Instructor: As a cybersecurity analyst, 2 2
it's your responsibility to understand the risks 3 3
to an enterprise and its information technology systems. 4 4
Now, you must always analyze the systems 5 5
to understand how they support the business's workflow 6 6
and how the confidentiality, integrity, and availability 7 7
of these systems could be threatened by an attacker. 8 8
You need to be thinking about a few things 9 9
when trying to determine what level of risks exist. 10 10
For instance, how can an attack be performed? 11 11
For example, can this attack be performed 12 12
against your current network 13 13
in its current situation and security status? 14 14
And are the assets even accessible to the outside world? 15 15
How about what is the potential impact 16 16
to the confidentiality, integrity, 17 17
and availability of the data? 18 18
When you're putting things in place 19 19
to protect the confidentiality, integrity, 20 20
and reliability of the data, 21 21
you're going to do that based on the potential impact. 22 22
Also, you need to consider how likely it is 23 23
that the risk will actually occur. 24 24
How exploitable is this flaw? 25 25
How bad is this vulnerability? 26 26
Is this just something theoretical 27 27
or is there a working exploit out in the wild 28 28
that people are using every day? 29 29
This is going to determine how likely this thing is to occur. 30 30
Finally, you need to think about what mitigations 31 31
you already have in place. 32 32
For example, if you have some mitigations in place 33 33
that will prevent a certain vulnerability 34 34
from being exploited, 35 35
then that vulnerability is effectively mitigated 36 36
and controlled and you don't have to worry as much about it. 37 37
When you're doing these type of things, 38 38
you also need to think about how long it takes 39 39
to put additional controls in place, 40 40
to help bring those mitigations up if needed, 41 41
and are adding additional protections 42 42
even going to be cost-effective for you. 43 43
To help you do all of this, 44 44
we use a concept known as threat modeling. 45 45
Threat modeling is the process of identifying 46 46
and assessing the possible threat actors and attack vectors 47 47
that pose a risk to the security of an application, 48 48
a network, or other systems. 49 49
When you're evaluating the system, 50 50
you need to do it both from an inside-out perspective 51 51
and an outside-in. 52 52
That means, you need to consider 53 53
both the defender's point of view 54 54
and the attacker's point of view. 55 55
By doing this, you can start seeing 56 56
where your systems are vulnerable 57 57
and what type of mitigations you need to put in place. 58 58
Threat modeling can be used against your corporate networks 59 59
in general at a large scale, 60 60
or you can look at specific targets 61 61
like a certain website or an application 62 62
that you're deploying. 63 63
Both of these are very important to do. 64 64
Now, when you do threat modeling, 65 65
this is a cooperative area. 66 66
You need to get inputs from a variety of stakeholders. 67 67
You need to have your cybersecurity experts there 68 68
with their knowledge on the relevant threat intelligence 69 69
and research, as well as non-experts 70 70
such as the users and customers, 71 71
the people from the business side, 72 72
human resources, legal, and other areas of your business. 73 73
By working together, we can best model the threat 74 74
and understand the likelihood and the impact 75 75
if something bad happens. 76 76
When you're conducting threat modeling, 77 77
there is three main areas you need to consider. 78 78
You need to think about the adversary capability, 79 79
the attack surface, and the attack vector. 80 80
When we talk about an adversary's capability, 81 81
we're talking about a formal classification of the resources 82 82
and expertise available to that particular threat actor. 83 83
For example, do they use acquired and augmented tools? 84 84
Which means they're basically using commodity malware 85 85
and open source tools and techniques. 86 86
Or do they have a developed capability? 87 87
If they have a developed capability, 88 88
this means they can identify 89 89
and exploit zero day vulnerabilities 90 90
and deploy significant human and financial resources 91 91
to attack planning and execution. 92 92
Maybe they're advanced. 93 93
This means they can exploit things like supply chains 94 94
and introduce vulnerabilities way back early in the cycle 95 95
where you won't even know they're there inside your systems. 96 96
This is especially true 97 97
when you're dealing with a nation state 98 98
because they use an integrated approach 99 99
where they're using cyber and non-cyber methods 100 100
to achieve their goals. 101 101
The second area we have to consider is our attack surface. 102 102
Now, the attack surface is the point at which 103 103
a networker application receives external connections 104 104
or inputs and outputs that are potential vectors 105 105
to be exploited by a threat actor. 106 106
Every network has some form of attack surface out there, 107 107
and you have to determine what it is for your network. 108 108
For example, when you go to my website 109 109
to access your course, 110 110
there is an attack surface there 111 111
because you're accessing our servers 112 112
and our network through your web browser. 113 113
And that means we could be attacked 114 114
using that as part of your attack vector 115 115
going in through that attack surface. 116 116
