Walk into the module concerning threat modeling and threat classification
module We'll introduce you to one of the methods of threat classification and point out the merits of
such an approach in the security policy development process.
Let's specify what threat modeling actually is.
It consists of the identification assessment and description of threats to computer systems security.
We should try to analyze the computer system from the perspective of a person who would like to break
into it.
To put it simply attack methodology is as follows The attacker has to gain access to the system.
Our task is therefore to identify the ways through which an attacker can do that.
For example VPN remote connections or the possibility to log into an unprotected computer can be classified
as entry points.
This depends on the type of system.
Nevertheless we should continue describing all the threats.
The next step is to list and describe the resources to be protected.
This shouldn't be limited to a general statement that the whole system is to be protected.
The list should be detailed to ensure that every element that needs to be protected will be protected.
In the case of the database server which may be the first resource to be protected we don't have to
list each and every record of the database unless we're trying to create a security policy of this one
database.
The next element of threat modeling is to examine and describe data flow paths.
This involves the description of how the computers stablish has a connection with the server can every
computer establish that connection with the server.
Or are there some specific requirements such as port number or the newest version of the antivirus program.
All possible paths should be described because the attackers can use any of them
no system can be completely protected.
This is simply impossible.
We can however divide this system into more or less protected subsystems.
We should define the trust boundary represented in the diagram with the letter T.
Clearly defined trust boundaries later become the elements under protection.
With a physical computer in a sudden set of servers can be defined as trust boundaries.
A special type of such a sudden that is the DMZ demilitarized zone which requires a separate trust boundary
this pertains to every subnet in our computer system.
The list of protected elements should be as detailed as is required to reflect the actual configuration
of the system resources.
Each resource will be assigned an individual security value or level.
This can be simplified so as to comprise high low medium or none.
Application designers perform threat modeling in a more formal way.
There is a separate branch of I.T. devoted to threat modeling exclusively.
The diagram you see in the slide is a generalized representation of steps we've discussed before.
Application designers had to define system mentary points.
That is how the application communicates with users and other applications.
Moreover they had to examine so-called case studies.
That's different ways in which the application is used and the consequences of each kind of possible
use.
Also they had to define the resources the application uses
such an analysis should help the designer to determine which type of threats the application may be
susceptible to.
To assume that viruses are the only threat to the operating system is a severe mistake.
The lack of a detailed analysis may result in a situation where you focus on a threat that concerns
your system to a very limited degree viruses are common.
But even if your computer gets infected by a virus it won't have a very serious consequence.
Without a detailed analysis we will miss the most serious threats and if we're not aware of them we
won't be protected against them.