Threat Modeling and Offensive Security
undefined
Threat Modeling
Offensive Security
What is threat modeling?
•
Determining threat scenarios that can lead to compromise of
a system
•
Understanding the system
•
Thinking like an attacker
•
Devising a way in
Offensive Security
2
Threat Modeling – Why?
•
Helps confirm to-be-implemented security features
•
Helps identify security gaps
•
Helps identify monitoring shortfalls and requirements
•
Helps identify vulnerabilities in the system
•
Helps identify additional test cases to verify the security of
the system
Offensive Security
3
PTES Threat Modeling
•
Gather relevant data
•
Identify and categorize primary and secondary assets
•
Identify and categorize threats and threat communities
•
Map threats to assets
Offensive Security
4
Gathering relevant data
•
Everything about the business
Organizational structure
Processes
Sensitive information
Product details
Services rendered
•
Documentation on the business
OSINT sources
From the customer
Offensive Security
5
Assets
•
Policies Plans Procedures
•
Intellectual Property, Trade secrets, R&D
•
Customer & employee data
•
Marketing information
•
Financial information
Offensive Security
6
What would DSU consider assets?
Offensive Security
7
What is a ”threat”?
•
Potential danger
•
Malicious intent
•
Accidental
Natural disaster
•
There doesn’t need to be a vulnerability for there to be a
threat
Offensive Security
8
Motivation
•
Why would someone target YOU?
As an organization
•
Profit
•
Hacktivism
•
Political
•
Competitor
•
Rep???
Offensive Security
9
What threats does DSU face? Motivation?
Offensive Security
10
NIST SP 800-30 R1
•
Guide for Conducting Risk Assessment
Frame risk
Provide context to how risk is assessed, monitored, and responded to
Assess risk
Identify threats, vulnerabilities, harm, and likelihood
Respond to risk
Develop a course of action, evaluate, and implement response
Monitor risk
Determine effectiveness of response, identify changes, verify responses are
implemented
Offensive Security
11
Threat
•
Event with the potential to negatively impact an organization
Denial of Service
Disclosure of information
Unauthorized access
Modification of information
•
Threats are carried out by a threat actor
Insider threat
Nation State
Script Kiddie
Hactivist group
Offensive Security
12
Vulnerabilities
•
Weakness in a system
•
Can be exploited by a threat source
•
Software issues
•
Misconfigurations
•
Failover weaknesses
•
etc
Offensive Security
13
Likelihood
•
What are the chances of the threat + vulnerability happening
•
Intent
Does exploiting this vulnerability meet the goals of the threat actor?
•
Capability
Does the threat actor have the means to exploit the vulnerability?
•
Targeting
Does your organization have something the threat actor wants?
Offensive Security
14
Impact
•
The extent of the harm caused
•
How will it impact…
The business services
Reputation
Data
Financials
•
Think about the range and number of resources affected
Offensive Security
15
Risk Assessment Model
Offensive Security
16
Assess Risk
•
Example of a risk?
__________
•
What is an associated vulnerability?
__________
•
What harm could be caused by the risk + vulnerability?
Impact level?
__________
•
What is the likelihood of this occurring?
__________
Offensive Security
17
Assess Risk
•
Example of a risk actor?
Hactivist group
•
What is an associated vulnerability?
Known vulnerability in apache
•
What harm could be caused by the risk + vulnerability?
Defaced website + decreasing reputation
Medium Impact
•
What is the likelihood of this occurring?
Likely – known vulnerability in publicly facing server
Offensive Security
18
Poll
poll.dakotastate.net
•
Rate the risk of the following: Unpatched EternalBlue
vulnerability in an internal windows file server that contains
proprietary product information
•
A. Low Likelihood, High Impact
•
B. Medium Likelihood, High Impact
•
C. High Likelihood, Low Impact
•
D. Medium Likelihood, Medium Impact
•
E. None of the above
Offensive Security
19
DoD Cyber Table Top
•
Scalable threat modeling to a given system
Offensive Security
20
Cyber Table Top
•
Helps to better identify risks in a system or system of
systems
•
Educates non-technical engineers, system owners,
managers etc
•
Builds a more secure product or organization
Offensive Security
21
Scoping
•
Still challenging
Time is always the issue
•
Cyber table top is flexible
System
System of systems
Better yet… both
Risk to organization all the way down to risk to a login process on a
given system
Offensive Security
22
OPFOR
•
OPFOR == Opposing Force
•
Develops attacks
•
Achieve missions based on kill chain
•
Can use known CVE, CWE, CAPEC’s
•
Emulates attacker based on TTP’s (Tools, Techniques,
Procedures)
Script kiddie – Nation state
Is it a common tool in Kali, or difficult to custom develop
Offensive Security
23
Operations Team
•
Blue teams
Defenders
•
System admins, engineers
Builders, maintainers
•
System users
Regular users of a system
Offensive Security
24
DoD Cyber Table Top
•
Scalable threat modeling to a given system
Offensive Security
25
Simplified Kill Chain
Offensive Security
26
Model the system
•
Identify trust boundaries
Firewalls are key
Separation of internet vs. secure servers network
Security zones within the internal network
•
Add actors, both internal and external
•
Note information flow especially between boundaries
•
Locate key assets in the network
•
Add impact value
Offensive Security
27
Example Network
•
Identify boundaries
•
Note information flow
•
Identify key assets
•
Where would impact
be high? Low?
