Managing the Source of Risk
A key step in managing risk is to first understand and manage its source: threats and vulnerabilities, and especially threat/vulnerability pairs. Once you understand these elements, it is much easier to identify mitigation techniques.
A threat is any activity that represents a possible danger. This includes any circumstances or events with the potential to adversely impact the confidentiality, integrity, or availability of a business's assets.
Common types of attack
- Organizational attacks
- Hackers
- Automated attacks
- Attacks on restricted data
- Accidental breaches in security
- Viruses, Trojan horses, and worms
- Denial of service (DoS), where connections fail
Possible threat sources: the seven IT infrastructure domains
Threats can originate in any of the seven domains of a typical IT infrastructure: the User, Workstation, LAN, LAN-to-WAN, WAN, Remote Access, and System/Application domains.
Threats Against the Network, Host and Application
| Target | Threat | Examples |
|---|---|---|
| Network | Information gathering | Port scanning; trace routing to detect topology; broadcast requests to enumerate subnet hosts |
| Network | Eavesdropping | Packet sniffers stealing passwords |
| Network | Denial of service | SYN floods, ICMP echo request floods, malformed packets |
| Network | Spoofing | Packets with spoofed source addresses |
| Host | Arbitrary code execution | Buffer overflows in ISAPI DLLs; directory traversal |
| Host | File disclosure | Malformed HTR requests; virtualized UNC share vulnerability |
| Host | Denial of service | Malformed SMTP, WebDAV requests and URLs; brute-force file uploads |
| Host | Unauthorized access | Insufficiently restrictive ACLs; spoofing with stolen credentials |
| Host | Exploiting open ports and protocols | NetBIOS/SMB host enumeration; connecting remotely to SQL Server |
| Application | SQL injection | DROP TABLE typed into an input field |
| Application | Cross-site scripting (XSS) | Malicious client-side script stealing cookies |
| Application | Hidden-field tampering | Changing the value of a hidden form field |
| Application | Session hijacking / identity spoofing | Stolen session ID or forms-authentication cookie |
| Application | Information disclosure | Client sees a stack trace on an unhandled exception |
Memory trick · Which layer?
- Networkpackets
- Hostthe server OS and services
- Applicationinputs, cookies, sessions
SQL injection and XSS are always application threats.
Components of a Threat and Threat Agents
| Component | Meaning and examples |
|---|---|
| Threat agents | Criminals, terrorists, subversive/secret groups, state sponsored, disgruntled employees, hackers, pressure groups, commercial groups |
| Motivators | Political, secular, personal gain, religion, power, terrorism, curiosity |
| Capability | Software, technology, facilities, education and training, methods, books and manuals |
| Catalysts | Events, technology changes, personal circumstances |
| Amplifiers | Peer pressure, fame, access to information, changing technology, deskilling through scripting, skills, law enforcement activity, target profile |
| Inhibitors | Fear of capture or failure, technical difficulty, cost of participation, sensitivity to public perception, law enforcement activity |
Memory trick · A-M-C-C-A-I
Agents Must Carry Capability, Amplified or Inhibited
who, why, with what, what triggers it, what boosts it, what holds it back. Catalysts trigger; amplifiers increase; inhibitors discourage.
Types of threat agents
Database, Web and Information System Threats
Top ten database security threats
| # | Threat | Key idea |
|---|---|---|
| 1 | Excessive privilege abuse | Privileges exceed the job (an administrator who can change contact info also changes grades) |
| 2 | Legitimate privilege abuse | Legitimate access misused (health worker selling patient records) |
| 3 | Privilege elevation | Platform vulnerabilities turn user rights into administrator rights |
| 4 | Database platform vulnerabilities | Flaws in the underlying OS and services |
| 5 | SQL injection | Unauthorized statements injected into a SQL data channel |
| 6 | Weak audit trail | Regulatory risk, less deterrence, poor detection and recovery |
| 7 | Denial of service | Access denied to intended users |
| 8 | Communication protocol vulnerabilities | Many vendor patches fix protocol flaws |
| 9 | Weak authentication | Attackers assume legitimate identities with stolen credentials |
| 10 | Backup data exposure | Unprotected backup tapes and disks are stolen |
Ten web threats
- Bigger, subtler DDoS attacks
- Old browsers and vulnerable plug-ins (Java, Flash, Reader)
- Good sites hosting bad content (watering hole attacks)
- Mobile apps and BYOD on the unsecured web
- Failing to clean up bad input (SQL injection)
- Hazards of digital certificates (fraudulent SSL certificates)
- Cross-site scripting
- The insecure Internet of Things
- Getting in the front door (web bots scraping business intelligence)
- New technology, same problems (people click links)
Major security threats on information systems
| Threat | Description |
|---|---|
| Intrusion / hacking | Gaining access without the owner's knowledge (poor shopping carts, hidden fields, client-side validation, direct SQL, session hijacking, buffer overflow, port scan) |
| Viruses and worms | Programs that make systems not work properly (polymorphic, stealth, tunneling, droppers, cavity viruses) |
| Trojan horse | Two components, a server and a client; steal data, log keystrokes, send files |
| Spoofing | Fooling users into trusting a fake source (IP, DNS, ARP spoofing) |
| Sniffing | Capturing login IDs and passwords over the wire (TCPDump, Snoop) |
| Denial of service | Bringing down the network for legitimate users; can be done with a simple ping |
Vulnerabilities: Types and How They Manifest
A vulnerability is some weakness of a system that could allow security to be violated.
