November 2016 Study “Developed at DePaul University, the Persona non Grata approach makes threat modeling more tractable by asking users to focus on attackers, their motivations, and abilities. Once this step is completed, users are asked to brainstorm about targets and likely attack mechanisms that the attackers would deploy.” Source: https://insights.sei.cmu.edu/sei_blog/2016/11/cyber-threat-modeling-an-evaluation-of-three-methods.html • PnG reflected least false positives • PnG reflected consistent threats across multiple teams conducting threat analysis • PASTA focuses on: • Substantiating models with real threats • Supporting threats via real attack patterns that can be tested (DevSecOps test cases) • Supporting vulns that map to attack patterns (e.g. – CWE/ CVE: CAPEC mapping) • Collaborative amongst various constituents APPLICATION THREAT MODELING ACTIVITIES per STAGE MGT PMO BA ARC SWE QA SYS SOC RL PC SA EA CTO VA PT STAGE 1 - DEFINE BUSINESS OBJECTIVES - Est. New TM = 2-4 hours | Est. Repeat TM = < 1 hour A R R A I I I − I R I I R − − M GT Product M gmt Obtain business objectives for product or application A I R A I I I − I − − I I − − P M O Project M gmt Identify regulatory compliance obligations A I I A I I I − I R − I I − − B A Business Analyst Define a risk profile or business criticality level for the application A I I A I I I − I C I I R − − A R C Architect Identify the key business use cases for the application/product A R R A I I I − I − − I I − − SWE Software Engineer STAGE 2 - TECHNICAL SCOPE - Est. New TM = 3-4 hours | Est. Repeat TM = 1-3 hours I I C A R/A C I − I − I C I − − QA Quality Assurance Enumerate software applications/database in support of product/application I I C A R/A C I − − − − C I − − SYS SysAdmin Identify any client-side technologies (Flash, DHTML5, etc.) I I C A R/A C I − − − I C I − − SOC Security Operations Enumerate system platforms that support product/application I I C A R/A C I − − − I C I − − R L IT Risk Leader Identify all application/product actors I I C A R/A C I − − − I C I − − P C Product Compliance Enumerate services needed for application/product use & management I I C A R/A C I − − − I C I − − SA Software Assurance Enumerate 3rd party COTS needed for solution I I C A R/A C I − − − I C I − − EA Enterprise Architect Identify 3rd party infrastructures, cloud solutions, hosted networks, mobile devices I I C A R/A C I − I − I C I − − C T O Administration STAGE 3 - APPLICATION DECOMPOSITION - Est. New TM = 8 hours | Est. Repeat TM = 4 hours I I I A R C C − I − − C − − − VA Vuln Assessor Perform data flow diagram of application environment I I I A R I C − − − − C − − − P T Pen Tester Define application trust boundaries/trust models I I I A R C C − − − − C − − − Enumerate application actors I I I A R C C − − − − C − − − C o rpo rate F unctio ns Identify any stored procedures/batch processing I I I A R C C − − − − C − − − Office of the CTO Enumerate all application use cases (ex: login, account update, delete users, etc.) I I I A R C C − − − − C − − − Compliance STAGE 4 - THREAT ANALYSIS - Est. New TM = 6 hours | Est. Repeat TM = 2 hours I I R/A A R/A R/A C C − − − I − − − Security (ISRM ) Gather/correlate relevant threat intel from internal/external threat groups I I R/A A C I C C − − − I − − − Review recent log data around application environment for heightened security alerts − − I A R R/A I C − − − I − − − Gather audit reports around access control violations − I I A R C I C − − − I − − − R Responsible Identify probable threat motives, attack vectors & misuse cases I I I A R/A C I C − − − I − − − A Accountable STAGE 5 - VULNERABILITY ASSESSMENT - Est. New TM = 12 hours | Est. Repeat TM = 6 hours I I I A R C I C I − − C − R/A R C Consulted (2 way) Conduct targeted vulnerability scans based upon threat analysis − − − A R C I C I − − I − R R I Informed (1 way) Identify weak design patterns in architecture − − − A R C I − − − − C − R C Review/correlate existing vulnerability data I I I A R I I C − − − I − R/A I Map vulnerabilities to attack tree − I I A R I I − − − − C − C I STAGE 6 - ATTACK ENUMERATION - Est. New TM = 10 hours | Est. Repeat TM = 5 hours I I I A R R − − I − − C I I R/A Enumerate all inherent and targeted attacks for product/application I I I A R C − − I − − C I I R/A Map attack patterns to attack tree vulnerability branches (attack tree finalization) − − − A R C − − I − − C − I A Conduct targeted attacks to determine probability level of attack patterns − − − A C R − − I − − C − I R/A Reform threat analysis based upon exploitation results I I I A R C − − I − − C I I C STAGE 7 - RESIDUAL RISK ANALYSIS - Est. New & Repeat TM = 5 days (inc. countermeasure dev.) C I I A R C C C I I C C I I R Review application/product risk analysis based upon completed threat analysis I I I A R C I C I I C C I I R BU/Product Groups Corporate Functions R o les Legend R A C I Legend 3rd Party