Sudesh Krishnamoorthy Developer Technology Specialist | Microsoft | [email protected].
Threat Modeling: Improving the Application Life cycle Dan Sellers.Net Developer Specialist Microsoft...
-
Upload
helena-audrey-newman -
Category
Documents
-
view
217 -
download
2
Transcript of Threat Modeling: Improving the Application Life cycle Dan Sellers.Net Developer Specialist Microsoft...
Threat Modeling: Improving the Threat Modeling: Improving the Application Life cycleApplication Life cycle
Dan SellersDan Sellers.Net Developer Specialist.Net Developer SpecialistMicrosoft CanadaMicrosoft Canadahttp://blogs.msdn.com/dansellershttp://blogs.msdn.com/dansellers
AgendaAgenda
Important notes and definitionsImportant notes and definitions
Why model threats?Why model threats?
The modeling processThe modeling processDFD, Threat Types, Risk, MitigationsDFD, Threat Types, Risk, Mitigations
ExerciseExercise
Developer Security Data PointsDeveloper Security Data Points““75 percent of hacks happen at the application” - 75 percent of hacks happen at the application” - Gartner “Security at the Application Gartner “Security at the Application Level”Level”
““Over 70 percent of security vulnerabilities exist at the application layer, not the network Over 70 percent of security vulnerabilities exist at the application layer, not the network layer” - layer” - GartnerGartner
"The conclusion is unavoidable: any notion that security is a matter of simply protecting "The conclusion is unavoidable: any notion that security is a matter of simply protecting the network perimeter is hopelessly out of date” - the network perimeter is hopelessly out of date” - IDC and Symantec, 2004IDC and Symantec, 2004
““11 of CERT’s 13 major security advisories for 2003 are bugs arising from programming 11 of CERT’s 13 major security advisories for 2003 are bugs arising from programming errors in applications [not the OS]” - errors in applications [not the OS]” - Carnegie Mellon UniversityCarnegie Mellon University
““If only 50 percent of software vulnerabilities were removed prior to production … costs If only 50 percent of software vulnerabilities were removed prior to production … costs would be reduced by 75 percent” would be reduced by 75 percent” - - Gartner “Security at the Application Level”Gartner “Security at the Application Level”
““The battle between hackers and security professionals has moved from the network layer The battle between hackers and security professionals has moved from the network layer to the Web applications themselves"to the Web applications themselves" - - Network WorldNetwork World
““64 percent of developers are not confident in their ability to write secure applications” - 64 percent of developers are not confident in their ability to write secure applications” - Microsoft Developer ResearchMicrosoft Developer Research
““The Economic Impacts of Inadequate Infrastructure for Software Testing 2002” put the The Economic Impacts of Inadequate Infrastructure for Software Testing 2002” put the cost of fixing a bug in the field at $30,000 vs. $5,000 during codingcost of fixing a bug in the field at $30,000 vs. $5,000 during coding -- NIST NIST
Some Important Notes:Some Important Notes:
Security is a Process and NOT a ProductSecurity is a Process and NOT a Product
Two types of Security for SoftwareTwo types of Security for SoftwareApplication SecurityApplication Security
Secure SoftwareSecure Software
QA confused with Software Security QA confused with Software Security TestingTesting
Improve the process (start early, and often)Improve the process (start early, and often)
Fault InjectionFault Injection
Security TestingSecurity Testing
Intendedfunctionality
Traditionalfaults
Actualsoftwarefunctionality
Unintended,undocumentedor unknown functionalityPoor
Defenses Extra‘functionality’
BOs, XSS, etc
Weak authn
BO in authn
Intended behavior!
Test for the Unintended behavior!
Some Important DefinitionsSome Important Definitions
Threat AgentThreat AgentSomeone who could do harm to a system (also adversary)Someone who could do harm to a system (also adversary)
ThreatThreatAn adversary’s goalAn adversary’s goal
Threat TreeThreat TreeA graphical representation of security-relevant A graphical representation of security-relevant pre-conditions in a systempre-conditions in a system
VulnerabilityVulnerabilityA flaw in the system that could help a threat agent realize A flaw in the system that could help a threat agent realize a threata threat
AssetAssetSomething of value to valid users and adversaries alikeSomething of value to valid users and adversaries alike
AttackAttackWhen a motivated and sufficiently skilled threat agent takes When a motivated and sufficiently skilled threat agent takes advantage of a vulnerabilityadvantage of a vulnerability
8787
Why Threat Modeling?Why Threat Modeling?
