Threat Modeling and the Zero
Day Problem
A quick look at how methodical threat modeling could
combat an enterprise’s security problem
Christopher Lee
1
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Agenda
2

Software Vulnerabilities are Out of Control!

The Basic Vocabulary of Risk Management

What is Threat Modeling

How does Threat Modeling help, even in the face of Zero-day vulnerabilities?
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Coping with Vulnerabilities

Vulnerabilities are being reported at an alarming rate, despite vendors’ focus on writing secure
code.
Year
2001
2002
2003
2004
2005
2006
2007 –
Q1-Q3
# of
vulnerabilities
2,437
4,129
3,784
3,780
5,990
8,064
5,568
CERT/CC Statistics 1988-2007
3
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Cost of Reacting to Those Vulnerabilities…

Two major reactionary response to Software Vulnerabilities



Patching
System –or- Software Reconfiguration
“10% of machines will need to patched manually at a cost of $50/machine”. - Marc
Donner, executive director, Morgan Stanley

$50 * 500 = $25,000 (plus the cost of patch management software and patch
testing).

…and this is only for one patch in a 5000-node network…

Major software vendors have published their own “Hardening Guidelines”


4
In essence, accept no system defaults and remove everything that you don’t need.
However, the operating system vendor’s harden recommendation could also prevent some
application from working…

More importantly, system and/or software reconfiguration tend to cost even more
than applying patches.

Reactive measures are not the answer!
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Let’s be Proactive…
5

More Firewalls?

More IDS/IPS?

More Heuristics?

More Security Widgets?

More Consultants?

Where is the end to this Madness!
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Establish the Language…
6

Asset

Control

Threat

Vulnerability

Risk
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Establish the Language - Asset

Asset


7
Something an organization has determined to be valuable and must be protected.
e.g. Resource, Process, Product, Infrastructure, Engineering Diagrams, and etc
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Establish the Language - Safeguard

Control


8
Product and/or processes employed to mitigate a specific threat( or a group of threats) to an
acceptable level
e.g. Firewall, Locked Doors, Smart Cards, DRP/BCP Processes, Insurance, and etc.
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Establish the Language - Threat

Threat



9
Activity that represents possible dangers to the Assets
e.g. Unexpected Destruction of Buildings, Loss of Power, Destructive Virus, Departure of key
Technical Staff
Not possible to protect against all threats
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Establish the Language - Vulnerability

Vulnerability



10
Weakness that allow threats to materialize
Absence of sufficient safeguard
e.g. Poorly Designed Network, Improperly Configured Equipment, Poor Choice of Passwords,
Lack of Redundancy, and etc.
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Establish the Language - Risk

Risk



11
= Threat * Vulnerability * Assets Values
The degree for which the vulnerability can be exploited by one or more previous identified threats
Assessed either Quantitatively or Qualitatively
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling

Overview of the methodology:
1.
2.
3.
4.
5.
6.
12
Identify Assets
Identify Asset Access Mechanism
Create Architecture Overview
Identify Threats
Document Threats
Qualify Threats
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling – a Walkthrough

ACME Inc.



13
Financial Data Services
Migrate from Global Dialer to Internet
Client-Server application
• Client:
Visual C++ on Win32 platforms
• Server:
C++ on AIX
• Middleware: WebSphere MQ-Series
• Database: DB2
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling – a Walkthrough

Step 1, Identify the Assets

14
The financial data
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling – a Walkthrough

Step 2, Identify Asset Access Mechanism

15
The data is stored in database. And is created, modified, and queried by the end-user through the
application server
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling – a Walkthrough

Step 3, Create Architecture Overview
Application Client
MQ Client
Application Server
Request Queue 0
Windows
2000/XP/ME
Request Queue 1
Request Queue 2
Request Queue 3
Client
Request Queue 4
Firewall
Request Queue 5
Queue
Manager
MQ
API
Application
Server
Request Queue 6
Request Queue 7
Request Queue 8
Input Messages
Request Queue 9
Reply Queue
Output Messages
AIX
Financial Data
DB2
Database Query
Firewall
AIX
Database
16
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling – a Walkthrough

Step 4, Identify the Threats




17
Eavesdropping Data during Transit
Data Modification/Injection during Transit
Single Points of Failure at
• Firewall
• Application Server
• Database Server
Lack of communication control / physical separation to the DB2
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling – a Walkthrough

Step 5, Document the Threats
Threat Description
Eavesdropping Data during
Transit
Threat Target
Message between Client and
Server
18
Risk
?????
Attack Technique
Traffic Capturing
Countermeasure
IPSEC Encryption
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling – a Walkthrough

