Threat Modeling

Adam Shostack is a principal program manager on Microsoft's Trustworthy Computing team. He helped found the CVE \, the Privacy Enhancing Technologies Symposium, and the International Financial Cryptography Association His experience shipping products (at both Microsoft and tiny startups) and managing operational security ensures the advice in this book is grounded in real experience.

• Introduction xxiPart I Getting Started 1Chapter 1 Dive In and Threat Model! 3Learning to Threat Model 4Threat Modeling on Your Own 26Checklists for Diving In and Threat Modeling 27Summary 28Chapter 2 Strategies for Threat Modeling 29“What’s Your Threat Model?” 30Brainstorming Your Threats 31Structured Approaches to Threat Modeling 34Models of Software 43Summary 56Part II Finding Threats 59Chapter 3 STRIDE 61Understanding STRIDE and Why It’s Useful 62Spoofing Threats 64Tampering Threats 67Repudiation Threats 68Information Disclosure Threats 70Denial-of-Service Threats 72Elevation of Privilege Threats 73Extended Example: STRIDE Threats against Acme-DB 74STRIDE Variants 78Exit Criteria 85Summary 85Chapter 4 Attack Trees 87Working with Attack Trees 87Representing a Tree 91Example Attack Tree 94Real Attack Trees 96Perspective on Attack Trees 98Summary 100Chapter 5 Attack Libraries 101Properties of Attack Libraries 101CAPEC 104OWASP Top Ten 108Summary 108Chapter 6 Privacy Tools 111Solove’s Taxonomy of Privacy 112Privacy Considerations for Internet Protocols 114Privacy Impact Assessments (PIA) 114The Nymity Slider and the Privacy Ratchet 115Contextual Integrity 117LINDDUN 120Summary 121Part III Managing and Addressing Threats 123Chapter 7 Processing and Managing Threats 125Starting the Threat Modeling Project 126Digging Deeper into Mitigations 130Tracking with Tables and Lists 133Scenario-Specifi c Elements of Threat Modeling 138Summary 143Chapter 8 Defensive Tactics and Technologies 145Tactics and Technologies for Mitigating Threats 145Addressing Threats with Patterns 159Mitigating Privacy Threats 160Summary 164Chapter 9 Trade-Off s When Addressing Threats 167Classic Strategies for Risk Management 168Selecting Mitigations for Risk Management 170Threat-Specific Prioritization Approaches 178Mitigation via Risk Acceptance 184Arms Races in Mitigation Strategies 185Summary 186Chapter 10 Validating That Threats Are Addressed 189Testing Threat Mitigations 190Checking Code You Acquire 192QA’ing Threat Modeling 195Process Aspects of Addressing Threats 197Tables and Lists 198Summary 202Chapter 11 Threat Modeling Tools 203Generally Useful Tools 204Open-Source Tools 206Commercial Tools 208Tools That Don’t Exist Yet 213Summary 213Part IV Threat Modeling in Technologies and Tricky Areas 215Chapter 12 Requirements Cookbook 217Why a “Cookbook”? 218The Interplay of Requirements, Threats, and Mitigations 219Business Requirements 220Prevent/Detect/Respond as a Frame for Requirements 221People/Process/Technology as a Frame for Requirements 227Development Requirements vs. Acquisition Requirements 228Compliance-Driven Requirements 229Privacy Requirements 231The STRIDE Requirements 234Non-Requirements 240Summary 242Chapter 13 Web and Cloud Threats 243Web Threats 243Cloud Tenant Threats 246Cloud Provider Threats 249Mobile Threats 250Summary 251Chapter 14 Accounts and Identity 253Account Life Cycles 254Authentication 259Account Recovery 271Names, IDs, and SSNs 282Summary 290Chapter 15 Human Factors and Usability 293Models of People 294Models of Software Scenarios 304Threat Elicitation Techniques 311Tools and Techniques for Addressing Human Factors 316User Interface Tools and Techniques 322Testing for Human Factors 327Perspective on Usability and Ceremonies 329Summary 331Chapter 16 Threats to Cryptosystems 333Cryptographic Primitives 334Classic Threat Actors 341Attacks against Cryptosystems 342Building with Crypto 346Things to Remember about Crypto 348Secret Systems: Kerckhoffs and His Principles 349Summary 351Part V Taking It to the Next Level 353Chapter 17 Bringing Threat Modeling to Your Organization 355How To Introduce Threat Modeling 356Who Does What? 359Threat Modeling within a Development Life Cycle 367Overcoming Objections to Threat Modeling 379Summary 383Chapter 18 Experimental Approaches 385Looking in the Seams 386Operational Threat Models 387The “Broad Street” Taxonomy 392Adversarial Machine Learning 398Threat Modeling a Business 399Threats to Threat Modeling Approaches 400How to Experiment 404Summary 405Chapter 19 Architecting for Success 407Understanding Flow 407Knowing the Participants 413Boundary Objects 414The Best Is the Enemy of the Good 415Closing Perspectives 416Summary 419Now Threat Model 420Appendix A Helpful Tools 421Common Answers to “What’s Your Threat Model?” 421Appendix B Threat Trees 429STRIDE Threat Trees 430Other Threat Trees 470Appendix C Attacker Lists 477Attacker Lists 478Appendix D Elevation of Privilege: The Cards 501Spoofing 501Tampering 503Repudiation 504Information Disclosure 506Denial of Service 507Elevation of Privilege (EoP) 508Appendix E Case Studies 511The Acme Database 512Acme’s Operational Network 519Phones and One-Time Token Authenticators 525Sample for You to Model 528Glossary 533Bibliography 543Index 567