Types of vulnerabilities
- Physical
- Natural
- Hardware/software
- Media (stolen or damaged disks and tapes)
- Emanation (due to radiation)
- Communication
- Human
How vulnerabilities manifest (misuse)
| Misuse | Examples |
|---|---|
| External misuse | Visual spying, misrepresenting, physical scavenging |
| Hardware misuse | Logical scavenging, eavesdropping, interference, physical attack or removal |
| Masquerading | Impersonation, piggybacking, spoofing, network weaving |
| Pest programs | Trojan horses, logic bombs, worms, viruses |
| Bypasses | Trapdoor attacks, authorization attacks such as password cracking |
| Active misuse | Basic active attack, incremental attack, denial of service |
| Passive misuse | Browsing, interference, aggregation, covert channels |
Where vulnerabilities come from
| Source | Examples |
|---|---|
| Employees | Discussing work in public, taking data out of the office, installing unauthorized software, tailgating, opening spam, writing down passwords, lack of awareness |
| Former employees | Working for competitors, retaining company data, discussing company matters |
| Technology | Social networking, file sharing, rapid change, legacy systems, data on mobile devices |
| Hardware | Dust, heat and humidity, design flaws, out-of-date or misconfigured hardware |
| Software | Insufficient testing, no audit trail, bugs, unchecked input, bloatware, SaaS loss of control, vendors going out of business |
| Network | Unprotected communications, open connections/ports, insecure architecture, unused user IDs, excessive privileges, WiFi |
| IT management | Missed patches, weak incident and change management, no audits, improper waste disposal, lack of risk analysis, inadequate continuity planning |
| Partners and suppliers | Telecom and utility disruption, supply disruption, sharing confidential data |
Common Vulnerabilities and Exposures (CVE)
CVE defines a vulnerability as a weakness in the computational logic (e.g. code) found in software and hardware components that, when exploited, results in a negative impact to confidentiality, integrity, or availability. Mitigation typically involves coding changes, but could include specification changes or even removing affected protocols or functionality entirely.
All vulnerabilities in the NVD (National Vulnerability Database) have been assigned a CVE identifier. A CVE entry contains:
Examples
| CVE | Description |
|---|---|
| CVE-2016-7280 | XSS vulnerability in Microsoft Edge lets remote attackers inject arbitrary web script or HTML (Microsoft Edge Information Disclosure Vulnerability). |
| CVE-2016-3273 | The XSS Filter in Internet Explorer 9–11 and Edge does not properly restrict JavaScript, letting attackers obtain sensitive information via a crafted site. |
Threat Modeling and STRIDE
Threat modeling is a structured approach to identifying, quantifying, and addressing threats. Threat-modeling methods create an abstraction of the system, profiles of potential attackers (goals and methods), and a catalog of potential threats.
The twelve threat models
| STRIDE | PASTA | LINDDUN |
| CVSS | Attack Trees | Persona non Grata |
| Security Cards | hTMM | Quantitative TMM |
| Trike | VAST | OCTAVE |
STRIDE
- Evaluates the system detail design; it models the in-place system.
- Built on data-flow diagrams (DFDs).
- Identifies system entities, events, and system boundaries.
