実践的な脅威モデリング

Welcome to Practical Threat Modeling! This lesson dives into proactive security, identifying potential threats and vulnerabilities *before* they become costly problems.

Threat modeling is a structured approach to:

• Understand your system's design.
• Identify potential threats to that design.
• Evaluate and prioritize those threats.
• Devise mitigation strategies.

It helps 'shift left' security, integrating it early in the development lifecycle.

Finding security flaws during the design phase is far more effective and cheaper than fixing them in production.

Threat modeling helps you:

• Reduce Costs: Fixing design flaws is less expensive than patching deployed code.
• Improve Design: Build security in from the ground up, not as an afterthought.
• Prioritize Resources: Focus on the most critical risks first.
• Meet Compliance: Demonstrate a commitment to security.

While methodologies vary, most threat modeling processes follow these key steps:

1. Define Scope: What system or feature are we analyzing?
2. Deconstruct Application: Understand how the system works (components, data flows, trust boundaries).
3. Identify Threats: Brainstorm potential attacks against the system.
4. Identify Vulnerabilities: Pinpoint weaknesses that could allow threats to succeed.
5. Mitigate: Design and implement controls to reduce risk.
6. Verify: Ensure mitigations are effective.

STRIDE is a widely used mnemonic developed by Microsoft. It helps categorize threats against a system based on different types of security properties.

Each letter in STRIDE represents a specific threat category:

• Spoofing
• Tampering
• Repudiation
• Information Disclosure
• Denial of Service
• Elevation of Privilege

Let's break down each one.

• Spoofing (S): This threat involves an attacker pretending to be someone or something else. Think of identity theft or faking a source IP address. It attacks Authentication.
• Tampering (T): This refers to unauthorized modification of data. An attacker altering data in transit or at rest to achieve a malicious goal. It attacks Integrity.

These two often go hand-in-hand, as spoofing an identity might lead to tampering with data.

• Repudiation (R): This occurs when a user denies performing an action, and there's no way to prove otherwise. For example, denying a transaction. It attacks Non-Repudiation, requiring robust logging.
• Information Disclosure (I): This is the unauthorized exposure of sensitive data. This could be anything from user passwords to confidential business logic. It attacks Confidentiality.

Proper logging and access controls are key to addressing these threats.

• Denial of Service (D): An attacker makes a system or service unavailable to legitimate users. This could be overwhelming a server with requests or crashing an application. It attacks Availability.
• Elevation of Privilege (E): An attacker gains higher access rights than they should have, such as a regular user becoming an administrator. It attacks Authorization.

These threats often have significant business impact, from lost revenue to complete system compromise.

To effectively apply STRIDE, you first need to understand your system. Data Flow Diagrams (DFDs) are excellent for this.

DFDs help you visualize:

• Processes: Where data is transformed.
• Data Stores: Where data resides (databases, files).
• External Entities: Users, other systems interacting with yours.
• Data Flows: How data moves between components.

Mapping these helps identify 'trust boundaries' and attack surfaces.

Once threats are identified (e.g., using STRIDE), you need to prioritize them. The DREAD methodology helps rate the severity of a threat by considering five factors:

• Damage: How bad would an attack be?
• Reproducibility: How easy is it to reproduce the attack?
• Exploitability: How easy is it to launch the attack?
• Affected Users: How many users would be impacted?
• Discoverability: How easy is it to find the vulnerability?

Each factor is typically rated on a scale (e.g., 1-10 or Low/Medium/High), and the scores are combined to give an overall risk rating.

Let's consider a potential threat: An unauthenticated user can access another user's profile data.

Using DREAD, we might rate it:

• Damage: High (sensitive data exposed).
• Reproducibility: High (easy to replicate).
• Exploitability: Medium (requires some skill, but common).
• Affected Users: High (all users' data is at risk).
• Discoverability: Medium (might be found through testing or by chance).

A high overall DREAD score indicates a critical threat requiring immediate attention.

You're performing threat modeling on a new e-commerce application. You've identified a scenario where an attacker could intercept and modify the price of an item during checkout before the final payment is processed.

Which STRIDE threat category best describes this specific vulnerability?

We've explored the world of Threat Modeling, a crucial proactive security practice.

• It helps identify and mitigate vulnerabilities early in the development process.
• The STRIDE methodology (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service, Elevation of Privilege) provides a framework for categorizing threats.
• Data Flow Diagrams (DFDs) are valuable tools for visualizing system components and data flows.
• The DREAD methodology (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) helps prioritize identified threats based on their potential impact and likelihood.

By applying these methodologies, you can build more secure systems from the ground up!