The Why
The motivation of a cyber attacker may fall into one or more of these categories financial gain, political motives, revenge, espionage or terrorism. Once an attacker gets in they may install malware, such as a virus or ransomware. This can disrupt operations, lock users out of their systems, or even cause physical damage to infrastructure. Understanding the motives behind cyber attacks helps to prevent and respond to them effectively.
The primary goal of threat modelling is to identify vulnerabilities and risks before they can be exploited by attackers, allowing organizations to take proactive measures to mitigate these risks.
This should include a list of critical assets and services that need to be protected. Examine the points of data entry or extraction to determine the surface attack area and check if user roles have varying levels of privileges.
Threat modelling should begin in the early stages of the SDLC, when the requirements and the design of the system are being established. This is because the earlier in the SDLC that potential security risks are identified and addressed, the easier and less expensive they are to mitigate. Also, it is advisable to engage your security operations team early in the design phase. Due to the sensitive nature of the threat modelling document, it would be advisable to label the document as confidential and not distribute freely within an organisation.
It is important to revisit the threat model to identify any new security risks that may have emerged and when new functionality is added to a system, or as the system is updated or changed.
Threat modelling is typically viewed from an attacker’s perspective instead of a defender’s viewpoint. Remember the most likely goal or motive of an attacker is information theft, espionage or sabotage. When modelling your threats, ensure you include both externally and internally initiated attacks.
To assist in determining the possible areas of vulnerabilities, a data flow diagram (DFD) would be beneficial. This will give a visual representation of how the application processes the data and highlights any persistent points. It helps to identify the potential entry points an attacker may use and the paths that they could take through the system to reach critical data or functionality.
The How
Let’s go through the process of modelling a simple CRM website which maintains a list of customers stored in a database hosted in Azure.
The hypothetical solution uses a Web Application Gateway to provide HA (High Availability) using two webservices. There are also two microservices, one manages all the SQL Database CRUD operations for customers and the other manages all customers images that are persisted to a blob store. Connection strings to the database are stored in Azure Key vault. Customers use their social enterprise identities to gain access to the website by using Azure AD B2C.
The help with the process of threat modelling the application, a DFD (Data Flow Diagram) is used to show the flow of information between the processors and stores. Once the DFD is completed, add the different trust boundaries on the DFD drawing.
Next, we will start the threat modelling process to expose any potential threats in the solution. For this we use the STRIDE Model developed by Microsoft https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool-threats#stride-model. There are other modelling tools available such as PASTA (Process for Attack Simulation and Threat Analysis), LINDDUN (link ability, identifiability, nonrepudiation, detectability, disclosure of information, unawareness, noncompliance), Common Vulnerability Scoring System (CVSS) and Attack Trees.
The STRIDE framework provides a structured approach to identifying and addressing potential threats during the software development lifecycle
STRIDE is an acronym for Spoofing, Tampering, Repudiation, Information disclosure, Denial of Service, and Elevation of privilege.
The method I use involves creating a table that outlines each of the STRIDE categories, documenting potential threats and the corresponding mitigation measures. Use the DFD to analyse the security implications of data flows within a system and identify potential threats for each of the STRIDE categories. The mitigation may include implementing access controls, encryption mechanisms, secure authentication methods, data validation, and monitoring systems for suspicious activities.
Spoofing (Can a malicious user impersonate a legitimate entity or system to deceive users or gain unauthorized access)
| Id | Threat | Risk | Mitigation |
| SF01 | Unauthorized user attempts to impersonate a legitimate customer or administrator account | Moderate | Users authenticate using industrial authentication mechanisms and Administers enforced to use MFA. Azure AD monitoring to detect suspicious login activities. |
| SF02 | Forgery of authentication credentials to gain unauthorized access. | Low | Token based authentication is used to protect against forged credentials |
Tampering (Can a malicious user modify data or components used by the system?)
