General: Modeling Process

00:00

Hello and welcome to another penetration testing execution Standard discussion. Today we're going to be looking at some general threat modeling processes and what you can do to start threat modeling within your penetration testing efforts. So a quick disclaimer

00:16

pee test videos do cover tools that could be used for system hacking as well as techniques, and the tools discussed or used during demonstrations or techniques should be researched and understood by the user.

00:27

Please research your laws and regulations regarding the use of such tools, or take Ning's within your given area to ensure that we don't violate any laws. Now let's jump into our objectives.

00:38

So just a few today that we're going to be going through. So we're going to describe what threat Mama Ling is. We've had a pretty bulky slide on that, but we're going to go through that together. Look at a high level process for threat modeling.

00:49

Gonna look at a high level example

00:52

and describe some high level modeling tools that you can use in your efforts to identify risks and threats to an organization. So what is threat modeling? What is it that we're doing when we threat model so essentially were looking at and providing clarity to an organization based on its risk appetite.

01:10

And we're prioritizing what assets are going to be more important over others. And essentially,

01:15

we're going to figure out what would pose the greatest risk to the organization. Additionally, it enables the tester to focus on and delivering

01:25

an engagement that closely emulates the tools, techniques, capabilities, accessibility in general, profile of the attacker. And so overall, we want to act like the attacker. We don't want to waste our time on small systems or things that aren't going to provide any benefit to us if we were a legit

01:45

threat actor. And so when we approach threat modeling, we want to approach it from that same aspect of that same avenue,

01:53

and so it should be constructed. The threat model should be constructed in coordination with the organization being tested whenever possible, and even in a complete black not situation where the tester doesn't have any prior information on the organization,

02:07

they should create a threat model based on the Attackers view, so pay attention to that based on the Attackers view like we were saying

02:15

in combination with open source intelligence and so we recently went through that again. Open source. Intelligence and intelligence is a timely or always accurate, but it is beneficial in that you could see what's out there on the Internet and then potentially identify some areas of risk, or that you could attack within the organization.

02:35

Now this is, ah, high level process for threat modeling. So if you've got some other tool or technique that you use, then by all means, you know, take what's relevant and discard what is not.

02:46

But if you don't have a place to start, this is definitely a good one. So the first thing that you want to do is gather relevant documentation with respect to process is with respect to assets with respect to the organization and start to evaluate that

03:01

and then identify and categorize primary and secondary assets, primary being those that are most critical secondary

03:08

those that they could potentially do without,

03:12

and then identifying categorize threats and threat communities against those particular assets and mapped those threat communities against primary secondary assets. And so

03:23

that, in a nutshell, is what you could do. So let's kind of apply an example to that.

03:30

So

03:31

in

03:34

respect to the penetration test Execution standard. Let's say that

03:38

internally hosted CR M application, maybe in scope. Okay, The customer information is stored in the back end database and is easily

03:46

identifiable primary asset and is directly linked to the scope. With respect to the particular application,

03:53

However, you start to review the technical design of the database server, and it can also be identified that HR databases are stored on the same back in

04:03

on, but it's a secondary asset. So essentially an attacker can use the C R M application as a stepping stone to obtain employee information.

04:15

So in a basic threat modeling exercise,

04:17

it may not be a parent right up front that that information would have been accessible or would have been a component of that primary application. But by looking at the secondary assets, looking at how things connect, looking at how things operate, we were able to identify that if this system were in fact

04:36

compromise, that it could be used

04:40

to engage other systems or other information sets. And so it's important to always keep that in mind when looking at a primary asset

04:48

and when looking at a network, the client in most cases in some cases, depending on their level within the organization where they're at, may not have all of the necessary information to help us map out all of the connections to the different systems or may not be able to help us to map out how these systems interact with one another. So

05:08

it is our responsibility to make sure that we tease that information out

05:13

and that we get everything that we can that would be pertinent to this this type of scenario when we're doing our threat modeling.

05:19

So let's look at some high level tools. So, depending on what you're trying to do or how you want to go about modeling threats, there are a number of things out there.

05:29

So each of these air methods that you can use that's broken down into, like common threats and common areas, denial of service or different attack vectors. Or, you know, if we're going to maybe do a diagram or some type of graph, we model assets against common threats

05:46

because, you know, if you look at something like the minor attack framework, there's literally tons and tons of ways that a system could be attacked. And so

05:54

there are some models and methods that essentially allow us to kind of break that down to some core areas.

06:00

Now, if you've done any type of vulnerability scans or any type of security scans, or if you've picked up a security base book recently, it's likely that you've run into CVS s and the scoring system that comes with that. There are calculators online that you could use where you could apply

06:17

a CVS escort to a particular threat within an organization. And so there's a way that you could use that to apply it.

06:25

You could do attack trees, persona non grata, meaning that you kind of act like the attacker and think like the attacker and come up with vectors, their security cards or kind of brainstorming tools that you can use. And so it's like a deck of cards with different attack types

06:39

got HTM em. You've got quantitative threat modeling method and then trike. So any of these methods, if you give him a quick search on Google,

06:46

you'll find that you know they each have their pros and cons with respect to how they can be applied In a given scenario,

06:53

and again if you're doing something that's not here. If you've come up with a process for threat model and as long as you're you know, following some best practices and coming up with consistent results, that's really you know, all that's applicable here.

07:05

Now, with that in mind, let's do a quick check on learning true or false. The first step. Any threat modeling process should be gathering relevant documentation.

07:16

All right, well, if you need additional time to go through that, please pause the video and do so

07:21

so to go ahead and just lay this out there if you don't know what the system looks like, if you don't know what it is that you're modeling, you really don't have a place to start. And so gathering relevant documentation, information specs, network diagrams, whatever the case may be,

07:42

is going to really be the first step in the threat modeling process. And so this statement rings true with respect to the information we have below.

07:53

Now

07:54

let's go ahead and look at our summary for today's discussion. So we describe what threat modeling is essentially looking at the primary and secondary systems and laying out the potential threats to those systems. We looked at a high level process for

08:07

threat modeling again, a plywood it what you need to apply to that and, you know, don't apply what you don't need to. If you've already got a process in place

08:16

and it's effective for you, keep using it. We described a high level example where we look at a primary system

08:22

and through evaluation of that system and understanding how it connects to secondary systems. We discovered that it could be used as a stepping stone for an attacker, so that's going to be pertinent, important in our testing and risk assessment process. And then we looked at some high level modeling tools.

08:41

Again, the list is not comprehensive in nature,