In this section of the course,
we are going to discuss threat modeling considerations.
The threat modeling consideration section of the course
focuses on "Domain 1: Governance, Risk, and Compliance,"
as well as "Domain 3: Security Engineering,"
specifically, objectives 1.4 and 3.2.
Objective 1.4 states that, given a scenario,
you must be able to perform threat modeling activities.
Objective 3.2 states that, given a scenario,
you must be able to analyze requirements
to enhance the security of endpoints and servers.
Threat modeling is the process of identifying and evaluating
potential threats to your organization.
When assessing potential threats,
it's important to understand
not only who might target your organization,
but also why they might do so.
Different attackers have varying levels
of resources, skills, and motivations,
each of which influence the strategies and tools they use.
By analyzing these factors,
you can anticipate how an attack might occur
and prepare defenses to respond to it.
As we go through this section,
we'll cover many topics
related to threat modeling considerations,
including threat actor motivation,
threat actor resources, threat actor capabilities,
attack patterns, threat actor methods,
initial access and escalation methods,
and post-exploitation and evasion methods.
First, we will look at threat actor motivation.
Threat actor motivations are the underlying reasons or goals
that drive an attacker to target
a specific organization or system.
Threat actor motivations include geopolitical,
espionage, financial, activism, and notoriety factors.
Geopolitical motivations often involve nation state actors
seeking to disrupt or influence
another country's political or economic stability.
Espionage is driven by the desire
to steal sensitive information
such as intellectual property or state secrets.
Financially-motivated attackers seek monetary gain
usually through activities
like ransomware attacks or fraud.
Activists, often known as hacktivists,
aim to promote a political or social cause
by disrupting services or leaking information.
And notoriety-driven attackers,
including thrill seekers
or those seeking to build a reputation,
may target high-profile systems
to gain recognition or bragging rights.
In comparison, a financially-motivated attacker
might deploy ransomware
to extort money from an organization,
while a politically-motivated attacker
might launch a cyberattack to destabilize a rival nation
during a time of political tension.
Next we will explore threat actor resources.
Threat actor resources are the assets
that an attacker has available
to plan, execute, and sustain an attack.
Threat actor characteristics include resource considerations
such as time and money.
Time is a critical resource.
Well-funded threat actors like nation state actors
may have the luxury to conduct
prolonged sophisticated campaigns,
allowing them to meticulously plan and execute their attacks
over months or even years.
Money enables attackers to purchase advanced tools,
higher-skilled personnel or even acquire zero-day exploits.
In this way, money significantly increases
the sophistication and potential impact of operations.
For example, a financially-backed threat actor
might spend significant resources to buy high-end malware
or bribe insiders,
while a less resourced attacker might rely
on publicly available tools and quick opportunistic attacks.
After that, we will look at threat actor capabilities.
Threat actor capabilities are the skills, tools,
and expertise that attackers possess
to identify and exploit vulnerabilities in a target system.
Threat actor characteristics include capabilities
such as knowledge, vulnerability creation, exploit creation,
and supply chain access.
Threat actor knowledge encompasses an understanding
of a target's systems and defenses.
Knowledge, usually through enumeration or inside sources,
enables attackers to effectively identify vulnerabilities
and exploit weaknesses.
Next, vulnerability creation involves the ability
to introduce new vulnerabilities within a system.
Exploit creation, on the other hand,
refers to the development of tools or methods
to take advantage of identified vulnerabilities.
Finally, supply chain access
represents an advanced capability where attackers infiltrate
third-party vendors or service providers
to compromise the target indirectly.
Next, we will explore attack patterns.
Attack patterns are tactics and techniques
that threat actors use
to exploit vulnerabilities in a system.
In threat modeling,
attack patterns may be modeled to include injection,
authentication and authorization,
and on-path attacks.
Injection attacks involve
inserting malicious code or commands into a system
through vulnerable input points.
