1
00:00:13,180 --> 00:00:14,920
So, here we are.

2
00:00:14,920 --> 00:00:16,580
The end of day one.

3
00:00:16,700 --> 00:00:18,060
Our final talk.

4
00:00:18,060 --> 00:00:21,240
Something that I've been super excited to hear about.

5
00:00:21,500 --> 00:00:27,220
But before we get to that, again, if you haven't gotten a t-shirt, head out to the AppSecVillage website.

6
00:00:27,220 --> 00:00:29,140
You can pick up a shirt there.

7
00:00:29,260 --> 00:00:34,080
And let's give a big thumbs up to everybody who helped to put this on this year.

8
00:00:34,080 --> 00:00:35,500
This is fantastic.

9
00:00:36,440 --> 00:00:38,660
Definitely want to thank everyone.

10
00:00:38,660 --> 00:00:44,580
The next speaker, Mario Arias, is going to talk about Threat Modeling the Death Star.

11
00:00:44,580 --> 00:00:48,960
Which, what a better model can we use, right?

12
00:00:48,960 --> 00:00:53,620
Mario is a software developer with 10 years of experience in four different countries.

13
00:00:53,620 --> 00:00:58,960
His expertise involves security, DevOps, and Agile practices.

14
00:00:58,960 --> 00:01:06,980
Mario helps teams to deliver value quickly while keeping applications, infrastructure, and data safe.

15
00:01:06,980 --> 00:01:10,620
With that, let's welcome Mario to the stage.

16
00:01:10,980 --> 00:01:12,200
Hello, everyone.

17
00:01:12,200 --> 00:01:15,220
Welcome to my talk, Threat Modeling the Death Star.

18
00:01:15,380 --> 00:01:16,440
My name is Mario.

19
00:01:16,440 --> 00:01:19,320
I have been a software developer for over 10 years.

20
00:01:19,420 --> 00:01:24,200
And recently, I have moved to be a full-time security engineer two or three years ago.

21
00:01:24,700 --> 00:01:28,540
And today, nowadays, I'm a software engineer at Canva.

22
00:01:29,540 --> 00:01:33,020
Today, I want to talk about Threat Modeling.

23
00:01:33,020 --> 00:01:39,660
Threat Modeling is a subject that is very important and is very dear to my heart for many different reasons.

24
00:01:39,660 --> 00:01:47,100
But the main reason is a reason that was shown on the State of DevOps report from last year.

25
00:01:47,280 --> 00:02:01,420
So, the State of DevOps report is a report done by Puppet and different companies where they look at different companies and they try to get information about how efficient they are in the DevOps world.

26
00:02:01,420 --> 00:02:04,720
And one of the things they look at is security.

27
00:02:05,340 --> 00:02:09,600
And they have, like, looking at all different companies on all different sizes.

28
00:02:09,920 --> 00:02:20,540
The most effective way to improve your security posture is to do collaborative Threat Models with the security team and the development teams.

29
00:02:20,540 --> 00:02:24,000
That's really, really important to improve your security posture.

30
00:02:24,000 --> 00:02:28,480
And that's what I have seen in my experience as well as a security engineer.

31
00:02:28,480 --> 00:02:36,600
Every time I introduce Threat Modeling to a company or to a team, I could see the benefits of it very quickly.

32
00:02:36,600 --> 00:02:39,280
Like, the improvement of the security posture.

33
00:02:40,520 --> 00:02:48,440
But before we're going to jump in and go into more advanced details about Threat Modeling, I want to talk a little bit about what the definition is, right?

34
00:02:48,800 --> 00:02:53,200
And if you look, if you try to Google it, you're going to see, like, many different definitions.

35
00:02:53,200 --> 00:02:56,020
But this one I like the best.

36
00:02:56,560 --> 00:03:02,920
It's that Threat Modeling is a process to identify and enumerate threats.

37
00:03:03,040 --> 00:03:06,860
That's what Threat Modeling is at the end of the day, right?

38
00:03:07,240 --> 00:03:10,840
And that makes a lot of sense for security people.

39
00:03:10,840 --> 00:03:18,540
But then when you try to go to non-security people or non-Threat Modeling nerds, they don't get very impressed, right?

40
00:03:18,540 --> 00:03:20,880
It's a very dry concept.

41
00:03:20,880 --> 00:03:23,080
It's a very abstract concept.

42
00:03:23,080 --> 00:03:31,860
And it's really hard to engage people who are not from security to actually understand and get involved with Threat Modeling.

43
00:03:32,500 --> 00:03:34,760
And that's a hard situation, isn't it?

44
00:03:34,760 --> 00:03:39,560
Like, where you have Threat Modeling brings so much benefits to the organization.

45
00:03:39,900 --> 00:03:43,780
But on the other hand, it's really hard to get other people to do it.

46
00:03:44,040 --> 00:03:46,640
And that was my position a few years ago.

47
00:03:46,640 --> 00:03:50,220
And I tried to introduce Threat Modeling in a company.

48
00:03:50,360 --> 00:03:54,720
And I really knew that Threat Modeling is quite important.

49
00:03:55,320 --> 00:03:59,040
But I also knew that it's not very engaging at all.

50
00:03:59,040 --> 00:04:09,740
So I was trying to find a balance where I could reap the benefits of Threat Modeling while making sure people were motivated enough to engage and participate in the process.

51
00:04:09,740 --> 00:04:14,520
It's not only one checkbox that you need to do at the end of the day, right?

52
00:04:16,040 --> 00:04:19,960
Anyway, then I came up with a list of requirements.

53
00:04:20,460 --> 00:04:22,040
What the requirements are?

54
00:04:22,040 --> 00:04:28,660
The requirements are something like, I felt, if it wasn't there for the Threat Modeling process, it wouldn't be very successful.

55
00:04:28,660 --> 00:04:33,400
I wouldn't think that actually it's something that's valuable to the company.

56
00:04:34,460 --> 00:04:37,860
And I came up with three different requirements, right?

57
00:04:37,940 --> 00:04:40,260
One is, it needs to be engaging.

58
00:04:40,260 --> 00:04:42,280
Threat Modeling definitely needs to be engaging.

59
00:04:42,280 --> 00:04:45,520
It shouldn't be another boring meeting people need to attend.

60
00:04:45,520 --> 00:04:55,820
It should be something more fun and more engaging, so people can go and have a good time, at least in the Threat Modeling session.

61
00:04:55,920 --> 00:04:58,020
It needs to be highly collaborative.

62
00:04:58,240 --> 00:05:06,660
Again, the magic of the Threat Modeling happens when you get the security team doing it, and the development team is doing it as well, together.

63
00:05:06,660 --> 00:05:10,240
And collaborating gets the process done.

64
00:05:10,240 --> 00:05:19,740
It's not like a process for me, it was like a no-go, a process where the security team did it behind the scenes, and they just returned a report to the development team.

65
00:05:19,740 --> 00:05:22,140
It definitely wasn't something I wanted to do.

66
00:05:23,060 --> 00:05:26,040
And finally, it needs to be valuable for everyone.

67
00:05:26,220 --> 00:05:36,220
And it sounds a bit silly, but it's very easy for people to think, like, I'm doing this Threat Modeling just to make sure the security team is happy, and then I can do my stuff.

68
00:05:36,920 --> 00:05:39,700
That's not the idea that I want to do for the Threat Modeling.

