In this section of the course,
we are going to discuss threat modeling frameworks.
The threat modeling framework section of the course,
focuses on domain one,
governance, risk and compliance, specifically objective 1.4.
Objective 1.4 states that given a scenario,
you must be able to perform threat modeling activities.
Threat modeling frameworks provide structured approaches
to understanding and defending,
against potential cyber threats.
By analyzing how attacks are typically carried out,
organizations can identify vulnerabilities
and anticipate the tactics that adversaries might use.
Frameworks offer different perspectives
from categorizing attack patterns
to understanding the stages of an intrusion.
This can help defensive teams prioritize security efforts.
Ultimately, threat modeling frameworks serve
as essential tools for building stronger defenses
and improving overall security posture.
As we go through this section,
we will cover many topics related
to threat modeling frameworks,
including the cyber kill chain,
Common Attack Pattern Enumeration and Classification,
or CAPEC, MITRE Adversarial Tactics, Techniques,
and Common Knowledge or MITRE ATT&CK,
the diamond model of intrusion analysis,
Spoofing Tampering, Repudiation Information Disclosure,
Denial of Service and Elevation of Privilege or STRIDE,
and the Open Web Application Security Project or OWASP.
First, we will look at the cyber kill chain.
The cyber kill chain is a threat modeling framework
that breaks down the steps an attacker must go through
to complete an attack.
In this framework, each step must occur sequentially
for an attack to be successful.
In this way,
the cyber kill chain helps organizations understand
and disrupt an adversary's attack,
effectively breaking a link in the chain.
The cyber kill chain was originally developed
by Lockheed Martin and consists of seven steps.
The first step is reconnaissance.
During the reconnaissance step,
attackers gather detailed information about their target
to identify vulnerabilities or entry points.
The second step is weaponization.
During the weaponization step,
attackers create malicious tools or payloads,
tailored to exploit the identified weaknesses.
The third step is delivery.
During the delivery step,
an attacker transmits the payload to the target,
often through methods like phishing emails
or malicious websites.
The fourth step is exploitation.
During the exploitation step,
an attacker uses the payload to exploit a vulnerability,
within the target system.
The fifth step is installation.
During the installation step,
an attacker installs malware
or other tools to maintain persistent access
to the compromise system.
The sixth step is command and control.
During the command and control step,
an attacker establishes a communication channel
with the compromised system to control it
and direct further actions.
The seventh and final step is actions on objectives.
During actions on objectives,
an attacker achieves their goal such as stealing data,
disrupting operations or spreading ransomware.
Applying the cyber kill chain,
an organization may detect an attack,
during the delivery stage by identifying suspicious emails.
Once detected, the organization can prevent the attack
from progressing to the exploitation and installation phases
by blocking the sender's address or domain,
quarantining or deleting similar emails across the network,
alerting employees to be cautious
of similar phishing attempts and updating email filters
to prevent similar emails
from reaching users in the future.
This response would effectively stop the attack,
before it can continue
and force the attacker back to step one in a new attack.
Next, we will explore Common Attack Pattern Enumeration
and Classification or the CAPEC framework.
CAPEC is a threat modeling framework developed by MITRE.
It categorizes and describes common attack patterns,
used by adversaries to exploit vulnerabilities in systems.
CAPEC provides detailed attributes for each attack pattern,
such as the attacks prerequisites, potential outcomes,
and the typical steps involved in executing the attack.
These attributes enable security professionals
to understand how attacks are carried out.
A key use case for CAPEC
is in identifying and mitigating vulnerabilities,
during the software development lifecycle.
By referencing CAPEC patterns,
developers can anticipate potential threats
and design more secure systems.
For example, if a development team identifies
that their application is vulnerable to SQL injection,
they can refer to the relevant CAPEC entry
to understand the attributes of this attack,
allowing them to implement specific defenses against it.
After that, we will look at the MITER Adversarial Tactics,
Techniques and Common Knowledge or MITRE ATT&CK framework.
The MITRE ATT&CK framework categorizes
and documents the tactics,
techniques and procedures or TTPs used by adversaries
to compromise and exploit systems.
The framework is organized into matrices
that outline the various stages of an attack
with each matrix entry detailing specific attributes,
like the required permissions, platforms,
and potential mitigation strategies.
MITRE ATT&CK matrices include the Enterprise ATT&CK matrix,
ATT&CK for Mobile, pre-ATT&CK
and ATT&CK for Industrial Control Systems or ICS.
