The diagram you see above shows a more formal approach to the dreaded modeling used in application design.
Potential attack pads are presented on a threat tree thanks to this we can follow the attack from the
beginning to the end and review its consequences.
The example shows that gaining anonymous access to the administrator interface is possible through enabling
remote administration or obtaining the administrators password.
The diagram helps us classify the threat in accordance with the Dredd model.
After the threat has been assessed we have to decide how to minimalize it.
We put the threat value on the chart such as you can see in the slide.
We put the threat value on the y axis and we put the resource value on the x axis.
The chart is very important because it shows the risk acceptance curve.
Every value under the curve represents an acceptable threat.
There's no point in investing money on the prevention of such threats.
This is because either the risk or the resource value is very low.
With the increase of the resource value we approached the curve and eventually cross-city
high resource value places the threat above the curve.
Even if the risk value is relatively low this requires us to take measures to minimize the risk
creating the risk acceptance curve chart.
It's the last stage of threat modeling on the chart replaced points that represent individual threats.
The chart helps us to decide what we should do next.
The first method we could employ is outsourcing.
This is a very popular solution which consists in transferring the risk onto somebody else.
We're aware of the resource value but also know that the protection will be so costly or so complicated
from the technical side that we're not able to implement it on our own.
In such situations we can hire a web hosting company to manage the database or instead of managing a
web server independently we can buy a webspace from a hosting company which guarantees the safety of
our content.
The second solution consists of implementing a protective infrastructure.
For example you could use network auditing software such as an intrusion detection system IDs by an
application firewall to protect the server.
Or you could transfer this server to another subnet and restrict the access to the server by limiting
the possibilities of communication with the subnet such strategies usually involved ready made solutions
created by companies dealing in I.T. Security.
The third option is to create a security policy tailored to our own needs.
Initially it seems to be the most expensive and the most demanding way of increasing the security of
the system.
This is the way I've been trying to persuade you throughout the seminar
outsourcing risk acceptance or ready made solutions are not the best answers to the problem.
The best ways to implement your own solution adjusted to the specific needs of your own system.
However if you decide to try sourcing I advise you consider a solution that's been very popular recently
namely cloud computing
you can move whole applications or systems to the cloud contrary to private clouds public clouds or
in fact computer infrastructures to rent.
You don't have to invest in computers administrators or programmers.
The solution involves low initial cost because in fact we only lease all of these.
It's an alternative to implementing your own security policy.
We are however interested in the security level of such a solution.
The chart you see above presents a comparison of the security levels of different solutions we've discussed.
The first column demonstrates a traditional model in which you manage the infrastructure all by yourself.
The elements of the system you're responsible for in this model are highlighted in yellow these elements
include physical protection of the server room operating system configuration etc..
The last column represents an adjusted model used in the public cloud
the public cloud is in fact three distinct types of cloud computing.
You can buy a cloud which consists of infrastructure only that is computers with pre-installed operating
systems.
What do you do with them is completely up to you.
A basic rule is that the company is only responsible for what's provided in the case of the Ayas cloud
you're responsible for the security of applications data and the environment in which the users work.
The second type of cloud computing is called Platform as a service.
In addition to what you get with the highest cloud the cloud comes with an environment for specific
applications.
If we bypass the cloud we're not responsible for the security of that environment software as a service
as another type of cloud computing.
This means that we buy a complex service solution and we are not responsible for any additional details
Google Docs is an example of a Sassa cloud.
If we choose the Sask cloud we completely transfer the responsibility for the security to the provider
of the service.
The SAS cloud however is rarely used in companies
in this module.
We've discussed how to assess threat risk.
We've tried to answer the question.
When do you have to take action to counter previously identified risk.
I've given you three possible solutions to the problem.
Ignoring the risk was not included.
We can transfer the responsibility to someone else implement our own solution or create a security policy
tailored to our own needs.
Thank you for your attention.