69
00:05:39,700 --> 00:05:45,680
I want something that if people are participating, collaborating, they could get something out of it.

70
00:05:45,700 --> 00:05:50,220
They could understand the process, and see the value of it, and then do it again and again.

71
00:05:50,220 --> 00:05:57,960
Not only because the security team wants to have the software more secure, because they also see value, and they also want to get their software more secure.

72
00:05:59,720 --> 00:06:03,200
And then I look at very different methodologies.

73
00:06:03,200 --> 00:06:06,980
I look at Stride, I look at Pasta, I look at many others.

74
00:06:06,980 --> 00:06:11,680
But the software methodology that I like the most is Attack Trace.

75
00:06:11,680 --> 00:06:21,760
I think that resonates well with me, my experience, and resonates very well with the teams and companies I have worked for, where I introduced that.

76
00:06:22,120 --> 00:06:26,700
I really like the way, because it's very simple, and it's very easy to do it.

77
00:06:26,980 --> 00:06:35,100
That doesn't mean it's the best methodology for everyone, like, different people have different styles, different companies have different cultures.

78
00:06:35,100 --> 00:06:37,940
You might find something different for yourself.

79
00:06:38,060 --> 00:06:43,100
But for me, when I saw Attack Trace, I really understood the concept.

80
00:06:43,100 --> 00:06:46,640
I really could see that being rolled out to the company.

81
00:06:47,340 --> 00:06:52,140
But before I actually tried to do the rollout for the company, I did a pilot first.

82
00:06:52,200 --> 00:06:54,480
I chose a few selected teams.

83
00:06:54,480 --> 00:07:00,820
They were doing some interesting work, and they were trying to model the aggregate value at that phase of the work.

84
00:07:01,400 --> 00:07:11,060
And with that, I talked to them, I did some pilots, I did a few training models, and then I did a survey at the end of it, to see what people think about the process.

85
00:07:11,060 --> 00:07:24,180
And I really asked them to be very honest, because if it wasn't working for them, chances are it wouldn't work for other people in the company, so it wouldn't be successful, and we should just start from scratching in, rather than try to roll out that process.

86
00:07:25,040 --> 00:07:29,280
And the numbers I got were very positive, let's say this.

87
00:07:29,280 --> 00:07:36,960
80% of developers found it useful, they found it valuable, and they would participate again.

88
00:07:36,980 --> 00:07:41,100
And for me, the participation again was the ultimate metric.

89
00:07:41,100 --> 00:07:45,620
If they would participate again, it's because I hit the three requirements.

90
00:07:45,620 --> 00:07:50,640
They saw value in it, it was collaborative, and it was engaging.

91
00:07:50,640 --> 00:07:55,240
And they saw value, they actually saw value for them, and they wanted to do it again.

92
00:07:55,360 --> 00:08:01,180
So that made me feel confident, and then I did roll out that to the rest of the company.

93
00:08:01,600 --> 00:08:08,380
And I'm going to talk about that, what's the process I did roll out, but I want to use Star Wars for that.

94
00:08:08,380 --> 00:08:14,380
Because, again, thread modeling is very dry, it's a very abstract concept.

95
00:08:14,580 --> 00:08:19,460
So I always try to get different ways to make thread modeling a bit more engaging.

96
00:08:19,780 --> 00:08:23,100
And Star Wars is one of the funniest ways that I have seen so far.

97
00:08:23,660 --> 00:08:26,020
So let's start with Star Wars.

98
00:08:27,120 --> 00:08:41,380
And that story starts with yourself, in the audience, watching this at this point, where you are the new CSO of the Galactic Empire, Chief Security Officer.

99
00:08:41,460 --> 00:08:42,660
Well done.

100
00:08:42,660 --> 00:08:50,860
You started as a low-level Stormtrooper, fighting the trenches against the rebellion, and you made all your way to the top.

101
00:08:50,860 --> 00:08:52,940
Now you're a Chief Security Officer.

102
00:08:52,940 --> 00:08:54,300
Well, well done.

103
00:08:55,040 --> 00:08:58,620
But not everything is perfect, isn't it?

104
00:08:59,600 --> 00:09:02,580
That guy now is your new boss.

105
00:09:03,280 --> 00:09:05,300
Yeah, and...

106
00:09:05,880 --> 00:09:08,340
How can I say this?

107
00:09:08,580 --> 00:09:12,620
He has a very different style of leadership.

108
00:09:12,620 --> 00:09:21,260
This whole thing you learned about today, blameless culture or servant leadership, is definitely not something he believes in.

109
00:09:21,260 --> 00:09:24,540
He's more like an old-school kind of guy.

110
00:09:24,540 --> 00:09:29,440
He really thinks high accountability is the way moving forward.

111
00:09:29,540 --> 00:09:30,560
But that's okay.

112
00:09:30,560 --> 00:09:35,720
Everybody had some problematic boss at some point in their careers.

113
00:09:35,720 --> 00:09:38,460
I'm pretty sure you can work around the guy.

114
00:09:40,540 --> 00:09:46,780
And you, as being a CSO, you start to look at the crowd use of the Empire.

115
00:09:46,780 --> 00:09:48,720
What's the most important assets?

116
00:09:48,720 --> 00:09:52,040
And what do you need to protect first before everything else?

117
00:09:52,040 --> 00:09:55,500
And the answer was very easy and very big as well.

118
00:09:55,500 --> 00:09:57,860
The answer was the Death Star.

119
00:09:58,200 --> 00:10:01,460
It's the most expensive project in the whole Galactic Empire.

120
00:10:01,460 --> 00:10:04,760
It costs around 2 trillion credits.

121
00:10:05,000 --> 00:10:07,560
It's been 20 years in the making.

122
00:10:07,560 --> 00:10:10,280
It's the biggest weapon of the galaxy.

123
00:10:10,280 --> 00:10:15,400
And a major strategic asset for the Galactic Empire.

124
00:10:15,400 --> 00:10:19,940
So definitely, that's the asset you need to focus on.

125
00:10:20,240 --> 00:10:25,540
However, it's a project that's been like any waterfall project.

126
00:10:25,820 --> 00:10:29,140
They are like over budget and overdue.

127
00:10:29,140 --> 00:10:30,840
And the business is not happy with it.

128
00:10:30,840 --> 00:10:33,920
And the business would like to release that as quickly as they can to production.

129
00:10:33,920 --> 00:10:38,900
It's been delayed, delayed, delayed for over too many years.

130
00:10:38,900 --> 00:10:42,700
So your boss and the Emperor, they're not very happy.

131
00:10:43,100 --> 00:10:44,080
But that's fine.

132
00:10:44,080 --> 00:10:45,240
You can work with that.

133
00:10:45,240 --> 00:10:46,700
You're a professional, right?

134
00:10:48,520 --> 00:10:52,360
Okay, so you've identified already what you need to protect.

135
00:10:52,360 --> 00:10:53,300
That's the Death Star.

136
00:10:53,300 --> 00:10:54,780
It's a good first step.

137
00:10:54,960 --> 00:10:58,920
But you need to have some sort of understanding what kind of adversaries are going to happen.

138
00:10:58,920 --> 00:11:01,460
Like what kind of attackers are going to happen.

139
00:11:01,820 --> 00:11:05,460
And you use a simple exercise called evil personas.

140
00:11:05,920 --> 00:11:10,480
The Galactic Empire has been attacked for too many years already.

141
00:11:10,480 --> 00:11:16,320
So you kind of know exactly what kind of attackers the Empire can have.

