CoreQ Academy1.4 Given a scenario, perform threat-modeling activities.
Threat modeling asks "who would attack this, how, and what stops them?" for both existing systems and designs that do not exist yet.
Actor characteristics
- Motivation
- Why the actor attacks.
- Financial
- Profit from ransom, fraud or data sales.
- Geopolitical
- State interests: espionage, sabotage, influence.
- Activism
- Promoting a cause.
- Notoriety
- Fame or reputation in the attacker community.
- Espionage
- Stealing secrets.
- Resources
- What the actor can invest.
- Time
- Patience for long campaigns.
- Money
- Funding for tools, infrastructure and exploits.
- Capabilities
- What the actor can actually do.
- Supply chain access
- Ability to compromise vendors or components upstream.
- Vulnerability creation
- Ability to plant weaknesses, e.g. in open-source projects.
- Knowledge
- Depth of technical and target-specific knowledge.
- Exploit creation
- Ability to develop new exploits, including zero-days.
Attack patterns and frameworks
- Attack patterns
- Common, repeatable ways attacks are carried out.
- MITRE Adversarial Tactics, Techniques, and Common Knowledge (ATT&CK)
- Knowledge base of real adversary behaviour by tactic and technique.
- Common Attack Pattern Enumeration and Classification (CAPEC)
- MITRE catalogue of attack patterns, especially against software.
- Cyber Kill Chain
- Lockheed Martin model: reconnaissance, weaponisation, delivery, exploitation, installation, command and control, actions on objectives.
- Diamond Model of Intrusion Analysis
- Analyses intrusions through four connected features: adversary, capability, infrastructure and victim.
- Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, and Elevation of Privilege (STRIDE)
- Threat categories applied to each element of a data-flow diagram.
- Open Worldwide Application Security Project (OWASP)
- Resources such as the Top 10 and threat modeling guidance for applications.
Attack surface determination
- Architecture reviews
- Examining designs for exposed components and weak trust assumptions.
- Data flows
- Mapping where data moves, is stored and processed.
- Trust boundaries
- Points where data crosses between different trust levels; where controls belong.
- Code reviews
- Finding attack surface and flaws in code.
- User factors
- How users' behaviour and roles create exposure.
- Organizational change
- Events that alter the attack surface.
- Mergers
- Joining networks and identities from another organisation.
- Acquisitions
- Inheriting another organisation's systems and debt.
- Divestitures
- Separating systems and access cleanly when part of the business leaves.
- Staffing changes
- Joiners, movers and leavers changing access needs.
- Enumeration/discovery
- Actively finding assets.
- Internally and externally facing assets
- Everything reachable internally and from the internet.
- Third-party connections
- Links to vendors and partners.
- Unsanctioned assets/accounts
- Shadow IT and orphaned accounts.
- Cloud services discovery
- Finding cloud accounts and SaaS in use.
- Public digital presence
- Domains, social media, code and documents visible to attackers.
Methods
- Abuse cases
- Describing how a feature could be misused, the counterpart of use cases.
- Antipatterns
- Common bad designs to look for (e.g. trusting client-side validation, shared admin accounts).
- Attack trees/graphs
- Diagrams of how an attacker could reach a goal through alternative paths.
Modeling applicability of threats to the organization/environment
- With an existing system in place
- Model the real system and its current controls.
- Selection of appropriate controls
- Choosing controls that address the modelled threats.
- Without an existing system in place
- Model a design before it is built so security is designed in.
Check your understanding
Loading quiz…
Original CoreQ Academy material, mapped to objective 1.4 of the publicly available CompTIA SecurityX CAS-005 exam objectives (Exam objectives V5, document version 7.0). Not affiliated with or endorsed by CompTIA. Contains no exam questions.