Source: Common Criteria for Information Technology Security Evaluation v2.1Source: Common Criteria for Information Technology Security Evaluation v2.1
Because Because attackersattackers
Want to attackWant to attack Your Your applicationapplication
We must putWe must putappropriate defenses appropriate defenses
in our productsin our products
Time DetectedTime Detected
IntroducedIntroduced RequirementsRequirements ArchitectureArchitecture ConstructionConstruction TestTest Post-ReleasePost-Release
RequirementsRequirements 11 33 5-105-10 1010 10-10010-100
ArchitectureArchitecture -- 11 1010 1515 25-10025-100
ConstructionConstruction -- -- 11 1010 10-2510-25
What is Threat Modeling?What is Threat Modeling?
Source: Code Complete 2Source: Code Complete 2ndnd Ed Ed
Threat Modeling:Threat Modeling:Is the security-based analysis of an Is the security-based analysis of an application to help find “anti-scenarios”application to help find “anti-scenarios”
Is a critical part of the design processIs a critical part of the design process
Reduces the cost of securing an Reduces the cost of securing an applicationapplication
Design
1 X
Development
Static Analysis
6.5X
Testing
Integration Testing
System/Acceptance Testing
15X
Deployment
Application In the Field
100XWhy Software Development Must ChangeWhy Software Development Must Change
Delivering secure applications has to become a Delivering secure applications has to become a mandatory requirement … the cost of fixing mandatory requirement … the cost of fixing defects after deployment is almost fifteen times defects after deployment is almost fifteen times greater than detecting and eliminating them greater than detecting and eliminating them during development. during development.
Source IDC and IBM Systems Sciences Institute
Security Training
Security Kickoff& Register with
SWI
Security DesignBest
Practices
Security Arch & Attack SurfaceReview
Use SecurityDevelopment
Tools &Security BestDev & Test Practices
Create Security
Docsand Tools
For Product
PrepareSecurity
ResponsePlan
Security Push
Pen Testing
FinalSecurity Review
Security Servicing &ResponseExecution
Feature ListsQuality Guidelines
Arch DocsSchedules
DesignSpecifications
Testing and Verification
Development of New Code
Bug Fixes
Code Signing A Checkpoint
Express Signoff
RTM
Product SupportService Packs/QFEs Security
Updates
Requirements Design Implementation Verification ReleaseSupport
&Servicing
Where Threat Modeling Where Threat Modeling Fits in the SDLFits in the SDL
ThreatModeling
FunctionalSpecifications
Security Deployment Lifecycle Task and ProcessesSecurity Deployment Lifecycle Task and Processes
Traditional Microsoft Software Product Development Lifecycle Tasks and ProcessesTraditional Microsoft Software Product Development Lifecycle Tasks and Processes
The Goals of Threat Modeling and The Goals of Threat Modeling and Secure DesignSecure Design
Identify where an application is Identify where an application is most vulnerablemost vulnerable
Determine which threats require Determine which threats require mitigationmitigation
Reduce risk to an acceptable level Reduce risk to an acceptable level through mitigationthrough mitigation
The Updated Threat Modeling ProcessThe Updated Threat Modeling Process
Plan Plan MitigationsMitigations
DefineDefineScenariosScenarios
CreateCreateDFDDFD
ManualManual
RoteRote
DetermineDetermineThreatThreatTypesTypes
Build Build Threat TreesThreat Trees
DetermineDetermineRiskRisk
OptionalOptional
Define ScenariosDefine Scenarios
Define the most common and realistic Define the most common and realistic use scenarios for the applicationuse scenarios for the application
Example from Microsoft Windows Server Example from Microsoft Windows Server 2003 and Microsoft Internet Explorer2003 and Microsoft Internet Explorer
““Think about an admin browsing the Internet Think about an admin browsing the Internet from a Domain Controller”from a Domain Controller”
Bounds the scope of what you need to Bounds the scope of what you need to modelmodel
6868
Model the Application Model the Application with DFDswith DFDs