Part of the MITRE ATT&CK framework is the ATT&CK Navigator.
The ATT&CK Navigator
is a tool that allows security professionals to visually map
and analyze how specific techniques,
might be used by specific threat actors,
against their systems.
For example, a cybersecurity team might use
the ATT&CK Navigator to map out the tactics, techniques,
and procedures associated with a specific threat actor,
such as Advanced Persistent Threat or APT29.
By highlighting the techniques that APT29 commonly employs,
the team can visualize how these techniques align
with their own organization security controls.
This comparison would allow the team
to identify gaps in their defenses
and prioritize security enhancements
to protect against the most relevant
and dangerous methods used by APT29.
Next, we'll explore the diamond model of intrusion analysis.
The diamond model of intrusion analysis
is a threat modeling framework that dissects cyber incidents
by focusing on four key components,
the adversary, infrastructure, capability and victim.
In the diamond model of intrusion analysis,
these four components are visualized
as the vertices of a diamond.
The adversary component represents the individual
or group behind the attack,
including their motives, resources, and intent.
The infrastructure component refers to the tools, networks,
and other resources used by the adversary
to carry out the attack.
Infrastructure can include command and control servers,
malware, or phishing websites.
The capability component,
encompasses the specific techniques,
tactics and procedures employed by the adversary.
Capabilities include exploiting a software vulnerability
or deploying malware.
Finally, the victim component is the target of the attack.
Victims include the organization, individuals
or systems affected along with the specific vulnerabilities
that were exploited.
These four components are interconnected
with each one influencing the others.
Together, they provide a holistic view of the intrusion.
The model also includes meta-features.
A meta-feature is an additional attribute
that provides context and depth to the four components
by linking them with specific details like time, phase
and methodology.
The meta-features are timestamp, phase, result, direction,
methodology and resources.
The diamond model can also be integrated
with other frameworks such as MITRE ATT&CK
to map specific tactics and techniques
to the broader intrusion strategy.
For example, an organization might use the diamond model
to trace the path of an attack
from an adversaries capabilities,
through their infrastructure to the victim,
and then cross-reference these findings
with the attack matrix to develop targeted defenses
and response strategies.
Following that, we will look at the Spoofing, Tampering,
Repudiation, Information Disclosure, Denial of Service,
and Elevation of Privilege or STRIDE framework.
The STRIDE framework is used to identify
and categorize potential security threats,
across six categories,
spoofing, tampering, repudiation,
information disclosure, denial of service
and elevation privilege.
Each of these categories represents
a different type of threat.
Spoofing involves impersonating another entity.
Tampering refers to unauthorized modification of data.
Repudiation deals with denying actions,
after they have been performed.
Information disclosure
is the unauthorized release of sensitive data,
denial of service disrupts system availability,
and elevation of privilege occurs
when a user gains higher access rights than intended.
The STRIDE framework
is commonly used during the design phase
of software development to evaluate security vulnerabilities
by examining how each threat category could be exploited
in a system.
For example, a developer might use STRIDE
to identify that a web application is vulnerable
to tampering if input validation is weak
and then implement measures such as data integrity checks
to mitigate that risk.
Finally, we will explore
the Open Web Application Security Project or OWASP.
OWASP is a nonprofit organization
that provides a comprehensive framework
for improving the security of software,
particularly web applications.
One widely recognized product is the OWASP Top 10.
The OWASP Top 10 is a list
of the 10 most critical web application security risks.
The OWASP Top 10 serves as an essential reference
for developers and security professionals
to understand and mitigate common vulnerabilities,
such as injection flaws,
broken authentication and Cross-site Scripting.
Beyond the OWASP Top 10,
OWASP offers a variety of other tools and resources,
such as OWASP Application Security Verification Standard
for standardizing security requirements.
In practice, a development team might use the OWASP Top 10
as a checklist during code reviews
to ensure their web application
is protected against the most common threats,
while employing OWASP tools like the Zed Attack Proxy or ZAP
to perform dynamic security testing,
throughout the development process.
To finish things off,
we'll take a short quiz
to see what you learned during this section of the course
and we will review each of those quiz questions
to fully ensure you can explain
why the right answers were right
and the wrong answers were wrong.
So, let's get ready to dive into threat modeling frameworks
in this section of the course.