Use our OWASP Threat Modeling Playbook to Improve your Product Security
1 like287 views
The webinar discusses the importance of threat modeling in application security, emphasizing the need for a structured playbook to guide the process. Key topics include identifying and managing risks, gaining stakeholder buy-in, and integrating threat modeling into organizational practices while addressing common adoption challenges. The session also highlights the collaborative effort to open-source a comprehensive threat modeling playbook to enhance global cybersecurity efforts.
Use our OWASP Threat Modeling Playbook to Improve your Product Security
- 1. 1Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential b Use our Threat Modeling Playbook to improve your product security Webinar – 10 September 2020 Sebastien Deleersnyder, CEO Toreon
- 2. 2Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential § Threat modeling § Leveling up – we need a playbook! § Get stakeholder buy-in § Embed in your organization § Training your people § Strengthen your processes § Innovate with technology § Open sourcing our playbook / demo § Q&A Agenda https://github.com/Toreon/threat-model-playbook https://www.toreon.com/threat-modeling-playbook/
- 3. 3Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Threat Modeling
- 4. 4Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Threat modeling is the activity of identifying and managing application risks Threat modeling
- 5. 5Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Secure development lifecycle DESIGN BUILD TEST OPS Source Code Review (Static) Threat Modeling WAF Tuning Security Testing (Dynamic) Coding Guidelines Configuration Guidelines
- 6. 6Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Threat modeling stages What can go wrong? Identify threats What are we going to do about it? Mitigate threats Did we do a good enough job? Validate What are we building? Diagram
- 7. 7Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Why perform threat modeling? • Get team on same page with a shared vision on security • Increased risk awareness and understanding • Identify & address greatest risks • Prevent security design flaws • Prioritize development efforts based on risk weighting • Cost justification and support for needed controls • Document due diligence (GDPR…)
- 8. 8Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Adoption constraints • Generally requires outside security expertise • Can take a lot of time (costly) • Difficult to internalize and reproduce across application portfolios and teams • Tools have limited functionality • Does not scale
- 9. 9Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Leveling up - we need a playbook
- 10. 10Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Pulling it together https://owaspsamm.org/ https://github.com/c0rdis/security-champions-playbook https://owasp.org/www-community/Threat_Modeling
- 11. 11Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential How a playbook will help us • Translate vision and strategy into tactics • American Footballè Plays selected depending on • position on the field, • strengths and weaknesses of the opposition • and the stage of the game. • Translates well to threat modeling: need to understand offense and defense • Gamification increases adoption
- 12. 12Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Level up your threat modeling game Threat Modeling Playbook Get TM stakeholders buy-in Embed TM in your organization Train your people to TM Strengthen your TM processes Innovate with TM technology •Involve people and allocate time •Inject TM expertise •Show threat modeling ROI •Establish context •Assess and treat risk •Monitor and review •Communicate •Identify stakeholders •Create TM specialist role •Train your people •Create a positive TM culture • Understand current process • Introduce application risk levels • Choose a TM methodology • Perform and persist the TM • Integrate with risk framework • Follow up TM action items • Optimize methodology and risk calculation •Select the right tools •Process the tools outcome •Integrate in your TM methodology
- 13. 13Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Get stakeholder buy-in
- 14. 14Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Involve people and allocate time • Who is involved? • Stakeholder costs and obstacles? • What are potential gains? Business stakeholders Management Application owner Architect Developer Security and/or DevOps engineer Project manager
- 15. 15Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Select your approach Do it yourself Hire an expert Threat modeling training Inject threat modeling expertise
- 16. 16Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Demonstrate ROI • Your threat models need clear and actionable outcomes • Balance threat models with project constraints • Link threat models to development and security artefacts • User stories • Bug fixes • Incidents • JIRA tickets … Threat modeling findings Deployment issues
- 17. 17Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Embed in your organization
- 18. 18Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Embed in your organization • Integrate in your risk management process • If not available, consider ISO 27005:2018 standard (Information security risk management) • Link to people, processes and technology framework
- 19. 19Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential PPT framework mapped to ISO 27005 Monitoring & Review Process: • Follow up on threat model actions • Optimize methodology and risk calculation. Communication Risk Assessment / Risk Treatment Context Establishment Process: • Understand the current process • Introduce application security risk levels • Define threat modeling methodology Technology: • Identify current toolset Process: • Perform and persist threat model Technology: • Whiteboards and flipcharts for modeling • Persisting models • Integration with DevOps tooling • Use special threat modeling tooling • Threat modeling as code People: • Identify stakeholders • Create a threat modeling specialist role • Train your people • Threat modeling culture
- 20. 20Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Train your people to TM
- 21. 21Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Identify stakeholders threat modeling is best performed within a core team of limited size Role Motivation Business stakeholder Ensure that business value and potential business impact is clear. Architect Provide a high-level overview of the application ecosystem and the underlying rationale. Developer Provide details on used libraries, frameworks, and coding guidelines. Security and/or DevOps engineer Provide details on existing security and/or infrastructure configuration. Project manager Validate proposed mitigations in terms of timing and budget. Threat model specialist Ensure proper execution of the threat model process.