142
00:11:17,080 --> 00:11:21,920
So let's talk about it because we need to protect the Death Star against them.

143
00:11:23,020 --> 00:11:25,720
And the fourth one is very interesting.

144
00:11:25,720 --> 00:11:27,340
It's Jar Jar Binks, right?

145
00:11:27,460 --> 00:11:35,380
Jar Jar Binks just represents a class of attackers where they don't know very well what they are doing.

146
00:11:35,380 --> 00:11:37,860
They don't have too many resources.

147
00:11:37,880 --> 00:11:39,500
They're also very competitive.

148
00:11:39,500 --> 00:11:45,420
So they keep trying to show their colleagues how good they are.

149
00:11:46,140 --> 00:11:48,580
Sometimes it can be annoying for the Empire.

150
00:11:48,620 --> 00:11:53,400
But honestly, when it comes to the Death Star, they are not very important personas.

151
00:11:53,400 --> 00:12:01,840
So although it's good to list them, but it's not very good for your modeling for the Death Star.

152
00:12:01,840 --> 00:12:03,680
So we'll just move to the next persona.

153
00:12:04,820 --> 00:12:09,820
Now we're going to talk about Han Solo, right?

154
00:12:09,860 --> 00:12:16,340
And Han Solo is a very interesting persona because Han Solo has a lot more expertise.

155
00:12:16,800 --> 00:12:22,140
Han Solo knows what they're doing like any other Bolt Hunters.

156
00:12:22,140 --> 00:12:23,620
They know what they're doing.

157
00:12:23,700 --> 00:12:25,640
They have more resources as well.

158
00:12:25,640 --> 00:12:27,280
They have their own ship.

159
00:12:27,280 --> 00:12:30,960
They might have different weapons.

160
00:12:30,960 --> 00:12:35,320
But then again, they are there for the money and they don't organize themselves very well.

161
00:12:35,320 --> 00:12:37,640
Bolt Hunters are very competitive as well.

162
00:12:37,640 --> 00:12:41,640
They keep trying to go to the easy prey and get some easy money.

163
00:12:41,640 --> 00:12:44,620
But they don't try anything too big or anything like that.

164
00:12:45,040 --> 00:12:48,660
When it comes to the Death Star, it can be annoying.

165
00:12:49,160 --> 00:12:54,720
But on the other hand, they're probably not a big threat as well.

166
00:12:56,240 --> 00:12:58,660
But these people...

167
00:12:59,340 --> 00:13:01,680
These people can be problematic.

168
00:13:02,460 --> 00:13:03,660
Jedis.

169
00:13:03,920 --> 00:13:07,740
First, their expertise is huge.

170
00:13:07,740 --> 00:13:11,960
Well, not only because they have been training for many, many years.

171
00:13:11,960 --> 00:13:15,460
But because they have magic in their favor.

172
00:13:16,280 --> 00:13:18,660
How can you defend against magic?

173
00:13:18,660 --> 00:13:22,420
If you have a guard and they're like, you didn't see me or whatever.

174
00:13:22,420 --> 00:13:24,800
It's really, really hard to defend against them.

175
00:13:25,020 --> 00:13:30,760
Lucky you, since your boss managed to kill most of them years and years ago.

176
00:13:30,760 --> 00:13:36,820
And the ones that are out there, they're probably hidden and they're not much of a threat anyway.

177
00:13:37,260 --> 00:13:42,700
So although you list them as a threat, because they're very unlikely to show up.

178
00:13:42,760 --> 00:13:45,840
And it's very hard to protect against these people.

179
00:13:45,840 --> 00:13:47,880
You also don't focus them very much.

180
00:13:47,880 --> 00:13:53,200
You trust that your boss did a very good job and eliminated them.

181
00:13:54,640 --> 00:13:58,880
Then we start talking about more interesting personas when it comes to the Death Star.

182
00:13:59,080 --> 00:14:02,260
And here we talk about insider threats.

183
00:14:02,360 --> 00:14:07,020
But honestly, insider threats should be many different personas.

184
00:14:07,020 --> 00:14:11,520
Because the Empire has many different levels, ranking levels, right?

185
00:14:11,920 --> 00:14:15,780
A Stormtrooper that's an insider threat is not as dangerous.

186
00:14:15,780 --> 00:14:20,140
Whereas a Sea Lab executive like yourself is becoming an insider threat.

187
00:14:21,200 --> 00:14:27,060
Regardless of their position though, they have been trained by the Galactic Empire, right?

188
00:14:27,400 --> 00:14:32,220
So they have a strong training and they know what they need to do.

189
00:14:32,220 --> 00:14:34,320
They are very good at what they do.

190
00:14:35,220 --> 00:14:37,280
They might have, again, resources.

191
00:14:37,280 --> 00:14:39,400
It's a bit of an interesting thing.

192
00:14:39,400 --> 00:14:41,940
If you're a Stormtrooper, you don't have much money.

193
00:14:41,940 --> 00:14:47,360
Whereas a Sea Lab executive like yourself has lots of money, lots of resources.

194
00:14:47,540 --> 00:14:51,780
But regardless, again, of their position, they organize themselves pretty well.

195
00:14:52,640 --> 00:14:55,980
The Galactic Empire is a military organization.

196
00:14:56,140 --> 00:14:58,620
So they organize all the insider threats.

197
00:14:58,880 --> 00:15:00,860
They can join terrorist groups.

198
00:15:00,860 --> 00:15:02,880
They can form their own terrorist groups.

199
00:15:03,120 --> 00:15:06,520
So they can't become a problem because they organize themselves very well.

200
00:15:06,520 --> 00:15:09,520
Even if you're at a low level Stormtrooper.

201
00:15:10,350 --> 00:15:18,780
But the most important persona for the Death Star is Princess Leia, right?

202
00:15:18,780 --> 00:15:23,320
Princess Leia represents the Rebellion.

203
00:15:23,660 --> 00:15:31,960
The Rebellion, as you all well know, is a terrorist organization trying to bring trouble to the Galactic Empire.

204
00:15:31,960 --> 00:15:35,200
Whereas the Empire is just trying to make the galaxy stable, you know?

205
00:15:35,200 --> 00:15:37,360
A bit of order here and there.

206
00:15:39,060 --> 00:15:43,220
But although they are a terrorist organization, they have lots of expertise.

207
00:15:43,220 --> 00:15:46,520
They have pilots, they have diplomats, they have spies.

208
00:15:46,540 --> 00:15:47,840
And they are very good.

209
00:15:47,840 --> 00:15:50,980
They can sometimes go toe-to-toe with the Galactic Empire.

210
00:15:50,980 --> 00:15:53,360
So they do have a lot of expertise.

211
00:15:54,140 --> 00:15:59,140
Even for a terrorist organization, they have lots of resources.

212
00:15:59,780 --> 00:16:02,540
You're not quite sure where they get the money from.

213
00:16:02,540 --> 00:16:05,080
But they have lots of money.

214
00:16:05,080 --> 00:16:06,660
They have a small army.

215
00:16:06,660 --> 00:16:08,120
They have ships.

216
00:16:08,560 --> 00:16:10,760
They have bases across the galaxy.

217
00:16:10,760 --> 00:16:13,400
So they have lots of resources.

218
00:16:13,940 --> 00:16:18,400
And for a terrorist organization, they organize themselves pretty well.

