Upload File

threat modeling for secure - application security testing ... · threat modeling for secure...

  • Home
  • Documents
  • Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat
8
Threat Modeling for Secure Embedded Software As embedded software becomes more ubiquitous and connected – powering everything from home appliances and cars to aircraft and mission-critical systems – organizations must take additional steps to ensure that the code produced is both secure and reliable. Embedded software, however, presents a unique set of challenges for application development and engineering teams. To combat embedded software threats, teams are turning to strategies such as threat modeling, static analysis and penetration testing to secure their embedded code. Software developers’ greatest challenges in producing secure embedded code are rooted in the nature of the devices that run the software: » » They are resource-constrained and have less “room” to compensate for CPU- or memory-robbing attacks. As a result, they are easily susceptible to denial of service attacks. » » Their performance can be slowed by cryptography. To speed performance, embedded developers do not include secure networking protocols on embedded devices as often as they do on their desktop counterparts. » » Their firmware can be changed. Knowledgeable users can swap out existing embedded firmware and replace it with an operating system of their choice. » » They are only intermittently connected to a network. Inconsistent network connections reduce the likelihood that security patches will be kept up-to-date, and increase the chance that the device will access an unsecure network. » » They are easy to steal due to their small physical size. In theory, an attacker could swap one embedded device for another and load malicious information into a system. This paper will examine threat modeling and explain how it can be used in concert with secure development best practices, including automated source code analysis, peer code reviews, and penetration testing to both identify and mitigate embedded software threats. SECURITY INNOVATION & KLOCWORK WHITE PAPER | JUNE 2011 WWW.KLOCWORK.COM “Google Confesses Android Security Breach, Rolls Out Fix” “Sony Announces PS2 Bank Security Breach” “Microsoft Warns Xbox Live Users of Security Threat” “RSA Offers to Replace Tokens After Attack”

Upload: others

Post on 28-Jun-2020

17 views

Category:

Documents


0 download

Report

TRANSCRIPT

Page 1: Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

ThreatModelingforSecureEmbeddedSoftware

Asembeddedsoftwarebecomesmoreubiquitousandconnected–poweringeverythingfromhomeappliancesandcarstoaircraftandmission-criticalsystems–organizationsmusttakeadditionalstepstoensurethatthecodeproducedisbothsecureandreliable.Embeddedsoftware,however,presentsauniquesetofchallengesforapplicationdevelopmentandengineeringteams.Tocombatembeddedsoftwarethreats,teamsareturningtostrategiessuchasthreatmodeling,staticanalysisandpenetrationtestingtosecuretheirembeddedcode.

Softwaredevelopers’greatestchallengesinproducingsecureembeddedcodearerootedinthenatureofthedevicesthatrunthesoftware:

»» They are resource-constrainedandhaveless“room”tocompensateforCPU-ormemory-robbingattacks.Asaresult,theyareeasilysusceptibletodenialofserviceattacks.

»» Their performance can be slowed by cryptography.Tospeedperformance,embeddeddevelopersdonotincludesecurenetworkingprotocolsonembeddeddevicesasoftenastheydoontheirdesktopcounterparts.

»» Their fi rmware can be changed.Knowledgeableuserscanswapoutexistingembeddedfirmwareandreplaceitwithanoperatingsystemoftheirchoice.

»» They are only intermittently connected to a network.Inconsistentnetworkconnectionsreducethelikelihoodthatsecuritypatcheswillbekeptup-to-date,andincreasethechancethatthedevicewillaccessanunsecurenetwork.

»» They are easy to steal due to their small physical size.Intheory,anattackercouldswaponeembeddeddeviceforanotherandloadmaliciousinformationintoasystem.

Thispaperwillexaminethreatmodelingandexplainhowitcanbeusedinconcertwithsecuredevelopmentbestpractices,includingautomatedsourcecodeanalysis,peercodereviews,andpenetrationtestingtobothidentifyandmitigateembeddedsoftwarethreats.

