Threat modeling driven security testing
0 likes203 views
The document describes threat modeling for a web application with user authentication. It identifies threats to the web UI and web application components, including spoofing, tampering, and information disclosure. It then provides example attacks for different authentication methods and recommends countermeasures and which standards/requirements they meet. Finally, it includes example tests for validating the countermeasures using behavior-driven development (BDD) style.
Threat modeling driven security testing
- 2. 2 CTO @ Continuum Security Security Architect @ WH SGSI (ISO-27001) & Pen test & dev @ Universitat Jaume I https://www.linkedin.com/in/paul-santapau-a9953a4/
- 3. 3 Threat Modeling. Modeling with Patterns. Including verification and testing into a CI/CD pipeline.
- 4. 4
- 5. 5
- 6. 6
- 7. 7
- 8. 8
- 12. 12 - component: Web UI id: web-ui data: - name: PII - name: Public Data implements: - authentication: user_password_form - session_management: cookie_based dataflows: - sends_to: web-app - receives_from: web-app trust_zones: - name: Internet trust: 1 - component: Web Application id: web-app data: - name: PII - name: Public Data implements: - channel_encryption: tls_v1.3 - session_management: framework_generated_session_id dataflows: - sends_to: web-ui - receives_from: web-ui trust_zones: - name: DMZ trust: 40
- 13. 13
- 14. 14 THREAT VIOLATES Spoofing Authentication Tampering Integrity Repudiation Non-repudiation Information Disclosure Confidentiality Denial of Service Availability Elevation of Privilege Authorization
- 15. 15
- 16. 16 CAPEC ...
- 17. 17 STRIDE OWASP Top 10 CAPEC Checklists +++ Abstraction +++ Detail
- 18. 18 Without Patterns and Templates With Patterns and Templates
- 19. 19 - Default passwords. - Password database access. - Dictionary-based brute force. - Username guessing / enumeration. - Credentials captured by a man in the middle attack. - Password reset abuse. - Authentication replay. - Session id prediction. - Session hijacking. - Session fixation. - Shoulder surfing. - …
- 20. 20 ¿Web form username and password-based authentication? Attack Threat - Default passwords. Attackers gain access to the system using default passwords. - Password database access. Attackers gain access to user accounts by accessing the password database - Dictionary-based brute force. Attackers gain access to user accounts by performing a dictionary-based brute force attack. - Username guessing. Attackers gain access to user accounts by performing a username guessing attack. - Username enumeration. Attackers gain access to user accounts by performing a username enumeration attack. ... ...
- 21. 21
- 22. 22 Security team experience. Standards: OWASP, NIST, CIS, etc. Regulations: PCI, EUGDPR, ISO-27001...
- 24. 24 ¿Web form username and password-based authentication? Threat Countermeasure(s) Attackers gain access to the system using default passwords. Remove default credentials and role-based accounts from the application Attackers gain access to user accounts by accessing the password database Store passwords in unrecoverable form to prevent disclosure Attackers gain access to user accounts by performing a dictionary-based brute force attack. Require the use of strong passwords Attackers gain access to user accounts by performing a username guessing attack. Implement application and network rate limiting on the login function Attackers gain access to user accounts by performing a username enumeration attack. Ensure failed login timings do not reveal account status Ensure application errors do not reveal account status ... ...
- 25. 25 ¿Web form username and password-based authentication? Threat Countermeasure(s) Standard Req Attackers gain access to the system using default passwords. Remove default credentials and role-based accounts from the application OWASP-ASVS Level 1 r2.19 Attackers gain access to user accounts by accessing the password database Store passwords in unrecoverable form to prevent disclosure OWASP-ASVS Level 2 r2.13 Attackers gain access to user accounts by performing a dictionary-based brute force attack. Require the use of strong passwords OWASP-ASVS Level 2 r2.7 Attackers gain access to user accounts by performing a username guessing attack. Implement application and network rate limiting on the login function OWASP-ASVS Level 1 r2.20 Attackers gain access to user accounts by performing a username enumeration attack. Ensure failed login timings do not reveal account status Ensure application errors do not reveal account status OWASP-ASVS Level 3 r2.28 OWASP-ASVS Level 1 r2.18 ... ... ...