Offensive Security
28
Example: Attack 1
•
A
t
t
a
c
k
:
A
c
c
e
s
s
•
A
t
t
a
c
k
D
e
s
c
r
i
p
t
i
o
n
:
M
a
l
i
c
i
o
u
s
u
s
e
r
w
i
l
l
a
t
t
e
m
p
t
t
o
g
a
i
n
a
c
c
e
s
s
t
o
t
h
e
n
e
t
w
o
r
k
b
y
s
e
n
d
i
n
g
p
h
i
s
h
i
n
g
e
m
a
i
l
s
t
o
u
s
e
r
s
o
n
t
h
e
n
e
t
w
o
r
k
.
T
h
i
s
w
i
l
l
m
o
s
t
l
i
k
e
l
y
r
e
s
u
l
t
i
n
l
o
w
l
e
v
e
l
u
s
e
r
a
c
c
e
s
s
t
o
a
d
o
m
a
i
n
c
o
n
n
e
c
t
e
d
s
y
s
t
e
m
.
I
n
r
a
r
e
c
i
r
c
u
m
s
t
a
n
c
e
s
a
p
r
i
v
i
l
e
g
e
d
u
s
e
r
m
a
y
b
e
c
o
m
p
r
o
m
i
s
e
d
.
•
A
s
s
u
m
p
t
i
o
n
:
U
s
e
r
s
w
i
l
l
c
l
i
c
k
o
n
a
p
h
i
s
h
.
Offensive Security
29
Example: Attack 1
•
A
t
t
a
c
k
c
o
s
t
a
n
d
e
f
f
o
r
t
:
L
o
w
,
f
i
n
d
i
n
g
e
m
a
i
l
a
d
d
r
e
s
s
e
s
f
o
r
a
g
i
v
e
n
o
r
g
a
n
i
z
a
t
i
o
n
i
s
n
o
t
c
h
a
l
l
e
n
g
i
n
g
.
C
r
e
a
t
i
n
g
a
p
h
i
s
h
i
n
g
e
m
a
i
l
i
s
n
o
t
d
i
f
f
i
c
u
l
t
.
•
L
i
k
e
l
i
h
o
o
d
:
[
U
s
e
s
c
a
l
e
o
f
1
-
5
w
i
t
h
d
e
s
c
r
i
p
t
i
o
n
]
5
,
H
i
g
h
l
i
k
e
l
i
h
o
o
d
o
f
a
p
h
i
s
h
b
e
i
n
g
c
l
i
c
k
e
d
o
n
b
y
a
u
s
e
r
.
•
R
e
s
u
l
t
:
U
s
e
r
l
e
v
e
l
a
c
c
e
s
s
t
o
t
h
e
s
y
s
t
e
m
•
[
I
F
A
T
T
A
C
K
I
S
E
F
F
E
C
T
O
R
E
X
F
I
L
T
R
A
T
E
]
I
m
p
a
c
t
:
(
H
o
w
d
o
e
s
t
h
i
s
i
m
p
a
c
t
t
h
e
o
r
g
a
n
i
z
a
t
i
o
n
i
n
s
h
o
r
t
a
n
d
l
o
n
g
t
e
r
m
?
Offensive Security
30
Other Ideas
•
Supply chain
Compromised hardware
Peripherals (keyboards, mice)
•
Physical access
•
USB Droppers
•
Wi-Fi
•
Web applications
•
VPN applications
•
Core business functions
•
Users
Which service they are the administrator of
•
Cyber-attack causing kinetic effects
Offensive Security
31
Threat modeling in offensive security involves determining potential threat scenarios that could compromise a system, understanding the system from an attacker's perspective, and devising defensive strategies. It helps confirm security implementations, identify gaps, monitor shortcomings, vulnerabilities, and test cases. Gathering relevant data about the business, assets, and potential threats is crucial to mapping threats effectively.
Download Presentation
Please find below an Image/Link to download the presentation.
The content on the website is provided AS IS for your information and personal use only. It may not be sold, licensed, or shared on other websites without obtaining consent from the author. Download presentation by click this link. If you encounter any issues during the download, it is possible that the publisher has removed the file from their server.
