start	end	text
13180	21240	So, here we are. The end of day one. Our final talk. Something that I've been super excited to hear about.
21500	27220	But before we get to that, again, if you haven't gotten a t-shirt, head out to the AppSecVillage website.
27220	34080	You can pick up a shirt there. And let's give a big thumbs up to everybody who helped to put this on this year.
34080	38660	This is fantastic. Definitely want to thank everyone.
38660	44580	The next speaker, Mario Arias, is going to talk about Threat Modeling the Death Star.
44580	48960	Which, what a better model can we use, right?
48960	53620	Mario is a software developer with 10 years of experience in four different countries.
53620	58960	His expertise involves security, DevOps, and Agile practices.
58960	66980	Mario helps teams to deliver value quickly while keeping applications, infrastructure, and data safe.
66980	70620	With that, let's welcome Mario to the stage.
70980	75220	Hello, everyone. Welcome to my talk, Threat Modeling the Death Star.
75380	79320	My name is Mario. I have been a software developer for over 10 years.
79420	84200	And recently, I have moved to be a full-time security engineer two or three years ago.
84700	88540	And today, nowadays, I'm a software engineer at Canva.
89540	93020	Today, I want to talk about Threat Modeling.
93020	99660	Threat Modeling is a subject that is very important and is very dear to my heart for many different reasons.
99660	107100	But the main reason is a reason that was shown on the State of DevOps report from last year.
107280	112920	So, the State of DevOps report is a report done by Puppet and different companies
112920	121420	where they look at different companies and they try to get information about how efficient they are in the DevOps world.
121420	124720	And one of the things they look at is security.
125340	129600	And they have, like, looking at all different companies on all different sizes.
129920	137340	The most effective way to improve your security posture is to do collaborative Threat Models
137340	140540	with the security team and the development teams.
140540	144000	That's really, really important to improve your security posture.
144000	148480	And that's what I have seen in my experience as well as a security engineer.
148480	156600	Every time I introduce Threat Modeling to a company or to a team, I could see the benefits of it very quickly.
156600	159280	Like, the improvement of the security posture.
160520	165040	But before we're going to jump in and go into more advanced details about Threat Modeling,
165040	168440	I want to talk a little bit about what the definition is, right?
168800	173200	And if you look, if you try to Google it, you're going to see, like, many different definitions.
173200	176020	But this one I like the best.
176560	182920	It's that Threat Modeling is a process to identify and enumerate threats.
183040	186860	That's what Threat Modeling is at the end of the day, right?
187240	190840	And that makes a lot of sense for security people.
190840	195980	But then when you try to go to non-security people or non-Threat Modeling nerds,
195980	198540	they don't get very impressed, right?
198540	203080	It's a very dry concept. It's a very abstract concept.
203080	211860	And it's really hard to engage people who are not from security to actually understand and get involved with Threat Modeling.
212500	214760	And that's a hard situation, isn't it?
214760	219560	Like, where you have Threat Modeling brings so much benefits to the organization.
219900	223780	But on the other hand, it's really hard to get other people to do it.
224040	226640	And that was my position a few years ago.
226640	230220	And I tried to introduce Threat Modeling in a company.
230360	234720	And I really knew that Threat Modeling is quite important.
235320	239040	But I also knew that it's not very engaging at all.
239040	243120	So I was trying to find a balance where I could reap the benefits of Threat Modeling
243640	249740	while making sure people were motivated enough to engage and participate in the process.
249740	254520	It's not only one checkbox that you need to do at the end of the day, right?
256040	259960	Anyway, then I came up with a list of requirements.
260460	262040	What the requirements are?
262040	267080	The requirements are something like, I felt, if it wasn't there for the Threat Modeling process,
267080	268660	it wouldn't be very successful.
268660	273400	I wouldn't think that actually it's something that's valuable to the company.
274460	277860	And I came up with three different requirements, right?
277940	282280	One is, it needs to be engaging. Threat Modeling definitely needs to be engaging.
282280	285520	It shouldn't be another boring meeting people need to attend.
285520	289340	It should be something more fun and more engaging,
289340	295820	so people can go and have a good time, at least in the Threat Modeling session.
295920	298020	It needs to be highly collaborative.
298240	303140	Again, the magic of the Threat Modeling happens when you get the security team doing it,
303140	306660	and the development team is doing it as well, together.
306660	310240	And collaborating gets the process done.
310240	313440	It's not like a process for me, it was like a no-go,
313600	316920	a process where the security team did it behind the scenes,
316920	319740	and they just returned a report to the development team.
319740	322140	It definitely wasn't something I wanted to do.
323060	326040	And finally, it needs to be valuable for everyone.
326220	330400	And it sounds a bit silly, but it's very easy for people to think,
330400	334860	like, I'm doing this Threat Modeling just to make sure the security team is happy,
334860	336220	and then I can do my stuff.
336920	339700	That's not the idea that I want to do for the Threat Modeling.
339700	343840	I want something that if people are participating, collaborating,
343840	345680	they could get something out of it.
345700	348800	They could understand the process, and see the value of it,
348800	350220	and then do it again and again.
350220	354140	Not only because the security team wants to have the software more secure,
354140	357960	because they also see value, and they also want to get their software more secure.
359720	363200	And then I look at very different methodologies.
363200	366980	I look at Stride, I look at Pasta, I look at many others.
366980	371680	But the software methodology that I like the most is Attack Trace.
371680	375160	I think that resonates well with me, my experience,
375160	379920	and resonates very well with the teams and companies I have worked for,
379920	381760	where I introduced that.
382120	386700	I really like the way, because it's very simple, and it's very easy to do it.
386980	390580	That doesn't mean it's the best methodology for everyone,
390580	395100	like, different people have different styles, different companies have different cultures.
395100	397940	You might find something different for yourself.
398060	403100	But for me, when I saw Attack Trace, I really understood the concept.
403100	406640	I really could see that being rolled out to the company.
407340	410460	But before I actually tried to do the rollout for the company,
410460	412140	I did a pilot first.
412200	414480	I chose a few selected teams.
414480	416900	They were doing some interesting work,
416900	420820	and they were trying to model the aggregate value at that phase of the work.
421400	424760	And with that, I talked to them, I did some pilots,
424760	426520	I did a few training models,
426520	428260	and then I did a survey at the end of it,
428260	431060	to see what people think about the process.
431060	433140	And I really asked them to be very honest,
433140	435380	because if it wasn't working for them,
435380	438160	chances are it wouldn't work for other people in the company,
438160	439760	so it wouldn't be successful,
439760	442080	and we should just start from scratching in,
442080	444180	rather than try to roll out that process.
445040	449280	And the numbers I got were very positive, let's say this.
449280	454700	80% of developers found it useful, they found it valuable,
454700	456960	and they would participate again.
456980	461100	And for me, the participation again was the ultimate metric.
461100	465620	If they would participate again, it's because I hit the three requirements.
465620	470640	They saw value in it, it was collaborative, and it was engaging.
470640	473600	And they saw value, they actually saw value for them,
473600	475240	and they wanted to do it again.
475360	478380	So that made me feel confident,
478380	481180	and then I did roll out that to the rest of the company.
481600	483320	And I'm going to talk about that,
483320	485220	what's the process I did roll out,
485220	488380	but I want to use Star Wars for that.
488380	491240	Because, again, thread modeling is very dry,
491240	494380	it's a very abstract concept.
494580	499460	So I always try to get different ways to make thread modeling a bit more engaging.
499780	503100	And Star Wars is one of the funniest ways that I have seen so far.
503660	506020	So let's start with Star Wars.
507120	513480	And that story starts with yourself, in the audience, watching this at this point,
514280	518880	where you are the new CSO of the Galactic Empire,
518880	521380	Chief Security Officer.
521460	522660	Well done.
522660	525360	You started as a low-level Stormtrooper,
525360	529120	fighting the trenches against the rebellion,
529120	530860	and you made all your way to the top.
530860	532940	Now you're a Chief Security Officer.
532940	534300	Well, well done.
535040	538620	But not everything is perfect, isn't it?
539600	542580	That guy now is your new boss.
543280	545300	Yeah, and...
545880	548340	How can I say this?
548580	552620	He has a very different style of leadership.
552620	555480	This whole thing you learned about today,
555480	558520	blameless culture or servant leadership,
558820	561260	is definitely not something he believes in.
561260	564540	He's more like an old-school kind of guy.
564540	569440	He really thinks high accountability is the way moving forward.
569540	570560	But that's okay.
570560	575720	Everybody had some problematic boss at some point in their careers.
575720	578460	I'm pretty sure you can work around the guy.
580540	583220	And you, as being a CSO,
583220	586780	you start to look at the crowd use of the Empire.
586780	588720	What's the most important assets?
588720	592040	And what do you need to protect first before everything else?
592040	595500	And the answer was very easy and very big as well.
595500	597860	The answer was the Death Star.
598200	601460	It's the most expensive project in the whole Galactic Empire.
601460	604760	It costs around 2 trillion credits.
605000	607560	It's been 20 years in the making.
607560	610280	It's the biggest weapon of the galaxy.
610280	615400	And a major strategic asset for the Galactic Empire.
615400	619940	So definitely, that's the asset you need to focus on.
620240	625540	However, it's a project that's been like any waterfall project.
625820	629140	They are like over budget and overdue.
629140	630840	And the business is not happy with it.
630840	633920	And the business would like to release that as quickly as they can to production.
633920	638900	It's been delayed, delayed, delayed for over too many years.
638900	642700	So your boss and the Emperor, they're not very happy.
643100	644080	But that's fine.
644080	645240	You can work with that.
645240	646700	You're a professional, right?
648520	652360	Okay, so you've identified already what you need to protect.
652360	653300	That's the Death Star.
653300	654780	It's a good first step.
654960	658920	But you need to have some sort of understanding what kind of adversaries are going to happen.
658920	661460	Like what kind of attackers are going to happen.
661820	665460	And you use a simple exercise called evil personas.
665920	670480	The Galactic Empire has been attacked for too many years already.
670480	676320	So you kind of know exactly what kind of attackers the Empire can have.
677080	681920	So let's talk about it because we need to protect the Death Star against them.
683020	685720	And the fourth one is very interesting.
685720	687340	It's Jar Jar Binks, right?
687460	695380	Jar Jar Binks just represents a class of attackers where they don't know very well what they are doing.
695380	697860	They don't have too many resources.
697880	699500	They're also very competitive.
699500	705420	So they keep trying to show their colleagues how good they are.
706140	708580	Sometimes it can be annoying for the Empire.
708620	713400	But honestly, when it comes to the Death Star, they are not very important personas.
713400	721840	So although it's good to list them, but it's not very good for your modeling for the Death Star.
721840	723680	So we'll just move to the next persona.
724820	729820	Now we're going to talk about Han Solo, right?
729860	736340	And Han Solo is a very interesting persona because Han Solo has a lot more expertise.
736800	742140	Han Solo knows what they're doing like any other Bolt Hunters.
742140	743620	They know what they're doing.
743700	745640	They have more resources as well.
745640	747280	They have their own ship.
747280	750960	They might have different weapons.
750960	755320	But then again, they are there for the money and they don't organize themselves very well.
755320	757640	Bolt Hunters are very competitive as well.
757640	761640	They keep trying to go to the easy prey and get some easy money.
761640	764620	But they don't try anything too big or anything like that.
765040	768660	When it comes to the Death Star, it can be annoying.
769160	774720	But on the other hand, they're probably not a big threat as well.
776240	778660	But these people...
779340	781680	These people can be problematic.
782460	783660	Jedis.
783920	787740	First, their expertise is huge.
787740	791960	Well, not only because they have been training for many, many years.
791960	795460	But because they have magic in their favor.
796280	798660	How can you defend against magic?
798660	802420	If you have a guard and they're like, you didn't see me or whatever.
802420	804800	It's really, really hard to defend against them.
805020	810760	Lucky you, since your boss managed to kill most of them years and years ago.
810760	816820	And the ones that are out there, they're probably hidden and they're not much of a threat anyway.
817260	822700	So although you list them as a threat, because they're very unlikely to show up.
822760	825840	And it's very hard to protect against these people.
825840	827880	You also don't focus them very much.
827880	833200	You trust that your boss did a very good job and eliminated them.
834640	838880	Then we start talking about more interesting personas when it comes to the Death Star.
839080	842260	And here we talk about insider threats.
842360	847020	But honestly, insider threats should be many different personas.
847020	851520	Because the Empire has many different levels, ranking levels, right?
851920	855780	A Stormtrooper that's an insider threat is not as dangerous.
855780	860140	Whereas a Sea Lab executive like yourself is becoming an insider threat.
861200	867060	Regardless of their position though, they have been trained by the Galactic Empire, right?
867400	872220	So they have a strong training and they know what they need to do.
872220	874320	They are very good at what they do.
875220	877280	They might have, again, resources.
877280	879400	It's a bit of an interesting thing.
879400	881940	If you're a Stormtrooper, you don't have much money.
881940	887360	Whereas a Sea Lab executive like yourself has lots of money, lots of resources.
887540	891780	But regardless, again, of their position, they organize themselves pretty well.
892640	895980	The Galactic Empire is a military organization.
896140	898620	So they organize all the insider threats.
898880	900860	They can join terrorist groups.
900860	902880	They can form their own terrorist groups.
903120	906520	So they can't become a problem because they organize themselves very well.
906520	909520	Even if you're at a low level Stormtrooper.
910350	918780	But the most important persona for the Death Star is Princess Leia, right?
918780	923320	Princess Leia represents the Rebellion.
923660	931960	The Rebellion, as you all well know, is a terrorist organization trying to bring trouble to the Galactic Empire.
931960	935200	Whereas the Empire is just trying to make the galaxy stable, you know?
935200	937360	A bit of order here and there.
939060	943220	But although they are a terrorist organization, they have lots of expertise.
943220	946520	They have pilots, they have diplomats, they have spies.
946540	947840	And they are very good.
947840	950980	They can sometimes go toe-to-toe with the Galactic Empire.
950980	953360	So they do have a lot of expertise.
954140	959140	Even for a terrorist organization, they have lots of resources.
959780	962540	You're not quite sure where they get the money from.
962540	965080	But they have lots of money.
965080	966660	They have a small army.
966660	968120	They have ships.
968560	970760	They have bases across the galaxy.
970760	973400	So they have lots of resources.
973940	978400	And for a terrorist organization, they organize themselves pretty well.
978700	984060	They have become a major pain for the Galactic Empire in the last few years.
984100	990380	Sometimes shut down Empire operations or shut down entire armies.
990380	995240	So definitely Princess Leia is your most important persona.
995500	997220	And the one you need to look after.
998140	1001240	Cool. So that's the summary of your personas, right?
1001240	1006480	From Skipped Kitty, going through Bounty Hunter, Inside the Threat,
1006480	1010120	Jedis, and even Princess Leia, the Rebellion.
1011400	1014340	Now going back a little bit to the real world.
1014820	1019140	Personas, if you want to do that in your own organization,
1019140	1022220	for a large organization, it shouldn't be very hard for you
1022220	1025840	because your organization probably has been attacked before.
1025940	1030720	So you just talk to the security team in your company,
1030720	1032960	the ones who look more incident response.
1032960	1036440	They might have an idea of the kind of attackers you have.
1036580	1040080	If you, on the other hand, are working for a smaller company,
1040080	1047980	you might try to look at other websites and find places where they define generic attackers.
1047980	1051260	You start with them, and then as you grow, as you scale,
1051260	1055560	and then have real attacks, you can tweak your personas as you go.
1055560	1060080	But it's important to have a kind of understanding of what the attackers are
1060080	1065360	and not keep only on the abstract level of an imaginable attacker.
1066920	1070420	Cool. So now you have the asset that's a Death Star.
1070420	1075380	You have the personas. So now it's time to build the attack tree.
1075920	1080380	And the first thing you need to do is get the right people in the room.
1080380	1086180	I remember when my first slide was talking about how TreadMoney should be a collaborative exercise
1086180	1088880	and everybody should participate together.
1089320	1091420	So that's what you try to do.
1091420	1096560	You try to get everybody in the room so you could run the exercise.
1096640	1100480	You got the Death Star designers and architects.
1100480	1102080	You got your own team.
1102080	1105220	You took so much trouble to go through that.
1105220	1109660	Because imagine, it's really hard already to go into the time zones
1109660	1113580	and book everybody at the same time when you're across the galaxy
1113580	1115740	where time zones are not even a thing.
1116020	1119140	But somehow you managed to put everyone in the room.
1119140	1126940	You even got Darth Vader to do an introduction for the meeting,
1126940	1132340	to give some motivation for people, you know, like the kind of C-level introduction.
1133480	1137020	And then you start to run the attack tree session.
1137840	1141540	And the attack tree session starts with the root node.
1141900	1144600	It's kind of the attacker role, right?
1144600	1147400	What the attacker wants to do against your asset.
1147660	1150780	And you could look at very different kind of attacks.
1150780	1156980	For example, if you look at Han Solo, a bounty hunter.
1157240	1161060	When he looks at the Death Star, he's probably trying to make some money out of it.
1161080	1163940	He might steal some weapons, he might steal food, I don't know.
1163940	1166340	He might steal a lot of stuff.
1166740	1171600	But then you need to look and focus on what's most damaging for the Galactic Empire.
1171740	1175780	Even if Han Solo manages to steal a bunch of weapons or a bunch of food,
1176620	1179100	that really doesn't impact very much the Galactic Empire.
1179100	1183400	It's annoying for sure, but it's not much of a big problem.
1183500	1187340	So you come up with two different attacker roles.
1188440	1195100	If the attacker manages to accomplish this, it can be really damaging for the Galactic Empire.
1195100	1197520	So you're going to focus on that one.
1198160	1201660	And there are two kinds of goals that you need to look at.
1201680	1206580	Take control of the Death Star or take the Death Star out of action.
1206580	1211240	And taking control of the Death Star would be really, really bad.
1211240	1215800	Imagine going to 20 years of project, release that to production,
1215800	1221160	just for some kind of attacker to get that weapon from you and use against the Empire.
1221160	1222700	That would be terrible.
1223040	1228120	But as well, it would be very unlikely for the kind of attackers you have,
1228120	1235880	because none of them have the resources to actually manage a ship like the Death Star.
1235880	1242040	You need to have like one million crew inside the Death Star to manage the whole thing.
1242040	1247800	You need to have a very specific expertise and there's lots of proprietary technology.
1247900	1254620	So even Princess Leia wouldn't be able to take the Death Star out of the Galactic Empire and use it against the Empire.
1254980	1260560	But they definitely, definitely can take the Death Star out of action.
1260560	1263120	That's probably what would be the first goal.
1263120	1269420	As soon as they know about the Death Star, they try to take it out of action and take this advantage,
1269420	1272960	the Galactic Empire's beauty, out of the game.
1272960	1275000	So we're going to focus on that.
1275000	1278840	And we're also going to focus on Princess Leia as a persona,
1278840	1283260	because she's probably the one who can actually accomplish this.
1284820	1288340	So we chose to take the Death Star out of action.
1288340	1293720	Now we need to think about how would you try to do this, right?
1294260	1297760	How would you accomplish taking the Death Star out of action?
1297760	1301440	So that's where the collaboration and the magic happens.
1301440	1305620	The security team throws some ideas, the developers throw other ideas,
1305620	1310620	and then you try to figure out which one of these nodes are more likely to happen.
1310620	1317220	And when you've got everybody in the room, there are two kinds of nodes that show up.
1317220	1321340	They're really important, and then they're more likely to happen.
1321600	1324420	One is disable the Death Star.
1324600	1330760	I'm not talking about a 15-minute disablement or maybe turn off the power for 15 minutes or something like that.
1330760	1336660	I'm talking about some sort of disablement that is so dangerous, it's so problematic,
1336660	1340100	that probably the Death Star is not usable anymore.
1340100	1345540	You need to rebuild the Death Star from scratch so you can re-enable again.
1345600	1350620	So it's kind of a disablement, where it's probably better to just create another one rather than fix it.
1350900	1353860	Same like you break your iPhone screen, for example.
1353860	1356900	It's so expensive, they're most likely to just buy a new one.
1357800	1359860	And the other one is destroy the Death Star.
1359860	1364420	Literally destroy the whole thing, exploding PCs or whatever.
1364720	1368540	So that's the two main ways you can take the Death Star out of action.
1369900	1373360	So let's focus a little bit on disable the Death Star.
1373680	1378060	To disable the Death Star, you'd have two kinds of nodes as well.
1378060	1380300	Two different ways to do this.
1380300	1385820	One is what we call a system failure and the other one is a mechanical failure.
1385820	1391580	And a system failure is mostly like, for example, you disable the navigation system,
1391580	1395920	you disable the heating system, you disable the engine system.
1395920	1401580	You disable in such a way these core critical systems that they might cause a chain reaction
1401580	1405040	in the other systems and shut down the Death Star.
1405080	1408220	Or it can cause some sort of mechanical failure.
1408220	1411220	And then it can cause some problem on the hardware itself.
1411480	1416440	And the hardware can cause, again, another kind of chain reaction
1416440	1419440	that's going to cause the whole Death Star to shut down.
1420660	1423800	So how would you accomplish these things?
1424400	1429480	And then for system failure, you need to compromise a critical IT system.
1429700	1434280	And for the mechanical failure, you need to overload the critical infrastructure.
1434480	1436540	So let's elaborate that a little bit.
1436800	1441460	So there are many systems running inside the Death Star, right?
1441520	1445030	And they manage some sort of critical infrastructure.
1445360	1449140	So if you have access, if an attacker has access to this kind of systems,
1449140	1450820	they can do some damage.
1450820	1456280	But usually the system protects against problematic parameters,
1456280	1459440	problematic variables, or any dangerous kind of action.
1459820	1462660	So what you want to do is, what an attacker needs to do,
1462660	1464460	is not only have access to these systems,
1464460	1468700	they need to compromise so they can bypass these kind of protections
1469260	1471220	to cause a system failure.
1471900	1476400	When it comes to mechanical failure, you might overload some critical infrastructure.
1476400	1479100	So you might overload the heating system somehow.
1479100	1485600	And to overload the heating system, you might cause all the hardware to have problems, right?
1485600	1489540	Or you can cause the Death Star to be very uncomfortable to stay with,
1489540	1492280	and people need to leave the ship.
1492440	1494580	So there are different ways you can do that.
1496540	1500460	But the interesting thing is, regardless if you're trying to compromise
1500460	1504940	the critical IT system or overload the critical infrastructure,
1504940	1508220	you need to have access to the internal network.
1508220	1514520	That's no other way. So either to have access to sensitive areas of the Death Star,
1514520	1518300	you need to have this kind of action, you need to have this kind of privilege,
1518300	1521500	or to compromise the critical IT system, you need to be inside the network
1521500	1523380	so you can interact with the system.
1524680	1529580	And it's internal network, because if you think about it,
1529580	1531080	Death Star is just a weapon, right?
1531080	1534720	It's not like they make their system public so people can access it.
1534720	1537440	They are not a service, right? They are a weapon.
1537440	1541780	And as a weapon, they hide everything as much as they can.
1542340	1546920	So in order to get privilege access, you need to be inside the internal network.
1547040	1551160	Anything that's public is probably not very important
1551160	1555060	and segregated from the other internal network.
1555920	1558440	And in order to get access to the internal network,
1558440	1561500	you need to be inside the Death Star. There is no other way.
1562020	1564580	And then again, Death Star is a weapon,
1564580	1568820	and they don't expose systems to the outside world.
1568840	1571560	And they segregated that stuff very well.
1571560	1574100	So you need to be inside the Death Star.
1574100	1579440	So maybe you can go to a server room or steal some kind of employee badge
1579440	1581340	or biometrics or whatever.
1581340	1584320	So in order to get your privilege access.
1585340	1589040	The interesting thing is, we could go in more detail
1589040	1592940	and like, how would you get physical access to the Death Star?
1592940	1597540	But as I said before, the Death Star has one million crew, right?
1597540	1601000	Like, it's very likely that an attacker like Princess Leia
1601000	1603300	is going to be able to do that.
1603520	1606760	Even if that's not true, another attacker that we have
1606760	1608980	is an internal attacker.
1609000	1613540	So it might be a person who actually has rights to be inside the Death Star
1613540	1616740	and inside the Death Star to try to do some malicious.
1617020	1620020	So we're going to stop this part of the attack tree here
1620820	1623580	and go to the next step.
1624140	1626180	So that's all we have so far.
1626180	1629680	So we have like, take the Death Star out of action.
1629740	1631680	You have disabled the Death Star
1631680	1635800	and then you have system failure and mechanical failure
1635800	1637240	and so on and so forth.
1637620	1641400	But this is only one part of the attack trees, right?
1641400	1646020	We have the other one where you want to destroy the Death Star.
1646300	1647580	So how would you do that?
1647580	1649460	How would you destroy the Death Star?
1649760	1652160	And there are basically two ways to do this.
1652200	1655520	One is a big military attack.
1655580	1657360	The Death Star is a big weapon.
1657360	1658780	It's a huge weapon.
1659180	1661240	It can cause a lot of damage.
1661440	1666980	But also, it's still vulnerable to kind of military attacks.
1667340	1669480	So yeah, that's a way to do it.
1670180	1674520	And there is another way that you figure out on the training modeling.
1674520	1678060	And you are so proud that you actually got that.
1678520	1681880	There is a reactor inside the Death Star.
1682120	1684340	In the very core of the Death Star, there is a reactor
1684340	1689760	which controls everything and provides energy for the whole ship.
1690120	1693260	But the reactor is very, very hot.
1693440	1698740	So it needs to send this heat to the space.
1698820	1701280	And the way to do that, they build ventilation tunnels
1701280	1707040	that go from the core straight to the top of the ship.
1707060	1709580	So then the heat can dissipate.
1709880	1712040	But this is also a vulnerability.
1712080	1716600	Because now we have a straight path to the core.
1716600	1718700	And the core is very unstable.
1718700	1722060	So anything that goes there, any kind of explosion,
1722060	1725360	can cause a chain reaction that can explode the whole Death Star.
1725500	1730160	It's a really big problem in case an attacker can exploit this.
1730980	1734580	But there are some sort of protections, let's say.
1734940	1738120	The first one is obscurity.
1738820	1740840	This kind of port is not very...
1740840	1743900	You need to know where the port is, for one.
1744000	1745100	The Death Star is huge.
1745100	1749600	There is no easy way for an attacker from outside to know where they should hit.
1749900	1752680	And second, the port is very small.
1752680	1754140	It's only two meters wide.
1754140	1760860	So it's really hard for any kind of pilot to send a bomb over there.
1761340	1765120	So it's not like it's very likely that to happen.
1765120	1767300	But still, not really great.
1768400	1773000	So in order to destroy the reactor, you need to shoot the thermal port.
1773500	1778300	And to shoot the thermal port, you need to know where the port is, right?
1778580	1781160	So you need to obtain the Death Star plans.
1781160	1787500	You need to somehow know what the port is so you can go there and shoot it.
1789080	1792840	And that's the second piece of the attack tree.
1793180	1798820	So together with the first part of the attack tree and the second part of the attack tree,
1798820	1804040	that's what we found out about the main problems with the Death Star design
1804040	1806400	or the procedures we have at the moment.
1807620	1810300	And these are the main goals
1810300	1812380	the attacker can try to accomplish.
1812380	1814720	So if you get access to privilege,
1814720	1816620	privilege access to network,
1816620	1818080	that's going to be a problem.
1818080	1824100	They have different ways where they can accomplish the disabling of the Death Star.
1824420	1826840	A military attack, really huge,
1826840	1830020	but something that a rebellion can pull out.
1830020	1831840	So if you're not prepared,
1831840	1835900	the rebellion can try to destroy the Death Star by a huge military attack.
1836120	1838380	And finally, the thermal port.
1838380	1843120	If somehow an attacker can shoot the thermal port,
1843120	1844240	they cause a chain reaction
1844240	1848120	and it can destroy the reactor and the Death Star altogether.
1848640	1849400	That's good.
1849400	1851940	So that was part of the threat modeling.
1851940	1853580	And then you figure out some threats.
1855580	1857540	And the way I like it,
1857540	1861500	why I like the attack trees is because it's a problem solving exercise.
1861760	1865600	And everyone in 90 has this kind of mindset of problem solving.
1865600	1867160	We have a problem and try to solve it.
1867160	1868240	That's how we do, right?
1868240	1869540	That's how we operate.
1869820	1873680	But rather than like use this to build stuff,
1873680	1876640	now we have to change the mindset and say like,
1876640	1879180	now rather than use your problem solve to build,
1879180	1882340	you're going to use your problem solving skills to attack.
1882380	1886340	That's really, really powerful to get this kind of people,
1886340	1889400	who usually don't think about attackers or attacks at all,
1889400	1890680	thinking about these things.
1890680	1895020	And it's interesting to see how they can find vulnerabilities on their own design.
1896020	1899960	And it's very interesting as well, because they are collaborating on the session.
1899960	1901640	When you need to go back to them and say,
1901640	1905240	hey, remember the vulnerability we found, we need to fix it.
1905620	1907000	They already know the context.
1907000	1907940	They were there.
1908020	1911420	Maybe they were the ones who found out anyway.
1911740	1915100	And they are the ones who know how to fix it easily as well.
1915760	1918000	So it's a really interesting exercise.
1918000	1923280	And it's really, really powerful the way we can get people who never think about attackers,
1923280	1924920	try to think like this.
1924920	1929160	It makes them look at their system in a very different way.
1929180	1930840	And they only can cause good things,
1930840	1934920	because they know how to fix the problems and make the system more secure.
1936560	1937600	Cool.
1937680	1940680	Now you have identified the risks and the threats.
1940680	1942900	So now we need to mitigate those.
1943800	1948280	And the first risk we need to mitigate is privileged access to the internal network.
1948360	1950960	And the impact for that is high.
1950960	1953760	If an attacker actually manages to do this,
1953760	1956280	it can be really problematic for the Empire.
1956620	1959000	The likelihood we put as a medium,
1959000	1962320	because it's not very easy, you need to be inside the Death Star.
1962360	1967380	But the Death Star and the network of the Death Star is not very secure.
1967600	1973500	The Rebellion has been hacking the Galactic Empire for many years.
1973540	1976360	But you are a good security professional, aren't you?
1976620	1980580	So you come up with some measures that you can implement in the network,
1980580	1983200	some quick wins, some testing.
1983340	1987980	And then you harden the network and make it a lot harder for the attacker
1988660	1991520	to get privileged access to this.
1991640	1994180	So after this work has been done,
1994180	1998580	you actually managed to improve the likelihood from medium to low.
1998600	2000340	The impact is too high, though.
2000340	2003820	It's really hard to make sure the impact is going to go down.
2003820	2007820	But at least it's unlikely that it's going to happen.
2009580	2010980	Next one.
2011360	2013540	The next one is a military attack.
2013980	2017000	And then again, the impact is really high.
2017240	2020920	If Rebellion can pull out an attack,
2020920	2022840	then it can destroy the Death Star.
2022840	2024960	That's a really, really high impact.
2024960	2027280	But the likelihood is also high.
2027520	2031720	Why is that? Because if you are Princess Leia,
2031720	2036340	and you get to know that your biggest adversary has such a big weapon,
2036340	2039620	you probably want to go and try to attack them first.
2040160	2043460	But there are a few things you can do to mitigate that risk.
2044100	2048580	The first thing is you need to come up with ways for the crew
2048580	2051540	to respond to attacks very easily and very efficiently.
2051620	2053980	So you define the runbooks,
2053980	2059000	you make sure people keep on the call,
2059000	2060220	and keep on training,
2060220	2063060	and make sure this exercise has been running.
2063060	2065800	So when the actual real thing comes,
2065800	2067880	the response works very well.
2068260	2071720	But not only that, the Death Star is going to need some support, right?
2071880	2074640	So that's why you get Star Destroyers.
2074640	2078980	Star Destroyers are very big, other big ships of the Galactic Empire.
2079080	2082920	And if they are close by when the Death Star is being attacked,
2082920	2086620	they can provide really helpful and strong support.
2086620	2092180	And probably less likely for Rebellion to attack the Death Star
2092180	2095680	when they have strong support as the Star Destroyers.
2096320	2100700	And finally, try to monitor the Rebellion activities, right?
2100700	2102940	If they try to pull out that kind of attack,
2102940	2105300	it's a huge movementation,
2105300	2107540	and they need to talk to so many different people,
2107540	2109080	and a lot of coordination.
2109200	2111920	So if you get some sort of signal out of them,
2111920	2113660	and then you interpret that,
2113660	2117160	you can prepare before they actually pull out the attack.
2117160	2119840	So you'll be a lot more prepared when they come.
2120500	2125360	So for this, you manage to get impact from high to medium.
2125360	2131340	Because even if the Rebellion tries to attack with a strong military attack,
2131340	2133280	you'll be a lot more prepared,
2133280	2135460	and maybe you can either defeat them,
2135460	2139080	or at least buy enough time to get the Death Star out of them.
2139700	2141880	So that's a good outcome.
2141880	2143820	And the likelihood is also medium.
2143820	2147960	Because if the Rebellion cannot actually destroy the Death Star,
2147960	2150320	they'll most likely not try to attack.
2150320	2152280	They'll only go for the victory, right?
2152600	2154560	So if the victory is not certain,
2154560	2156700	they'll probably not be able to do it.
2156700	2159400	But regardless, you need to be prepared,
2159400	2160660	and then that's what you did.
2160720	2161720	Very well done.
2163120	2167020	And finally, shoot at the thermal port.
2167680	2170440	And the impact, again, is as high as the other risks.
2170440	2173660	If somebody manages to shoot at the thermal port,
2173660	2176020	you destroy the reactor, you destroy the Death Star.
2176020	2179340	And the likelihood was low.
2179960	2184460	And you didn't like how this outcome was low.
2184460	2185080	And why is that?
2185080	2187060	People were saying the likelihood is low
2187060	2191240	because you need to know where the port is.
2191240	2195420	And even if you do, it's a really difficult and hard shot, right?
2195560	2197740	So you wanted to do a little bit more.
2197740	2199900	You wanted to do some sort of protections,
2199900	2202780	and maybe cause, like, if an attacker is coming,
2202780	2204240	just close down the door,
2204240	2207420	or open different ones, or have different levels of protection.
2207460	2209460	You try to argue for that.
2209460	2212380	But remember, I was talking in the beginning.
2212740	2215620	The project was being delayed for so many years already.
2215620	2221000	The budget has been, like, over for many years as well.
2221120	2226120	So the business didn't want to, like, go back to the design,
2226120	2228960	redesign the kind of ports to make sure it's more secure,
2228960	2230200	and then implement it.
2230200	2233060	That delayed the project for a few more years.
2233060	2237760	And so the business decided to accept the risk.
2239520	2245180	So, but yet, you're going to try to do something, right?
2245180	2248960	So at least you're going to try to hide the DevStar plans.
2249280	2251200	So if one of the things they need to do
2251200	2253340	in order to shoot the terminal port,
2253340	2254700	they need to know where the port is.
2254700	2256960	So if at least you try to hide it and make it harder
2256960	2260980	for an attacker to find out about the DevStar plan,
2260980	2263440	sorry, about the DevStar port,
2264040	2267280	then it wouldn't be a problem anymore, right?
2267280	2269960	At least you would mitigate to a certain level.
2269960	2272940	That's the only thing you could have done, so you did.
2273580	2276640	And then you went on with your life, right?
2276640	2278480	You did the best you could,
2278480	2281340	then you look at different other areas of the security
2281340	2284860	of the Galactic Empire, and you hope for the best.
2285760	2288720	And then eventually, the DevStar has been released,
2288720	2294040	and the DevStar has been like a cause of joy for the Empire.
2294040	2297140	They caused lots of trouble for the Galactic Empire,
2297140	2300120	and that happened.
2302160	2304720	The DevStar was destroyed,
2304720	2309940	which is not a good outcome for anyone in the Galactic Empire.
2310160	2312720	But you're a professional, right?
2312720	2314900	So what do you do in that situation?
2315470	2316800	Forensic analysis.
2317220	2319440	So you try to figure out what went wrong,
2319440	2324160	how the Rebellion managed to destroy such an important weapon.
2324660	2328420	And the answer is this guy, Luke Skywalker.
2328780	2332020	He was the one who managed to shoot the Determinant port.
2332240	2335380	But there are some interesting things about Luke Skywalker.
2335720	2338760	The first thing is, he's a Jedi,
2339420	2343340	which is interesting, because they were supposed to be hiding,
2343340	2345580	not actually attacking the Empire.
2348960	2353200	And before he actually managed to shoot the Terminal port,
2353200	2355980	he was about to be shot down,
2355980	2358460	but the person who actually helped Luke Skywalker
2358460	2360600	was a bounty hunter.
2360600	2364620	He came up at the last minute and saved Luke from being destroyed,
2364620	2367360	and then Luke managed to shoot the Terminal port.
2367360	2371320	Which is interesting, because bounty hunters only help...
2371320	2373640	they only work for money, right?
2373840	2376060	They don't organize themselves very well,
2376060	2378520	so why a bounty hunter is helping a Jedi?
2380840	2383620	There's another thing that's quite interesting.
2383620	2387600	Luke Skywalker is actually Princess Leia's brother,
2388260	2392940	which makes him a high-level ranking Rebellion official, too.
2392940	2394900	So he's not only a Jedi,
2394900	2399980	he's a Rebellion official.
2400120	2402860	So, yes, interesting.
2402960	2405900	And the worst part of it all, the worst part...
2407180	2411940	Luke Skywalker is the son of your boss, right?
2411940	2414640	Which makes this whole lot more complicated,
2414640	2418580	because Luke Skywalker is considered an internal attacker now?
2418580	2420120	You don't know.
2420340	2422580	But definitely, like, not a problem,
2422580	2426000	and you don't have a good feeling about it, right?
2426000	2428200	That's a problem for your boss,
2428200	2431320	to take care of his family and his own boss.
2431780	2435780	But yeah, Luke Skywalker is definitely a problem,
2435780	2438860	and he was the one who managed to pull the shot.
2439080	2445580	But how did Luke Skywalker actually manage to find out about the port, right?
2446480	2449300	And the answer is these two people here.
2449300	2455800	They managed to hack the Galactic Empire and get the plans.
2455900	2457340	And you did a good job.
2457340	2462940	You put the Death Star plans in a very secure location,
2462940	2465580	at least the most secure you had in the Galactic Empire.
2466060	2469320	So these two people managed to go to this location,
2469320	2471580	hack into the data centers,
2471580	2473320	install the hard drive,
2473320	2477600	and then send the copy of it to the Rebellion.
2478040	2479760	You know what's worse?
2480600	2484640	The worst thing about that is there was no encryption arrest!
2484740	2488420	So they only got a copy of the hard drive and sent it to the Rebellion.
2488860	2490160	That's not really good.
2491160	2492820	But that's how they did it.
2492820	2496360	So they stole the plans, they sent the plans to the Rebellion,
2496360	2499220	the Rebellion quickly attacked the Death Star,
2499220	2502240	and for a miracle they managed to shoot to the Terminal port,
2502240	2504420	and everything was destroyed, right?
2505700	2507740	Well, I wish good luck for you,
2507740	2512360	because now you need to deliver your report for the forensic analysis to your boss.
2512920	2514120	Good luck!
2515880	2518500	Now let's talk a little bit about lessons learned, right?
2518500	2520100	Lessons learned of this story.
2521140	2522940	And the interesting thing is,
2522940	2527640	I used this analogy where you found out about the problem of the Terminal port
2527640	2529560	at the very end of the design,
2529560	2531980	at the very end of the building of the software,
2531980	2534200	at the very end, before going to production.
2535080	2538360	And then there's a problem that happens in all companies.
2538360	2541180	You find a security problem at the very end,
2541180	2542400	and then you need to fix it,
2542400	2545700	but nobody wants to fix it before release to production.
2546680	2551280	So thread modeling is something that you should do early and often.
2551420	2553480	So in the case of the Death Star,
2553480	2556460	if you have done the thread modeling at the design level,
2556460	2557640	and people are like,
2557640	2561800	design this Death Star and come up with this design of the Terminal port,
2562380	2566360	you could have seen it, or someone from your team,
2566360	2568740	seen the problem, and then you fix the design.
2568900	2569800	Right there.
2569800	2572780	It's a lot cheaper to fix at the design level,
2572780	2575160	or the beginning of the construction,
2575160	2577340	or in the case of software, the beginning of the coding,
2577340	2579580	than actually at the very end, right?
2579660	2581560	And that's a problem that happens all the time.
2581560	2585280	So if you want to do thread modeling, do it early and do it often.
2585680	2587180	Because things change, right?
2587180	2590060	Especially for software, things change all the time.
2590060	2594440	We pivot, we implement new features, we scope certain features.
2594440	2598860	So we need to look at that a certain amount of time.
2599760	2602660	There are always unknowns, right?
2602680	2606080	In this case, Luke Skywalker was a very unknown.
2606080	2608860	He was at least three different personas, right?
2609140	2611860	So even though you have thread modeling,
2611860	2613760	and you have covered some of the risks,
2613760	2617160	you always need to think about that you might have not seen something.
2617160	2620160	Or there's some sort of information that you don't have it.
2620340	2623760	Or the attacker can act in a very different way.
2624000	2627420	So it's not because you haven't done thread modeling, it means you're secure.
2627420	2630460	It means you covered some of the worst threats,
2630460	2632860	but that doesn't mean you are very secure.
2632900	2634960	So you still need to do some work on top of it.
2634960	2636380	Thread modeling is just the beginning.
2637720	2640840	And finally, thread modeling must be engaging.
2640840	2645260	And then again, if people go to a meeting that's very boring,
2645260	2647980	and they don't like it, and it's complicated,
2648580	2651220	or it's on a checkbox, they don't engage.
2651220	2653040	If they don't engage, they don't collaborate.
2653040	2656920	If they don't collaborate, you don't have the magic of the thread modeling.
2656940	2661060	The modeling doesn't work as well, as good as they would if people are engaging.
2661060	2663380	So in this case, I have been using attack trees.
2663380	2668020	I think it's been very successful where I have been done it.
2668020	2670900	But it doesn't need to be attack trees.
2670900	2673600	Regardless of what you do for thread modeling,
2673600	2677740	you need to make sure the people involved are engaging,
2677740	2680220	they are engaged, they have a good time,
2680220	2682700	and they see value in it, so they can keep coming back
2682700	2685820	and keep doing this exercise over and over again.
2687500	2690120	Cool. That's all I have to talk about today.
2690120	2693320	Thank you very much. May the force be with you.