- 26. 26
- 27. 27 ¿Web form username and password-based authentication? Threat Countermeasure(s) Standard Req Attackers gain access to the system using default passwords. Remove default credentials and role-based accounts from the application OWASP-ASVS Level 1 r2.19 Attackers gain access to user accounts by accessing the password database Store passwords in unrecoverable form to prevent disclosure OWASP-ASVS Level 2 r2.13 Attackers gain access to user accounts by performing a dictionary-based brute force attack. Require the use of strong passwords OWASP-ASVS Level 2 r2.7 Attackers gain access to user accounts by performing a username guessing attack. Implement application and network rate limiting on the login function OWASP-ASVS Level 1 r2.20 Attackers gain access to user accounts by performing a username enumeration attack. Ensure failed login timings do not reveal account status Ensure application errors do not reveal account status OWASP-ASVS Level 3 r2.28 OWASP-ASVS Level 1 r2.18 ... ... ...
- 28. 28 ¿Web form username and password-based authentication? Countermeasure(s) Implemented Remove default credentials and role-based accounts from the application Store passwords in unrecoverable form to prevent disclosure Require the use of strong passwords Implement application and network rate limiting on the login function Ensure failed login timings do not reveal account status Ensure application errors do not reveal account status ...
- 29. 29
- 30. 30 ¿Web form username and password-based authentication? Countermeasure(s) Remove default credentials and role-based accounts from the application Store passwords in unrecoverable form to prevent disclosure Require the use of strong passwords Implement application and network rate limiting on the login function Ensure failed login timings do not reveal account status Ensure application errors do not reveal account status ...
- 31. 31 Remove default credentials and role-based accounts from the application @authentication Feature: Authentication Verify that the authentication system is robust Scenario: Default passwords should not be used Given a web form based authentication When the default user logs in Then the password in not in the default passwords list
- 32. 32 Store passwords in unrecoverable form to prevent disclosure @authentication Feature: Authentication Verify that the authentication system is robust Scenario: Passwords should be stored in unrecoverable format Given a web form based registration When a user registration happens And the password is provided and stored Then the password cannot be reverted back to its original form
- 33. 33 Require the use of strong passwords @authentication Feature: Authentication Verify that the authentication system is robust Scenario: Passwords should be strong Given a web form based authentication When a user registration happens Then the password is asked When a weak password is provided Then the user cannot register
- 34. 34 Implement application and network rate limiting on the login function @authentication Feature: Authentication Verify that the authentication system is robust Scenario: authentication attempts should be limited Given a web form based authentication When a user tries to log in And uses invalid passwords And the time between tries is less than X seconds Then the source is locked down
- 35. 35
- 38. 38 Business Need Secure Design / Threat Model PO Architects / DevOps / QA Risk Patterns / Tests Implement Verify Test Deploy Security
- 40. 40
- 41. 41 ● Threat Modeling: Designing for Security: https://books.google.es/books/about/Threat_Modeling.html?id=asPDAgAAQBAJ&source=kp_cover&redir_esc=y ● Scaling Threat Modeling with Tools: https://continuumsecurity.net/scaling-threat-modeling-with-tools/ ● BDD-Security: https://github.com/continuumsecurity/bdd-security/wiki ● OWASP Top 10: https://www.owasp.org/index.php/Top_10-2017_Top_10 ● Common Attack Pattern Enumeration and Classification: https://capec.mitre.org/ ● OWASP Application Security Verification Standard: https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification_Standard_Project ● Mobile Application Security Verification Standard: https://www.owasp.org/index.php/OWASP_Mobile_Security_Testing_Guide