- Microsoft no longer maintains STRIDE separately; it is part of the Microsoft SDL through the Threat Modeling Tool.
| Letter | Threat | Question it asks | Property violated |
|---|---|---|---|
| S | Spoofing | Can an attacker gain access using a false identity? | Authentication |
| T | Tampering | Can an attacker modify data as it flows through the application? | Integrity |
| R | Repudiation | If an attacker denies doing something, can we prove they did it? | Non-repudiation |
| I | Information disclosure | Can an attacker gain access to private or potentially injurious data? | Confidentiality |
| D | Denial of service | Can an attacker crash or reduce the availability of the system? | Availability |
| E | Elevation of privilege | Can an attacker assume the identity of a privileged user? | Authorization |
STRIDE vs DREAD
STRIDE classifies threats (what kind). DREAD scores them (how bad) so they can be prioritized.
PASTA, LINDDUN, CVSS and Attack Trees
LINDDUN privacy threats
| Letter | Threat | Meaning |
|---|---|---|
| L | Linkability | Distinguishing whether two items of interest are linked (visits by the same user) |
| I | Identifiability | Identifying the subject within a set (the sender of an email) |
| N | Non-repudiation | Being unable to deny an action where deniability is needed (anonymous voting, whistleblowing) |
| D | Detectability | Distinguishing whether an item of interest exists |
| D | Disclosure of information | Data privacy leakage (STRIDE is used here) |
| U | Unawareness | Being unaware of the consequences of sharing information |
| N | Non-compliance | Not complying with legislation, regulations, and corporate policy |
Attack trees
- A hierarchical decomposition of a threat into individual, testable conditions.
- The root is the adversary's goal.
- Each level below decomposes the attack into finer approaches.
- Child nodes are ORed together by default; special notation marks AND nodes.
Goal: read a file from a password-protected PC → get password (search desk, social engineer), network access, or physical access (boot with CD, remove hard disk).
Goal: read a message sent between PCs → 1. convince sender (blackmail, bribe); 2. read on sender's PC; 3. read on receiver's PC; 4. read in transit (sniff, usurp mail server).
PnG, Security Cards, hTMM, Quantitative TMM, Trike, VAST and OCTAVE
| Method | Key characteristics |
|---|---|
| Persona non Grata (PnG) | Focuses on the motivations and skills of human attackers; views the system from an unintended-use point of view; helpful early in threat modeling. |
| Security Cards | A brainstorming technique with a deck of cards to find unusual and complex attacks: who might attack, why, which assets, and how. |
| hTMM | Hybrid Threat Modeling Method (SEI, 2018): SQUARE + Security Cards + PnG. Goals: no false positives, no overlooked threats, consistent results, cost effective. |
| Quantitative TMM | Attack trees + STRIDE + CVSS applied together for cyber-physical systems with complex interdependencies. Build attack trees for the STRIDE categories, then score components with CVSS. |
| Trike | A security audit framework using threat modeling from a risk-management, defensive perspective. Uses an actor-asset-action matrix with CRUD cells, a DFD, attack trees, and a five-point probability scale; threats are elevation of privilege or denial of service. |
| VAST | Visual, Agile, and Simple Threat modeling: scales across infrastructure and DevOps, fits Agile. Application threat models (developers, DFD and process flow) and operational threat models (infrastructure, attacker view). |
| OCTAVE | Operationally Critical Threat, Asset, and Vulnerability Evaluation: a risk-based strategic method focused on organizational risk, not technological risk. |
OCTAVE's three phases
Build asset-based threat profiles
An organizational evaluation.
Identify infrastructure vulnerabilities
An evaluation of the information infrastructure.
Develop a security strategy and plans
Identify risks to critical assets and make decisions.
hTMM main steps
Identify the system to be threat-modeled
Apply Security Cards based on developer suggestions
Remove unlikely PnGs
Those with no realistic attack vectors.
Summarize results with tool support
Continue with a formal risk-assessment method
Easy to confuse
hTMM = SQUARE + Security Cards + PnG. Quantitative TMM = attack trees + STRIDE + CVSS.