E N D
Presentation Transcript
Threat Modeling Offensive Security
What is threat modeling? Determining threat scenarios that can lead to compromise of a system Understanding the system Thinking like an attacker Devising a way in Offensive Security 2
Threat Modeling Why? Helps confirm to-be-implemented security features Helps identify security gaps Helps identify monitoring shortfalls and requirements Helps identify vulnerabilities in the system Helps identify additional test cases to verify the security of the system Offensive Security 3
PTES Threat Modeling Gather relevant data Identify and categorize primary and secondary assets Identify and categorize threats and threat communities Offensive Security Map threats to assets 4
Gathering relevant data Everything about the business Organizational structure Processes Sensitive information Product details Services rendered Documentation on the business OSINT sources From the customer Offensive Security 5
Assets Policies Plans Procedures Intellectual Property, Trade secrets, R&D Customer & employee data Marketing information Financial information Offensive Security 6
What would DSU consider assets? Offensive Security 7
What is a threat? Potential danger Malicious intent Accidental Natural disaster There doesn t need to be a vulnerability for there to be a threat Offensive Security 8
Motivation Why would someone target YOU? As an organization Profit Hacktivism Political Competitor Offensive Security Rep??? 9
What threats does DSU face? Motivation? Offensive Security 10
NIST SP 800-30 R1 Guide for Conducting Risk Assessment Frame risk Provide context to how risk is assessed, monitored, and responded to Assess risk Identify threats, vulnerabilities, harm, and likelihood Respond to risk Develop a course of action, evaluate, and implement response Monitor risk Determine effectiveness of response, identify changes, verify responses are implemented Offensive Security 11
Threat Event with the potential to negatively impact an organization Denial of Service Disclosure of information Unauthorized access Modification of information Threats are carried out by a threat actor Insider threat Nation State Script Kiddie Hactivist group Offensive Security 12
Vulnerabilities Weakness in a system Can be exploited by a threat source Software issues Misconfigurations Failover weaknesses Offensive Security etc 13
Likelihood What are the chances of the threat + vulnerability happening Intent Does exploiting this vulnerability meet the goals of the threat actor? Capability Does the threat actor have the means to exploit the vulnerability? Targeting Does your organization have something the threat actor wants? Offensive Security 14
Impact The extent of the harm caused How will it impact The business services Reputation Data Financials Think about the range and number of resources affected Offensive Security 15
Risk Assessment Model Offensive Security 16
Assess Risk Example of a risk? __________ What is an associated vulnerability? __________ What harm could be caused by the risk + vulnerability? Impact level? __________ Offensive Security What is the likelihood of this occurring? __________ 17
Assess Risk Example of a risk actor? Hactivist group What is an associated vulnerability? Known vulnerability in apache What harm could be caused by the risk + vulnerability? Defaced website + decreasing reputation Medium Impact Offensive Security What is the likelihood of this occurring? Likely known vulnerability in publicly facing server 18
Poll poll.dakotastate.net Rate the risk of the following: Unpatched EternalBlue vulnerability in an internal windows file server that contains proprietary product information A. Low Likelihood, High Impact B. Medium Likelihood, High Impact C. High Likelihood, Low Impact D. Medium Likelihood, Medium Impact Offensive Security E. None of the above 19
DoD Cyber Table Top Scalable threat modeling to a given system Offensive Security 20
Cyber Table Top Helps to better identify risks in a system or system of systems Educates non-technical engineers, system owners, managers etc Builds a more secure product or organization Offensive Security 21
Scoping Still challenging Time is always the issue Cyber table top is flexible System System of systems Better yet both Risk to organization all the way down to risk to a login process on a given system Offensive Security 22
OPFOR OPFOR == Opposing Force Develops attacks Achieve missions based on kill chain Can use known CVE, CWE, CAPEC s Emulates attacker based on TTP s (Tools, Techniques, Procedures) Script kiddie Nation state Is it a common tool in Kali, or difficult to custom develop Offensive Security 23
Operations Team Blue teams Defenders System admins, engineers Builders, maintainers System users Regular users of a system Offensive Security 24
DoD Cyber Table Top Scalable threat modeling to a given system Offensive Security 25
Simplified Kill Chain Offensive Security 26
Model the system Identify trust boundaries Firewalls are key Separation of internet vs. secure servers network Security zones within the internal network Add actors, both internal and external Note information flow especially between boundaries Locate key assets in the network Offensive Security Add impact value 27
Example Network Identify boundaries Note information flow Identify key assets Where would impact be high? Low? Offensive Security 28
Example: Attack 1 Attack: Access Attack Description: Malicious user will attempt to gain access to the network by sending phishing emails to users on the network. This will most likely result in low level user access to a domain connected system. In rare circumstances a privileged user may be compromised. Assumption: Users will click on a phish. Offensive Security 29
Example: Attack 1 Attack cost and effort: Low, finding email addresses for a given organization is not challenging. Creating a phishing email is not difficult. Likelihood: [Use scale of 1-5 with description] 5, High likelihood of a phish being clicked on by a user. Result: User level access to the system [IF ATTACK IS EFFECT OR EXFILTRATE] Impact: (How does this impact the organization in short and long term? Offensive Security 30
Other Ideas Supply chain Compromised hardware Peripherals (keyboards, mice) Physical access USB Droppers Wi-Fi Web applications VPN applications Core business functions Offensive Security Users Which service they are the administrator of Cyber-attack causing kinetic effects 31
