This document discusses techniques for optimizing threat modeling to require fewer resources. It proposes using templates and risk patterns to generate threats and countermeasures for common application components and use cases. This allows for more efficient "just enough" threat modeling compared to traditional manual methods. The document demonstrates how to decompose templates into reusable risk patterns and generate threat models through a rules engine. It also introduces the open source IriusRisk tool for implementing this approach.

1. Just Enough Threat Modeling
By
Stephen de Vries
@stephendv

2. About me
Founder of Con+nuum Security SL
Open Source BDD-Security project
IriusRisk SDLC Risk Management solu+on
17 years in AppSec consul+ng
Dev/Sec skill split

3. What is Threat Modeling?
A.k.a: Architectural Risk Analysis

4. BSIMM 6
37% Perform design review of high risk applica+ons
28% Have SoQware Security Group lead design review efforts
85% Perform security feature review
Ra+o of SoQware Security to Dev + QA = 1 to 245
Participating Firms
The 78 participating organizations are drawn from four well-represented verticals (with some overlap): financial
services (33), independent software vendors (27), consumer electronics (13), and healthcare (10). Verticals with
lower representation in the BSIMM population include: insurance, telecommunications, security, retail, and energy.
Those companies among the 78 who graciously agreed to be identified include:
Adobe, Aetna, ANDA, Autodesk, Bank of America, Black Knight Financial Services, BMO Financial
Group, Box, Capital One, Cisco, Citigroup, Comerica, Cryptography Research, Depository Trust and
Clearing Corporation, Elavon, EMC, Epsilon, Experian, Fannie Mae, Fidelity, F-Secure, HP Fortify,
HSBC, Intel Security, JPMorgan Chase & Co., Lenovo, LinkedIn, Marks & Spencer, McKesson, NetApp,
NetSuite, Neustar, Nokia, NVIDIA , PayPal, Pearson Learning Technologies, Qualcomm, Rackspace,
Salesforce, Siemens, Sony Mobile, Symantec, The Advisory Board, The Home Depot, TomTom,
trainline, U.S. Bank, Vanguard, Visa, VMware, Wells Fargo, and Zephyr Health
On average, the 78 participating firms had practiced software security for 3.98 years at the time of assessment
(ranging from less than a year old to 15 years old as of October, 2015). All 78 firms agree that the success of their
of software security it has not previously been
applied at this scale. Previous work has either
described the experience of a single organization
or offered prescriptive guidance based only on a
combination of personal experience and opinion.
simply reported.

5. Security cannot slow down development

6. Ar+sanal HandcraQed Threat Models since 1999

7. Accuracy
25%
50%
75%
100%
Resources required (Time + Skill)
Threat Modelling Process

8. Accuracy
25%
50%
75%
100%
Resources required (Time + Skill)
Threat Modelling Process
The hard stuff
The easy stuff

9. Accuracy
25%
50%
75%
100%
Resources required (Time + Skill)
Threat Modelling Process
The hard stuff
The easy stuff

10. Workshop/Analysis based Threat Modelling Threat Modelling with Templates / Pa[erns

11. Op+mising with templates / checklists

12. Use a 3rd party auth provider
Countermeasure 2
Only if Countermeasure 2
is not an op+on
Use Company X SSO for all
Internet facing applica+ons
OWASP ASVS as a Threat Model Template
V2.13 Verify that account passwords are
protected using an adap+ve key deriva+on
func+on, salted using a salt that is unique to
that account…
Countermeasure 1
If the DB is compromised then
a[ackers could also compromise
users’ authen+ca+on creden+als
Threat

13. Web Applica+on Threat Model Template

14. Problems with a one size fits all approach
Threat Model
Template
100% Accurate
Threat Model
of System

15. Problems with a one size fits all approach
100% Accurate
Threat Model
of System
Threat Model
Template

16. Deconstruct the template into components
TM
Template for DB
TM
Template for
Web Service
TM
Template for
WebUI

17. •HTML Web UI Threat Template.xlsx
•Mobile Device Threat Template.xlsx
•NoSQL Database Threat Template.xlsx
•SQL Database Threat Template.xlsx
•HTTP Service Threat Template.xlsx
•REST Web Service Threat Template.xlsx
•SOAP Web Service Threat Template.xlsx
•Amazon EC2 Threat Template.xlsx
•Connec+on to Third Party API Threat Template.xlsx

18. •HTML Web UI Threat Template.xlsx
•Mobile Device Threat Template.xlsx
•NoSQL Database Threat Template.xlsx
•SQL Database Threat Template.xlsx
•HTTP Service Threat Template.xlsx
•Authen+ca+on
•Creden+als Reset
•User Registra+on
•Profile Update
•Inter account funds transfer
•Na+onal funds transfer
•Interna+onal funds transfer
•…
•REST Web Service Threat Template.xlsx
•SOAP Web Service Threat Template.xlsx

