Threat modeling is a process where
you go through the possible attacks that
could occur in your network and you kind of work
through the process to figure out how these attacks can
happen, what would the steps look like,
and how could an attacker potentially carry out
this type of an attack?
So it's very similar to a risk analysis in what you're
trying to figure out.
You're trying to figure out what threats
and what risks are going to affect or potentially affect
your organization.
It's a method where you use to really figure out and identify
where you need to focus your efforts as
far as your cybersecurity controls
and where you need to focus and do the most planning in.
Now, when you're looking at doing threat modeling,
one of the first things you do is
try to think of, what sort of threats are possible?
What could your organization be facing?
And with that, it's very important
to use realistic threats.
What is likely to happen?
You know, it's likely that somebody
could break into a server through any different means.
It's unlikely that you're going to have a massive solar flare
that will take out your entire infrastructure
or that aliens will steal your network administrator.
Those are more unlikely threats.
I suppose they're still possible, but very unlikely.
So it's important to use your realistic threats.
What is likely to happen?
What is a very good potential that could happen?
After you identify those potential threats,
what would the impact be if they did occur?
How would this affect the business?
What sort of business processes could be affected?
Is it going to cost the company money?
Is it going to affect any other assets in the company?
How is it going to affect the company's bottom-line?
How is it going to affect this organization's revenue?
Those are a lot of questions we need to ask.
What would the overall impact to the organization be?
But also, what would the individual impacts
to the organization be?
It's not always easy to figure that out.
But it's a process should go through to really figure out
where the threats are going to come from
and what the threats are going to be.
And it's good to figure out and to identify, what's
the origin of these threats?
Knowing the source of it can really help you narrow down
and identify what sort of countermeasures
that you might want to have in place
or that you could have in place to really kind of help
prevent or mitigate this sort of threat.
It can also give you a better understanding
of some of the capabilities and motivations of some threat
actors.
Now, this is getting close to attribution territory.
But knowing the origin of potential threats
is different than attribution.
Attribution is essentially where you have an incident that
has occurred and you're trying to figure out who did it,
who do you attribute this to?
Whereas when you're looking at the origin of threats
from a threat modeling process really what
you're trying to do there is identify known threats,
things that have happened before,
things that are likely to happen,
and where do those threats come from,
what's the origin of those threats?
So it's a little different than attribution there.
So when you're going through threat modeling,
there's a process you can use to really help figure
out the kind of chain of what's going to happen.
And that's called mapping.
One of the most useful ways of mapping your threats
is something called an attack tree.
This is a visual method that's used to really map out
the threat and the steps that an attacker might take to carry
out or realize this attack.
There's a lot of different methods that an attacker use--
try that again.
There are many different methods an attacker can use
to accomplish the same thing.
There's all kinds of different paths to get to the same goal
that an attacker can use.
And an attack tree is really going
to help you identify what those steps are
and trace them as they branch out.
And at the end of those branches,
you have an idea of where your controls need to go
and where they need to be.
So a good to example of this is if the attacker's goal
is to steal organizational trade secrets from your organization
or from your company that are on a specific file server,
well, there's multiple methods they could use.
So two possible methods, they could gain access to the server
somehow or they can trick an employee into just
providing those secrets.
So then to break it down further,
how would they gain access to the server?
Well, they could use credentials somehow.
They could somehow steal an access token
if they may have already been on the network.
They could use some methods to hack into the server.
So then you keep branching out from there.
OK, so if they're using credentials,
then how did they get those credentials?
Maybe they did some sort of a brute-force attack
against this server and they were
successful in getting them that way.
Maybe they succeeded in stealing the credential access tokens
somehow.
Maybe they got credentials through a phishing email
that an employee was tricked into clicking on a link
and inadvertently giving up those credentials.
That's different than tricking the employee into just
providing the secrets.
But social engineering could definitely
be used to get the employee to provide
any of that information, the direct information,
that the attacker is trying to get.
So as you can see there, you start
at the top of the tree with what the goal is,
what the attacker's goal is.
And then you branch out from there
trying to figure out and identify
what methods the attacker can use and break down
those methods to see what the steps are.
And as you get to the end of each of those branches,
you know where your controls are for.
So for in this example, let's say they were using brute force
and they were able to get credentials that way.
Well, you can set account lockouts.
So if the wrong password is tried five times in a row,
the account's locked out.
That can all but eliminate the brute-force option.
Phishing, you can introduce better and more in-depth URL
filtering or perhaps you URL sandboxing,
so when a user clicks on a link in an email,
they're put into an isolated sandbox that
maybe prevents form submission so they can't send credentials.
You can do a security awareness training
so that the employee is less susceptible
to a social engineering attack if an attacker calls them up
attempting to get some sort of trade secrets.
So that you can see that at the end of each
of those paths and those branches,
that is where you can look and see,
OK, we've identified where this attack would originate from
so we can know what sort of security control
to put in place.
Now, there's two different models
that are very commonly used when talking about threat modeling.
The first of those is one known as the Cyber Kill Chain.
This was developed by Lockheed Martin.
So The full name of it is actually the Lockheed Martin
Cyber Kill Chain.
But it is a model that specifically lays out
seven different specific stages of an attack.
Go through those real quick.
The first would be reconnaissance.
This is where the attacker does their research,
some open-source intelligence gathering, anything like that.
They're getting information on their target.
Weaponization, they are figuring out
how to use that information to their advantage
to be able to attack the target.
