threat modeling web application: a case study

Antonio FontesLength: 45+15 minutes

Confoo Conference - 2011

Montreal

Threat Modelingdetecting web application threats before coding

Speaker info

• Antonio Fontes• Owner L7 Sécurité (Geneva, Switzerland)

• 6+ years experience in information security

• Fields of expertise:– Web applications defense

– Secure development

– Threat modeling, risk assessment & treatment

• OWASP:– Chapter leader – Geneva

– Board member - Switzerland

L7 Sécurité - Switzerland - http://L7securite.ch2

My objectives for today:

• You understand the concept of threat modeling

• You can build a basic but actionable threat model for your web application

• You know when you should build a threat model and what it should document in it

• These new tools help you feel more confidentabout the security of your web application.


Let's start immediatly…


Case study

• A famous daily printed newspaper sold in the country uses standard news distribution channels:– They host a website, on which short articles are

posted regularly all day long by the online editor

– They distribute a printed journal, every day of the week.

• Content on the website is free.

• The printed version is sold.


Case study

• The board is concerned by a recent move from one of its major competitors: two months ago, they started selling an electronic edition of their printed journal along with access to the archives.

• Ear-in-walls heard that they were able to convert a few hundred customers to the electronic version.

• That kind of revenue cannot be ignored!


Case study

• The board decided to copy its competitor and also sell an electronic edition of the newspaper.

• Access to the electronic edition and its archives must be strictly restricted to customers who completed the subscription process. (aka: paid members)


Case study

• Since this Monday, the internal development team is designing the new feature for the website, that will enable users, who successfully authenticated as a paid account, to access the electronic edition.

• When possible, the architects will reuse the existing infrastructure (they already host 'member accounts' who can post comments on the articles).


Case study

• Someone from the Board attended yesterday's talks at Confoo.

• He heard about those pesky guys who hack into web applications to steal data and money from honest businesses!!!


Case study

• He also heard about that obscure threat modeling thing, which seems to help project teams detect major threats and appropriate countermeasures to their web applications, before even one single line of code is produced.

• He hired you for 1 day. Just to give it a try.


1. Understand the system


1. Describe (understand) the system

• What is the business requirement behind it?– Is the business exposed to particular data

regulations? (Privacy? Healthcare? Food? Drugs? Legal? Financial?)

– What role will the system play in the organization?• Will it bring money? Will it be the main revenue

source?

• Is the system processing online transactions?

• Is it storing/collecting sensitive/private information?

• Should it be kept always online or is it okay if it stops sometimes?


"The system will generate revenue somehow."

"It is not processing orders but it gives access to

things users should have paid for before."

"Payments will be processed on paper, we

already send invoices for paper subscriptions."

"But we host member account information in our

database."



• What is the reason of your presence?




Driver Comment

People can die from it (SCADA systems, energy, transports, food & drugs, etc.)

-

Stay compliant with laws and regulations Yes

Just sleep well and avoid blackhats Yes

Never want to be compromised again! -

Protect users privacy Yes

Make sure customers pay our goods/services Yes

Keep the money inside our system -

Avoid going offline -

Threat Modeling seems awesome! (seen on TV) -

"We were never compromised." (well, we think…)

"The website security was audited a few months

ago and security was fixed."

"We just don't want a bad thing to happen when

this new feature comes out."

"We don't want people to download the

electronic version without paying for it!!!"



• What does the system look like?– Technologies?

– Architecture?

– Functionalities? (use cases?)

– Components?

• What are its typical usage scenarios?– Power users? Visitors? Contributors? Professional

use vs. private use?

• How are users authenticated?


"We use standard web technologies."

"The website is using a proprietary CMS engine

we bought. It is connected to a database server

inside our internal network."

"We also host member data in this database."



• What would be the assets of highest value?

– Is there sensitive/private/proprietary information anywhere?

– Are there any financial flows?

– Is one of these components critical for your business?

– Has the system access to other more sensitive systems?


"The members database contains personal

information."

"The database is located within our internal

network."

"Money: the electronic editions!!!"


2. Identify potential threat sources



• Given what we know, who might be interested in compromising your system?

– There will be a list in the next page

– Information can also come from other sources:

• Media, newspapers

• From the owner of the business (in sensitive industries, some insiders have access to undisclosed threat information)



Source Realistic? Comment

Hacktivists Not really

Smart guys Yes Disgruntled employees + stealing elec. Edition.

Script kiddies Yes

Rogue blackhats Maybe

Competitors Yes Retrieve the customers database

Organized cybercriminals Maybe

Governments / The NSA!!! Not really


3. Identify major threats



• Which bad scenarios can happen?– Which threat sources would trigger it?

– How would they proceed?

– What would be the impact for my business?• Shameful? Bad? Catastrophic?

• Helpers:– Think about threats induced naturally by the

technology itself.

– Think about what the CEO really doesn't want.



Threat Source Attack details

Stealing the customers database

Competition Exploiting injection flaws, internal threat,

Stealing the electronic edition

Smart users Exploiting client-side injection flaws, phishing, user account leaked in the nature, intercepting the e.edition, access the URL of the electronic version

Hacking into the system -> system compromise

Script kiddies Exploiting injection flaws, internal threat, using automated tools


How would we prevent these attacks?