219
00:16:18,700 --> 00:16:24,060
They have become a major pain for the Galactic Empire in the last few years.

220
00:16:24,100 --> 00:16:30,380
Sometimes shut down Empire operations or shut down entire armies.

221
00:16:30,380 --> 00:16:35,240
So definitely Princess Leia is your most important persona.

222
00:16:35,500 --> 00:16:37,220
And the one you need to look after.

223
00:16:38,140 --> 00:16:39,020
Cool.

224
00:16:39,020 --> 00:16:41,240
So that's the summary of your personas, right?

225
00:16:41,240 --> 00:16:50,120
From Skipped Kitty, going through Bounty Hunter, Inside the Threat, Jedis, and even Princess Leia, the Rebellion.

226
00:16:51,400 --> 00:16:54,340
Now going back a little bit to the real world.

227
00:16:54,820 --> 00:17:05,840
Personas, if you want to do that in your own organization, for a large organization, it shouldn't be very hard for you because your organization probably has been attacked before.

228
00:17:05,940 --> 00:17:12,960
So you just talk to the security team in your company, the ones who look more incident response.

229
00:17:12,960 --> 00:17:16,440
They might have an idea of the kind of attackers you have.

230
00:17:16,580 --> 00:17:27,980
If you, on the other hand, are working for a smaller company, you might try to look at other websites and find places where they define generic attackers.

231
00:17:27,980 --> 00:17:35,560
You start with them, and then as you grow, as you scale, and then have real attacks, you can tweak your personas as you go.

232
00:17:35,560 --> 00:17:45,360
But it's important to have a kind of understanding of what the attackers are and not keep only on the abstract level of an imaginable attacker.

233
00:17:46,920 --> 00:17:47,780
Cool.

234
00:17:47,780 --> 00:17:50,420
So now you have the asset that's a Death Star.

235
00:17:50,420 --> 00:17:52,060
You have the personas.

236
00:17:52,100 --> 00:17:55,380
So now it's time to build the attack tree.

237
00:17:55,920 --> 00:18:00,380
And the first thing you need to do is get the right people in the room.

238
00:18:00,380 --> 00:18:08,880
I remember when my first slide was talking about how TreadMoney should be a collaborative exercise and everybody should participate together.

239
00:18:09,320 --> 00:18:11,420
So that's what you try to do.

240
00:18:11,420 --> 00:18:16,560
You try to get everybody in the room so you could run the exercise.

241
00:18:16,640 --> 00:18:20,480
You got the Death Star designers and architects.

242
00:18:20,480 --> 00:18:22,080
You got your own team.

243
00:18:22,080 --> 00:18:25,220
You took so much trouble to go through that.

244
00:18:25,220 --> 00:18:35,740
Because imagine, it's really hard already to go into the time zones and book everybody at the same time when you're across the galaxy where time zones are not even a thing.

245
00:18:36,020 --> 00:18:39,140
But somehow you managed to put everyone in the room.

246
00:18:39,140 --> 00:18:52,340
You even got Darth Vader to do an introduction for the meeting, to give some motivation for people, you know, like the kind of C-level introduction.

247
00:18:53,480 --> 00:18:57,020
And then you start to run the attack tree session.

248
00:18:57,840 --> 00:19:01,540
And the attack tree session starts with the root node.

249
00:19:01,900 --> 00:19:04,600
It's kind of the attacker role, right?

250
00:19:04,600 --> 00:19:07,400
What the attacker wants to do against your asset.

251
00:19:07,660 --> 00:19:10,780
And you could look at very different kind of attacks.

252
00:19:10,780 --> 00:19:16,980
For example, if you look at Han Solo, a bounty hunter.

253
00:19:17,240 --> 00:19:21,060
When he looks at the Death Star, he's probably trying to make some money out of it.

254
00:19:21,080 --> 00:19:23,940
He might steal some weapons, he might steal food, I don't know.

255
00:19:23,940 --> 00:19:26,340
He might steal a lot of stuff.

256
00:19:26,740 --> 00:19:31,600
But then you need to look and focus on what's most damaging for the Galactic Empire.

257
00:19:31,740 --> 00:19:39,100
Even if Han Solo manages to steal a bunch of weapons or a bunch of food, that really doesn't impact very much the Galactic Empire.

258
00:19:39,100 --> 00:19:43,400
It's annoying for sure, but it's not much of a big problem.

259
00:19:43,500 --> 00:19:47,340
So you come up with two different attacker roles.

260
00:19:48,440 --> 00:19:55,100
If the attacker manages to accomplish this, it can be really damaging for the Galactic Empire.

261
00:19:55,100 --> 00:19:57,520
So you're going to focus on that one.

262
00:19:58,160 --> 00:20:01,660
And there are two kinds of goals that you need to look at.

263
00:20:01,680 --> 00:20:06,580
Take control of the Death Star or take the Death Star out of action.

264
00:20:06,580 --> 00:20:11,240
And taking control of the Death Star would be really, really bad.

265
00:20:11,240 --> 00:20:21,160
Imagine going to 20 years of project, release that to production, just for some kind of attacker to get that weapon from you and use against the Empire.

266
00:20:21,160 --> 00:20:22,700
That would be terrible.

267
00:20:23,040 --> 00:20:35,880
But as well, it would be very unlikely for the kind of attackers you have, because none of them have the resources to actually manage a ship like the Death Star.

268
00:20:35,880 --> 00:20:42,040
You need to have like one million crew inside the Death Star to manage the whole thing.

269
00:20:42,040 --> 00:20:47,800
You need to have a very specific expertise and there's lots of proprietary technology.

270
00:20:47,900 --> 00:20:54,620
So even Princess Leia wouldn't be able to take the Death Star out of the Galactic Empire and use it against the Empire.

271
00:20:54,980 --> 00:21:00,560
But they definitely, definitely can take the Death Star out of action.

272
00:21:00,560 --> 00:21:03,120
That's probably what would be the first goal.

273
00:21:03,120 --> 00:21:12,960
As soon as they know about the Death Star, they try to take it out of action and take this advantage, the Galactic Empire's beauty, out of the game.

274
00:21:12,960 --> 00:21:15,000
So we're going to focus on that.

275
00:21:15,000 --> 00:21:23,260
And we're also going to focus on Princess Leia as a persona, because she's probably the one who can actually accomplish this.

276
00:21:24,820 --> 00:21:28,340
So we chose to take the Death Star out of action.

277
00:21:28,340 --> 00:21:33,720
Now we need to think about how would you try to do this, right?

278
00:21:34,260 --> 00:21:37,760
How would you accomplish taking the Death Star out of action?

279
00:21:37,760 --> 00:21:41,440
So that's where the collaboration and the magic happens.

280
00:21:41,440 --> 00:21:50,620
The security team throws some ideas, the developers throw other ideas, and then you try to figure out which one of these nodes are more likely to happen.

281
00:21:50,620 --> 00:21:57,220
And when you've got everybody in the room, there are two kinds of nodes that show up.

282
00:21:57,220 --> 00:22:01,340
They're really important, and then they're more likely to happen.

283
00:22:01,600 --> 00:22:04,420
One is disable the Death Star.

284
00:22:04,600 --> 00:22:10,760
I'm not talking about a 15-minute disablement or maybe turn off the power for 15 minutes or something like that.

285
00:22:10,760 --> 00:22:20,100
I'm talking about some sort of disablement that is so dangerous, it's so problematic, that probably the Death Star is not usable anymore.