Delivery is when they actually perform the attack,
try and get in and break into the whatever system or network
they're trying to get into.
Followed by exploitation, is when they're really getting in.
They've delivered their payloid--
payload, not pay payloid.
Payloid's not a thing.
They've delivered their payload.
And they're now exploiting any vulnerability or anything else
that they may have discovered in that reconnaissance phase.
Installation is when they are getting they're maintaining
and they're really getting that foothold on their network.
Command and control is when they're communicating
back and forth between their network and another compromised
network or another malicious network,
maybe one they can control, to relay commands
back and forth to whatever infrastructure
they have put into that compromised network.
And then one called actions on objective,
which that is where they get what their end-goal is.
They had their objective laid out
at the very beginning when they first started
doing their reconnaissance.
That last number seven, that's that last stage
of the attack, the Cyber Kill Chain,
is when they've accomplished their goal.
They've undertaken those actions to accomplish that goal.
Now, the Cyber Kill Chain goes into a lot more
in depth than that.
But that's the basics of those seven stages.
But this can help you develop countermeasures
at each one of those stages with the goal being
to stop the attack as early in the chain as possible.
So if you can harden your networks
so that it becomes a lot more difficult for them
to even deliver a malicious payload,
if you stop them at stage three, well, they're
never going to get down to stage five, six, seven, any of those.
If you make it harder for them to get sensitive or private
information on the company, they may not
get much further than stage one in that case.
So the goal when you're working with the Cyber Kill Chain model
is to try and develop countermeasures
to stop the attackers as early in the chain as possible.
Another one that's very commonly used
is one developed by the MITRE Corporation known
as the MITRE ATT&CK framework.
The ATT&CK here stands for Adversarial, Tactics,
Techniques, and Common Knowledge.
That's what that CK at the end stands for.
But it is pronounced as attack.
This is a much more detailed model than these Cyber Kill
Chain.
In my experience, I have used this model a lot
more than the Cyber Kill Change just because it
goes a lot more in depth.
It breaks down the attack into much smaller and much more
specific sections.
There are 14 different tactics that are built in here.
You have reconnaissance, resource development--
which is similar to the reconnaissance and delivery
in the Cyber Kill Chain--
initial access-- how they first get into the network--
execution and persistence, privilege escalation--
so if they got into the network with a low-privileged user,
privilege escalation is where they get administrative or root
access to a system--
defense evasion-- pretty self-explanatory--
credential access--
stealing credentials-- discoveries--
when they're going through and looking for more
in the network--
lateral movements, collection, command and control again,
exfiltration, and then the impact.
So I have another screen that's going to show you all those
here, so I don't have to remember those.
But the tactics, they're broken down
into 14 individual tactics.
And then you have the techniques that
can be used for each of those 14 tactics.
And then each of those techniques
then has even more subtechniques, which
can also be called procedures.
And this is a lot of the time where
you get the Tactics, Techniques, and Procedures or TTPs.
So because it is so complex, they
do offer a good mapping tool available here
at a attack.mitre.org.
I definitely recommend you go check this out.
It is a very useful model to use for any sort
of threat modeling, a very good framework.
It has been very useful in my cybersecurity career.
I definitely recommend it.
So let's take a look at these tactics here.
So you have reconnaissance, again gathering information,
trying to figure out what can be exploited.
Resource development is when they
start putting that information together
to start formulating an attack.
Initial access, when they first get access onto your network
through, whatever means it is.
Execution is when they begin to elevate--
I don't want to say elevate their access,
but begin to get a little deeper into the network.
Persistence is when the attacker will actually
set up some sort of mechanism so that they can maintain access
in that network.
Privilege escalation, again, if they get in
get access as a low-privileged user,
depending on how they gained access,
privileged escalation is when they
find some method to elevate their access to some sort
of administrative level.
Defense evasion is when they figured out and developed a way
to get around the countermeasures you
may have in place.
Credential access, they're already in your network.
They've already elevated their access.
And now they're working on gaining more credentials
so they can dive even deeper into the network.
Discovery, again, discovering more, looking for more assets
to exploit on the network in an attempt
to gain even more persistence and gain even more privileges
in the network to get as much information,
as much data as they can, or potentially do as much damage
as they want to, depending on the motivation
for their attack.
Lateral movement is one there on one part of the network
and they find a way to pivot to another part of the network.
Depending on how you may have network segmentation set up,
lateral movement can affect.
So network segmentation can a lot of times
block that lateral movement, or at least
hinder it pretty significantly.
Collection is when they've found the data they are trying
to steal-- in this case, we're talking about them stealing
data--
and they begin to collect it and gather this data all together.
Command and control, we explaied is also
part of the Cyber Kill Chain.
Exfiltration is when they're beginning
to pull that data out of your network
into systems that they control.
And then impact, maybe they are attempting
to cause some harm to the organization.
So for the example, if we're talking about ransomware here,
a lot of times, this ransomware also
has a data exfiltration component to it.
But then the real impact of it, at least to your organization,
is your data is now encrypted and you
may have to pay a ransom or restore
backups or any of the options for getting that data back.
So there are the 14 tactics for the MITRE ATT&CK framework.
And again, each of these 14 tactics
is broken down into more techniques for how
an attacker could accomplish each of these,
and then broken down even further into subtechniques.
So I definitely recommend you go to that website, the MITRE
ATT&CK website to look at their threat modeling
dashboard they have.
It becomes a lot easier.
You can actually play around with it
and look at all of the subtechniques and things
like that on their site.