- 22. 22Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Create a threat modeling specialist role • Primary purpose: incorporate TM practices and security culture • Typically floating specialists supporting the squads • Provide threat modeling advice, support squads, and drop in for a sprint or two • Step 1 carve out this role • Step 2 hire candidate specialists
- 23. 23Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Train your people • Involved staff need to understand the why and how • Organize lunch & learn sessions for your squads • Perform threat modeling demos • Do role-based training • include organization specific playbooks and templates, examples, and lessons learned • Adapt to your technology stack and project governance.
- 24. 24Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Strengthen your TM processes
- 25. 25Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Understand your current process • Align on OWASP SAMM • What is current process? • What? • When? • Inputs & outputs? • Steps taken? • Draw overview • Map on this playbook
- 26. 26Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Introduce application risk levels Order your applications in different risk “buckets”
- 27. 27Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential § Lots of methodologies available § Is it sound? § Model based § Traceable § Systematic § Business integration § Context aware § Scalable § Will it work for you? § Should at least cover “4 question” framework Choose a threat modeling methodology What can go wrong? Identify threats What are we going to do about it? Mitigate threats Did we do a good enough job? Validate What are we building? Diagram
- 28. 28Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Integrate with your risk management framework • Agree on how to handle TM findings • Embed in your framework (or consider ISO 27005) • Essential components: • Risk levels • Risk level implications • Risk escalation and acceptance • Risk review process
- 29. 29Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Agree on mitigations and follow-up actions • Who is accountable for the progress and due date? • What is the current status of the mitigation? • What is the risk of the mitigation? • Who is responsible for the execution / implementation? What are the actions that are needed? • What is the current state of each of the actions needed to finish this mitigation?
- 30. 30Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Optimize methodology and risk calculation • Reuse artefacts: diagrams, risk calculations, user stories • Hook into and adapt: • Penetration testing • Compliance needs • Audit findings • Quality of service levels • Input to test automation, penetration testing, training, awareness • Align and standardize risk calculation across teams
- 31. 31Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Innovate with TM technology
- 32. 32Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Select the right tools • Start with basic tools, such as flipcharts & whiteboards • Consider remote collaboration tools • Select threat modeling tool that fits your methodology • Growing market of open-source and commercial tools
- 33. 33Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Tool outcomes • Primary functions and outputs: • Create and collaborate on threat models • Persist threat models • Support objective, risk-based approach to mitigate threats • Cover: awareness, risk documentation, input for other (security) activities, share threat modeling knowledge, … • Support access control and operational needs
- 34. 34Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Integrate in YOUR methodology • Never change your process to accommodate a tool • Fit your DevOps pipelines: • reuse your team tools • Reuse diagrams and diagramming tools • Integrate with knowledge repository • Track actions in team ticket system • Reuse security scoring system • Consider “threat modeling as code”
- 35. 35Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Open sourcing our playbook
- 36. 36Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Level up (y)our threat modeling game Threat Modeling Playbook Get TM stakeholders buy-in Embed TM in your organization Train your people to TM Strengthen your TM processes Innovate with TM technology •Involve people and allocate time •Inject TM expertise •Show threat modeling ROI •Establish context •Assess and treat risk •Monitor and review •Communicate •Identify stakeholders •Create TM specialist role •Train your people •Create a positive TM culture • Understand current process • Introduce application risk levels • Choose a TM methodology • Perform and persist the TM • Integrate with risk framework • Follow up TM action items • Optimize methodology and risk calculation •Select the right tools •Process the tools outcome •Integrate in your TM methodology
- 37. 37Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Open sourcing “our” playbook • Donated to the OWASP threat modeling project • Free to use! • Increase the impact of threat modeling globally • Community feedback, input for next cycle … https://github.com/Toreon/threat-model-playbook
- 38. 38Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential § https://github.com/Toreon/threat-model-playbook Demo
- 39. 39Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Call to action • Download & use it ! • Let us know what works • Let us know what does not work • Collaboration on version 2
- 40. 40Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Q&A
- 41. 41Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Contributors • Jonas Muylaert • Joris Van den Broeck • Sebastien Deleersnyder • Steven Wierckx • Thomas Heyman
- 42. 42Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Online https://github.com/Toreon/threat-model-playbook https://www.toreon.com/threat-modeling-playbook/
- 43. 43Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential § Email: seba@toreon.com / seba@owasp.org § Subscribe to our Threat Modeling Insider “TMI” newsletter: https://www.toreon.com/tmi-threat-modeling/ § Next open training: Whiteboard Hacking a.k.a. Hands-on Threat Modeling (2 x 4h on 22-23 Sep) https://www.toreon.com/threat-modeling-online/ Stay in touch!
- 44. 44Copyright © 2020 Toreon. All rights reserved. WWW.TOREON.COM Confidential Stay safe & healthy