The next category and the model is denial of service.
This one is the hardest to tackle.
Each widely available service can be used for purposes other than intended access to a web server can
be blocked by a large amount of incoming data.
You can overload a system or an application instructing them to perform absurd operations
to overload a computer you can use the so-called avalanche effect.
This means using multiple machines to flood the bandwidth of the target computer through standard communication
attempts
systems with partially implemented security policy are prone to the elevation of privilege attacks in
some systems each user has the ability to make system wide changes.
In others regular users have limited privileges a regular user cannot perform certain operations these
operations include installing new software establishing connections and changing system configuration.
All of which could be useful to the attackers This in turn requires them to gain elevated privileges
the stress mode can be not only applied to computer systems that has computers and servers.
It can also be used for threat modeling of database servers.
You can see an example of such an application in the last slide.
It shows that weak passwords make it easier for the attackers to impersonate a trusted user.
If we identify such a threat we have to think how to eliminate or at least limited one of the methods
is to implement a system of passwords.
Let's see how this could be achieved if we didn't have data about the user's activity.
Let's say you manage a database application that doesn't record operations performed by users.
That's why you don't know who introduced the new offer.
Change the price of an existing offer or delete the key client from the database.
This is a threat to the confidentiality.
Consistency and integrity of your data having classified the threat as repudiation.
Think of the best way to eliminate it.
Because the problem concerns a database.
The best answer is user activity monitoring tools.
Depending on the database type These can include database triggers trace files or database auditing
in the diagram you can see that database resources include clients personal data.
We treat them as confidential and we try to describe the threat to this resource.
It seems reasonable that the resource is vulnerable to the threat called information disclosure having
identified the threat.
We try to find a technological or non technological solution that would help us limit or eliminate it.
The solution may include data encryption or some other access control mechanism we trust.
I hope that on the basis of the analysis of the model database application and diagrams shown in the
slides you'll be able to perform a system analysis on your own.
This would be the first step to the development of security policy.
Thank you for your attention.