19. • HTML Web UI Threat Template.xlsx
• Authen+ca+on
• Mobile Device Threat Template.xlsx
• Authen+ca+on
• Creden+als Reset
• Profile Update
• NoSQL Database Threat Template.xlsx
• SQL Database Threat Template.xlsx
• HTTP Service Threat Template.xlsx
• Authen+ca+on
• Creden+als Reset
• User Registra+on
• Profile Update
• Inter account funds transfer
• Na+onal funds transfer
• Interna+onal funds transfer
• …
• REST Web Service Threat Template.xlsx
• Authen+ca+on
• Profile Update
• Funds Transfer
• SOAP Web Service Threat Template.xlsx

20. Introducing Risk Patterns
Re-usable patterns of threats + countermeasures
that apply to a slice of architecture

21. Web UI Web ServiceAuthen+cate
Worked Example: Web Authen+ca+on

22. Threat A: Dictionary attack against username using common password
Threat B: Login bypassed by replaying credentials stored in Browser
Threat C: Credentials posted to a spoofed server
Web UI Web ServiceAuthen+cate
Threat D: Legitimate users cannot access the site because of DoS

23. Use Case: AuthenIcate
Threat A: Dictionary attack against username using common password
Countermeasure 1: Implement password quality checks
Countermeasure 2: Rate limit authen+ca+on a[empts from same IP
Threat B: Login bypassed by replaying credentials stored in Browser
Countermeasure 4: Set AUTOCOMPLETE to false on login form
Countermeasure 5: Enable TLS on the server
Countermeasure 6: Set the HSTS Header
Threat C: Credentials posted to a spoofed server
Countermeasure 3: Require the use of 2FA
Threat D: Legitimate users cannot access service because of DoS
Countermeasure 7: Enable upstream DoS protec+on

24. •Are the threat+countermeasures inherent in this type of
component ?
•Are the threat+countermeasures inherent in the use-case?
•Are the threat+countermeasures specific to this use-case in this
component?
Web UI Web ServiceAuthen+cate
Iden+fy Pa[erns

25. Threat A: Dictionary attack against username using common password
Countermeasure 1: Implement password quality checks
Countermeasure 2: Rate limit authen+ca+on a[empts from same IP
Threat B: Login bypassed by replaying credentials stored in Browser
Countermeasure 4: Set AUTOCOMPLETE to false on login form
Countermeasure 5: Enable TLS on the server
Countermeasure 6: Set the HSTS Header
Threat C: Credentials posted to a spoofed server
Countermeasure 3: Require the use of 2FA
Threat D: Legitimate users cannot access service because of DoS
Countermeasure 7: Enable upstream DoS protec+on
Web Service+
Authen+ca+on
WebUI+Authen+ca+on
Web
Service+Authen+ca+on
Web Service

26. Does the pa[ern apply in a more generic form?
Can a varia+on of the pa[ern be applied to a similar
component or use-case?
Op+mise for re-use

27. Threat A: Dictionary attack against username using common password
Countermeasure 1: Implement password quality checks
Countermeasure 2: Rate limit authen+ca+on a[empts from same IP
Countermeasure 3: Require the use of 2FA
Risk Pattern:
User/Pass Authentication against any Service
Web Service +
Authen+ca+on

28. Risk Pattern:
Authentication from WebUI
Threat B: Login bypassed by replaying credentials stored in Browser
Countermeasure 4: Set AUTOCOMPLETE to false on login form
WebUI+Authen+ca+on

29. Risk Pattern:
Authentication from Mobile Client
Threat B: Login bypassed by replaying credentials stored on device
Countermeasure 4: Do not store creden+als on the device
Countermeasure 5: Encrypt the creden+als stored on the device using the passcode
Risk Pattern:
Authentication from WebUI
Threat B: Login bypassed by replaying credentials stored in Browser
Countermeasure 4: Set AUTOCOMPLETE to false on login form
Can a varia+on of the pa[ern be applied to a similar component or use-case?

30. Countermeasure 5: Enable TLS on the server
Countermeasure 6: Set the HSTS Header
Threat C: Credentials posted to a spoofed server
Risk Pattern:
Authentication against an HTTP Service
Web
Service+Authen+ca+on

31. Risk Pattern:
Generic-Service
Threat D: Legitimate users cannot access service because of DoS
Countermeasure 7: Enable up-stream DoS protec+onWeb Service

32. Risk Pattern:
User/Pass Authentication against a Service
Risk Pattern:
Authentication against an HTTP Service
Risk Pattern:
Authentication from WebUI
Risk Pattern:
Authentication from Mobile Device
Client ServerAuthen+cate
Generated Threats & Countermeasures
Risk Pattern:
Generic-Service

33. Web UI Web Service
U/P Authen+cate
Generated Threats & Countermeasures
Threat A: Dictionary attack against username using common password
Implement password quality checks
Rate limit connec+ons from the same IP address
Require the use of 2FA
Threat B: Credentials posted to a spoofed server
Set the HSTS header
Enable TLS on the server
Risk Pattern:
User/Pass Authentication against a Service
Risk Pattern:
Authentication against an HTTP Service
Risk Pattern:
Authentication from WebUI
Risk Pattern:
Authentication from Mobile Device
Risk Pattern:
Generic-Service
Threat D: Legitimate users cannot access service because of DoS
Enable up-stream DoS preven+on