Now, to determine your attack surface, 117 117
you have to inventory your assets 118 118
and figure out what's on your network, 119 119
because if you know what's there, 120 120
you can then defend what's there. 121 121
Now, there are three areas that you should consider 122 122
when you're doing your threat modeling 123 123
in terms of attack surface. 124 124
You need to think about the network holistically. 125 125
This would be things like the switches, 126 126
the routers, the computers, 127 127
all those things that make up your corporate data network. 128 128
The second area is any websites or cloud services you have, 129 129
because these are all things that could be attacked 130 130
from an end user either through the web front end 131 131
or programmatically through an API. 132 132
And the third area 133 133
is any kind of custom software applications you may have. 134 134
If you have some sort of form 135 135
or control on the user interface 136 136
or you have some kind of software 137 137
that's been deployed that uses an API 138 138
or file or data imports, 139 139
that all introduces vulnerabilities 140 140
to the host and the platform, 141 141
and so you have to consider these custom applications 142 142
as you're thinking about the different places 143 143
'cause they are part of your total attack surface. 144 144
Now, the third main area you have to consider 145 145
is your attack vector. 146 146
Now, an attack vector is a specific path 147 147
by which a threat actor gains unauthorized access 148 148
to a system. 149 149
Now, an attack vector can be one of three things. 150 150
It can be cyber, which means you're using hardware 151 151
or software against an IT system. 152 152
It could be human, 153 153
which means you're using social engineering 154 154
to conduct your attack through coercion, 155 155
impersonation, or even force. 156 156
Or it can be physical, 157 157
which means you're trying to take over local access 158 158
by being on-premise and touching the thing 159 159
to do your attack. 160 160
These are the three ways 161 161
that you can think about attack vectors, 162 162
either cyber, human, or physical. 163 163
So now that we've talked about the three main areas 164 164
of threat modeling, 165 165
which consist of the adversary capability, 166 166
the attack surface, and the attack vector, 167 167
we need to think about the likelihood 168 168
and the impact that are involved 169 169
with some kind of an attack. 170 170
Remember, there are thousands or even millions 171 171
of threat actors in adversary groups out there. 172 172
Some of them are script kiddies 173 173
and they have very low capability, 174 174
and some are nation states and APTs, 175 175
and they have a very high capability. 176 176
Depending on who you're dealing with, 177 177
you're going to have a larger impact or a less impact 178 178
and you're going to be more likely or less likely 179 179
to have an attack. 180 180
All of this comes down to risk, 181 181
and risk is assessed by factoring your likelihood 182 182
of an event and the impact of that event. 183 183
When I talk about likelihood, 184 184
this is the chance of a threat being realized, 185 185
which is usually going to be expressed as a percentage. 186 186
For instance, if I have a nation state 187 187
trying to go after my company, 188 188
the chances are 189 189
that they have a high likelihood of being able to break in. 190 190
They probably have an 80 or 90% chance 191 191
because they have such sophistication 192 192
and they have access to zero day exploits 193 193
and other things like that. 194 194
Now, on the other hand, if we consider the impact, 195 195
this is going to be the cost of a security incident 196 196
or disaster scenario, 197 197
which is usually going to be expressed in cost or dollars. 198 198
So let's say I had some sort of an event that happened 199 199
and it was something like it was going to take my server down 200 200
for five minutes. 201 201
What is the impact of that? 202 202
Well, it probably has a very small cost for me, 203 203
because if my server's down for five minutes, 204 204
you, as a student will probably just try to come back 205 205
in five minutes and then make your purchase. 206 206
So we had very little or no impact financially. 207 207
Now, on the other hand, 208 208
if I was a credit card processing agency 209 209
processing all of the world's credit card transactions 210 210
like Visa or MasterCard 211 211
and you took me down for five minutes, 212 212
that's going to cost me thousands 213 213
or hundreds of thousands of dollars in processing fees 214 214
that we're not able to take 215 215
because the cards aren't going to be working. 216 216
And so there'd be a much higher impact 217 217
if they were down for five minutes 218 218
than if I was down for five minutes. 219 219
So what all this comes down to is risk 220 220
and how you can calculate risk. 221 221
And again, this comes down to your likelihood 222 222
and your impact, 223 223
and we use these percentages and these dollar amounts 224 224
to come up with some final calculation. 225 225
Now, when we talk about risk later on in this course, 226 226
we're going to determine your actual threats 227 227
annual rate of occurrence, the ARO, 228 228
and how much it really does cost you 229 229
if you have this incident happen. 230 230
But for now, I just want to cover the basic concepts 231 231
of the fact that we have to consider 232 232
our likelihood and impact as we do our threat modeling.