oredev: an exploratory tester's lessons on security threat modeling

@maaretp http://maaretp.com

An Exploratory Tester’s Lessons on

Security Threat Modeling

by Maaret Pyhäjärvi


Feedback fairy with a day-job at F-Secure. Tester, (Polyglot) Programmer, Speaker, Author, Community Facilitator, Conference Organizer.


Makers and Menders by Andrea Goulet https://www.slideshare.net/andrea_goulet/makers-and-menders

My dream job is cleaning up other

people’s code - M. Scott Ford

on Makers and Menders


Security Threat

Modeling

CVE


Exploratory Testing Learning with the Application


http://visible-quality.blogspot.fi/2017/03/from-appreciation-of-shallow-testing.html

She's like "I want to exploratory test your ApprovalTests" and I'm like "Yeah, go for it", cause it's all written test first and its code I'm very proud of. And she destroyed it in like an hour and a half.


Testers don’t break the code, they break your illusions about

the code. - Adapted from James Bach


Product is my external imagination

I am my developer’s external imagination


Threat Modeling Giving time for Security


The owner of priorities order it via an item on the backlog.


Threat Modeling is a whiteboard exercise used to uncover work

needed to further secure a system, so security work can be spent where it is worth them

most.


Data Flow Diagram

Message Sequence Chart


S Spoofing T Tampering R Repudiation I Information Disclosure D Denial of Service E Elevation of Privilege


Threats to Privacy T Transferring Data Across

Borders R Retention Policy I Informed Consent M Minimization


Result: More Work to Do

•  Security testing for an interface •  Security mechanisms to implement • Architecture changes •  End user documentation • Validating an assumption


Combining the two Validating assumptions


Illusion type III: Product doing only what it is supposed

to do.


Doing threat modeling by yourself if fine if you have good team dynamics, are free from

cognitive biases, and have an up-to-date knowledge of common

attack vectors.


Serendipity and Perseverance


The more I practice, the luckier I get – Arnold Palmer


It’s not that I’m so smart, I just stay with the problems longer. – Albert Einstein

See also: http://blogs.scientificamerican.com/guest-blog/the-forgotten-life-of-einsteins-first-wife/


https://cybersecuritybase.github.io/


Maaret Pyhäjärvi Email: [email protected] Twitter: @maaretp Web: maaretp.com Blog: visible-quality.blogspot.fi (please connect with me through Twitter or LinkedIn)

oredev: an exploratory tester's lessons on security threat modeling

Software