Threat Modeling in the garden of Eden

Threat Modeling in the garden of Eden Mano ‘dash4rk’ Paul HackFormers

ABC’s about me • Author • Official (ISC)2 Guide to the CSSLP • Advisor • (ISC)2 Software Assurance Advisor • Biologist (Shark) • Christian • CEO, SecuRisk Solutions & Express Certifications

Agenda • Teach Security: Threat Modeling • Teach Christ: In the garden of Eden • Discussion

Teach Security Threat Modeling

Threat Modeling • Process/Activity • Systematic to determine applicable threats • Iterative to ensure threats are addressed • A must-have for companies today • Cannot ignore

Why Threat Model? • To manage Risk! • Risk of what? Disclosure/Alteration/Destruction • Risk to what? Assets • Why? Threats agents and Vulnerabilities • So what do we do? Threat Model Identify threats & vulnerabilities • Then what? Manage risk  apply controls • Model threats  Apply controls  Reduce risk

ABC of Threat Modeling • Step 1: Identify Assets • Step 2: Identify Boundaries (Entry/Exit/Flows) • Step 3: Identify Controls • But first we need to identify applicable Threats

Step 1: Identify Assets • Assets (anything of value) • Financial • Personal • Sensitive • Intellectual property

Step 2: Identify Boundaries External Internal DMZ

Step 3: Identify Controls • Oh but first, we need to identify Threats • Threat Identification • Attack Trees • Threat Framework

STRIDE Threat Framework Spoofing Masquerading Tampering Alteration Repudiation Denying Info. Disclosure Data Loss/Leakage Denial of Service Downtime Elevation of Privilege Admin (root)

Identify Controls Appropriate INCORPORATION of Controls reduces Risk Spoofing Tampering Repudiation Info. Disclosure Denial of Service Elevation of Privilege

Teach Christ In the garden of Eden

The Asset • What is man that thou (God) art mindful of him? • Psalm 8:4 • Man - God’s most precious asset • “For you are fearfully and wonderfully made” (Psalm 139:14) • “Created in the image of God” (Genesis 1:27) • Man – God’s most prime asset • Dominion was given to man over all the fish, fowl and all living things that moved upon the earth (Genesis 1:28) • Apex of God’s creation; not Ex-Ape of Evolution

The Boundaries Garden of Eden External

The threats Prelude to the Garden encounter: Lucifer (the devil) tried to elevate himself above God and was thrown out (Ezekiel 28) Elevation of Privilege The fruit which was bad for the soul (spirit) was pleasing to the eye (flesh) (Genesis 3:6) Spoofing God said: You shall not eat of the tree of knowledge … (Genesis 2:17)Devil asked: … you shall not eat of any tree? (Genesis 3:1) Tampering Devil said: Yea, Hath God said - phishing for information (Genesis 3:1) Info. Disclosure Adam said (denied): It wasn’t me, but Eve; Eve said (denied): It wasn’t me, but the serpent (Genesis 3:12,13) Repudiation Access to the tree of life was denied after man disobeyed (Genesis 3:22-24). Denial of Service

The Impact Garden of Eden External

The Control No more boundaries (separation from God);Gift of God is eternal life to all who believe in Jesus Christ– John 3:16 Appropriate INCLUSION of Jesus Christ in our life eliminates the risk of second death Garden of Eden External

Discussion Points • What are some of the “threats” in your personal/professional life? • How are you addressing these threats?

Closing Thoughts try { if (uLikedThisMtg) { getLinkedIn(); subscribeViaEmail(); followAndTweet(); // @hackformers emailUs(); // mano.paul@hackformers.org } else { giveFeedback(); // mano.paul@hackformers.org } } catch(Threats t) { applyControl(God JesusChrist); } finally { ThankUandGodBless(); }

Want More? • Speaker: Michael Howard • Principal Cybersecurity Program Manager, Microsoft • Author, Writing Secure Code and many more … • Topic: TBD • Date: March 09, 2012 • Time: 11:30 a.m. – 1:00 p.m. • Venue: Microsoft Technology Center • www.hackformers.org • @hackformers

Backup

Identify Control

Threat Modeling in the garden of Eden