Modeled injection attacks include SQL injection
into a web application
with the goal of manipulating the system's behavior.
Authentication and authorization attacks
target the mechanisms that control user access.
Authentication and authorization attacks
include brute force attacks on passwords
or exploiting flaws in access control lists
to gain unauthorized entry.
On-path attacks, formerly known
as man-in-the-middle attacks,
occur when an attacker intercepts
and potentially alters communications between two parties.
On-path attacks aim to steal sensitive information
or inject malicious content.
In application, a modeled threat attacker
could use an injection attack to compromise a database,
then exploit weak authentication controls
to escalate privileges,
and finally execute an on-path attack
to intercept and manipulate network traffic,
demonstrating how multiple attack patterns can be combined
to achieve a broader objective.
Following that, we will look at threat actor methods.
Threat actor methods are specific strategies and approaches
attackers use to compromise systems
to achieve their actions on objectives.
Threat actor methods include abuse cases, anti-patterns,
and attack trees or graphs.
Abuse cases are scenarios
where legitimate features of a system
are misused or exploited by attackers to cause harm.
An example of an abuse case
is using password reset functionalities
to hijack an account.
Next, anti-patterns are common practices or solutions
that, while initially appearing effective,
actually create vulnerabilities or security risks.
An example of an anti-pattern
is using Base64 encoding to obfuscate sensitive information.
This is because Base64 encoding simply changes the format
of the sensitive data.
It does not protect it in any way.
Finally, attack trees or graphs
are visual vulnerability representations
that map out the various paths an attacker might take
to achieve a specific goal.
Attack trees and graphs may illustrate
potential entry points, methods,
and escalation steps involved in an attack.
Then we will explore initial access and escalation methods.
Initial access and escalation methods
are the techniques attackers use
to first gain entry into a system
and then elevate their privileges
to gain broader network control.
Initial access and escalation methods
include threat actor tactics, techniques, and procedures
such as injections, credential dumping,
and privilege escalation.
Injections, such as SQL injection or command injection,
are common methods attackers use
to insert malicious code into a system
to gain initial access.
Credential dumping involves extracting
stored usernames and passwords
from compromised systems.
Stolen credentials can then be used
to authenticate as legitimate users
and further compromise the network.
Privilege escalation is the process by which an attacker,
having gained initial access,
exploits vulnerabilities or misconfigurations
to increase their access rights.
Privilege escalation allows attackers
to perform unauthorized actions at a higher security level
than their initial exploit provided.
For example, an attacker might use an SQL injection
to gain access to a web application,
then perform credential dumping to retrieve admin passwords,
and finally exploit a privilege escalation vulnerability
to gain full control over the server.
Finally, we will look at post-exploitation
and evasion methods.
Post-exploitation and evasion methods in threat modeling
refer to the techniques attackers use
after gaining initial access
to maintain control, expand their reach within the system,
and avoid detection.
Post-exploitation and evasion methods
include threat actor tactics, techniques, and procedures
such as lateral movement, unauthorized execution,
and defensive evasion.
Lateral movement involves the attacker
navigating through the network,
often by compromising additional systems
to gain access to more valuable assets or data.
Unauthorized execution refers to an attacker
running malicious code or commands on compromised systems,
usually to conduct data exfiltration or system disruption.
Defensive evasion encompasses attacker tactics
to avoid detection by security tools and analysts.
Defensive evasion tactics include
disabling security software, hiding malicious processes,
or using encrypted communication channels.
In practice, an attacker might use lateral movement
to access a critical database,
execute unauthorized scripts to extract sensitive data,
and employ defensive evasion techniques
like wiping logs and disabling security alerts
to remain undetected during the operation.
To finish things off, we'll take a short quiz
to see what you learned during this section of the course,
and we will review each of those quiz questions fully
to ensure you can explain why the right answers were right
and the wrong answers were wrong.
So let's get ready to dive
into threat modeling considerations
in this section of the course.