286
00:22:20,100 --> 00:22:25,540
You need to rebuild the Death Star from scratch so you can re-enable again.

287
00:22:25,600 --> 00:22:30,620
So it's kind of a disablement, where it's probably better to just create another one rather than fix it.

288
00:22:30,900 --> 00:22:33,860
Same like you break your iPhone screen, for example.

289
00:22:33,860 --> 00:22:36,900
It's so expensive, they're most likely to just buy a new one.

290
00:22:37,800 --> 00:22:39,860
And the other one is destroy the Death Star.

291
00:22:39,860 --> 00:22:44,420
Literally destroy the whole thing, exploding PCs or whatever.

292
00:22:44,720 --> 00:22:48,540
So that's the two main ways you can take the Death Star out of action.

293
00:22:49,900 --> 00:22:53,360
So let's focus a little bit on disable the Death Star.

294
00:22:53,680 --> 00:22:58,060
To disable the Death Star, you'd have two kinds of nodes as well.

295
00:22:58,060 --> 00:23:00,300
Two different ways to do this.

296
00:23:00,300 --> 00:23:05,820
One is what we call a system failure and the other one is a mechanical failure.

297
00:23:05,820 --> 00:23:15,920
And a system failure is mostly like, for example, you disable the navigation system, you disable the heating system, you disable the engine system.

298
00:23:15,920 --> 00:23:25,040
You disable in such a way these core critical systems that they might cause a chain reaction in the other systems and shut down the Death Star.

299
00:23:25,080 --> 00:23:28,220
Or it can cause some sort of mechanical failure.

300
00:23:28,220 --> 00:23:31,220
And then it can cause some problem on the hardware itself.

301
00:23:31,480 --> 00:23:39,440
And the hardware can cause, again, another kind of chain reaction that's going to cause the whole Death Star to shut down.

302
00:23:40,660 --> 00:23:43,800
So how would you accomplish these things?

303
00:23:44,400 --> 00:23:49,480
And then for system failure, you need to compromise a critical IT system.

304
00:23:49,700 --> 00:23:54,280
And for the mechanical failure, you need to overload the critical infrastructure.

305
00:23:54,480 --> 00:23:56,540
So let's elaborate that a little bit.

306
00:23:56,800 --> 00:24:01,460
So there are many systems running inside the Death Star, right?

307
00:24:01,520 --> 00:24:05,030
And they manage some sort of critical infrastructure.

308
00:24:05,360 --> 00:24:10,820
So if you have access, if an attacker has access to this kind of systems, they can do some damage.

309
00:24:10,820 --> 00:24:19,440
But usually the system protects against problematic parameters, problematic variables, or any dangerous kind of action.

310
00:24:19,820 --> 00:24:31,220
So what you want to do is, what an attacker needs to do, is not only have access to these systems, they need to compromise so they can bypass these kind of protections to cause a system failure.

311
00:24:31,900 --> 00:24:36,400
When it comes to mechanical failure, you might overload some critical infrastructure.

312
00:24:36,400 --> 00:24:39,100
So you might overload the heating system somehow.

313
00:24:39,100 --> 00:24:45,600
And to overload the heating system, you might cause all the hardware to have problems, right?

314
00:24:45,600 --> 00:24:52,280
Or you can cause the Death Star to be very uncomfortable to stay with, and people need to leave the ship.

315
00:24:52,440 --> 00:24:54,580
So there are different ways you can do that.

316
00:24:56,540 --> 00:25:08,220
But the interesting thing is, regardless if you're trying to compromise the critical IT system or overload the critical infrastructure, you need to have access to the internal network.

317
00:25:08,220 --> 00:25:09,640
That's no other way.

318
00:25:09,720 --> 00:25:23,380
So either to have access to sensitive areas of the Death Star, you need to have this kind of action, you need to have this kind of privilege, or to compromise the critical IT system, you need to be inside the network so you can interact with the system.

319
00:25:24,680 --> 00:25:31,080
And it's internal network, because if you think about it, Death Star is just a weapon, right?

320
00:25:31,080 --> 00:25:34,720
It's not like they make their system public so people can access it.

321
00:25:34,720 --> 00:25:36,320
They are not a service, right?

322
00:25:36,320 --> 00:25:37,440
They are a weapon.

323
00:25:37,440 --> 00:25:41,780
And as a weapon, they hide everything as much as they can.

324
00:25:42,340 --> 00:25:46,920
So in order to get privilege access, you need to be inside the internal network.

325
00:25:47,040 --> 00:25:55,060
Anything that's public is probably not very important and segregated from the other internal network.

326
00:25:55,920 --> 00:26:00,300
And in order to get access to the internal network, you need to be inside the Death Star.

327
00:26:00,300 --> 00:26:01,500
There is no other way.

328
00:26:02,020 --> 00:26:08,820
And then again, Death Star is a weapon, and they don't expose systems to the outside world.

329
00:26:08,840 --> 00:26:11,560
And they segregated that stuff very well.

330
00:26:11,560 --> 00:26:14,100
So you need to be inside the Death Star.

331
00:26:14,100 --> 00:26:21,340
So maybe you can go to a server room or steal some kind of employee badge or biometrics or whatever.

332
00:26:21,340 --> 00:26:24,320
So in order to get your privilege access.

333
00:26:25,340 --> 00:26:32,940
The interesting thing is, we could go in more detail and like, how would you get physical access to the Death Star?

334
00:26:32,940 --> 00:26:37,540
But as I said before, the Death Star has one million crew, right?

335
00:26:37,540 --> 00:26:43,300
Like, it's very likely that an attacker like Princess Leia is going to be able to do that.

336
00:26:43,520 --> 00:26:48,980
Even if that's not true, another attacker that we have is an internal attacker.

337
00:26:49,000 --> 00:26:56,740
So it might be a person who actually has rights to be inside the Death Star and inside the Death Star to try to do some malicious.

338
00:26:57,020 --> 00:27:03,580
So we're going to stop this part of the attack tree here and go to the next step.

339
00:27:04,140 --> 00:27:06,180
So that's all we have so far.

340
00:27:06,180 --> 00:27:09,680
So we have like, take the Death Star out of action.

341
00:27:09,740 --> 00:27:17,240
You have disabled the Death Star and then you have system failure and mechanical failure and so on and so forth.

342
00:27:17,620 --> 00:27:21,400
But this is only one part of the attack trees, right?

343
00:27:21,400 --> 00:27:26,020
We have the other one where you want to destroy the Death Star.

344
00:27:26,300 --> 00:27:27,580
So how would you do that?

345
00:27:27,580 --> 00:27:29,460
How would you destroy the Death Star?

346
00:27:29,760 --> 00:27:32,160
And there are basically two ways to do this.

347
00:27:32,200 --> 00:27:35,520
One is a big military attack.

348
00:27:35,580 --> 00:27:37,360
The Death Star is a big weapon.

349
00:27:37,360 --> 00:27:38,780
It's a huge weapon.

350
00:27:39,180 --> 00:27:41,240
It can cause a lot of damage.

351
00:27:41,440 --> 00:27:46,980
But also, it's still vulnerable to kind of military attacks.

352
00:27:47,340 --> 00:27:49,480
So yeah, that's a way to do it.

353
00:27:50,180 --> 00:27:54,520
And there is another way that you figure out on the training modeling.

354
00:27:54,520 --> 00:27:58,060
And you are so proud that you actually got that.

