VGTU Intro to Threats 2015
- 2. About me Audrius Kovalenko | @slicklash NOT Computer Security Expert Just a developer
- 3. Which one is more secure?
- 4. Which one is more secure? INSECURE* 87% INSECURE INSECURE (IN)SECURE link link link
- 5. What’s a “secure” system?
- 6. What’s a “secure” system? Good security = Prevention + Detection + Response
- 8. Security threats Authentication Spoofing Integrity Tampering Non-repudiation Repudiation Confidentiality Information Disclosure Availability Denial of Service Authorization Elevation of Privilege STRIDE
- 12. Information disclosure STRIDE Hacked Same Password Success
- 15. Lack of security design last minute fixes
- 16. Securing the design threat modeling
- 17. What are you building? data flow diagram
- 18. Decomposition roles User Roles Name Description Authentication Admin Administrators have complete and unrestricted access to Notices, Partner Accounts and Logs. Windows Partner Partners can create, read and update Notices. Basic User Users can read and update Notices. Forms Service Roles Name Description Authentication APP Role Identity APP is running as. Windows Integrated (ApplicationPoolIndentity) SVC Role Identity SVC is running as. Windows Integrated (Local System) MSMQ Role Identity MSMQ is running as. Windows Integrated (Network Service)
- 19. Decomposition (2) components Components Name Roles Type Run As Communication Channel Technology Uses APP Admin User Website APP Role HTTPS C#, ASP.NET MVC 5 Cryptography, File I/O API Partner Website API Role HTTPS C#, ASP.NET MVC 5 Cryptography, File I/O SVC MSMQ Windows Service SVC Role TCP/IP C# Cryptography, File I/O
- 20. Decomposition (3) data Data Name Description Data Elements Data Stores Form Defines structure of a Notice Fields Database Access Control Role Access Control Remarks Admin C R U D Partner R Limited information. Form must be published. User
- 21. What can go wrong? card games
- 22. What can go wrong? (2) checklists CAPEC https://capec.mitre.org/data/index.html OWASP ASVS https://www.owasp.org/index.php/Category:OWASP_Application_Security_Verification... OWASP AppSensor https://www.owasp.org/index.php/AppSensor_DetectionPoints
- 23. How to prioritize? convert threat to risk Risk Loss event frequence Loss magnitude Threat event frequence prob. Threat agent actions result in loss
- 24. How to mitigate? raise the cost Time Skills Money etc. capability
- 25. How to make it work for you? Practice Experience Reflection Theory find your own way
- 28. Resources STRIDE http://blogs.microsoft.com/cybertrust/2007/09/11/stride-chart OWASP Cornucopia https://www.owasp.org/index.php/OWASP_Cornucopia EoP Card Game https://www.microsoft.com/en-us/SDL/adopt/eop.aspx FAIR http://www.risklens.com/what-is-fair SAFECode http://www.safecode.org/publications
- 29. QA