SECURITYINNOVATION&KLOCWORKWHITEPAPER | JUNE2011

WWW.KLOCWORK.COM

“Google Confesses Android Security Breach, Rolls Out Fix”

“Sony Announces PS2 BankSecurity Breach”

“Microsoft Warns Xbox Live Users of Security Threat”

“RSA Offers to Replace TokensAfter Attack”

Page 2: Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Threat Modeling for Secure Embedded Software | Klocwork White Paper | 2

ThreatModeling–ABriefOverview_ ___________________________________________________________________________

Threatmodelingisasecurityengineeringactivitythatdocumentsthekeyassetsfoundinanapplicationorsystemandpurposelyexposesriskstothoseassetsinathoroughanddisciplinedmanner.Thegoalofathreatmodelistoshinealightuponhiddensecurityrisksthatmaynotbeobviousoranticipatedbythedesignteam.Thisinformationcanthenbeusedtodevelopariskmanagementstrategyandprovidearoadmapforfuturesecurityengineeringactivities.

Byidentifyinganapplication’spotentialvulnerabilities,threatmodelinghelpsdevelopmentteamstounderstandandprioritizethearrayofrisksforwhichthesoftwareissusceptible.Withtheresultsofathreatmodelinhand,developmentteamscanensurethattheyareconcentratingtheirdesign,developmentandtestingtechniquesontherisksthatmattermost.

Benefits of Threat ModelingThreatmodelingisoneofthemostpowerfulsecurityengineeringactivitiesbecauseitfocusesonactualthreats,notsimplyonvulnerabilities.Athreatisanexternaleventthatcandamageorcompromiseanassetorobjective,whereasvulnerabilityisaweaknesswithinasystemthatmakesanexploitpossible.Vulnerabilitiescanberepaired,butthreatscanliveonindefinitelyorchangeovertime.Threatmodelingfacilitatesarisk-basedsoftwaredevelopmentapproachbyuncoveringexternalrisksandencouragingtheuseofsecurecodingpractices.

Inparticular,threatmodelinghelpsdevelopmentteamsto:

»» Assesstheprobability,potentialharm,andpriorityofattacks»» Prioritizesecurityeffortsaccordingtotruerisk»» Shapeanapplicationdesigntomeetsecurityobjectives»» Identifywhereadditionalsecurityresourcesarerequired»» Weighsecuritydecisionsagainstotherdesigngoals»» Improvethesecurityofanapplicationbyimplementingeffective

countermeasures»» Understandattackvectorsforpenetrationtesting»» Understandtheconditionsunderwhichanattackmaybesuccessful

Byhelpingdevelopmentteamstoidentifyandunderstandpotentialthreats,threatmodelingprovidestheessentialinformationneededtoplananembeddedsoftwaresecuritystrategy.

Caveat to Threat ModelingItisimportanttonotethatthreatmodelingisnotanattackplan,atestplan,aformalproofofsystemsecurity,oradesignreview.Threatmodelinginformsthoseplansandreviewsbyofferingdeepinsightintothemethodsattackerscouldusetomanipulateembeddedsoftware.Threatmodelingisthereforeakeycontributortodesignreviewandtestplanning,butshouldnotbeconsideredasubstituteforthoseactivities.

CreatingaThreatModel_____________________________________________________________________________________________

Developingathreatmodelisateameffort,butworksbestwhenthemodelingexerciseisledbyadesignerwithsecurityexpertise.Thefollowingactivityoverviewoutlinesanefficientandrepeatableprocedureformodelingthreatstoembeddedsoftware.

Step 1: Identify Security ObjectivesFirst,theteammustclarifythedesiredlevelofsecurity.Isthegoaltopreventanyandallsecuritybreaches?Arecertainattackspermissible?Preventingeverypossibleattackmaynotbepossibleorcost-effective,soitisimportanttodeveloprealisticobjectivesthatbalancesecurity,costandeffort.

“By helping development teams to identify and understand potential threats, threat modeling provides the essential information needed to plan an embedded software security strategy.”

