Monday, March 10, 2014

How to Construct a Threat Statement

Scientists begin experiments with a hypothesis. Researchers begin their papers with a thesis statement. It is similarly useful to begin a threat analysis with a threat statement. The threat statement establishes the scope of the threat and guides the analyst in his threat research. Consider this threat statement, “Unauthorized disclosure of sensitive data.” Partially mapping out the scope of this statement, it looks something like this diagram shown below.

This scope of analysis is a bit large. Consider how large it would be for an enterprise with sensitive information spread across hundreds of systems! However, it is not unapproachable. Every journey, however long, begins with a single step. In this case, that step is to define the threat into a series of more narrow threat statements, such as this one, “Unauthorized disclosure of sensitive data through theft or loss of off-site stored data backup tape by outsider.” The map of this statement is much narrower.

This threat statement, unauthorized disclosure of sensitive data through theft of off-site stored data backup tape by outsiders, is narrowly scoped. It identifies the threat agent (outsider); it specifies the assets in question (data backup tapes; and the method through which the threat may be realized (theft and loss). This narrowly scoped threat analysis can be completed quickly and compared with other related threats analyses for decision-making.

Analyzing narrowly defined threats does not preclude solving larger scope threat questions such as the first one stated above, unauthorized disclosure of sensitive data.  The solution is necessary to protect sensitive information assets.  However, the answer to these broad scope threats is the sum of the solutions to the more narrowly scoped threat statements.

A well-bounded threat statement consists of four key elements: the asset category that is the focus of the threat agent’s objective, the end state condition the threat agent seeks to achieve within the context of the asset, the threat agent’s privilege level as it relates to the target, and the compromise approach the agent will use to realize the threat.

Target Asset / Asset Category
The target asset is the focus of the threat agent’s objective.  It is the system or category of systems the adversary seeks to compromise.  By restricting the threat statement to a specific asset or asset category, we establish boundaries for analysis of attack methods and related controls.  While the target may be a specific asset, modeling an asset category allows the analysis to be reused across multiple assets.

Other targets include Internet connection, core router, internal web application, Windows XP operating system, Oracle 10g database, Windows 2003 Server, a specific web application, such as, Active Directory, or even USB flash drives.

The end state is the condition the threat agent seeks to achieve within the context of the target asset.  It is his goal as it relates to the system he is attacking.  Including the end state in the threat statement narrows the analysis on attack vectors used to achieve the end state. 

Some other end states include application administrator access, network denial of service, unauthorized operating system access, remote system control, physical possession of storage media, and access to internal network communications.

The threat statement should specify the threat agent’s privilege level as it relates to the target system. The types of attack methods available to a threat agent and the complexity and risk exposure of executing the attack methods are partially dependent on the agent and his privilege level as it relates to the target system. For example, physical compromise of a system within a secured data center is easier for an administrator with authorized access to the data center than for an outsider who has no data center access privileges.

Other privilege levels include an outsider with no access to non-public target resources, an insider who has access to the target system owner’s private network or physical facilities but no local area network or physical access to the target system, and a privileged insider who has direct physical or local network access to the target system.

The compromise approach specifies the category of methods the threat agent will use to realize the threat. The compromise approach in our example threat statement is theft of authentication credentials.  This limits the scope of attack methods to those such as horizontal credential guessing, vertical credential guessing, keystroke logging, phishing, social engineering, and network communications intercept through CAM table flooding or ARP spoofing.