Week 3 CYBR650 Blog - Identifying Attacks

High Tech, Low Tech, or No Tech…There are countless paths to compromise

 There was a lot of great information on analyzing threats during this week’s readings. As I am also taking the Risk Management course, I have seen several different approaches to identifying threats, and multiple takes on how to threat model. Interestingly enough, one of the more interesting reads this week was from 1999. In a Schneir on Security article about modeling security threats, Bruce Shneir dropped a very interesting line. He said “in truth, unbreakable security is broken all the time, often in ways its designers never imagined.” That really is the name of the game. We obviously can’t imagine everything when it comes to threats, but that really should be the goal. No stone unturned, and no idea too farfetched.

Who are you securing your system from?

That article was about attack trees, which is a topic I find to be an excellent method to provoke brainstorming about “the art of the possible” when it comes to attacks. It isn’t the be-all end-all threat modeling method; however, it should definitely be a piece of the puzzle. It allows you to model for a specific attacker goal. I think this aids in exploring all ways to achieve that goal – provoking that critical brainstorming piece. Are there technical exploits? Are there users with access who could become compromised? Are there ways to completely circumvent security? Some examples of different attack trees you can create:

How do you protect your database from insider threat?

How do you protect the website from a hacker in another country?

How do you protect your website against compromise to business competitors?

For each one of these, an attack tree lets you create lines to all of the possible goals an enemy could hope to achieve against you. This takes some time, and more importantly, a strong sense of both your enemy’s motives and capabilities along with your own assets and defensive measures.

The Attack Tree “So What”

Ultimately threat modeling has to feed back into the risk management process somewhere. It is great to understand the different types of attacks and how they might be executed, but to provide useful feedback into the process the threat analysis should be able to identify some key metrics. Items such as most probable, most dangerous, most expensive and least expensive are different labels that can be given into the different nodes within an attack tree. Ultimately you want to be able to rack and stack these threats so you can assign the appropriate resources to countering the threat.

On a final note, I found multiple sources for software to help build out an attack tree. This might seem like a task that can be performed in PowerPoint or Visio, but would eventually prove inadequate as the tree and associated metadata grows. SecurITree by Amenaza is pay for license attack tree software that appears to be extremely robust. They have a Capabilities-based Attack Tree Threat Risk Analysis, which allows you to plan out protection based on the capabilities of your known adversaries.