Page 3: Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Threat Modeling for Secure Embedded Software | Klocwork White Paper | 3

Step 2: Create a System OverviewOnceitssecurityobjectivesareclear,thedevelopmentteamshouldexamineitssoftwareapplicationandidentifyeachassetofvalue.Assetsofvaluearecomponentsthatanattackerwouldvalueandwhichthereforeneedtobeprotected.Examplesinclude:

»» Dataassetssuchascreditcardnumbers»» TechnologyassetssuchasintellectualpropertyorcontentunderDigital

RightsManagement»» Softassetssuchasbusinessreputationandcustomertrust.Certain

attacks,suchasdefacement,canhaveaminorimpactonhardassetsbutcandramaticallyreducecustomerconfidenceinanorganization’sabilitytodevelopareliable,trustworthyproduct.

Step 3: Isolate and Decompose the Device’s Software DesignWhileproductdevelopersarenormallyconcernedwithusecases,athreatmodelencouragestheteamtothinkaboutabusecases.Anabusecaseisanattackscenarioinwhichamalicioususerwishestoabuse,ratherthanuse,asystem.Thethreatmodelingprocesshelpstogenerateabusecasesby“decomposing”adevice’ssoftwaredesigntoisolatetheareasmostsusceptibletoabuse.

Whenbrainstormingonabusecases,consider:

»» Thedata on the deviceanddatainsystemsthatcanbeaccessedbythedevice.

»» Theinput sourcesthatcouldbeusedtoattackthedevicesoftware.Thesecouldincludenetworkdatastreamstothedeviceoperatingsystem,installedapplications,GPSsignals,andcellularvoice/dataentry.

»» Physical challengesthatcouldariseifthedevicefindsitswayintothehandsofanattacker.Forinstance,howwouldyouprotectsensitivedataifthedeviceisstolen?

Afterenumeratingtheassetsofvalueanddecomposingthedevice’ssoftwaredesign,adevelopmentteamcangenerateathoroughlistofthreatsthatcouldnegativelyimpactthedeviceorsystem.

Step 4: Identify ThreatsThegoalofthethreatmodelingexerciseistoidentifyasmanythreatsaspossible.Todothis,developmentteamsshouldusethe“CIAmethod”andconsidertheeventsthatwouldimpacttheConfidentiality,Integrity,orAvailabilityofeachasset.

Manydevices,forexample,revealgeographicinformationabouttheuser.The“GoogleLatitude”functiononasmartphonecanrevealauser’sphysicallocation,andalogof“cardholderpresent”creditcardtransactionscanidentifyauser’smovements.Deviceswithembeddedsoftwareoftenlogaccesstosystemresources.Whencompromised,thisinformationcanprovideablueprintofinterestingandvaluableinformationonthedevice.

Onceadevelopmentteamhasidentifiedanyandallthreatsthatcouldcompromisetheconfidentiality,integrityandavailabilityofitsassets,itmustconsiderthetypeofattacksthatcouldbeusedtorealizeeachthreat.Themostefficientwaytoidentifypotentialattacksistodevelopan“attacktree”foreachthreat.

Anattack treeisavisualtoolthatdocumentsthreatsandattacksforanasset,asshowninFigure2.Thethreatisdocumentedatthetopofthetreeanditisfollowedbyasetofbranchesthatrepresentpotentialattackmethods.Thesebranchesarethenfurthersubdividedtoidentifytheconditionsortechniquesthatcouldbeusedinasuccessfulattack.

“While product developers are normally concerned with use cases, a threat model encourages the team to think about abuse cases.”

Page 4: Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Threat Modeling for Secure Embedded Software | Klocwork White Paper | 4

Intheaboveexample,thethreattreenotonlyidentifiesthetypeofattacksthatarepossiblewhenanattackerimpersonatesauser,italsoliststheconditionsandtechniquesunderwhichasuccessfulattackcouldtakeplace.Thisinformationcanbeusedinthenextstepofthethreatmodeltoidentifythespecificvulnerabilitieswithintheembeddedcode.

