CYS403 · Chapter 3 · Annotated SlidesThreat and Vulnerability Management
Original
Overview

Threat and Vulnerability Management

Threat sources and types (network, host, application), threat agents, common vulnerabilities and CVE, threat modeling methods (STRIDE, PASTA, LINDDUN, CVSS, attack trees, persona non grata, security cards, hTMM, Trike, VAST, OCTAVE, DREAD) and threat/vulnerability pairs.

How to read this page

Every original slide is shown unchanged. Yellow marks on a slide point to a numbered note: hover or tap a mark to jump to its note, and hover a note to see its marks. Questions tagged Past exam appeared on a real paper; Prediction questions are likely angles, not confirmed. Pick an answer to each question: a wrong pick tells you why it is wrong, so you can try again.

All 53 slides
  1. 1 Slide 1
  2. 2 Intended Learning Outcomes
  3. 3 Common Types of Attack
  4. 4 Introduction
  5. 5 Introduction
  6. 6 Possible threat sources
  7. 7 Types of Threats
  8. 8 Threats Against the Network
  9. 9 Threats Against the Host
  10. 10 Threats Against the Application
  11. 11 Components of a Threat
  12. 12 Threat Agents
  13. 13 Top ten Database Security Threats
  14. 14 Ten web threats
  15. 15 Major Security Threats on Information Systems http://ubiquity.acm.org/article.cfm?id=1117695
  16. 16 Vulnerabilities
  17. 17 How do the vulnerabilities manifest?
  18. 18 Examples of Information Security Vulnerabilities
  19. 19 Examples of Information Security Vulnerabilities (Cont.)
  20. 20 Common Vulnerabilities and Exposures (CVE) List
  21. 21 Common Vulnerabilities and Exposures (CVE) List
  22. 22 Example on CVE
  23. 23 Threat Modeling
  24. 24 12 threat models
  25. 25 STRIDE and Associated Derivations
  26. 26 STRIDE and Associated Derivations
  27. 27 STRIDE and Associated Derivations
  28. 28 PASTA
  29. 29 PASTA
  30. 30 LINDDUN
  31. 31 LINDDUN
  32. 32 LINDDUN
  33. 33 Common Vulnerability Scoring System (CVSS)
  34. 34 Common Vulnerability Scoring System (CVSS)
  35. 35 Threats Analysis (Attack Tree)
  36. 36 Attack Trees — Graph Notation
  37. 37 Attack Trees — Text Notation
  38. 38 Attack Trees
  39. 39 Persona non Grata
  40. 40 Security Cards
  41. 41 Slide 41
  42. 42 hTMM
  43. 43 Quantitative Threat Modeling Method
  44. 44 Slide 44
  45. 45 Trike
  46. 46 Visual, Agile, and Simple Threat modeling (VAST)
  47. 47 OCTAVE
  48. 48 Slide 48
  49. 49 DREAD
  50. 50 Example
  51. 51 Slide 51
  52. 52 Threat/Vulnerability Pairs
  53. 53 Threat Matrix
Slide 1 / 53

Slide 1

Slide 1: Slide 1
Slide 2 / 53

Intended Learning Outcomes

Slide 2: Intended Learning Outcomes
Slide 3 / 53

Common Types of Attack

Slide 3: Common Types of Attack
Slide 4 / 53

Introduction

Slide 4: Introduction
Slide 5 / 53

Introduction

Slide 5: Introduction
Slide 6 / 53

Possible threat sources

Slide 6: Possible threat sources

Notes

  1. Threat sources: human (intentional or accidental), natural, environmental, technical.

Slide 7 / 53

Types of Threats

Slide 7: Types of Threats

Exam angle

Past exam · Major exam

SQL injection’s threat type; what is not a threat

PredictionQ1

SQL injection is a(n) ____ threat.

Slide 8 / 53

Threats Against the Network

Slide 8: Threats Against the Network
Slide 9 / 53

Threats Against the Host

Slide 9: Threats Against the Host
Slide 10 / 53

Threats Against the Application

Slide 10: Threats Against the Application
Slide 11 / 53

Components of a Threat

Slide 11: Components of a Threat
Slide 12 / 53

Threat Agents

Slide 12: Threat Agents

Notes

  1. Threat agent: the actor (hacker, insider, malware) that carries out the threat.

Slide 13 / 53

Top ten Database Security Threats

Slide 13: Top ten Database Security Threats
Slide 14 / 53

Ten web threats

Slide 14: Ten web threats
Slide 15 / 53

Major Security Threats on Information Systems http://ubiquity.acm.org/article.cfm?id=1117695

Slide 15: Major Security Threats on Information Systems http://ubiquity.acm.org/article.cfm?id=1117695
Slide 16 / 53

Vulnerabilities

Slide 16: Vulnerabilities

Notes

  1. Vulnerabilities come from design flaws, misconfiguration, missing patches, weak processes and people.

Slide 17 / 53

How do the vulnerabilities manifest?