Most “whiteboard architectures” Most “whiteboard architectures” are DFD-likeare DFD-like
ExternalExternalEntityEntity
ProcessProcess Multi-ProcessMulti-Process
Data StoreData Store DataflowDataflow PrivilegePrivilegeBoundaryBoundary
8787
7575
DFD ProcessDFD Process
Create the context diagramCreate the context diagram
Create Level-0 DFDCreate Level-0 DFD
Create Level-1 DFD (if needed)Create Level-1 DFD (if needed)
Create Level-2 DFD (if needed)Create Level-2 DFD (if needed)
Keep going until there are no more Keep going until there are no more multi-processesmulti-processes
Generally Level-2 is “deep enough” Generally Level-2 is “deep enough”
9090
The Context DiagramThe Context Diagram
ServerServer
UsersUsers
AdminAdmin
RequestRequest
ResponseResponse
AdminAdminSettingsSettings
Logging Logging DataData
One multi-process, One multi-process, and the different external entitiesand the different external entities
7777
Privilege BoundariesPrivilege Boundaries
Specific DFD addition to TMsSpecific DFD addition to TMs
Boundary between DFD elements with Boundary between DFD elements with different privilege levelsdifferent privilege levels
Machine boundary (data from the other Machine boundary (data from the other machine could be anonymous)machine could be anonymous)
Process boundary Process boundary (e.g., user process (e.g., user process SYSTEM process) SYSTEM process)
9393
Next – The Level-0 DFDNext – The Level-0 DFD
UserUser
AdminAdmin
AuthnAuthnEngineEngine
AuditAuditEngineEngine
ServiceService
MnmgtMnmgtToolToolCredentialsCredentials
Data FilesData Files
Audit DataAudit DataRequestRequest
ResponseResponse
Aut
hnA
uthn
Req
uest
Req
uest
AuthnAuthn
InfoInfo
Set/GetSet/GetCredsCreds
RequestedRequestedFile(s)File(s)
Audit DataAudit Data
SetSet
User DataUser Data
Verify
Verify
User D
ata
User D
ata
Aud
itA
udit
Req
uest
sR
eque
sts
Aud
itA
udit
Info
Info
Aud
itA
udit
Rea
dR
ead
Aud
itA
udit
Writ
eW
rite
GetGetCredsCreds
11
22
33
44
55
66
77
88
99
7979
Implementation ExamplesImplementation Examples
• Real People• News feeds• Data feeds• Events• Notifications• Etc.
• Function call• Network traffic• Shared memory
• Etc.
• Services• Web Services• Assemblies• DLLs• EXEs• COM object• Etc.
• Database• File• Registry• Shared Memory
• Queue/Stack• Etc.
Common DFD “Bugs”Common DFD “Bugs”(1) How does the data get into the data store?(1) How does the data get into the data store?
ServiceService
Data FilesData Files
ServiceService
Data FilesData Files
Data Entry Data Entry OperatorOperator
Data Data EntryEntryToolTool
7878
Common DFD “Bugs”Common DFD “Bugs”(2) How does data move from one data store to another?(2) How does data move from one data store to another?
Data FilesData Files
Data FilesData Files
Data FilesData Files
Data FilesData Files
ReplicationReplicationEngineEngine
Common DFD “Bugs”Common DFD “Bugs”(3) How does data move from a user to a data store?(3) How does data move from a user to a data store?
UserUser
Data FilesData Files
UserUser
Data FilesData Files
Data EntryData EntryToolTool
DFD Element Threat TypesDFD Element Threat Types
Each DFD element (Asset) is Each DFD element (Asset) is susceptible to certain kinds of threatssusceptible to certain kinds of threats
SpoofingSpoofing
TamperingTampering
RepudiationRepudiation
Information DisclosureInformation Disclosure
Denial of ServiceDenial of Service
Elevation of PrivilegeElevation of Privilege
8484
104104
Anti-C in CIAAnti-C in CIA
Anti-I in CIAAnti-I in CIA
Anti-A in CIAAnti-A in CIA
Every Asset is Subject to AttackEvery Asset is Subject to Attack
UserUser
AdminAdmin
AuthnAuthnEngineEngine
AuditAuditEngineEngine
ServiceService
MnmgtMnmgtToolToolCredentialsCredentials
Data FilesData Files
Audit DataAudit DataRequestRequest
ResponseResponse
Aut
hnA
uthn
Req
uest
Req
uest
AuthnAuthn
InfoInfo
Set/GetSet/GetCredsCreds
RequestedRequestedFile(s)File(s)
Audit DataAudit Data
SetSet
User DataUser Data
Verify
Verify
User D
ata
User D
ata
Aud
itA
udit
Req
uest
sR
eque
sts
Aud
itA
udit
Info
Info
Aud
itA
udit
Rea
dR
ead
Aud
itA
udit
Writ
eW
rite
GetGetCredsCreds
11
22