Step 5: Identify VulnerabilitiesAgoodthreattreewilllistalloftheconditionsunderwhichanattackcouldbesuccessful.Imaginethatathreatmodelhashighlightedthatcreditcardinformationcouldbeobtainedfromthesystemviaa“man-in-the-middleattack”onacommunicationchannel.Inthiscase,theattacktreewouldshowthattheattackcouldbesuccessfulifcreditcardinformationistransmittedoverthedatachannelincleartext.Ifthedevelopmentteamfindsthatthisconditionismetinitssystem,itshoulddevelopamitigationstrategytoblocktheattack.Ifthatconditionisnotmet,anattackisnotpossibleandtheteamcanconcentrateitseffortselsewhere.

Attheendofthisprocess,thethreatmodelwillcomprisealistofvulnerabilitiesthatcanbeusedtoplananattackmitigationstrategy.

Step 6: RepeatThreatmodelsareorganicdocumentsandshouldberevisitedfrequently.Conditionschange,designschange,andthethreatlandscapechanges.TheDVDworld,forexample,providesanexcellentexampleoftheneedforcontinuousthreatmodeling.WhenDVDplayerswerefirstcreated,thekeysforDVDDigitalRightsManagement(DRM)wereincludedintheactualDVDplayerhardware.Hardwareplayerswereinitiallytamper-proof,buttheintroductionofsoftwareDVDplayersmadeitmucheasierforattackerstoreverse-engineerthekeysandbreaktheencryption.

TheoriginalthreatmodelforanearlyDVDplayerwouldhavelistedonlytheoriginalthreat:“DVDContentisStolen”,anditsmitigation:“DVDcontentisencrypted,encryptionkeysarestoredintamper-proofhardware”.Withtheintroductionofsoftwareplayers,thethreatmodelhadtobeupdatedtoidentifyandmitigatethenewrisks.

Figure 2 | Sample Attack Tree for an impersonation threat

Client/UI Threat #4:Attacker

Impersonates User

Spoof authentication token/transaction

ID

Bypass the client application/UI to create

transaction

Modify the audit trail so that it appears that a

different user conducted the transaction

Attempt to intercept credentials during their

transmission

Attempt to discover credentials left in

memory

Attacker discovers another user’s

credentials

Page 5: Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Threat Modeling for Secure Embedded Software | Klocwork White Paper | 5

Threat Modeling - Activity Summary TableInput Step Output

• Businessrequirements• Securitypolicies• Compliancerequirements

Step 1: Identify security objectives

• Keysecurityobjectives

• Deployment diagrams• Use cases• Functional specifications

Step 2: Create a system overview

• Whiteboard-style diagram with end-to-end deployment scenario

• Key scenarios• Roles• Technologies• Application security

mechanisms

• Deployment diagrams• Use cases• Functional specifications

Step 3: Isolate and decompose your device design

• Trust boundaries• Entry points• Exit points• Data flows

• Common threats Step 4: Identify threats

• Threat list

• Common vulnerabilities Step 5: Identify vulnerabilities

• Vulnerability list

Figure 3 | Threat Modeling Activity Summary Table

PuttingitintoPractice:Identifying&MitigatingVulnerabilitiesinCode_ ___________________________

Whilethreatmodelingcanuncoverthebroadthreatsandvulnerabilitiesofanembeddedsystem,itcannotmitigatethosethreats.Todoso,developmentteamsmustpracticedefensivecoding,engageinfrequentcodereviews,andperformpenetrationtesting.

Code DefensivelyDefensivecodingisaformofdesignthataimstoensurethecontinuingfunctionofsoftwareandsourcecodeinspiteofmisuseorabuse.Whileathreatmodelcanidentifyvulnerabilitiesduetodesign,acertainpercentageofvulnerabilitieswillalwaysresultfromcodingflaws.

Developersoftenfindthatmanyofthevulnerabilitiesidentifiedinthethreatmodelresultfromonlyahandfulofcodingerrors.Onesimpleinsecurecodingtechniquethatisperformedrepeatedlycancontributetodozensofvulnerabilities.Hackersfrequentlyexploitthebest-knownvulnerabilities,sodevelopersthatcodedefensivelyandeliminatethemostcommoncodingflawscansubstantiallyreducetheriskofasuccessfulattack.