Step 6, Qualify the Threats

19
The DREAD Model (4)
High = 3
Medium = 2
Low = 1
Damage Potential
The attacker can subvert the
security system; get full trust
authorization; run as
administrator; upload content.
Leaking sensitive information
Leaking trivial information
Reproducibility
The attack can be reproduced
every time and does not require a
timing window.
The attack can be reproduced, but
only with a timing window and a
particular race situation.
The attack is very difficult to
reproduce, even with
knowledge of the security
hole.
Exploitability
A novice programmer could make
the attack in a short time.
A skilled programmer could make
the attack, then repeat the steps.
The attack requires an
extremely skilled person and
in-depth knowledge every
time to exploit.
Affected Users
All users, default configuration,
key customers
Some users, non-default
configuration
Very small percentage of
users, obscure feature;
affects anonymous users
Discoverability
Published information explains
the attack. The vulnerability is
found in the most commonly used
feature and is very noticeable.
The vulnerability is in a seldomused part of the product, and only
a few users should come across it.
It would take some thinking to see
malicious use.
The bug is obscure, and it is
unlikely that users will work
out damage potential.
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling – a Walkthrough

Threat: Eavesdropping Data during Transit

Damage Potential = 2
Reproducibility = 3
Exploitability = 2
Affected Users = 3
Discoverability = 2

RISK = 2 + 3 + 2 + 3 + 2 = 12




20
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Apply the Results of Threat Modeling
Application Client
VPN Dialer
Application
MQ Client
Application Server
VPN Client
Request Queue 0
Windows
2000/XP/ME
Request Queue 1
Request Queue 2
Request Queue 3
Client
Request Queue 4
Firewall
Queue
Manager
Request Queue 5
MQ
API
Application
Server
Request Queue 6
Request Queue 7
Request Queue 8
Input Messages
Request Queue 9
Reply Queue
Output Messages
IPSec VPN
AIX
VPN Gateway
Financial Data
Database Query
DB2
Firewall
AIX
Database
21
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Upcoming Advisories?
22
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Time between Vulnerability Discovery and Patch Release

23
Microsoft Security Bulletin MS05-014

Vendor Notified on Feb-16-2004 (6)

Patch released on Feb-08-2005 (Previously released on Nov-2004)
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
The Zero-Day Problem…


So is Anti-Virus signatures…

So is Intrusion Prevention Signatures…

24
Patches and workarounds are released after the
fact
What happens between an exploit for a
vulnerability is discovered and when one of the
above is released?
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling for the Zero-Day

Threat Modeling gives us:




25
Identification of information assets
Identification of threats and associated qualifications
Basis for Risk Assessment
• Risk Mitigation Strategies
• Basis for implementation of Products & Processes
No more surprises, no more scrambling, and no more crisis.
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Threat Modeling ≠ Silver Bullet
26

You can’t always eliminate the Risks!

Effectiveness depends on Subject Matter Expertise on the implemented technology

Evolution of Technology
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Conclusion
27

Race between Reactive Countermeasures and Vulnerability Discovery is a fact of
life

Systematic defense, build on thorough Threat Modeling methodology, is your best
protection

There is still no silver bullet!
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
References
1.
CERT Statistics: http://www.cert.org/stats/cert_stats.html
2.
Marc Donner, “Bits, Bad Guys, and Bucks”, Volume Three, Issue Two, Secure Business Quarterly,
http://www.sbq.com/sbq/patch/sbq_patch_mdonner.pdf
3.
Dana Epp, “Dana Epp's ramblings at the Sanctuary: Understanding Threat Modeling”, retrieved on May 22, 2005,
http://silverstr.ufies.org/blog/archives/000611.html
4.
28
J.D. Meier, Alex Mackman, Michael Dunner, Srinath Vasireddy, Ray Escamilla and Anandha Murukan, Microsoft Corporation, “Threat Modeling”,
retrieved on May 22, 2005, http://msdn.microsoft.com/security/securecode/threatmodeling/default.aspx?pull=/library/enus/dnnetsec/html/thcmch03.asp
5.
Carnegie Mellon Software Engineering Institute, “Operationally Critical Threat, Asset, and Vulnerability Evaluation (OCTAVE) Framework, Version
1.0”, retrieved on May 22, 2005 http://www.sei.cmu.edu/publications/documents/99.reports/99tr017/99tr017figures.html
6.
Jouko Pynnonen (February, 2005). Posting to the BugTraq mailing list RE: “Internet Explorer zone spoofing with encoded URLs”, retrieved on May
22, 2005, http://www.securityfocus.com/archive/1/389859/2005-02-03/2005-02-09/0
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD
Questions?
29
Manitoba Telecom Services Inc. Used under license. / Utilisé en vertu d’une licence.
MTS Allstream Inc. proprietary. Use pursuant to company instructions./
Information exclusive à MTS Allstream Inc. Utiliser conformément aux directives de la société.
® MD