• Let's summarize the controls all together:


Threat Controls

Exploiting injection flaws Input validation at every entry point

Unauthorized access through the URL of the electronic edition

Enforcing access control -> no direct access to the PDF document (url rewrite rule -> user->isloggedin())

Url is not predictable

System is kept up-to-date

4. Document the opportunity(risk mitigation controls)


4. Document the opportunity

• Document:

– The threats, that we identified

– The controls, which prevent these threats from being executed by the threat-sources

• Recommend and prioritize:

– What should be absolutely done?

– In which order?


4. Document the opportunity

Priority Controls Result

Highest Input validation at every entry point

High Enforcing access control -> no direct access to the PDF document (url rewrite rule -> user->isloggedin())

High Url is not predictable fail

High System is kept up-to-date


Job done.

Let's do a little check…


Conclusion…and thoughts…


Conclusion• TM seems imprecise, inexact, undefined:

– Requires good understanding of the business case

– Requires good knowledge of web application threats

– Requires common sense

– It can be frustrating the first times…


Conclusion

• Repeating the basic process a few timesquickly brings good results:

1. Characterize the system

2. Identify the threat sources

3. Identify the major threats

4. Document the countermeasures

5. Transmit to the dev team


Conclusion

• Who should make the TM?

– Theoretically: the development team

– Practically: an appsec guy with good knowledge of internet threats, web attack techniques and the ability to understand what isimportant for the business underassessment will definitely setthe "efficiency" attribute.


Conclusion

• "When should I make a TM?"

– Sometime is a good time.

– If the objective is to avoid implementing poor code, do it at design stage.

– After v1 is online: when new data "assets" appear in the data-flow diagram, it's usually a good sign to adapt the TM.

– If you conduct risk-driven vulnerability assessments or code reviews, the TM helps a lot.


Conclusion

• TMing can be performed early:


Analyze Design Implement Verify Deploy Respond

Security requirements Secure

design

Secure coding

Code review

Security testing Secure

deployment

Incident response

Vulnerability management

Risk analysis Risk

assessment Penetration testing

Governance (Strategy , Metrics)

Policy / Compliance

Training & awareness

Threat modeling

Design review

Conclusion

• TMing can also be performed later:


Analyze Design Implement Verify Deploy Respond

Security requirements Secure

design

Secure coding

Code review

Security testing

Secure deployment

Incident response

Vulnerability management

Risk analysis

Risk assessment

Penetration testing

Governance (Strategy , Metrics)

Policy / Compliance

Training & awareness

Threat modeling

Design review

Threat modeling

Threat modeling

Conclusion

• TMing can be performed from an asset perspective:

– Aka the asset-centric approach (what we just did today)

• It can be performed from an attacker perspective:

– Aka the attacker-centric approach

• Who would attack the system with what means?


Conclusion

• TMing can also be performed according to the system description:– Aka the system-centric approach

– Most detailed and rigorous technique• Use of threat identification tools: STRIDE

– Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privileges…

• Use of threat classification tools: DREAD– Damageability, Reproducibility, Exploitability, Affected

population, Discoverability…

• Systemic DFD analysis


Conclusion


Conclusion

• "What should I document in a TM? "

– Search on Google

– Basically: what you think is necessary. There is no rule (yet).

– If you're spending days writing a threat model for a single web app, there is certainly a problem…

– Remember that threat modeling is often a way of formalizing important stuff that gets forgotten later in the SDLC! (just 1 page is often enough!)


Conclusion

• "Your example was really 'basic'. Where can I go deeper?"– Improve your DFD

(dataflow-diagrams) drawing skills

– Keep aware of new web attacks, threats and intrusion trends

– Read feedback from field practitioners (some good references are provided at end of presentation)

– Standardize your technique: • ISO 27005 : Information security risk management (§8.2)

• NIST SP-800-30: Risk management guide (§3)


Questions?


Recommended readings:

• Guerilla threat modeling (Peter Torr)http://blogs.msdn.com/b/ptorr/archive/2005/02/22/guerillathreatmodelling.aspx

• Threat risk modeling (OWASP)http://www.owasp.org/index.php/Threat_Risk_Modeling

• Application threat modeling (OWASP)http://www.owasp.org/index.php/Application_Threat_Modeling

• Threat modeling web applications (Microsoft)http://msdn.microsoft.com/en-us/library/ff648006.aspx

• Comments on threat modeling (in French, DLFP)http://linuxfr.org/news/threat-modeling-savez-vous-quelles-sont-les-menaces-qui-guette

• NIST SP-800-30: risk management guidehttp://csrc.nist.gov/publications/nistpubs/800-30/sp800-30.pdf


Merci! / Thank you!

Contact me: [email protected]

Follow me: @starbuck3000

Download this: on slideshare.net (starbuck3000)


threat modeling web application: a case study

Documents

systeml7 scurit switzerland

electronic edition

web applicationyou

electronic version

printed journal

printed version

actionable threat model

major threats