Moreover,threatmodelingoftenuncoversthreatsthatcanonlybemitigatedthroughgoodcodingpractices.If,forexample,anorganizationhasidentifiedathreatthatrequiresacentralizedinputanddatavalidationstrategy,itwillrequirecode-levelfixestoaccomplishthevalidation.Theseprinciplesmightincludevalidatingallinputforlength,range,formatandtype.

Byfollowingdefensivecodingpractices–mostnotably,theuseofautomatedtoolstoidentifyweakcodingpracticesanduncovervulnerabilities–developmentteamscandramaticallyreducethefrequencyandimpactofbadcode.

Page 6: Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Threat Modeling for Secure Embedded Software | Klocwork White Paper | 6

Automated Source Code AnalysisAutomatedsourcecodeanalysis(SCA)toolsprovideahighreturnoninvestmentforanysoftwaredevelopmentorganizationbyhelpingtoeliminatebugsearlyinthedevelopmentcycle.Industryestimatesholdthatthecostofaddressingacodedefectafterabuildis10timeshigherthanaddressingitduringdevelopment.Whileautomatedprogramsdonotremovetheneedformanualcodetesting,theycandramaticallyreducethetimespentoncodereviewsandfocusmanualtestsonthemostimportantand“hardest-hitting”issues.

Staticanalysistools,forexample,canidentifyhundreds–ifnotthousands–ofcodingproblems.Theseinclude:

»» Common vulnerabilitiessuchasbufferoverflows,uninitializeddata,useofdanglingpointers,injectionflawsandknowninsecureAPIsandlibraries.

»» Secure coding guidelinessuchasCWE,CERT,DISAandOWASP,aswellasanycustomchecksorguidelinesthatwouldbeuniquetoyourcodebase.

»» Reliability-related concernssuchasmemoryleaks,memoryallocation,resourcemanagementandmore.

»» Long-term maintainability concernssuchasarchitecturalviolations,deadcode,unusedlocalvariables,andothercodingstylebestpractices.

Byincorporatingautomatedstaticanalysistoolsorganizationscansimplifyexistingpeerreviewprocessesandautomateanumberofcodereviewactivities.Moreover,byrunningthisanalysisearlyinthesoftwaredevelopmentprocess,developerscaneliminatesimplemistakesbeforetheymakeitintothecodestream.

Infact,staticanalysistoolsareidealforeducatingdevelopersaboutthecodingproblemslistedabove.Mostdevelopersarenotsecurityexperts,butsourcecodeanalysistoolscanhelptoinformandeducatedevelopersofthemostcommonsecurityissues.Byexaminingstaticanalysisresults,developerscanidentifythefrequentproblemsand,overtime,makeimprovementsintheirprocessestoavoidthem.

Itisimportanttonote,however,thatstaticanalysiscanonlyidentifyspecificcodingproblems.Itisuptothedevelopmentteamtodecidewhetherthoseproblemsneedtobeaddressed.Thatdecisiondependsonestablishedtrustboundariesandthecosts/benefitsassociatedwiththerepairs.Developmentteamscanspeedthesedecisionsbyconsultingthethreattreesestablishedduringthethreatmodelingprocesstodeterminewhetherthevulnerabilitiesrepresenttruethreatstothesystem.

Engage in Frequent Code ReviewsSecuritycodereviewsarecriticalinthedevelopmentofsecurecode.Theyunveilvulnerabilitiesthataredifficulttodiscoverthroughtestingprocessessincetheyexaminethesourcecodedirectlyandreviewcodepathsdeepinsideanapplication.Throughafocusedanditerativeapproachtocodereviewthatconsistsofbothmanualandautomatedinspection,codereviewscanbeperformedasoftenaseverycheck-intodiscoverbugsbeforetheymakeitintothebuild.Thesefrequentcodereviewsnotonlyidentifyadditionalvulnerabilities,theyalsoallowdeveloperstogainexperienceandlearncollectivelyfromtheirmistakes.