355
00:27:58,520 --> 00:28:01,880
There is a reactor inside the Death Star.

356
00:28:02,120 --> 00:28:09,760
In the very core of the Death Star, there is a reactor which controls everything and provides energy for the whole ship.

357
00:28:10,120 --> 00:28:13,260
But the reactor is very, very hot.

358
00:28:13,440 --> 00:28:18,740
So it needs to send this heat to the space.

359
00:28:18,820 --> 00:28:27,040
And the way to do that, they build ventilation tunnels that go from the core straight to the top of the ship.

360
00:28:27,060 --> 00:28:29,580
So then the heat can dissipate.

361
00:28:29,880 --> 00:28:32,040
But this is also a vulnerability.

362
00:28:32,080 --> 00:28:36,600
Because now we have a straight path to the core.

363
00:28:36,600 --> 00:28:38,700
And the core is very unstable.

364
00:28:38,700 --> 00:28:45,360
So anything that goes there, any kind of explosion, can cause a chain reaction that can explode the whole Death Star.

365
00:28:45,500 --> 00:28:50,160
It's a really big problem in case an attacker can exploit this.

366
00:28:50,980 --> 00:28:54,580
But there are some sort of protections, let's say.

367
00:28:54,940 --> 00:28:58,120
The first one is obscurity.

368
00:28:58,820 --> 00:29:00,840
This kind of port is not very...

369
00:29:00,840 --> 00:29:03,900
You need to know where the port is, for one.

370
00:29:04,000 --> 00:29:05,100
The Death Star is huge.

371
00:29:05,100 --> 00:29:09,600
There is no easy way for an attacker from outside to know where they should hit.

372
00:29:09,900 --> 00:29:12,680
And second, the port is very small.

373
00:29:12,680 --> 00:29:14,140
It's only two meters wide.

374
00:29:14,140 --> 00:29:20,860
So it's really hard for any kind of pilot to send a bomb over there.

375
00:29:21,340 --> 00:29:25,120
So it's not like it's very likely that to happen.

376
00:29:25,120 --> 00:29:27,300
But still, not really great.

377
00:29:28,400 --> 00:29:33,000
So in order to destroy the reactor, you need to shoot the thermal port.

378
00:29:33,500 --> 00:29:38,300
And to shoot the thermal port, you need to know where the port is, right?

379
00:29:38,580 --> 00:29:41,160
So you need to obtain the Death Star plans.

380
00:29:41,160 --> 00:29:47,500
You need to somehow know what the port is so you can go there and shoot it.

381
00:29:49,080 --> 00:29:52,840
And that's the second piece of the attack tree.

382
00:29:53,180 --> 00:30:06,400
So together with the first part of the attack tree and the second part of the attack tree, that's what we found out about the main problems with the Death Star design or the procedures we have at the moment.

383
00:30:07,620 --> 00:30:12,380
And these are the main goals the attacker can try to accomplish.

384
00:30:12,380 --> 00:30:18,080
So if you get access to privilege, privilege access to network, that's going to be a problem.

385
00:30:18,080 --> 00:30:24,100
They have different ways where they can accomplish the disabling of the Death Star.

386
00:30:24,420 --> 00:30:30,020
A military attack, really huge, but something that a rebellion can pull out.

387
00:30:30,020 --> 00:30:35,900
So if you're not prepared, the rebellion can try to destroy the Death Star by a huge military attack.

388
00:30:36,120 --> 00:30:38,380
And finally, the thermal port.

389
00:30:38,380 --> 00:30:48,120
If somehow an attacker can shoot the thermal port, they cause a chain reaction and it can destroy the reactor and the Death Star altogether.

390
00:30:48,640 --> 00:30:49,400
That's good.

391
00:30:49,400 --> 00:30:51,940
So that was part of the threat modeling.

392
00:30:51,940 --> 00:30:53,580
And then you figure out some threats.

393
00:30:55,580 --> 00:31:01,500
And the way I like it, why I like the attack trees is because it's a problem solving exercise.

394
00:31:01,760 --> 00:31:05,600
And everyone in 90 has this kind of mindset of problem solving.

395
00:31:05,600 --> 00:31:07,160
We have a problem and try to solve it.

396
00:31:07,160 --> 00:31:08,240
That's how we do, right?

397
00:31:08,240 --> 00:31:09,540
That's how we operate.

398
00:31:09,820 --> 00:31:22,340
But rather than like use this to build stuff, now we have to change the mindset and say like, now rather than use your problem solve to build, you're going to use your problem solving skills to attack.

399
00:31:22,380 --> 00:31:30,680
That's really, really powerful to get this kind of people, who usually don't think about attackers or attacks at all, thinking about these things.

400
00:31:30,680 --> 00:31:35,020
And it's interesting to see how they can find vulnerabilities on their own design.

401
00:31:36,020 --> 00:31:39,960
And it's very interesting as well, because they are collaborating on the session.

402
00:31:39,960 --> 00:31:45,240
When you need to go back to them and say, hey, remember the vulnerability we found, we need to fix it.

403
00:31:45,620 --> 00:31:47,000
They already know the context.

404
00:31:47,000 --> 00:31:47,940
They were there.

405
00:31:48,020 --> 00:31:51,420
Maybe they were the ones who found out anyway.

406
00:31:51,740 --> 00:31:55,100
And they are the ones who know how to fix it easily as well.

407
00:31:55,760 --> 00:31:58,000
So it's a really interesting exercise.

408
00:31:58,000 --> 00:32:04,920
And it's really, really powerful the way we can get people who never think about attackers, try to think like this.

409
00:32:04,920 --> 00:32:09,160
It makes them look at their system in a very different way.

410
00:32:09,180 --> 00:32:14,920
And they only can cause good things, because they know how to fix the problems and make the system more secure.

411
00:32:16,560 --> 00:32:17,600
Cool.

412
00:32:17,680 --> 00:32:20,680
Now you have identified the risks and the threats.

413
00:32:20,680 --> 00:32:22,900
So now we need to mitigate those.

414
00:32:23,800 --> 00:32:28,280
And the first risk we need to mitigate is privileged access to the internal network.

415
00:32:28,360 --> 00:32:30,960
And the impact for that is high.

416
00:32:30,960 --> 00:32:36,280
If an attacker actually manages to do this, it can be really problematic for the Empire.

417
00:32:36,620 --> 00:32:42,320
The likelihood we put as a medium, because it's not very easy, you need to be inside the Death Star.

418
00:32:42,360 --> 00:32:47,380
But the Death Star and the network of the Death Star is not very secure.

419
00:32:47,600 --> 00:32:53,500
The Rebellion has been hacking the Galactic Empire for many years.

420
00:32:53,540 --> 00:32:56,360
But you are a good security professional, aren't you?

421
00:32:56,620 --> 00:33:03,200
So you come up with some measures that you can implement in the network, some quick wins, some testing.

422
00:33:03,340 --> 00:33:11,520
And then you harden the network and make it a lot harder for the attacker to get privileged access to this.

423
00:33:11,640 --> 00:33:18,580
So after this work has been done, you actually managed to improve the likelihood from medium to low.

424
00:33:18,600 --> 00:33:20,340
The impact is too high, though.

425
00:33:20,340 --> 00:33:23,820
It's really hard to make sure the impact is going to go down.

426
00:33:23,820 --> 00:33:27,820
But at least it's unlikely that it's going to happen.

