- After identifying potential threats to an information
system, security analysts should move on to the next phase
of the threat modeling process.
Considering a possible attacks to each system.
Let's take a look at the various types of attacks
that may be used against information systems.
Microsoft uses the STRIDE model to help categorize attacks.
This model is a helpful starting point when you are
trying to identify the attacks that may be used
against any particular system.
Each letter in the word STRIDE represents a different
category of attack.
S stands for spoofing.
Spoofing attacks used falsified identity information
to gain access to a system.
This may be as simple as a social engineering attack
that fakes the sender's name on an email address,
or it may be more complicated and involve spoofing
IP addresses, MAC addresses, wireless network names,
or any other claim of identity.
The best control against spoofing
is using strong authentication.
T stands for tampering.
Tampering attacks make unauthorized changes to systems
or data in an attempt to gain access or disrupt
data integrity.
For example, a student may hack into a college database
in an attempt to tamper with his or her grades.
R stands for repudiation.
Repudiation attacks attempt to deny responsibility
for an action, and may go farther and attempt
to blame a third party.
Requiring digital signatures is a useful control
against repudiation attacks.
I stands for information disclosure.
Information disclosure attacks attempt to steal confidential
information and disclose it to unauthorized individuals.
This may be done quietly, such as a competitor reading
and reacting to an organization's product development plans
or it may be public, such as a newspaper disclosing
classified government records.
D stands for denial of service or DOS.
DOS attacks attempt to deprive legitimate users
access to the information or systems that they need.
E stands for elevation of privilege.
This is sometimes also known as privilege escalation.
Elevation attacks attempt to take a normal user account
and transform it into an administrative or super user
account that allows the user to exceed its
legitimate privileges.
When thinking through an attack, it is often helpful
to use a system a diagram that shows the data flows,
and relationships between systems.
For example, this diagram shows a simple e-commerce website
where a user interacts with a web server.
That web server then relies upon an e-commerce database
server to provide product information.
It also depends upon an authentication server
to verify user identities and that authentication server
in turn relies upon an authentication database.
The arrows in this diagram show the data flows between
systems, and the dotted lines show firewalls.
Diagrams like this are useful
in determining potential attacks.
For example, if a security professional is evaluating
the security of the e-commerce database, it's helpful
to know that legitimate requests may come from
the web server, which is accessible to the public.
This would lead the analyst to consider the possibility
of the SQL injection attack.
Which could be sent by the user to the web server
and then passed by the web server to the e-commerce
database.
This type of diagramming is a form of reduction analysis.
An important threat modeling tool.
Reduction analysis breaks down a system into
smaller components, and then performs assessments
of each of those components.
This may mean breaking a large complex technology
infrastructure into individual servers, or it might involve
breaking a piece of software down into modules
and interfaces.
Reduction analysis helps simplify complex systems
and facilitate thorough security reviews.