Toperformaneffectivecodereview:

1. Identify code review objectives.Consultthethreatmodeltoprioritizerisksandidentifythemostimportantvulnerabilities.

2. Perform a preliminary scan.Usebothcontrolflowanddataanalysestostepthroughlogicalconditionsinthecode,understandtheconditionsunderwhicheachblockwillbeexecuted,andtracedatafromthepointsofinputtothepointsofoutput.

“Most developers are not security experts, but source code analysis tools can help to inform and educate developers of the most common security issues.”

Page 7: Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

Threat Modeling for Secure Embedded Software | Klocwork White Paper | 7

3. Review for common issues.Scanembeddedcodeforcommonvulnerabilitiesarounddataaccess,inputanddatavalidation,authentication,physicalpossessionandreplayattacks.

4. Review for unique issues.Consultthethreatmodelandscanembeddedcodeforvulnerabilitiesthatmaybeuniquetotheparticularsystem,deviceorapplicationinquestion.

Codereviewshouldbestartedearlyinthesoftwaredevelopmentprocessandrepeateduntiltheteamissatisfiedwiththeresultsoruntilapre-establishedtimelimithasbeenreached.Attheendofthisprocess,thedevelopmentteamwillhaveasetofprioritizedvulnerabilitiesandinspectionquestionsinhandthatitcanusetomakefuturereviewsevenmoreeffective.

Perform Security TestingSecuritytestingshouldbeoneofthefinalstepsperformedinanembeddedsoftwaresecurityproject.Throughapenetration test,developmentteamscangainconfidencethattheirearlierdesignreview,threatmodelingandcodereviewactivitieshavehardenedthesoftwareagainstattack.Ifteamshavefollowedthesecuritybestpracticesoutlinedinthiswhitepaperthroughoutthedevelopmentlifecycle,theproblemsthattheywillidentifyduringthisfinalstagewilltypicallybeminorandsimpletoremedy.

Whenanapplicationisreadyforapenetrationtest,leveragethethreatmodeltoimprovethetestplan.Usethethreatmodeltodetermineattackvectorsandconditionsunderwhichtheattacksmaybesuccessful.Securityvulnerabilitiescanbesubtle,sobesuretoconsiderallsignsofasuccessfulattack,suchasanunexpectedchangetoafilesystem,orunexpectednetworktraffic.

Likeacodereview,asecuritytestcanalsousebothautomatedandmanualtools.AutomatedSCAtoolscanbeusedtospeedanalyses,andmanualtestingtechniquescanbeemployedtobothdiscoverandaddresselusivevulnerabilities.

TheImportanceofThreatModeling____________________________________________________________________________

ModernembeddedsystemsareapproachingthecomplexityofatraditionalPCwhileintroducingadditionalcomplexitiesrelatedtoconnectivityandresourceconstraints.Throughtheuseofkeysecurityengineeringactivitiesincludingthreatmodeling,codereviews,codingbestpractices,andsecuritytesting,developmentteamscandetectandaddresssecurityvulnerabilitiesintheirembeddedcodequickly,efficientlyandpriortoproductrelease.

AboutKlocworkandSecurityInnovation_____________________________________________________________________

Klocwork®offersaportfolioofsoftwaredevelopmentproductivitytoolsdesignedtoensurethesecurity,qualityandmaintainabilityofcomplexcodebases.Usingprovenstaticanalysistechnology,Klocwork’stoolsidentifycriticalsecurityvulnerabilitiesandqualitydefects,optimizepeercodereview,andhelpdeveloperscreatemoremaintainablecode.Klocwork’stoolsareanintegralpartofthedevelopmentprocessforover850customersintheconsumerelectronics,mobiledevices,medicaltechnologies,telecom,militaryandaerospacesectors.Visitwww.klocwork.comtolearnmore.

SecurityInnovationisanestablishedleaderinthesoftwaresecurityandcryptographyspace.Foroveradecadethecompanyhasprovidedproducts,trainingandconsultingservicestohelporganizationsbuildanddeploymoresecuresoftwaresystemsandprotecttheirdatacommunications.VisitSecurityInnovationatwww.securityinnovation.com.

