Domain 2 - Threat Modeling and Methodologies

Definition of Threat Modeling

  • Threat modeling is the systematic identification, enumeration, and prioritization of threats related to an asset.

  • It involves methods to understand applicable threats to a system.

  • Due to the complexity of modern systems, threat modeling assists in systematically analyzing potential threats, making it more manageable.

Purpose of Threat Modeling

  • Threat models help to address the daunting challenge of identifying all possible threats that could affect an asset in a complex system.

Major Threat Models

  • Two predominant threat modeling methodologies:

    • STRIDE

    • PASTA

STRIDE Model

  • Developed by Microsoft, STRIDE is an acronym representing various types of threats:

    • S - Spoofing

    • Definition: An attacker impersonates another user or system to gain unauthorized access.

    • Violation type: Authentication.

    • T - Tampering

    • Definition: An attacker modifies data either at rest or in transit, potentially altering the system's state or privileges.

    • Violation type: Integrity.

    • R - Repudiation

    • Definition: Actions performed in the system cannot be attributed to the attacker, leading to non-traceability.

    • Violation type: Nonrepudiation.

    • I - Information Disclosure

    • Definition: Threats that allow attackers to access sensitive information that should remain confidential.

    • Violation type: Confidentiality.

    • D - Denial of Service (DoS)

    • Definition: Authorized users are unable to access necessary resources or systems, potentially due to overwhelming the system.

    • Violation type: Availability.

    • E - Elevation of Privilege

    • Definition: Attackers gain higher access levels (e.g., from user to admin/root) allowing them greater control and the ability to hide their tracks.

    • Violation type: Authorization.

PASTA Model

  • PASTA: Process for Attack Simulation and Threat Analysis

  • Key Differences from STRIDE:

    • PASTA is risk-centric and includes considerations of the system's business value and objectives.

    • It comprises a more thorough analysis, accounting for both business and technical risks.

    • Although it is a more resource-intensive approach, it yields more comprehensive results.

Steps in the PASTA Methodology

  1. Define Objectives - Establish what the system aims to achieve.

  2. Define Scope - Identify the boundaries of the application.

  3. Application Decomposition - Break down the system into its component parts for analysis.

  4. Threat Analysis - Identify potential threats against the system.

  5. Vulnerability and Weakness Analysis - Analyze weaknesses that could be exploited by identified threats.

  6. Attack Modeling - Simulate attacks using the threats identified to understand potential impacts.

  7. Risk and Impact Analysis - Evaluate the risk posed by identified threats and the impact of potential breaches.

Choosing Between STRIDE and PASTA

  • Use STRIDE when conducting a quick and simpler analysis of threats.

  • Use PASTA for comprehensive and risk-based assessments that consider the business context of the system.