34. Web UI Web Service
Authen+cate
Generated Threats & Countermeasures
Threat B: Login bypassed by replaying credentials stored in Browser
Set AUTOCOMPLETE to false on login form
Risk Pattern:
User/Pass Authentication against a Service
Risk Pattern:
Authentication against an HTTP Service
Risk Pattern:
Authentication from WebUI
Risk Pattern:
Authentication from Mobile Device
Risk Pattern:
Generic-Service

35. Web UI on
Mobile
Web ServiceAuthen+cate
Generated Threats & Countermeasures
Threat B: Login bypassed by replaying credentials stored on device
Do not store creden+als on the device
Encrypt the creden+als stored on the device using the passcode
Risk Pattern:
User/Pass Authentication against a Service
Risk Pattern:
Authentication against an HTTP Service
Risk Pattern:
Authentication from WebUI
Risk Pattern:
Authentication from Mobile Device
Risk Pattern:
Generic-Service

36. Web UI REST API
Token Auth
Generated Threats & Countermeasures
Threat B: Credentials posted to a spoofed server
Set the HSTS header
Enable TLS on the server
Risk Pattern:
User/Pass Authentication against a Service
Risk Pattern:
Authentication against an HTTP Service
Risk Pattern:
Authentication from WebUI
Risk Pattern:
Authentication from Mobile Device
Risk Pattern:
Generic-Service
Threat D: Legitimate users cannot access service because of DoS
Enable up-stream DoS preven+on

37. Web UI SSH Service
U/P Authen+cate
Generated Threats & Countermeasures
Threat A: Dictionary attack against username using common password
Implement password quality checks
Rate limit connec+ons from the same IP address
Require the use of 2FA
Risk Pattern:
User/Pass Authentication against a Service
Risk Pattern:
Authentication against an HTTP Service
Risk Pattern:
Authentication from WebUI
Risk Pattern:
Authentication from Mobile Device
Risk Pattern:
Generic-Service
Threat D: Legitimate users cannot access service because of DoS
Enable up-stream DoS preven+on

38. OS NTP Service
Get Time
Generated Threats & Countermeasures
Risk Pattern:
User/Pass Authentication against a Service
Risk Pattern:
Authentication against an HTTP Service
Risk Pattern:
Authentication from WebUI
Risk Pattern:
Authentication from Mobile Device
Risk Pattern:
Generic-Service
Threat D: Legitimate users cannot access service because of DoS
Enable up-stream DoS preven+on

39. Generic-Service
HTTP-Service
JSON-Service
Server-side Session
Data-store
SQL DB
NoSQL DB
Generic-Client
Thick Client
HTML/JS Client
Mobile Client
SOAP-Service
Sensi+ve
Data-Transport
Hierarchical Risk Pa[ern Library
AuthN
AuthN-SF AuthN-2FA
UserPass Token
Client-side Session

41. What type of component are
you building?
Web Service
Mobile client
Web UI
How are users authen+cated?
Username & Password
2FA
No auth
Rules Engine
Generic-Service
HTTP-Service
Stateful-Session
SF-Auth
SF-Auth-HTTP-Service
Sensi+ve-DataTransport
Risk Patterns

42. rule “SF-AUTH for HTTP-Service“
when
RiskPa[ern(ref == “HTTP-SERVICE")
RiskPa[ern(ref == “SF-Auth“)
then
insertLogical(new RiskPa[ern(“SF-Auth-HTTP-Service“));
insertLogical(new RiskPa[ern(“Stateful-Session“));
insertLogical(new RiskPa[ern(“Sensi+ve-DataTransport“));
end
rule “User chooses Web Service“
when
Ques+on(id == “web.service”, answer == true)
then
insertLogical(new RiskPa[ern("HTTP-SERVICE"));
end
rule “User chooses User/Pass auth“
when
Ques+on(id == “auth.user.pass”, answer == true)
then
insertLogical(new RiskPa[ern(“SF-Auth"));
end

43. Advantages
Speed and scale threat modelling
Create a persistent Threat/Countermeasure knowledge-base
Improved consistency

44. Disadvantages
Checklists short-circuit thinking about the problem
Garbage In Garbage Out

45. Community Edition
https://github.com/continuumsecurity/IriusRisk

46. Derive a threat model from an architecture questionnaire

47. Manage risk by applying countermeaures…
Or accepting the risk

48. Push countermeasures directly to Jira

49. Auto-sync countermeasure state with Jira

50. Publishing threat models as Templates for use by other users

51. Accuracy
25%
50%
75%
100%
Resources required (Time + Skill)
Tool vendors for Threat Modeling
http://mozilla.github.io/seasponge
Visio + Excel

52. https://github.com/continuumsecurity/IriusRisk
www.continuumsecurity.net
Questions?
@stephendv