tread factors

02:08

with the tread defectives

02:12

identified.

02:13

It is now time to develop controls to mitigate the threats. Now, do you remember from the first lesson there is such a thing as too much security?

02:23

I think about the value of the assets and the cost off the controls. To mitigate the risks, find the right balance for your controls.

02:34

I will now illustrate this with an example.

02:38

The example I use.

02:42

It's from a paper by Lockett Martin on a trek driven approach to cybersecurity from 2014.

02:50

In this case, imagine this is the diagram given to you

02:54

by your application architect.

02:58

So we have a tree zone applications with a variety of actus.

03:06

The first thing you do is create a less off assets. In this case, the examples would be the credentials.

03:14

User profiles critical data in your database

03:17

create a legend so that we could use it to identify where they are in the diagram.

03:25

In this examples, my legend are colored dots with green being credentials rate, user profile, black for critical data and papa for the D. B. M s

03:37

stint on the diagram out at the dots to signify where the assets resigned.

03:45

Next

03:46

we list the track actors

03:49

in this case would be that Internet based malicious actor,

03:53

an Internet based compromised credential

03:57

and a malicious inside

04:00

similar to the assets. Re create legends and then place them on the diagram to signify where these track actors reside

04:11

after you identify the actors and where they reside.

04:15

Now think off the attack vectors. They were used to compromise the system.

04:20

In this case, the list I've created includes social engineering, compromised users compromised at men,

04:28

cross like attacks, sequel injection and even zero day malware.

04:34

Now that you have identified the treads and tractors and the assets this time to think of controls, I will not cover that in this part of the lecture. But we'll come to that after we've done the enterprise security models.

04:49

This is a very quick high level guy on developing an application tread model.

04:56

Next, I would talk about a different perspective.

05:00

The operational trapped model,

05:02

while the application trip Mongol focused on the application for which is created

05:10

was men to only look at threats to that application.

05:15

Now, Operation Trap Model

05:17

allows organization to see the big picture.

05:21

It includes other respects like systems that get dependent on and so on.

05:28

Both models are needed.

05:30

Let me walk through an example, often operational tread model

05:34

in the operational trap model. In this example,

05:40

it's from a system known as trapped modeler, which is a commercial track modeling software. Now take a look at this track model.

05:47

The assets include things that are not typically part off the system. For example, you're single sign on system

05:57

all your hosting environment like Amazon, easy to all your windows and some back and systems like the TM.

06:05

You take a larger view off all interconnected systems because threat can come in true dependent systems all downstream or option systems. So in the operational view, you need to include a lot more members into the team to help develop it,

06:25

to help you get started with Operation Tread models, I would recommend Mazzella Sea Sponge That's a Web based trap modeling to develop my undergrad students. It's a Mary's university in Nova Scotia, Canada, a spot off zealous winter off security projects. In 2014

06:44

you can find the link below.

06:46

It is a very easy to use guided applications to help use, draw different assets and list the different threats in it.

06:57

Go ahead and give it a try. It's wet base, and you should be able to get to it as long as you have Internet connectivity.

07:04

The next model I would like to go true, it's the data flow trap model.

07:11

The focus off this track model,

07:14

as from the name is from the data exchange between components in the system.

07:18

It helps you identify what critical data is being transferred from, what system to what system

07:26

and what controls you need to save. Got that data.

07:31

As the overall foundation is a big proponent off the data flow trap model, they have created

07:40

a system called the OAS Trap Dragon, which is that on nine track modeling tool that focus on data floor models

07:47

that is in beta,

07:49

and I would encourage you to visit the website Track Dragon that are to give it a try. It helps you draw out the threats on a data flow and help you even identify and categorize the trends.

08:05

The interface is fairly intuitive, so I guess you can try it with some off the systems and try to draw out the data flow trap models for something you're working on.

08:16

So in summary and this episode,

08:18

we discuss what this application trap modeling. How to do it.

08:24

What is an operational trap model? Which is the bigger picture

08:30

and data flow track models, which focused on the data exchange.

08:35

And I've introduced three free tools like Sea Monster Cease Bunch and Trap Dragon, which could be used to get you started.

08:45

But do also check out track modeler, which is a commercial trap modeling software

08:52

that can help you jump start your trip modeling with known tread models for various specific designs, and it helps also identify trends that you may not have looked at.

09:07

In the next episode, we would conclude trap modeling

09:11

by going true. How to categorize the threats that you have identified

09:16

how to rang the treads so you could prioritize your resources

09:20

and cover some lesser used tread models like the social and environmental trip models.