33
44
55
66
77
88
99
Threat Types by Asset TypeThreat Types by Asset Type
External EntityExternal Entity
ProcessProcess
Data StoreData Store
DataflowDataflow
SS TT RR II DD EE
AssetAsset
List all Assets from the DFDList all Assets from the DFD
External EntitiesExternal Entities1 & 91 & 9
ProcessesProcesses2, 4, 5 & 82, 4, 5 & 8
Data StoresData Stores3, 6 & 73, 6 & 7
Data FlowsData Flows114, 44, 41, 21, 24, 44, 42, 2, 332, 62, 64, 34, 35, 55, 53, 3, 559, 99, 95, 95, 98, 88, 89, 9, 778, 88, 87, 47, 488
Every asset is subject to threatsEvery asset is subject to threats
A Complete List of ThreatsA Complete List of Threats
SpoofingSpoofingE: 1, 9E: 1, 9
P: 2, 4, 5, 8P: 2, 4, 5, 8
TamperingTamperingP: 2, 4, 5, 8P: 2, 4, 5, 8
DS: 3, 6, 7DS: 3, 6, 7
DF: 1DF: 14 etc4 etc
RepudiationRepudiationE: 1, 9E: 1, 9
P: 2, 4, 5, 8P: 2, 4, 5, 8
Information DisclosureInformation DisclosureP: 2, 4, 5, 8P: 2, 4, 5, 8
DS: 3, 6, 7DS: 3, 6, 7
DF: 1DF: 14 etc4 etc
Denial of ServiceDenial of ServiceP: 2, 4, 5, 8P: 2, 4, 5, 8
DS: 3, 6, 7DS: 3, 6, 7
DF: 1DF: 14 etc4 etc
Elevation of PrivilegeElevation of PrivilegeP: 2, 4, 5, 8P: 2, 4, 5, 8
Threat ReductionThreat Reduction
Assets…Assets………within the same trust boundarywithin the same trust boundary
……using like technologyusing like technology
Can be treated as one unitCan be treated as one unitSaves time!Saves time!
Great for data flowsGreat for data flows
Calculating Risk with NumbersCalculating Risk with Numbers
DREAD, etc.DREAD, etc.
Very subjectiveVery subjective
Often requires the analyst be a Often requires the analyst be a security expertsecurity expert
On a scale of 0.0 to 1.0, just how likely On a scale of 0.0 to 1.0, just how likely is it that an attacker could access a private is it that an attacker could access a private key?key?
Where do you draw the line?Where do you draw the line?Do you fix everything above 0.4 risk and Do you fix everything above 0.4 risk and leave everything below as “Won’t Fix”?leave everything below as “Won’t Fix”?
9393
Security Risk Rankings (Examples)Security Risk Rankings (Examples)
CriticalCriticalRun malicious codeRun malicious code
Most ‘E’ vulnsMost ‘E’ vulns
ImportantImportantDenial of service Denial of service against a serveragainst a server
ModerateModerateServer DoS that Server DoS that stops once attack stops once attack stopsstops
LowLowDoS against a clientDoS against a client
Mitigating ThreatsMitigating Threats
Options:Options:Leave as-isLeave as-is
Remove from productRemove from product
Remedy with technology countermeasureRemedy with technology countermeasure
Warn userWarn user
106106
Mitigation TechniquesMitigation Techniques
ThreatThreat Mitigation FeatureMitigation Feature
SpoofingSpoofing AuthenticationAuthentication
TamperingTampering IntegrityIntegrity
RepudiationRepudiation NonrepudiationNonrepudiation
Information DisclosureInformation Disclosure ConfidentialityConfidentiality
Denial of ServiceDenial of Service AvailabilityAvailability
Elevation of PrivilegeElevation of Privilege AuthorizationAuthorization
107107
Testing MitigationsTesting Mitigations
All threats and mitigations must All threats and mitigations must be testedbe tested
The job of a good security tester is to The job of a good security tester is to find other conditions in the threat treefind other conditions in the threat tree
Threats have mitigationsThreats have mitigations
Mitigations can be attackedMitigations can be attacked
SpoofingSpoofingAuthentication Authentication
Password guessing, brute force, Authn Password guessing, brute force, Authn downgradedowngrade
The Threat Modeling ProcessThe Threat Modeling Process
1. Define key scenarios1. Define key scenarios
2. Model the application using DFDs2. Model the application using DFDs
3. Determine threat types for each 3. Determine threat types for each DFD elementDFD element
4. Calculate risk4. Calculate risk
5. Plan mitigations5. Plan mitigations
© 2005 Microsoft Corporation. All rights reserved.This presentation is for informational purposes only. Microsoft makes no warranties, express or implied, in this summary.