DREAD, Threat/Vulnerability Pairs and the Threat Matrix
| Letter | Factor | Question |
|---|---|---|
| D | Damage potential | What are the consequences of a successful exploit? |
| R | Reproducibility | Would an exploit work every time or only under certain circumstances? |
| E | Exploitability | How skilled must an attacker be to exploit the vulnerability? |
| A | Affected users | How many users would be affected by a successful exploit? |
| D | Discoverability | How likely is it that an attacker will know the vulnerability exists? |
DREAD example from the slides
| Threat | D | R | E | A | D | Sum |
|---|---|---|---|---|---|---|
| Auth cookie theft (eavesdropping) | 3 | 2 | 3 | 2 | 3 | 13 |
| Auth cookie theft (XSS) | 3 | 2 | 2 | 2 | 3 | 12 |
Damage potential is high (spoofed identities); a cookie can be stolen any time but is useful only until it expires; anyone can run a sniffer while XSS needs moderate skill; all users could be affected but most won't click malicious links; the flaw is easy to discover. The higher sum means eavesdropping is prioritized.
Threat/vulnerability pairs
- A threat/vulnerability pair occurs when a threat exploits a vulnerability.
- The vulnerability provides a path for the threat that results in harm or loss.
- Both must come together to result in a loss.
- Vulnerabilities depend on your organization: with no public-facing servers, there are no vulnerabilities in that area, so the risk is zero.
A threat matrix plots the capabilities of a threat against the types of vulnerability, similar to a risk assessment matrix.
Exam Tips & Tricks
Threat definition
Any activity representing a possible danger: circumstances or events that could adversely impact CIA of assets.
Target layers
Network: sniffing, SYN floods, spoofed packets. Host: buffer overflows, ACLs, open ports. Application: SQL injection, XSS, hidden fields, session hijacking.
Catalyst vs amplifier vs inhibitor
Catalysts trigger (events, tech change); amplifiers increase (fame, peer pressure); inhibitors discourage (fear of capture, cost).
CVE entry
CVE ID + description + references. All NVD vulnerabilities have a CVE ID.
STRIDE
Spoofing, Tampering, Repudiation, Information disclosure, DoS, Elevation of privilege. DFD-based; part of Microsoft SDL.
Privacy = LINDDUN
Linkability, Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness, Non-compliance. Six steps, starts from a DFD.
Attack trees
Root = attacker's goal; children ORed by default; AND needs special notation.
OCTAVE vs hTMM
OCTAVE: organizational (not technological) risk, 3 phases. hTMM: SQUARE + Security Cards + PnG. Quantitative TMM: attack trees + STRIDE + CVSS.
DREAD
Damage, Reproducibility, Exploitability, Affected users, Discoverability. Slide example: eavesdropping 13 beats XSS 12.
Pairs
Loss needs a threat AND a vulnerability. No vulnerability in an area = zero risk there.
Flashcards — Test Yourself
Say the answer out loud, then flip the card to check. Shuffle the deck to test yourself in a new order.
Quick Reference — Everything at a Glance
| Topic | Key Point |
|---|---|
| Threat | Activity representing possible danger to CIA of assets. |
| Network threats | Information gathering, eavesdropping, DoS, spoofing. |
| Host threats | Arbitrary code execution, file disclosure, DoS, unauthorized access, open ports. |
| Application threats | SQL injection, XSS, hidden-field tampering, session hijacking, identity spoofing, information disclosure. |
| Threat components | Agents, motivators, capability, catalysts, amplifiers, inhibitors. |
| Threat agent types | Natural, unintentional, intentional. |
| Database threat #1 | Excessive privilege abuse. |
| Vulnerability types | Physical, natural, hardware/software, media, emanation, communication, human. |
| Misuse categories | External, hardware, masquerading, pest programs, bypasses, active, passive. |
| CVE | Weakness in computational logic that impacts CIA when exploited; entry = ID, description, references. |
| CVSS | Numerical severity score from analyst metric values. |
| STRIDE | Classifies threats on DFDs; Microsoft SDL Threat Modeling Tool. |
| PASTA | Risk-centric, 7 stages, aligns business objectives and technical requirements. |
| LINDDUN | Privacy threat modeling, 6 steps, DFD based. |
| Attack tree | Hierarchical decomposition; root = goal; OR by default. |
| PnG / Security Cards | Attacker motivations and skills / brainstorming deck of cards. |
| Trike | Security audit framework; actor-asset-action CRUD matrix; 5-point scale. |
| VAST | Agile, scalable; application and operational threat models. |
| OCTAVE | Organizational risk; 3 phases: threat profiles, infrastructure vulnerabilities, strategy. |
| DREAD | Damage, reproducibility, exploitability, affected users, discoverability; sum to prioritize. |
| Threat/vulnerability pair | A threat exploiting a vulnerability; both needed for a loss. |