| Id | Threat | Risk | Mitigation |
| TP01 | Unauthorized modification of CRM data in transit or at rest. | Moderate | TLS transport is used between all the components. SQL Database and Blob store are encrypted at rest by default. |
| TP02 | Manipulation of form input fields to submit malicious data. | High | Data validation and sanitation is performed at every system process. Configure the Web Application Firewall (WAF) rules to mitigate potential attacks. |
| TP03 | SQL injection attacks targeting the SQL Database. | Moderate | Secure coding practices to prevent SQL injection vulnerabilities. Configure the Web Application Firewall (WAF) rules to mitigate potential attacks. |
| TP04 | Unauthorized changes to the CRM website’s code or configuration. | Low | Source code is maintained in Azure Devops and deployed using pipelines which incorporate code analyses and testing. |
Repudiation (Can a malicious user deny that they performed an action to change system state?)
| Id | Threat | Risk | Mitigation |
| RP01 | Users deny actions performed on the CRM website. | Low | Logging and audit mechanisms implemented to capture user actions and system events |
| RP02 | Attackers manipulate logs or forge identities to repudiate their actions. | Moderate | Access to log files are protected by RBAC roles. |
Information Leakage (Can a malicious user extract information that should be kept secret?)
| Id | Threat | Risk | Mitigation |
| IL01 | Customer data exposed due to misconfigured access controls. | High | Follow the principle of least privilege and enforce proper access controls for CRM data. |
| IL02 | Insecure handling of sensitive information during transit or storage. | High | Encryption for sensitive data at rest and TLS is used when in transit. |
| IL03 | Improperly configured Blob Store permissions leading to unauthorized access to customer images. | Moderate | Regularly assess and update Blob Store permissions to ensure proper access restrictions. |
Denial of Service (Can a malicious user disrupt or degrade system functionality or availability?)
| Id | Threat | Risk | Mitigation |
| DS01 | Application Gateway targeted with a high volume of requests, overwhelming its capacity. | High | Configure appropriate rate limiting and throttling rules on the Application Gateway. |
| DS02 | SQL Database subjected to resource-intensive queries, causing service disruption. | Low | Implemented SQL Database performance tuning and query optimization techniques. |
| DS03 | Azure Blob Store overwhelmed with excessive image upload requests, impacting availability. | Moderate | Exponential back-off is implemented to decrease and to ease out spikes in traffic the store. |
Elevation of Privilege (Can a malicious user escalate their privileges to gain unauthorized access to restricted resources or perform unauthorized actions?)
| Id | Threat | Risk | Mitigation |
| EP01 | Unauthorized users gaining administrative privileges and accessing sensitive functionalities. | Moderate | Sensitive resource connection strings stored in Key vault. Implement network segmentation and access controls to limit lateral movement within Azure resources. SQL Database hosted inside VNet and access controlled by NSG |
| EP02 | Exploiting vulnerabilities to escalate user privileges and gain unauthorized access to restricted data or features. | Low | Regularly apply security patches and updates to the CRM website and underlying Azure components. Conduct regular security assessments and penetration testing to identify and address vulnerabilities. |
Alternative Approach
Instead of going through this process yourself, Microsoft offer a threat modeling tool which allows you to draw your Data Flow Diagram that represents your solution. Then the tool allows you to generate an HTML report of all the potential security issues and suggested mitigations. The tool can be downloaded from here https://learn.microsoft.com/en-us/azure/security/develop/threat-modeling-tool
Conclustion
With the rising sophistication of attacks and the targeting of critical infrastructure, cyber threats have become increasingly imminent and perilous. The vulnerabilities present in the Internet of Things (IoT) further contribute to this escalating threat landscape. Additionally, insider threats, risks associated with cloud and remote work, and the interconnected nature of the global network intensify the dangers posed by cyber threats.
To combat these threats effectively, it is crucial for organisations and individuals to priorities cybersecurity measures, including robust defenses, regular updates, employee training, and strong encryption techniques.
By reading this article, it is hoped that the significance of incorporating threat modeling into your application development process is emphasized.
