STRIDE Model for Cyber Threat Modelling

Paper details:

Maximum number of words: 2000 The word “system” is used to describe many different things: a way of doing things (e.g., Dad has a system for planting a garden); a machine with many different parts (e.g., a heating system); a complex environment (e.g., ecosystem). At the most abstract level, a secure system can be defined as one that satisfies some security policy. We have also seen ways of specifying these security policies that range from informal (e.g., writing the policy in words) to formal (e.g., using access control matrices). For this assignment, pick and briefly describe any cyber-related existing system. Analyse the system threat modelling and select one threat of your choice among the identified ones. Find and/or design a security policy that can address the selected threat. Describe how the policy can address, prevent, or mitigate the threat and explain which design principles are involved. As you can choose the system, it is necessary to briefly explain what its purpose and structure is. However, consider that the crucial parts are the threat modelling and the policy. The goal of the essay is for you to apply the concepts explored in this first half of the term, showing the level of understanding you have. References and graphs are not considered in the word count. If you can show or justify any part of the essay through these tools you may have more space and it may help readability. However, please remember that graphs will be considered in the word count if they are containing large portions of text.   USEFUL REFERENCE TO CONSIDER Introduction (100 words) Security goals – CIA triangle C – confidentiality – keeping data private X mass surveillance I – integrity – system and data cannot be altered X data breach A – availability – ability to use system as anticipated X spam a secure system is: binary – yes or no e.g. cryptography pros – longevity; cons – brittle, expensive OR risk management – able to identify threats e.g. malware detection system pros – adaptive; cons – arms race (new threats keep coming up; need to keep adapting); difficult to evaluate / quantify ‘safeness’ of a system pick and briefly describe any cyber-related existing system (500 words) Contactless payment protocol Analyse the system threat modelling and select one threat of your choice among the identified ones. briefly explain what its purpose and structure is. present a threat model about the system (700 words) (What is security engineering chapter 1) Define system: 1. a product or component, such as a cryptographic protocol, a smartcard or the hardware of a PC; 2. a collection of the above plus an operating system, communications and other things that go to make up an organisation’s infrastructure; 3. the above plus one or more applications (media player, browser, word processor, accounts / payroll package, and so on); 4. any or all of the above plus IT staff; 5. any or all of the above plus internal users and management; 6. any or all of the above plus customers and other external users Benefits: Risks: design a secure system based on: a. threats – who is the adversary policy is attacker-centric MUST use STRIDE threats model to assess threats based on capabilities and motivation Spoofing (steal ID) Tampering (clone ID) Repudiation (fake ID) Info disclosure (use access info) Denial of service (to real user) Elevation of privilege (no right but can receive the info through earlier steps) e.g. assess threats based on capabilities and motivation (STRIDE model) capabilities motivation (or threats?) recipient / user of system pretend to be user [Spoofing (steal ID)] hacker? (front-line person / shop) rig the system [Tampering (clone ID)] phish the real bank? Repudiation (fake ID)?? To refuse to accept as true hacker? (manufacturer) learn info about user [Info disclosure (use access info)] hacker? (software engineer) prevent access to user [Denial of service (to real user)] take control of accounts and prevent user from using services hacker? (janitor) unauthorised access to info [Info disclosure] or see info they should not see [Elevation of privilege] b. vulnerabilities – where can the system break policy is system-centric (What is security engineering chapter 1) A vulnerability is a property of a system or its environment which, in conjunction with an internal or external threat, can lead to a security failure, which is a breach of the system’s security policy. c. likelihood – might it happen? capabilities vulnerabilities likelihood recipient / user of system weak cryptography / design low front-line person / shop software / hardware defects low manufacturer hardware defects low software engineer software defects e.g. bugs and malware possible (hacker) janitor uncontrolled access to system (physical) possible d. impact – consider vs threat Depends on what is lost and on what scale policy is asset-centric motivation impact (based on scale of damage) pretend to be user [Spoofing (steal ID)] small rig the system [Tampering (clone ID)] huge learn info about user [Info disclosure (use access info)] small to large prevent access to user [Denial of service (to real user)] small TO largeunauthorised access to info [Info disclosure] or see info they should not see [Elevation of privilege] e. protection – what does it cost? vulnerabilities cost of V (protection?) weak cryptography / design expensive (binary model) software / hardware defects cheap to expensive hardware defects expensive software defects e.g. bugs and malware possible (hacker) cheap to expensive uncontrolled access to system (physical) possible cheap (risk mgmt.) measures not just cyber but can be physical as well e.g. given: e.g. assess threats based on capabilities and motivation (STRIDE model) capabilities motivation (or threats?) recipient / user of system pretend to be user [Spoofing (steal ID)] front-line person / shop rig the system [Tampering (clone ID)] manufacturer learn info about user [Info disclosure (use access info)] software engineer prevent access to user [Denial of service (to real user)] janitor unauthorised access to info [Info disclosure] or see info they should not see [Elevation of privilege] capabilities vulnerabilities likelihood recipient / user of system weak cryptography / design low front-line person / shop software / hardware defects low manufacturer hardware defects low software engineer software defects e.g. bugs and malware possible (hacker) janitor uncontrolled access to system (physical) possible motivation impact (based on scale of damage) pretend to be user [Spoofing (steal ID)] small rig the system [Tampering (clone ID)] huge learn info about user [Info disclosure (use access info)] small to large prevent access to user [Denial of service (to real user)] small to large unauthorised access to info [Info disclosure] or see info they should not see [Elevation of privilege] vulnerabilities cost of V (protection?) weak cryptography / design expensive (binary model) software / hardware defects cheap to expensive hardware defects expensive software defects e.g. bugs and malware possible (hacker) cheap to expensive uncontrolled access to system (physical) possible cheap (risk mgmt.) measures not just cyber but can be physical as well select a threat based on criteria that will allow to justify your choice. Find and/or design a security policy that can address the selected threat. Describe how the policy can address, prevent, or mitigate the threat and explain which design principles are involved. relate your solution to the theories and show pros and cons of your idea. (700 words) Good security engineering requires four things to come together: policy: what you are supposed to achieve; mechanism: the ciphers, access controls, hardware that is tamper-resistance and other machinery; assurance: the amount of reliance you can place on each particular mechanism; and incentive: the motive that the people guarding and maintaining the system have to do their job properly, and also the motive that the attackers have to try to defeat your policy (What is security engineering?) Security policy is a succinct statement of a system’s protection strategy (for example, ‘each credit must be matched by an equal and opposite debit, and all transactions over $1,000 must be authorised by two managers’). (What is security engineering) Security goals – CIA triangle C – confidentiality – keeping data private → use encryption I – integrity – system and data cannot be altered A – availability – ability to use system as anticipated Design principles (2018 edition): • Least privilege aka rights – based on access needed, limit opportunities and permissions to access files to read, write or execute • Separation of responsibilities – use more than one layer of check • Complete mediation – check every time not just once • Fail-safe default – basic firewall settings, controls • Defence in depth – series of network cyber defenses not just one layer of measure e.g. lock out after too many attempts; additional questions if unknown IP; good passwords education; phishing education; 2FA education • Open design – encryption should be with an algorithm and key; clear route so that you can ‘see’ any attacks → analyse new attacks • Psychological acceptability – users willing to follow security guidelines • Economy of mechanisms – KISS principle; do not overcomplicate • Prudent paranoia – do not underestimate adversary’s efforts • Privacy promotion – do not collect more data than necessary e.g. strong protection on password file; do not store passwords in the clear; do not store list of previous logins Every step of your essay will need justifications that validate your choices. use of references Maximagnum number of words: 2000 References: