1
00:00:06,299 --> 00:00:07,740
like

2
00:00:07,740 --> 00:00:11,460
hey everyone so today we I'll I'll be

3
00:00:11,460 --> 00:00:14,519
presenting about set modeling and

4
00:00:14,519 --> 00:00:17,460
yeah like I I'll start with my dad like

5
00:00:17,460 --> 00:00:20,580
my dad is a great third modeler so we

6
00:00:20,580 --> 00:00:22,320
will learn set modeling with the

7
00:00:22,320 --> 00:00:24,300
reference of my dad

8
00:00:24,300 --> 00:00:28,680
so first thing first something about me

9
00:00:28,680 --> 00:00:32,399
I I work as a security engineer at finoa

10
00:00:32,399 --> 00:00:35,280
I suffer from volunteers stress because

11
00:00:35,280 --> 00:00:38,219
like I like you can find me volunteering

12
00:00:38,219 --> 00:00:39,899
with almost every conference working

13
00:00:39,899 --> 00:00:42,960
behind the scenes I'm more of a security

14
00:00:42,960 --> 00:00:45,960
rankler than an engineer I live on the

15
00:00:45,960 --> 00:00:47,879
principle of around and finding

16
00:00:47,879 --> 00:00:49,500
out the landmines

17
00:00:49,500 --> 00:00:51,960
in the organization infrastructure and

18
00:00:51,960 --> 00:00:55,379
architecture you can always find me on

19
00:00:55,379 --> 00:00:58,260
Twitter in Discord

20
00:00:58,260 --> 00:01:01,079
so let's start

21
00:01:01,079 --> 00:01:03,500
okay so

22
00:01:03,500 --> 00:01:06,659
as one Sudan Kaminsky said it during

23
00:01:06,659 --> 00:01:10,200
Defcon 23 who are we who are the hackers

24
00:01:10,200 --> 00:01:12,360
like we are the people who manipulate

25
00:01:12,360 --> 00:01:15,540
house systems really work not just

26
00:01:15,540 --> 00:01:18,840
merely how they are supposed to work and

27
00:01:18,840 --> 00:01:20,700
that does not always mean we know how

28
00:01:20,700 --> 00:01:23,939
they work it helps but we don't always

29
00:01:23,939 --> 00:01:26,700
know and not knowing how things work

30
00:01:26,700 --> 00:01:29,340
tends to cause them to fail and we

31
00:01:29,340 --> 00:01:31,500
hackers just Define the failure

32
00:01:31,500 --> 00:01:33,720
condition as a six six uh success

33
00:01:33,720 --> 00:01:36,299
condition when every engineering team

34
00:01:36,299 --> 00:01:40,140
fails security team wins and like you've

35
00:01:40,140 --> 00:01:42,000
been security think that's people other

36
00:01:42,000 --> 00:01:45,000
people can make mistakes and fall into

37
00:01:45,000 --> 00:01:47,939
pits but be security folks are immune to

38
00:01:47,939 --> 00:01:51,060
everything but we believe we rescue

39
00:01:51,060 --> 00:01:54,899
things all the time but we we just have

40
00:01:54,899 --> 00:01:57,659
an attitude about it

41
00:01:57,659 --> 00:02:00,060
so set modeling what is set modeling

42
00:02:00,060 --> 00:02:03,060
like by definition set modeling is a

43
00:02:03,060 --> 00:02:05,100
structured approach of identifying and

44
00:02:05,100 --> 00:02:08,399
measuring risk or prioritizing them

45
00:02:08,399 --> 00:02:10,679
determining the value that potential

46
00:02:10,679 --> 00:02:13,680
mitigations can reduce or neutralize

47
00:02:13,680 --> 00:02:15,780
those threats

48
00:02:15,780 --> 00:02:18,480
in general when we when we proceed to

49
00:02:18,480 --> 00:02:20,580
threat modeling there are four questions

50
00:02:20,580 --> 00:02:23,400
which comes in our mind first is what

51
00:02:23,400 --> 00:02:25,500
are we building or what we are looking

52
00:02:25,500 --> 00:02:26,520
at

53
00:02:26,520 --> 00:02:29,099
what could go wrong either it's an

54
00:02:29,099 --> 00:02:31,739
infrastructure application or maybe a

55
00:02:31,739 --> 00:02:33,900
physical building here like you can set

56
00:02:33,900 --> 00:02:35,940
model anything any infrastructure

57
00:02:35,940 --> 00:02:37,860
anything

58
00:02:37,860 --> 00:02:41,640
uh it reminds me of last week I was

59
00:02:41,640 --> 00:02:43,440
attending Diana initiative virtual

60
00:02:43,440 --> 00:02:45,060
conference and there was a talk about

61
00:02:45,060 --> 00:02:46,680
threat modeling your mental health

62
00:02:46,680 --> 00:02:49,400
unlike it was a superb talk

63
00:02:49,400 --> 00:02:51,120
then

64
00:02:51,120 --> 00:02:54,060
we can identify threats by thinking what

65
00:02:54,060 --> 00:02:55,319
could go wrong

66
00:02:55,319 --> 00:02:59,099
and then when we recognize threads then

67
00:02:59,099 --> 00:03:01,739
we need to understand what we are going

68
00:03:01,739 --> 00:03:03,780
to defend

69
00:03:03,780 --> 00:03:07,379
to defend us against those threats and

70
00:03:07,379 --> 00:03:10,200
the final step will be like

71
00:03:10,200 --> 00:03:13,260
if we know that Riya threats we know

72
00:03:13,260 --> 00:03:15,900
from whom we have to defend ourselves

73
00:03:15,900 --> 00:03:19,019
now are we acting on those trips or not

74
00:03:19,019 --> 00:03:22,319
if we have acted then what suggested us

75
00:03:22,319 --> 00:03:24,060
now

76
00:03:24,060 --> 00:03:26,519
I'll start with some boring Frameworks

77
00:03:26,519 --> 00:03:29,280
to get the basic understanding I won't

78
00:03:29,280 --> 00:03:31,620
go deep into them I promise

79
00:03:31,620 --> 00:03:35,040
unlike as as usual no one likes doing

80
00:03:35,040 --> 00:03:36,780
things in theory

81
00:03:36,780 --> 00:03:40,080
so let's start with octave octave is

82
00:03:40,080 --> 00:03:42,299
more like practice focused threat

83
00:03:42,299 --> 00:03:45,000
modeling framework and full form of

84
00:03:45,000 --> 00:03:47,340
octave is operationally critical threat

85
00:03:47,340 --> 00:03:50,340
asset and vulnerability uh evaluation

86
00:03:50,340 --> 00:03:54,060
framework which basically defines the

87
00:03:54,060 --> 00:03:55,500
risk

88
00:03:55,500 --> 00:03:58,680
like which basically defines

89
00:03:58,680 --> 00:04:01,739
strategy based on risk assessments and

90
00:04:01,739 --> 00:04:04,620
planning techniques like octave is a

91
00:04:04,620 --> 00:04:06,360
self-directed approach when you are

92
00:04:06,360 --> 00:04:09,360
starting with octave

93
00:04:09,360 --> 00:04:12,180
it it just gives you a variation of

94
00:04:12,180 --> 00:04:14,879
tailored limited means that you you have

95
00:04:14,879 --> 00:04:17,399
unique constraints limit to it to your

96
00:04:17,399 --> 00:04:20,339
organization size this one more

97
00:04:20,339 --> 00:04:22,680
variation of of octave which is like

98
00:04:22,680 --> 00:04:25,979
octave is which is used for the teams

99
00:04:25,979 --> 00:04:28,620
less than 100 people and having a set

100
00:04:28,620 --> 00:04:30,600
modeling function of only just three to

101
00:04:30,600 --> 00:04:32,940
five people

102
00:04:32,940 --> 00:04:37,380
second is Strike trike is mostly works

103
00:04:37,380 --> 00:04:41,400
with uh in reference with ERM and what

104
00:04:41,400 --> 00:04:44,460
ERM is enter ERM is Enterprises

105
00:04:44,460 --> 00:04:48,660
management so it uh mainly works as a

106
00:04:48,660 --> 00:04:50,880
risk management tool within this

107
00:04:50,880 --> 00:04:52,680
framework that models are used to

108
00:04:52,680 --> 00:04:55,320
satisfy the security auditing process

109
00:04:55,320 --> 00:04:57,720
set models are based on requirement

110
00:04:57,720 --> 00:04:59,699
model and the requirement model

111
00:04:59,699 --> 00:05:01,740
established the stakeholder defined

112
00:05:01,740 --> 00:05:04,860
acceptable level of risk now what this

113
00:05:04,860 --> 00:05:07,620
acceptable level is we'll talk about it

114
00:05:07,620 --> 00:05:10,380
later when we will be talking about risk

115
00:05:10,380 --> 00:05:12,300
acceptance and installers

116
00:05:12,300 --> 00:05:15,000
then analysis of these requirement model

117
00:05:15,000 --> 00:05:17,639
yields a threat model from which threats

118
00:05:17,639 --> 00:05:19,680
are enumerated and assigned a particular

119
00:05:19,680 --> 00:05:22,080
risk values which ties to the business

120
00:05:22,080 --> 00:05:24,300
risks

121
00:05:24,300 --> 00:05:27,780
then third strike stride is quite

122
00:05:27,780 --> 00:05:30,240
popular and it's mostly a developer

123
00:05:30,240 --> 00:05:33,360
focused modeling technique stride stands

124
00:05:33,360 --> 00:05:35,699
for spoofing tampering repudiation

125
00:05:35,699 --> 00:05:38,940
information disclosure or denial of

126
00:05:38,940 --> 00:05:42,720
service and escalation of privileges

127
00:05:42,720 --> 00:05:45,780
so it is just a model of this used to

128
00:05:45,780 --> 00:05:48,320
help reason and find tricks to a system

129
00:05:48,320 --> 00:05:51,120
it is used in conjunction with a model

130
00:05:51,120 --> 00:05:53,639
of Target system that can be constructed

131
00:05:53,639 --> 00:05:55,080
in parallel

132
00:05:55,080 --> 00:05:58,080
like like other thread modeling models

133
00:05:58,080 --> 00:06:01,259
try do not works as a Works only in

134
00:06:01,259 --> 00:06:03,539
ideation phase or just set the End Cycle

135
00:06:03,539 --> 00:06:05,460
but Striders are like stride is

136
00:06:05,460 --> 00:06:07,440
applicable during the whole product life

137
00:06:07,440 --> 00:06:10,020
cycle like at every step you can think

138
00:06:10,020 --> 00:06:12,780
what we are building what processes we

139
00:06:12,780 --> 00:06:15,060
have but data stores we have what data

140
00:06:15,060 --> 00:06:16,800
flows we have and how we are creating

141
00:06:16,800 --> 00:06:19,259
the first boundaries between these all

142
00:06:19,259 --> 00:06:21,479
these data sources

143
00:06:21,479 --> 00:06:23,580
today it is often used by Security

144
00:06:23,580 --> 00:06:25,800
Experts to help answer a simple question

145
00:06:25,800 --> 00:06:28,560
what can go wrong in the system we are

146
00:06:28,560 --> 00:06:29,940
working on

147
00:06:29,940 --> 00:06:33,360
then we have pasta pasta is basically a

148
00:06:33,360 --> 00:06:35,580
process for attack simulation Theta

149
00:06:35,580 --> 00:06:38,520
analysis it's a seven step risk Centric

150
00:06:38,520 --> 00:06:42,539
method methodology just like trike it

151
00:06:42,539 --> 00:06:44,880
also works on to risk management thingy

152
00:06:44,880 --> 00:06:46,440
but like

153
00:06:46,440 --> 00:06:49,979
it measures business impacts more from

154
00:06:49,979 --> 00:06:52,500
the attacker's point of view the intent

155
00:06:52,500 --> 00:06:54,660
of this method is to provide a dynamic

156
00:06:54,660 --> 00:06:56,520
set identification

157
00:06:56,520 --> 00:06:59,099
enumeration and scoring process once the

158
00:06:59,099 --> 00:07:01,280
threat model is completed security

159
00:07:01,280 --> 00:07:03,660
Engineers can develop a detailed

160
00:07:03,660 --> 00:07:06,419
analysis of the identified sets finally

161
00:07:06,419 --> 00:07:08,759
the security controls can be numerated

162
00:07:08,759 --> 00:07:11,940
again the methodology is intended to

163
00:07:11,940 --> 00:07:13,979
provide an attacker-centric view of the

164
00:07:13,979 --> 00:07:15,380
application

165
00:07:15,380 --> 00:07:18,120
so that's that's all about Frameworks

166
00:07:18,120 --> 00:07:20,819
now why why we are thinking so much

167
00:07:20,819 --> 00:07:24,120
about threads why no no one likes

168
00:07:24,120 --> 00:07:27,419
threads no no one does but we

169
00:07:27,419 --> 00:07:30,479
we cannot protect against

170
00:07:30,479 --> 00:07:32,940
anything we cannot see we do not know

171
00:07:32,940 --> 00:07:35,340
about so we need to know threads if we

172
00:07:35,340 --> 00:07:37,800
want to defend ourselves from those

173
00:07:37,800 --> 00:07:40,919
threads so basically set modeling helps

174
00:07:40,919 --> 00:07:43,800
us to have a mitigation strategy and

175
00:07:43,800 --> 00:07:45,780
techniques based on the identified and

176
00:07:45,780 --> 00:07:49,379
documented sets you basically identify

177
00:07:49,379 --> 00:07:51,360
and address the greatest risk you

178
00:07:51,360 --> 00:07:53,280
prioritize this which

179
00:07:53,280 --> 00:07:55,620
which states you can assert which can

180
00:07:55,620 --> 00:07:58,080
which threads you can circumvent with

181
00:07:58,080 --> 00:07:59,699
another technology

182
00:07:59,699 --> 00:08:03,300
you increase the risk awareness in your

183
00:08:03,300 --> 00:08:06,300
organization

184
00:08:12,479 --> 00:08:14,280
then you basically

185
00:08:14,280 --> 00:08:16,620
once you have threats and once you know

186
00:08:16,620 --> 00:08:20,160
how how your risk exposure looks like

187
00:08:20,160 --> 00:08:23,160
you benefit from cause justification and

188
00:08:23,160 --> 00:08:25,500
support for needed controls

189
00:08:25,500 --> 00:08:28,259
you can use artifacts to document due

190
00:08:28,259 --> 00:08:30,479
diligence for each software project each

191
00:08:30,479 --> 00:08:32,339
infrastructure project any kind of

192
00:08:32,339 --> 00:08:35,820
project you have in your organization

193
00:08:35,820 --> 00:08:39,240
then some examples like how threats look

194
00:08:39,240 --> 00:08:41,958
like basically and like

195
00:08:41,958 --> 00:08:44,760
uh we will be talking about examples

196
00:08:44,760 --> 00:08:47,459
only in the text of stride because

197
00:08:47,459 --> 00:08:49,740
otherwise it will be a lot of examples

198
00:08:49,740 --> 00:08:52,620
if we start picking every framework

199
00:08:52,620 --> 00:08:56,339
so stride as as I said stride stands for

200
00:08:56,339 --> 00:08:57,899
spoofing tampering reputation

201
00:08:57,899 --> 00:09:00,360
information disclosure dos and elevation

202
00:09:00,360 --> 00:09:03,140
of privileges

203
00:09:03,200 --> 00:09:07,920
likes every every uh keyword and stride

204
00:09:07,920 --> 00:09:11,160
impacts a particular parameter of a

205
00:09:11,160 --> 00:09:13,920
paradigm of information security so

206
00:09:13,920 --> 00:09:16,500
spoofing impacts authenticity tampering

207
00:09:16,500 --> 00:09:19,500
uh impacts Integrity reputation causes

208
00:09:19,500 --> 00:09:22,380
non-reputability information disclosure

209
00:09:22,380 --> 00:09:25,560
is breach of confidentiality doses

210
00:09:25,560 --> 00:09:28,080
breach of like there is no availability

211
00:09:28,080 --> 00:09:30,660
and elevation of privileges Beach breach

212
00:09:30,660 --> 00:09:32,420
of authorization

213
00:09:32,420 --> 00:09:35,880
so how what is pooping spoofing is

214
00:09:35,880 --> 00:09:39,959
basically illegal access and using that

215
00:09:39,959 --> 00:09:42,360
access to have

216
00:09:42,360 --> 00:09:45,300
have information which one are not

217
00:09:45,300 --> 00:09:47,399
supposed to have

218
00:09:47,399 --> 00:09:49,620
the basic example can be cookie

219
00:09:49,620 --> 00:09:51,720
hijacking like if for example if you

220
00:09:51,720 --> 00:09:54,380
have an application in an organization

221
00:09:54,380 --> 00:09:57,959
where you can if you reuse cookie of

222
00:09:57,959 --> 00:09:59,640
another user then you can basically

223
00:09:59,640 --> 00:10:01,980
login into the account if there's no 2f

224
00:10:01,980 --> 00:10:04,560
enabled so so that's a spoofing that

225
00:10:04,560 --> 00:10:07,680
from that particular application then we

226
00:10:07,680 --> 00:10:09,720
come to tampering tampering is more

227
00:10:09,720 --> 00:10:12,720
about integrity and like example can

228
00:10:12,720 --> 00:10:15,120
include unauthorized changes made to a

229
00:10:15,120 --> 00:10:17,760
persistent data such as dark held in

230
00:10:17,760 --> 00:10:21,839
some database and alteration of data or

231
00:10:21,839 --> 00:10:24,420
maybe alternation of data when data is

232
00:10:24,420 --> 00:10:26,880
in flow from an open network to a

233
00:10:26,880 --> 00:10:29,399
computer like man in a middle attack you

234
00:10:29,399 --> 00:10:31,500
intercept thing and you manipulate it so

235
00:10:31,500 --> 00:10:32,820
approximately

236
00:10:32,820 --> 00:10:35,279
then we have repudiation

237
00:10:35,279 --> 00:10:37,980
reputation gets a bit complicated like

238
00:10:37,980 --> 00:10:40,380
reputation is

239
00:10:40,380 --> 00:10:44,579
Associated when you cannot

240
00:10:44,579 --> 00:10:48,140
a reputation can be can cause

241
00:10:48,140 --> 00:10:50,700
non-reputation which is like when you

242
00:10:50,700 --> 00:10:54,860
cannot backtrack the options of a user

243
00:10:54,860 --> 00:10:57,360
backtrack malicious actions to a

244
00:10:57,360 --> 00:10:59,760
particular user for example if you have

245
00:10:59,760 --> 00:11:02,760
a application in your organization

246
00:11:02,760 --> 00:11:06,360
which can only have single admin and you

247
00:11:06,360 --> 00:11:08,940
have three system administrator and what

248
00:11:08,940 --> 00:11:10,680
they're basically doing are they are

249
00:11:10,680 --> 00:11:12,899
using single set of credential between

250
00:11:12,899 --> 00:11:15,180
three of them

251
00:11:15,180 --> 00:11:17,700
if one of them

252
00:11:17,700 --> 00:11:20,760
poses like is The Insider threat to the

253
00:11:20,760 --> 00:11:22,620
organization and they do some malicious

254
00:11:22,620 --> 00:11:26,519
action you cannot use the audit logs of

255
00:11:26,519 --> 00:11:28,920
the that application to backtrack the

256
00:11:28,920 --> 00:11:30,720
activity of the malicious user because

257
00:11:30,720 --> 00:11:33,120
all three users are using the same set

258
00:11:33,120 --> 00:11:36,019
of credentials

259
00:11:38,180 --> 00:11:42,000
becomes useless so it's it is considered

260
00:11:42,000 --> 00:11:44,459
as a risk and then there is information

261
00:11:44,459 --> 00:11:47,220
flow or disclosure information

262
00:11:47,220 --> 00:11:49,740
disclosure is just

263
00:11:49,740 --> 00:11:51,899
breach of information which should not

264
00:11:51,899 --> 00:11:55,560
be exposed and it can be accidental

265
00:11:55,560 --> 00:11:58,380
share of files externally like if if

266
00:11:58,380 --> 00:12:02,040
some some files are

267
00:12:02,040 --> 00:12:04,019
files are confidential to your

268
00:12:04,019 --> 00:12:06,180
organization and they get shared by

269
00:12:06,180 --> 00:12:08,639
human error or by Insider thread outside

270
00:12:08,639 --> 00:12:10,620
the organization

271
00:12:10,620 --> 00:12:12,899
there then basically it's an information

272
00:12:12,899 --> 00:12:15,180
disclosure

273
00:12:15,180 --> 00:12:18,300
in some cases you can reduce

274
00:12:18,300 --> 00:12:21,480
human uh error factor for example if you

275
00:12:21,480 --> 00:12:23,519
have shared drives in your company

276
00:12:23,519 --> 00:12:25,440
and

277
00:12:25,440 --> 00:12:28,279
human error can't happen that one user

278
00:12:28,279 --> 00:12:30,540
accidentally shares

279
00:12:30,540 --> 00:12:33,260
your confidential data with someone

280
00:12:33,260 --> 00:12:36,660
external to just a single click but you

281
00:12:36,660 --> 00:12:39,240
can enforce controls that like you can

282
00:12:39,240 --> 00:12:41,820
have DLP policies on your shared drives

283
00:12:41,820 --> 00:12:45,240
that you can uh restrict the external

284
00:12:45,240 --> 00:12:48,600
use external share at all so even if

285
00:12:48,600 --> 00:12:51,180
they make that error it won't happen

286
00:12:51,180 --> 00:12:53,579
then there's the dial of service then I

287
00:12:53,579 --> 00:12:55,560
lost service is basically denying the

288
00:12:55,560 --> 00:12:58,139
service to valid users for example

289
00:12:58,139 --> 00:12:59,940
making a web server temporarily

290
00:12:59,940 --> 00:13:02,940
unavailable or unusable

291
00:13:02,940 --> 00:13:06,240
then we have elevation of privilege an

292
00:13:06,240 --> 00:13:08,880
unprivileged user against a privilege

293
00:13:08,880 --> 00:13:11,399
access and then compromise the security

294
00:13:11,399 --> 00:13:14,360
or destroy the entire infrastructure

295
00:13:14,360 --> 00:13:17,360
uh yesterday I was having an interesting

296
00:13:17,360 --> 00:13:20,700
discussion with a friend about elevation

297
00:13:20,700 --> 00:13:23,940
of privilege that if if we have a

298
00:13:23,940 --> 00:13:25,320
project in

299
00:13:25,320 --> 00:13:27,839
any ticket management tool

300
00:13:27,839 --> 00:13:31,560
and if we want to restrict that project

301
00:13:31,560 --> 00:13:33,120
from

302
00:13:33,120 --> 00:13:36,240
admin of that particular tool then it's

303
00:13:36,240 --> 00:13:38,639
it's nearly possible because admin can

304
00:13:38,639 --> 00:13:41,339
always give themselves privilege to have

305
00:13:41,339 --> 00:13:43,560
access to that project

306
00:13:43,560 --> 00:13:47,100
so it's it's an issue

307
00:13:47,100 --> 00:13:50,100
then they went to now we know what is

308
00:13:50,100 --> 00:13:52,320
State modeling how to do threat modeling

309
00:13:52,320 --> 00:13:56,360
now when to do threat modeling

310
00:13:56,360 --> 00:14:00,300
mainly set modeling is done as a top to

311
00:14:00,300 --> 00:14:03,839
bottom exercise when certain benchmarks

312
00:14:03,839 --> 00:14:07,380
are met for example if you have plan if

313
00:14:07,380 --> 00:14:09,720
you have plans of launching new set of

314
00:14:09,720 --> 00:14:13,380
features if you have been developing new

315
00:14:13,380 --> 00:14:17,420
features or you have like your

316
00:14:17,420 --> 00:14:20,100
acquiring some companies so maybe you

317
00:14:20,100 --> 00:14:23,760
want to set model the coming entity or

318
00:14:23,760 --> 00:14:25,320
you might be having a compliance

319
00:14:25,320 --> 00:14:28,079
requirement or you might be needing a

320
00:14:28,079 --> 00:14:30,300
regulatory approval so that modeling

321
00:14:30,300 --> 00:14:32,940
matters because it gives you the the

322
00:14:32,940 --> 00:14:35,100
score of your company which

323
00:14:35,100 --> 00:14:37,500
ties back to

324
00:14:37,500 --> 00:14:40,740
which ties back to for finances of your

325
00:14:40,740 --> 00:14:42,420
company

326
00:14:42,420 --> 00:14:45,180
and like when the

327
00:14:45,180 --> 00:14:47,459
one use case which I always think is

328
00:14:47,459 --> 00:14:51,060
like if a engineering team is if an

329
00:14:51,060 --> 00:14:52,920
engineering team face some incident and

330
00:14:52,920 --> 00:14:55,800
they are doing root cause analysis

331
00:14:55,800 --> 00:14:57,720
then they

332
00:14:57,720 --> 00:15:00,360
they can do threat modeling during uh

333
00:15:00,360 --> 00:15:03,600
during RCS as well because even when the

334
00:15:03,600 --> 00:15:06,120
root causes of a more pedestrian nature

335
00:15:06,120 --> 00:15:08,519
performing a root cause analysis can get

336
00:15:08,519 --> 00:15:09,899
the right people thinking about

337
00:15:09,899 --> 00:15:13,019
potential threats they may have ignored

338
00:15:13,019 --> 00:15:16,139
previously or they never considered them

339
00:15:16,139 --> 00:15:19,139
or maybe by patching that particular

340
00:15:19,139 --> 00:15:21,959
vulnerability they might propose new

341
00:15:21,959 --> 00:15:23,940
dependency which

342
00:15:23,940 --> 00:15:26,699
May or introduce unexpected security

343
00:15:26,699 --> 00:15:29,040
issues

344
00:15:29,040 --> 00:15:31,380
then otherwise in my opinion threat

345
00:15:31,380 --> 00:15:32,880
modeling perspective should be the way

346
00:15:32,880 --> 00:15:35,279
of life for every security engineer or

347
00:15:35,279 --> 00:15:37,560
like engineering team as it promotes

348
00:15:37,560 --> 00:15:41,040
security by Design from every aspect

349
00:15:41,040 --> 00:15:43,620
a day comes when you don't have to do

350
00:15:43,620 --> 00:15:45,660
set modeling exercise anymore because

351
00:15:45,660 --> 00:15:48,120
you are designing everything from the

352
00:15:48,120 --> 00:15:49,680
threat modeling perspective you are

353
00:15:49,680 --> 00:15:53,220
thinking security before doing things

354
00:15:53,220 --> 00:15:56,100
and it it is applicable from application

355
00:15:56,100 --> 00:15:57,660
to infrastructure

356
00:15:57,660 --> 00:15:59,880
infrastructure to your even physical

357
00:15:59,880 --> 00:16:01,620
security

358
00:16:01,620 --> 00:16:04,199
so now when not to do set modeling we

359
00:16:04,199 --> 00:16:06,300
just said that we should do set modeling

360
00:16:06,300 --> 00:16:09,899
by default but when not to do it

361
00:16:09,899 --> 00:16:13,440
basically I I can think of only one

362
00:16:13,440 --> 00:16:15,360
thing when not to do it when you have

363
00:16:15,360 --> 00:16:18,120
plenty of threats in your environment

364
00:16:18,120 --> 00:16:20,040
and those threats are critical you

365
00:16:20,040 --> 00:16:22,259
cannot just ignore them and find more

366
00:16:22,259 --> 00:16:24,180
five hazards in your organization

367
00:16:24,180 --> 00:16:27,360
husbands of wise men said that you don't

368
00:16:27,360 --> 00:16:29,639
go and look for more fire hazards when

369
00:16:29,639 --> 00:16:32,279
your house is already on fire don't

370
00:16:32,279 --> 00:16:34,320
overwhelm your engineering team so they

371
00:16:34,320 --> 00:16:37,320
stop caring about the threats

372
00:16:37,320 --> 00:16:40,019
husband Stephen and Napo said that it is

373
00:16:40,019 --> 00:16:42,300
a mirror of security gaps but cyber

374
00:16:42,300 --> 00:16:44,279
threat is mainly a reflection of our

375
00:16:44,279 --> 00:16:46,939
weaknesses

376
00:16:47,100 --> 00:16:50,279
then my dad my my dad is a great set

377
00:16:50,279 --> 00:16:53,160
modeler and that's a good thing but what

378
00:16:53,160 --> 00:16:55,079
he's doing wrong

379
00:16:55,079 --> 00:16:58,320
he is doing thus he is making the same

380
00:16:58,320 --> 00:17:00,000
mistake but almost every security

381
00:17:00,000 --> 00:17:03,540
engineering team makes which is threat

382
00:17:03,540 --> 00:17:04,740
modeling

383
00:17:04,740 --> 00:17:07,260
being good at set modeling is one thing

384
00:17:07,260 --> 00:17:09,599
and dealing with the outcomes of it is

385
00:17:09,599 --> 00:17:10,799
another

386
00:17:10,799 --> 00:17:13,699
so

387
00:17:14,640 --> 00:17:17,039
if you are doing threat modeling you are

388
00:17:17,039 --> 00:17:19,500
getting reports how how are you dealing

389
00:17:19,500 --> 00:17:22,579
with the results are you becoming

390
00:17:22,579 --> 00:17:24,599
overwhelmed are they becoming

391
00:17:24,599 --> 00:17:26,400
overwhelming to you or like what's

392
00:17:26,400 --> 00:17:28,799
happening so basically two wrong things

393
00:17:28,799 --> 00:17:31,679
happen usually when you deal with the

394
00:17:31,679 --> 00:17:33,480
threat modeling reports

395
00:17:33,480 --> 00:17:36,900
first is either security teams becomes

396
00:17:36,900 --> 00:17:39,900
too paranoid or engineering teams stop

397
00:17:39,900 --> 00:17:42,179
caring at all about them

398
00:17:42,179 --> 00:17:45,660
and those are like Pro usual cases and

399
00:17:45,660 --> 00:17:47,940
they they happen in lots of organization

400
00:17:47,940 --> 00:17:50,340
why they happen

401
00:17:50,340 --> 00:17:52,980
mainly security Engineers can get too

402
00:17:52,980 --> 00:17:55,559
paranoid they this they become a

403
00:17:55,559 --> 00:17:58,260
bottleneck for every processor every uh

404
00:17:58,260 --> 00:18:00,600
thing everything coming

405
00:18:00,600 --> 00:18:04,559
so we can start with risk acceptance

406
00:18:04,559 --> 00:18:06,900
what is risk acceptance risk acceptance

407
00:18:06,900 --> 00:18:08,760
is like

408
00:18:08,760 --> 00:18:11,760
amount of risk your organization is

409
00:18:11,760 --> 00:18:14,820
willing to accept and risk appetite it

410
00:18:14,820 --> 00:18:18,900
is like capacity of risk they can like

411
00:18:18,900 --> 00:18:21,360
the diverse kind of risk your

412
00:18:21,360 --> 00:18:23,820
organization can accept to achieve its

413
00:18:23,820 --> 00:18:26,580
business objects organizations basically

414
00:18:26,580 --> 00:18:29,220
recognize that they cannot remove all

415
00:18:29,220 --> 00:18:31,980
risk from their business and like we

416
00:18:31,980 --> 00:18:35,100
exist in world full of risk and for

417
00:18:35,100 --> 00:18:37,919
achieving our business goals we need to

418
00:18:37,919 --> 00:18:40,500
require accept some risk and mitigate

419
00:18:40,500 --> 00:18:43,320
them or either transfer them we can have

420
00:18:43,320 --> 00:18:46,140
we can have compensating controls around

421
00:18:46,140 --> 00:18:47,580
the threats to

422
00:18:47,580 --> 00:18:50,460
reduce the threat and have been residual

423
00:18:50,460 --> 00:18:52,919
threats which is like of lesser risk

424
00:18:52,919 --> 00:18:54,000
factor

425
00:18:54,000 --> 00:18:56,760
then what is this tolerance this

426
00:18:56,760 --> 00:18:58,799
tolerance is the amount of acceptable

427
00:18:58,799 --> 00:19:00,179
deviation

428
00:19:00,179 --> 00:19:02,700
from an organization's risk appetite

429
00:19:02,700 --> 00:19:05,580
while this appetite is a broad and like

430
00:19:05,580 --> 00:19:08,400
strategic term this tolerance is much

431
00:19:08,400 --> 00:19:10,740
more of a technical or tactical concept

432
00:19:10,740 --> 00:19:13,200
that identify the risk associated with a

433
00:19:13,200 --> 00:19:15,419
specific initiative or a specific

434
00:19:15,419 --> 00:19:19,160
project while risk appetite is

435
00:19:19,160 --> 00:19:21,960
organizations appetite and risk

436
00:19:21,960 --> 00:19:24,780
tolerance various projector project

437
00:19:24,780 --> 00:19:28,080
one way to understand the solution is I

438
00:19:28,080 --> 00:19:29,700
was reading an article by Tech Target

439
00:19:29,700 --> 00:19:32,280
and they presented it like

440
00:19:32,280 --> 00:19:34,880
where for example when

441
00:19:34,880 --> 00:19:37,620
uh driving

442
00:19:37,620 --> 00:19:40,260
at very high speed on

443
00:19:40,260 --> 00:19:42,780
government routes is like

444
00:19:42,780 --> 00:19:46,919
is a high risk for the driver and to all

445
00:19:46,919 --> 00:19:49,200
the other drivers on the right Road as

446
00:19:49,200 --> 00:19:52,020
well and government create speed limits

447
00:19:52,020 --> 00:19:55,020
designed to control this is the faster a

448
00:19:55,020 --> 00:19:57,780
car drives the more risk is created so

449
00:19:57,780 --> 00:20:00,179
the lower the speed limit the lower the

450
00:20:00,179 --> 00:20:03,059
degree of overall is to the every driver

451
00:20:03,059 --> 00:20:07,740
on the road however lower speed limits

452
00:20:07,740 --> 00:20:10,500
uh lower limits also inhibits the flow

453
00:20:10,500 --> 00:20:12,539
of traffic preventing vehicles from

454
00:20:12,539 --> 00:20:14,480
quickly reaching their destinations

455
00:20:14,480 --> 00:20:17,220
government must balance these concerns

456
00:20:17,220 --> 00:20:18,840
and determine the appropriate rate of

457
00:20:18,840 --> 00:20:21,539
speed which is like governments as

458
00:20:21,539 --> 00:20:24,900
capital type like how much risk they are

459
00:20:24,900 --> 00:20:26,880
willing to take to strike the balance

460
00:20:26,880 --> 00:20:27,840
between

461
00:20:27,840 --> 00:20:31,340
risk and fit

462
00:20:31,919 --> 00:20:35,039
then fun part how how I built a threat

463
00:20:35,039 --> 00:20:36,799
modeling function with just three people

464
00:20:36,799 --> 00:20:39,120
including me in our team

465
00:20:39,120 --> 00:20:41,760
and like it's totally doable just just

466
00:20:41,760 --> 00:20:43,980
give them a perspective just make them

467
00:20:43,980 --> 00:20:46,559
think and

468
00:20:46,559 --> 00:20:48,659
just make them think how things can go

469
00:20:48,659 --> 00:20:50,340
wrong and tell them to spread that

470
00:20:50,340 --> 00:20:52,500
mindset like when I started in my

471
00:20:52,500 --> 00:20:54,559
organization we were just three people

472
00:20:54,559 --> 00:20:57,240
loads of features in product were coming

473
00:20:57,240 --> 00:20:59,940
we were Reinventing infrastructure we

474
00:20:59,940 --> 00:21:01,919
were migrating to different Technologies

475
00:21:01,919 --> 00:21:04,080
hence threat modeling was needed

476
00:21:04,080 --> 00:21:06,000
everywhere we were waiting on regulatory

477
00:21:06,000 --> 00:21:07,799
approval we were waiting on complex

478
00:21:07,799 --> 00:21:10,679
requirements will be hard to do set

479
00:21:10,679 --> 00:21:13,380
modeling at every every step and there

480
00:21:13,380 --> 00:21:15,720
were so many like uh landmines in

481
00:21:15,720 --> 00:21:16,440
between

482
00:21:16,440 --> 00:21:19,020
so in my experience Frameworks are good

483
00:21:19,020 --> 00:21:21,840
for for or to give you a Mountainside or

484
00:21:21,840 --> 00:21:23,640
perspective when you are new to threat

485
00:21:23,640 --> 00:21:26,400
modeling but with time you develop it

486
00:21:26,400 --> 00:21:29,700
like Frameworks becomes a bit hard to

487
00:21:29,700 --> 00:21:32,760
scale up or become a bit complicated for

488
00:21:32,760 --> 00:21:34,380
a big organization

489
00:21:34,380 --> 00:21:37,020
and it's it's sometimes hard to go by

490
00:21:37,020 --> 00:21:39,600
the book all the time so you can have

491
00:21:39,600 --> 00:21:42,299
your own framework and you can decide

492
00:21:42,299 --> 00:21:44,700
how you want to measure the uh threat

493
00:21:44,700 --> 00:21:48,240
and Link it to the risk factor

494
00:21:48,240 --> 00:21:51,240
then once you are proficient at threat

495
00:21:51,240 --> 00:21:53,220
modeling then you pass on that mindset

496
00:21:53,220 --> 00:21:55,860
through every team then every team every

497
00:21:55,860 --> 00:21:58,440
engineering team learns to set model

498
00:21:58,440 --> 00:22:01,620
of what's coming and even gets better as

499
00:22:01,620 --> 00:22:03,900
they understand the product more than

500
00:22:03,900 --> 00:22:06,299
you they understand the infrastructure

501
00:22:06,299 --> 00:22:07,860
better than you as they are working on

502
00:22:07,860 --> 00:22:10,440
infrastructure all the time and they see

503
00:22:10,440 --> 00:22:13,500
the gaps just better than you like I've

504
00:22:13,500 --> 00:22:15,600
been on calls where I used to do threat

505
00:22:15,600 --> 00:22:18,120
modeling and now those developers all

506
00:22:18,120 --> 00:22:19,919
those infrastructure Engineers are doing

507
00:22:19,919 --> 00:22:21,480
threat modeling way better than me

508
00:22:21,480 --> 00:22:23,940
because they understand how it is

509
00:22:23,940 --> 00:22:26,760
working I have to first understand the

510
00:22:26,760 --> 00:22:29,340
technology to find to highlight the

511
00:22:29,340 --> 00:22:31,740
threads but they already know how it's

512
00:22:31,740 --> 00:22:35,280
uh how it's working in detail they they

513
00:22:35,280 --> 00:22:37,280
just need that mindset

514
00:22:37,280 --> 00:22:40,919
to look into things what what can go

515
00:22:40,919 --> 00:22:42,780
wrong and imagine every worst case

516
00:22:42,780 --> 00:22:44,220
scenario

517
00:22:44,220 --> 00:22:46,980
and as as I always say that threat

518
00:22:46,980 --> 00:22:48,900
modeling is more than just an exercise

519
00:22:48,900 --> 00:22:54,140
it's it's a mind mindset or a philosophy

520
00:22:54,240 --> 00:22:56,820
I'll conclude my slides with like

521
00:22:56,820 --> 00:22:58,980
thanking to Mark sandal who helped me

522
00:22:58,980 --> 00:23:01,440
brainstorming ideas and curating a raw

523
00:23:01,440 --> 00:23:04,140
idea about the threat modeling and like

524
00:23:04,140 --> 00:23:06,120
supporting me into building the whole

525
00:23:06,120 --> 00:23:10,039
function and just with just three people

526
00:23:10,340 --> 00:23:13,919
so any questions you can always find me

527
00:23:13,919 --> 00:23:16,440
at Twitter and Discord I'm I'm

528
00:23:16,440 --> 00:23:19,860
quite active there and always open for

529
00:23:19,860 --> 00:23:23,299
chat thank you