427
00:33:29,580 --> 00:33:30,980
Next one.

428
00:33:31,360 --> 00:33:33,540
The next one is a military attack.

429
00:33:33,980 --> 00:33:37,000
And then again, the impact is really high.

430
00:33:37,240 --> 00:33:42,840
If Rebellion can pull out an attack, then it can destroy the Death Star.

431
00:33:42,840 --> 00:33:44,960
That's a really, really high impact.

432
00:33:44,960 --> 00:33:47,280
But the likelihood is also high.

433
00:33:47,520 --> 00:33:48,380
Why is that?

434
00:33:48,420 --> 00:33:59,620
Because if you are Princess Leia, and you get to know that your biggest adversary has such a big weapon, you probably want to go and try to attack them first.

435
00:34:00,160 --> 00:34:03,460
But there are a few things you can do to mitigate that risk.

436
00:34:04,100 --> 00:34:11,540
The first thing is you need to come up with ways for the crew to respond to attacks very easily and very efficiently.

437
00:34:11,620 --> 00:34:23,060
So you define the runbooks, you make sure people keep on the call, and keep on training, and make sure this exercise has been running.

438
00:34:23,060 --> 00:34:27,880
So when the actual real thing comes, the response works very well.

439
00:34:28,260 --> 00:34:31,720
But not only that, the Death Star is going to need some support, right?

440
00:34:31,880 --> 00:34:34,640
So that's why you get Star Destroyers.

441
00:34:34,640 --> 00:34:38,980
Star Destroyers are very big, other big ships of the Galactic Empire.

442
00:34:39,080 --> 00:34:46,620
And if they are close by when the Death Star is being attacked, they can provide really helpful and strong support.

443
00:34:46,620 --> 00:34:55,680
And probably less likely for Rebellion to attack the Death Star when they have strong support as the Star Destroyers.

444
00:34:56,320 --> 00:35:00,700
And finally, try to monitor the Rebellion activities, right?

445
00:35:00,700 --> 00:35:09,080
If they try to pull out that kind of attack, it's a huge movementation, and they need to talk to so many different people, and a lot of coordination.

446
00:35:09,200 --> 00:35:17,160
So if you get some sort of signal out of them, and then you interpret that, you can prepare before they actually pull out the attack.

447
00:35:17,160 --> 00:35:19,840
So you'll be a lot more prepared when they come.

448
00:35:20,500 --> 00:35:25,360
So for this, you manage to get impact from high to medium.

449
00:35:25,360 --> 00:35:39,080
Because even if the Rebellion tries to attack with a strong military attack, you'll be a lot more prepared, and maybe you can either defeat them, or at least buy enough time to get the Death Star out of them.

450
00:35:39,700 --> 00:35:41,880
So that's a good outcome.

451
00:35:41,880 --> 00:35:43,820
And the likelihood is also medium.

452
00:35:43,820 --> 00:35:50,320
Because if the Rebellion cannot actually destroy the Death Star, they'll most likely not try to attack.

453
00:35:50,320 --> 00:35:52,280
They'll only go for the victory, right?

454
00:35:52,600 --> 00:35:56,700
So if the victory is not certain, they'll probably not be able to do it.

455
00:35:56,700 --> 00:36:00,660
But regardless, you need to be prepared, and then that's what you did.

456
00:36:00,720 --> 00:36:01,720
Very well done.

457
00:36:03,120 --> 00:36:07,020
And finally, shoot at the thermal port.

458
00:36:07,680 --> 00:36:10,440
And the impact, again, is as high as the other risks.

459
00:36:10,440 --> 00:36:16,020
If somebody manages to shoot at the thermal port, you destroy the reactor, you destroy the Death Star.

460
00:36:16,020 --> 00:36:19,340
And the likelihood was low.

461
00:36:19,960 --> 00:36:24,460
And you didn't like how this outcome was low.

462
00:36:24,460 --> 00:36:25,080
And why is that?

463
00:36:25,080 --> 00:36:31,240
People were saying the likelihood is low because you need to know where the port is.

464
00:36:31,240 --> 00:36:35,420
And even if you do, it's a really difficult and hard shot, right?

465
00:36:35,560 --> 00:36:37,740
So you wanted to do a little bit more.

466
00:36:37,740 --> 00:36:47,420
You wanted to do some sort of protections, and maybe cause, like, if an attacker is coming, just close down the door, or open different ones, or have different levels of protection.

467
00:36:47,460 --> 00:36:49,460
You try to argue for that.

468
00:36:49,460 --> 00:36:52,380
But remember, I was talking in the beginning.

469
00:36:52,740 --> 00:36:55,620
The project was being delayed for so many years already.

470
00:36:55,620 --> 00:37:01,000
The budget has been, like, over for many years as well.

471
00:37:01,120 --> 00:37:10,200
So the business didn't want to, like, go back to the design, redesign the kind of ports to make sure it's more secure, and then implement it.

472
00:37:10,200 --> 00:37:13,060
That delayed the project for a few more years.

473
00:37:13,060 --> 00:37:17,760
And so the business decided to accept the risk.

474
00:37:19,520 --> 00:37:25,180
So, but yet, you're going to try to do something, right?

475
00:37:25,180 --> 00:37:28,960
So at least you're going to try to hide the DevStar plans.

476
00:37:29,280 --> 00:37:34,700
So if one of the things they need to do in order to shoot the terminal port, they need to know where the port is.

477
00:37:34,700 --> 00:37:47,280
So if at least you try to hide it and make it harder for an attacker to find out about the DevStar plan, sorry, about the DevStar port, then it wouldn't be a problem anymore, right?

478
00:37:47,280 --> 00:37:49,960
At least you would mitigate to a certain level.

479
00:37:49,960 --> 00:37:52,940
That's the only thing you could have done, so you did.

480
00:37:53,580 --> 00:37:56,640
And then you went on with your life, right?

481
00:37:56,640 --> 00:38:04,860
You did the best you could, then you look at different other areas of the security of the Galactic Empire, and you hope for the best.

482
00:38:05,760 --> 00:38:14,040
And then eventually, the DevStar has been released, and the DevStar has been like a cause of joy for the Empire.

483
00:38:14,040 --> 00:38:20,120
They caused lots of trouble for the Galactic Empire, and that happened.

484
00:38:22,160 --> 00:38:29,940
The DevStar was destroyed, which is not a good outcome for anyone in the Galactic Empire.

485
00:38:30,160 --> 00:38:32,720
But you're a professional, right?

486
00:38:32,720 --> 00:38:34,900
So what do you do in that situation?

487
00:38:35,470 --> 00:38:36,800
Forensic analysis.

488
00:38:37,220 --> 00:38:44,160
So you try to figure out what went wrong, how the Rebellion managed to destroy such an important weapon.

489
00:38:44,660 --> 00:38:48,420
And the answer is this guy, Luke Skywalker.

490
00:38:48,780 --> 00:38:52,020
He was the one who managed to shoot the Determinant port.

491
00:38:52,240 --> 00:38:55,380
But there are some interesting things about Luke Skywalker.

492
00:38:55,720 --> 00:39:05,580
The first thing is, he's a Jedi, which is interesting, because they were supposed to be hiding, not actually attacking the Empire.

493
00:39:08,960 --> 00:39:20,600
And before he actually managed to shoot the Terminal port, he was about to be shot down, but the person who actually helped Luke Skywalker was a bounty hunter.