Page 8: Threat Modeling for Secure - Application Security Testing ... · Threat Modeling for Secure Embedded Software | |Klocwork White Paper 2 Threat Modeling – A Brief Overview_____ Threat

IN THE UNITED STATES:15 New England Executive ParkBurlington, MA 01803

IN CANADA:30 Edgewater Street, Suite 114Ottawa, ON K2L 1V8

t: 1.866.556.2967f: 613.836.9088www.klOCwOrk.COm

AppendixA:ThreatModelingChecklist______________________________________________________________________

1) Create a Threat Model»» IdentifySecurityObjectives»» CreateaSystemOverview»» IsolateandDecomposetheDevice’sSoftwareDesign»» IdentifyThreats»» IdentifyVulnerabilities

2) Code Defensively»» Lookfor“traditional”vulnerabilitiessuchasbufferoverflows,uninitialized

data,useofdanglingpointers,injectionflawsandknowninsecureAPIsandlibraries.

»» Scanforquality-relatedconcernssuchasmemoryleaks,memoryallocation,resourcemanagementandmore.

»» Examinelong-termmaintainabilityconcernssuchasarchitecturalviolations,deadcode,unusedlocalvariablesandothers.

»» Identifypoorcodestylesandstandards.»» Uncoverlayoutissues.

3) Perform Effective Code Reviews»» Identifycodereviewobjectives»» Performapreliminaryscan»» Reviewforcommonissues»» Reviewforuniqueissues

© Copyright Klocwork Inc. 2011 · All Rights Reserved

CORPORATE HEADQUARTERS:187 Ballardvale Street, Suite A195Wilmington, MA 01887

BRANCH OFFICE:1511 3rd Ave #400Seattle, WA 98101

t: 1.877.694.1008f: 1.978.694.1666

© Copyright Security Innovation 2011 · All Rights Reserved

www.SeCurItyInnOvatIOn.COm


Threat Modeling & Simulation

Reverse Threat Modeling

Introduction to Threat Modeling

Application Threat Modeling - OWASP.pdf

Tactical Threat Modeling - SAFECode · Tactical Threat Modeling

Threat Modeling for Automotive Security Analysisonlinepresent.org/proceedings/vol139_2016/68.pdf · Threat Modeling for Automotive Security Analysis ... threat modeling STRIDE method

Application Threat Modeling

Cloud Threat Modeling

Asset-Oriented Threat Modeling

Corporate Threat Modeling v2

Threat Modeling (Part 3)

Threat Modeling - ISACA

Threat Modeling (Part 4)

Using the Threat Agent Library to improve threat modeling

Adventures in Threat Modeling

Threat Modeling - GBV

Hickman threat modeling

Lecture 7: Threat Modeling

Threat Modeling / iPad

Threat Modeling And Analysis

Threat Modeling - home.eng.iastate.edu

Lecture 11: Threat Modeling

Secure Design: Threat Modeling

threat modeling - SecAppDev Peeters/threat... · threat modeling Johan Peeters ... threat model looks out: adversaries ... assignment I who are the potential adversaries?

Threat Modeling: Best Practices

Adam Shostack Microsoft - LayerOne...Threat Modeling (Swiderski and Snyder, Microsoft Press) "Guerilla Threat Modeling" (Torr) Patterns and Practices (J.D. Meier) Threat modeling for

Organizational Threat Modeling - EnergySec

Threat Modeling with STRIDE - Concordia Universityusers.encs.concordia.ca/~clark/courses/1601-6150/scribe/L04c.pdf · Threat Modeling with STRIDE Slides adapted from Threat Modeling:

02 Threat Modeling

Threat Modeling (Part 2)

Threat Modeling - CrossCountry Consulting

Threat modeling guide - DW.COM

Cryptocurrency-based Systems Threat Modeling for · Threat Modeling and Cryptocurrencies Threat modeling is an essential step in secure systems design. Explore the threat space to

Threat Modeling for Mobile Health Systems · Threat Modeling Overview TLP: WHITE, ID# 202004301030 • Threat modeling is an important aspect of the security development lifecycle,

Threat Modeling - Overview