[Wroclaw #9] To be or Not To Be - Threat Modeling in Security World
0 likes•351 views
The document discusses threat modeling and provides 10 hints for making threat modeling practical and valuable for project teams. The hints include realizing who the audience is, making threat modeling fun, showing the value it provides, understanding different points of view, allowing choices in the approach, asking questions and listening, using it in different ways such as red team/blue team, taking on a watchmaker mindset, constantly improving the process, and finding the right balance between proactive and passive approaches.
[Wroclaw #9] To be or Not To Be - Threat Modeling in Security World
- 1. To Be or Not To Be Threat Modeling in Security World Speaker: Mariusz Kondratowicz
- 2. 2 Agenda 1. Dilemma 2. Project Management in Threat Modeling 3. Let’s make it SMART 4. Let’s make it FUN 5. Let’s make it VALUABLE 6. Let’s make it PRACTICAL 7. Let’s make it WORK 8. Five more extra hints 9. Q&A
- 3. 3 To be... me At first: Sysadmin/NetOps Then: IT Security And finally: Compliance Manager @ Opera Software Currently: Leading Threat Modeling
- 4. 4 Dilemma „ To be, or not to be, that is the question” ~Shakespeare To be... more secure? To be... involved in Security? To be... slowed by Security? To be... overwhelmed by Security? Could be Threat Modeling You
- 5. 5 Project Management in TM
- 7. 7 Hint 1: Realise who is your interlocutor!
- 8. 8 WHO
- 9. 9 SMART
- 10. 10 Hint 2: Make it fun!
- 11. 11 Fun? Threat Modeling. Threat Modeling is a process. Threat Modeling is for everyone! Threat Modeling is not boring! Nope.
- 13. 13 Support from Security Team
- 15. 15 Threats Spoofing Tampering Repudiation Information Disclosure Denial of Service Elevation of Privilege
- 17. 17 Risks Denial of Service Information Disclosure
- 18. 18 Mittigation
- 19. 19 Risk Management vs Attacks&Impact
- 20. 20 Hint 3: Show the value!
- 21. 21 Why? • Map our risks
- 22. 22 Why? • Translate business risks into technical risks
- 23. 23 Why? • Organise and manage our risks
- 24. 24 Why? • Tool which could help you in security reviews • Better than normal checklist • Flexible • Dynamic • Support in planning new features
- 25. 25 Why? • Documentation • Data Flows • Compliance&Privacy • PCI-DSS Compliance Requirement 12.2
- 26. 26 Hint 4: Understand their PoV!
- 27. 27 Security cannot slow down dev!
- 29. 29 ...but focus on details
- 30. 30 Practical example • Step 1: Understand new assets • Step 2: Add dependency in right zone • Step 3: Access list • Step 4: Understand data flows • Step 5: Impact on existing components • Step 6: Identify risks • Step 7: Mitigate/Accept risks
- 31. 31 Hint 5: Allow them to choice!
- 32. 32 Approach - 1
- 33. 33 DFD
- 34. 34 Approach - 1
- 35. 35 AFD
- 36. 36 Approach - 1
- 37. 37 Approach - 1
- 38. 38 Approach - 1
- 39. 39 Approach - 2 DFD + Weekly security sync-ups (risks here) + Progress + Plans + Discussion
- 40. 40 Approach - 3 DFD + Triggers + Risk analysis
- 41. 41 Approach - 4 DFD + Checklists + risk analysis + Discussion
- 42. 42 Approach - 5 DFD + Checklists + optional risk analysis
- 43. 43 Hint 6: Ask and Listen!
- 44. 44 Ask and Listen! 1. What are you expectations? 2. Which elements from T-M are the most interesting for you? 3. Which approach will be the best? 4. Where do we want to store DFD, risks? 5. Who should be involved in Threat Model? 6. Establish process to maintain T-M on regular basis. 7. Choose starting point. 8. What problems challenges do you see?
- 45. 45 Hint 7: Use it in different way!
- 46. 46 Red Team & Blue Team
- 48. 48 Set your T-M
- 50. 50 Our Roadmap 1. Build good PR around Threat Modeling 2. Threat Modeling Training 3. Use Card Games in Threat Modeling 4. Monitor status 5. Constant feedback
- 51. 51 Hint 10: Find the Balance!
- 53. 53 Summarize Hint 1: Realise who is your interlocutor! Hint 2: Make it fun! Hint 3: Show the value! Hint 4: Understand their PoV! Hint 5: Allow them to choice! Hint 6: Ask and Listen! Hint 7: Use it in different way! Hint 8: Become Watchmaker! Hint 9: Constantly improve! Hint 10: Find the Balance!
- 54. „The rest is silence”* *unless you have any questions