494
00:39:20,600 --> 00:39:27,360
He came up at the last minute and saved Luke from being destroyed, and then Luke managed to shoot the Terminal port.

495
00:39:27,360 --> 00:39:31,320
Which is interesting, because bounty hunters only help...

496
00:39:31,320 --> 00:39:33,640
they only work for money, right?

497
00:39:33,840 --> 00:39:38,520
They don't organize themselves very well, so why a bounty hunter is helping a Jedi?

498
00:39:40,840 --> 00:39:43,620
There's another thing that's quite interesting.

499
00:39:43,620 --> 00:39:52,940
Luke Skywalker is actually Princess Leia's brother, which makes him a high-level ranking Rebellion official, too.

500
00:39:52,940 --> 00:39:59,980
So he's not only a Jedi, he's a Rebellion official.

501
00:40:00,120 --> 00:40:02,860
So, yes, interesting.

502
00:40:02,960 --> 00:40:05,900
And the worst part of it all, the worst part...

503
00:40:07,180 --> 00:40:11,940
Luke Skywalker is the son of your boss, right?

504
00:40:11,940 --> 00:40:18,580
Which makes this whole lot more complicated, because Luke Skywalker is considered an internal attacker now?

505
00:40:18,580 --> 00:40:20,120
You don't know.

506
00:40:20,340 --> 00:40:26,000
But definitely, like, not a problem, and you don't have a good feeling about it, right?

507
00:40:26,000 --> 00:40:31,320
That's a problem for your boss, to take care of his family and his own boss.

508
00:40:31,780 --> 00:40:38,860
But yeah, Luke Skywalker is definitely a problem, and he was the one who managed to pull the shot.

509
00:40:39,080 --> 00:40:45,580
But how did Luke Skywalker actually manage to find out about the port, right?

510
00:40:46,480 --> 00:40:49,300
And the answer is these two people here.

511
00:40:49,300 --> 00:40:55,800
They managed to hack the Galactic Empire and get the plans.

512
00:40:55,900 --> 00:40:57,340
And you did a good job.

513
00:40:57,340 --> 00:41:05,580
You put the Death Star plans in a very secure location, at least the most secure you had in the Galactic Empire.

514
00:41:06,060 --> 00:41:17,600
So these two people managed to go to this location, hack into the data centers, install the hard drive, and then send the copy of it to the Rebellion.

515
00:41:18,040 --> 00:41:19,760
You know what's worse?

516
00:41:20,600 --> 00:41:24,640
The worst thing about that is there was no encryption arrest!

517
00:41:24,740 --> 00:41:28,420
So they only got a copy of the hard drive and sent it to the Rebellion.

518
00:41:28,860 --> 00:41:30,160
That's not really good.

519
00:41:31,160 --> 00:41:32,820
But that's how they did it.

520
00:41:32,820 --> 00:41:44,420
So they stole the plans, they sent the plans to the Rebellion, the Rebellion quickly attacked the Death Star, and for a miracle they managed to shoot to the Terminal port, and everything was destroyed, right?

521
00:41:45,700 --> 00:41:52,360
Well, I wish good luck for you, because now you need to deliver your report for the forensic analysis to your boss.

522
00:41:52,920 --> 00:41:54,120
Good luck!

523
00:41:55,880 --> 00:41:58,500
Now let's talk a little bit about lessons learned, right?

524
00:41:58,500 --> 00:42:00,100
Lessons learned of this story.

525
00:42:01,140 --> 00:42:14,200
And the interesting thing is, I used this analogy where you found out about the problem of the Terminal port at the very end of the design, at the very end of the building of the software, at the very end, before going to production.

526
00:42:15,080 --> 00:42:18,360
And then there's a problem that happens in all companies.

527
00:42:18,360 --> 00:42:25,700
You find a security problem at the very end, and then you need to fix it, but nobody wants to fix it before release to production.

528
00:42:26,680 --> 00:42:31,280
So thread modeling is something that you should do early and often.

529
00:42:31,420 --> 00:42:47,240
So in the case of the Death Star, if you have done the thread modeling at the design level, and people are like, design this Death Star and come up with this design of the Terminal port, you could have seen it, or someone from your team, seen the problem,

530
00:42:47,240 --> 00:42:48,740
and then you fix the design.

531
00:42:48,900 --> 00:42:49,800
Right there.

532
00:42:49,800 --> 00:42:59,580
It's a lot cheaper to fix at the design level, or the beginning of the construction, or in the case of software, the beginning of the coding, than actually at the very end, right?

533
00:42:59,660 --> 00:43:01,560
And that's a problem that happens all the time.

534
00:43:01,560 --> 00:43:05,280
So if you want to do thread modeling, do it early and do it often.

535
00:43:05,680 --> 00:43:07,180
Because things change, right?

536
00:43:07,180 --> 00:43:10,060
Especially for software, things change all the time.

537
00:43:10,060 --> 00:43:14,440
We pivot, we implement new features, we scope certain features.

538
00:43:14,440 --> 00:43:18,860
So we need to look at that a certain amount of time.

539
00:43:19,760 --> 00:43:22,660
There are always unknowns, right?

540
00:43:22,680 --> 00:43:26,080
In this case, Luke Skywalker was a very unknown.

541
00:43:26,080 --> 00:43:28,860
He was at least three different personas, right?

542
00:43:29,140 --> 00:43:37,160
So even though you have thread modeling, and you have covered some of the risks, you always need to think about that you might have not seen something.

543
00:43:37,160 --> 00:43:40,160
Or there's some sort of information that you don't have it.

544
00:43:40,340 --> 00:43:43,760
Or the attacker can act in a very different way.

545
00:43:44,000 --> 00:43:47,420
So it's not because you haven't done thread modeling, it means you're secure.

546
00:43:47,420 --> 00:43:52,860
It means you covered some of the worst threats, but that doesn't mean you are very secure.

547
00:43:52,900 --> 00:43:54,960
So you still need to do some work on top of it.

548
00:43:54,960 --> 00:43:56,380
Thread modeling is just the beginning.

549
00:43:57,720 --> 00:44:00,840
And finally, thread modeling must be engaging.

550
00:44:00,840 --> 00:44:11,220
And then again, if people go to a meeting that's very boring, and they don't like it, and it's complicated, or it's on a checkbox, they don't engage.

551
00:44:11,220 --> 00:44:13,040
If they don't engage, they don't collaborate.

552
00:44:13,040 --> 00:44:16,920
If they don't collaborate, you don't have the magic of the thread modeling.

553
00:44:16,940 --> 00:44:21,060
The modeling doesn't work as well, as good as they would if people are engaging.

554
00:44:21,060 --> 00:44:23,380
So in this case, I have been using attack trees.

555
00:44:23,380 --> 00:44:28,020
I think it's been very successful where I have been done it.

556
00:44:28,020 --> 00:44:30,900
But it doesn't need to be attack trees.

557
00:44:30,900 --> 00:44:45,820
Regardless of what you do for thread modeling, you need to make sure the people involved are engaging, they are engaged, they have a good time, and they see value in it, so they can keep coming back and keep doing this exercise over and over again.

558
00:44:47,500 --> 00:44:48,060
Cool.

559
00:44:48,060 --> 00:44:50,120
That's all I have to talk about today.

560
00:44:50,120 --> 00:44:51,380
Thank you very much.

561
00:44:51,380 --> 00:44:53,320
May the force be with you.