Slide 17: How do the vulnerabilities manifest?
Slide 18 / 53

Examples of Information Security Vulnerabilities

Slide 18: Examples of Information Security Vulnerabilities
Slide 19 / 53

Examples of Information Security Vulnerabilities (Cont.)

Slide 19: Examples of Information Security Vulnerabilities (Cont.)
Slide 20 / 53

Common Vulnerabilities and Exposures (CVE) List

Slide 20: Common Vulnerabilities and Exposures (CVE) List

Notes

  1. CVE: a public dictionary of known vulnerabilities, each with a CVE-ID (CVE-YEAR-NUMBER).

Exam angle

PredictionQ1

CVE provides:

Slide 21 / 53

Common Vulnerabilities and Exposures (CVE) List

Slide 21: Common Vulnerabilities and Exposures (CVE) List
Slide 22 / 53

Example on CVE

Slide 22: Example on CVE
Slide 23 / 53

Threat Modeling

Slide 23: Threat Modeling

Notes

  1. Threat modeling: identify what can go wrong in a system and how to address it, early in design.

Slide 24 / 53

12 threat models

Slide 24: 12 threat models
Slide 25 / 53

STRIDE and Associated Derivations

Slide 25: STRIDE and Associated Derivations

Notes

  1. STRIDE: Spoofing, Tampering, Repudiation, Information disclosure, Denial of service, Elevation of privilege (each breaks one property).

  2. Memory trick Spoofing↔authentication, Tampering↔integrity, Repudiation↔non-repudiation, Info disclosure↔confidentiality, DoS↔availability, EoP↔authorization.

Exam angle

Past exam · Major exam

threat modeling an Azure App Service app

PredictionQ1

In STRIDE, "Tampering" violates:

PredictionQ2

Microsoft’s threat-modeling method for an app is:

Slide 26 / 53

STRIDE and Associated Derivations

Slide 26: STRIDE and Associated Derivations
Slide 27 / 53

STRIDE and Associated Derivations

Slide 27: STRIDE and Associated Derivations
Slide 28 / 53

PASTA

Slide 28: PASTA
Slide 29 / 53

PASTA

Slide 29: PASTA
Slide 30 / 53

LINDDUN

Slide 30: LINDDUN

Notes

  1. LINDDUN: privacy threats (Linkability, Identifiability, Non-repudiation, Detectability, Disclosure, Unawareness, Non-compliance).

Exam angle

PredictionQ1

Which method focuses on PRIVACY threats?

Slide 31 / 53

LINDDUN

Slide 31: LINDDUN
Slide 32 / 53

LINDDUN

Slide 32: LINDDUN
Slide 33 / 53

Common Vulnerability Scoring System (CVSS)

Slide 33: Common Vulnerability Scoring System (CVSS)

Notes

  1. CVSS: scores a vulnerability’s severity 0–10 (base, temporal, environmental metrics).

Slide 34 / 53

Common Vulnerability Scoring System (CVSS)

Slide 34: Common Vulnerability Scoring System (CVSS)
Slide 35 / 53

Threats Analysis (Attack Tree)

Slide 35: Threats Analysis (Attack Tree)
Slide 36 / 53

Attack Trees — Graph Notation

Slide 36: Attack Trees — Graph Notation
Slide 37 / 53

Attack Trees — Text Notation

Slide 37: Attack Trees — Text Notation
Slide 38 / 53

Attack Trees

Slide 38: Attack Trees
Slide 39 / 53

Persona non Grata

Slide 39: Persona non Grata
Slide 40 / 53

Security Cards

Slide 40: Security Cards
Slide 41 / 53

Slide 41

Slide 41: Slide 41
Slide 42 / 53

hTMM

Slide 42: hTMM
Slide 43 / 53

Quantitative Threat Modeling Method

Slide 43: Quantitative Threat Modeling Method
Slide 44 / 53

Slide 44

Slide 44: Slide 44
Slide 45 / 53

Trike

Slide 45: Trike
Slide 46 / 53

Visual, Agile, and Simple Threat modeling (VAST)

Slide 46: Visual, Agile, and Simple Threat modeling (VAST)
Slide 47 / 53

OCTAVE

Slide 47: OCTAVE

Notes

  1. OCTAVE: organizational, self-directed risk assessment of operational risk (Carnegie Mellon).

Slide 48 / 53

Slide 48

Slide 48: Slide 48
Slide 49 / 53

DREAD

Slide 49: DREAD

Exam angle

PredictionQ1

The "R" in DREAD stands for:

Slide 50 / 53

Example

Slide 50: Example
Slide 51 / 53

Slide 51

Slide 51: Slide 51
Slide 52 / 53

Threat/Vulnerability Pairs

Slide 52: Threat/Vulnerability Pairs

Notes

  1. Threat/vulnerability pair: a threat matters only if a matching vulnerability exists (and vice versa).

Slide 53 / 53

Threat Matrix

Slide 53: Threat Matrix