How can we define the Attack Surface of an existing software system?
The Attack Surface is all the different ways a hacker could interact with or attack a system. It includes:
Entry Points: Places where data or commands enter (e.g., login pages, APIs).
Exit Points: Where data leaves the system (e.g., logs, database exports).
Assets: Valuable data or resources hackers might target (e.g., user credentials, financial records).
Trust Levels: The permissions given to different users or system parts (e.g., admin vs. regular user).
A large attack surface means more security risks, so it's important to reduce it where possible.
How can we map the Attack Surface of an existing software system?
Mapping the Attack Surface means identifying all the points where security risks exist. Steps include:
Review system design and architecture
Look at how the system is built and document potential attack points.
Identify entry and exit points
Examples:
User forms and input fields
HTTP headers and cookies
APIs and web services
Databases and file storage
Find valuable assets
Interview developers and users to understand what data is critical.
Use security tools
Automated scanning tools like OWASP ZAP or Burp Suite can help find vulnerabilities.
Threat Modelling
walk through the main use cases following the flow of control and data to see where information is validated and stored.
Track changes in the attack surface
Any updates to the system (new features, database changes, etc.) should trigger a security review.
Describe the three high-level steps of the Threat Modeling Process.
Thread modelling includes identifing any potential thrads document it and find mitigation strategies to prevent them.
Understanding the attacker's view (Attack Surface Analysis)
Look at the system like a hacker would and identify weak points.
Characterizing the security of the system
Define how the system is supposed to work and find security risks.
Determining threats
List all possible attacks and analyze how dangerous they are.
Explain the terms Entry Point, Exit Point, Asset, Trust Level, and Trust Boundary.
Entry Point: Any place where data or commands enter the system (e.g., login page, API).
Exit Point: Any place where data leaves the system (e.g., log files, database output).
Asset: Anything valuable that hackers might try to access (e.g., passwords, customer data).
Trust Level: Defines how much access a user or system component has.
Trust Boundary: A point where different trust levels meet (e.g., user input entering a secure database).
How can we characterize the security of a system?
Define use cases (how the system should and shouldn't be used).
Identify assumptions and dependencies (e.g., relying on external services).
Model the system (create diagrams to see how data moves and where risks exist -> Data Flow Diagrams).
Describe the usage of data flow diagrams in the context of threat modeling.
They show how data moves and transforms in a system.
Help identify weak points where hackers could attack.
Use symbols to represent components like data storage, processes, and trust boundaries.
How can we use the STRIDE mnemonic to find threads?
STRIDE helps identify different types of attacks:
Spoofing → Pretending to be someone else (e.g., fake login).
Tampering → Changing data without permission (e.g., modifying bits in memory).
Repudiation → Denying an action (e.g., deleting logs to hide evidence). There is no way to track unauthorized actions to a specific user.
Information Disclosure → Leaking private data to people that are not authorized to see it (e.g., unprotected passwords).
Denial of Service → Making a system unavailable (e.g., crashing a website).
Elevation of Privilege → Gaining higher access than allowed (e.g., normal user becoming an admin).
What are common countermeasures for STRIDE threats?
Last changed2 months ago
