threat-modeling

# Threat Modeling Skill ## 🔴 AI FIRST Quality Principle > **Apply the AI FIRST principle: never accept first-pass quality. Minimum 2 iterations. Read all output, improve every section. No shortcuts.** ## Purpose This skill embodies the complete Hack23 AB threat modeling methodology as defined in [ISMS Threat_Modeling.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md). It provides systematic threat identification, risk quantification, and security control validation for proactive security assurance across all Hack23 projects. **Key Philosophy**: "Security through transparency" - All threat models are publicly documented to demonstrate security excellence to clients, regulators, and the open-source community. ## Hack23 Threat Modeling Process (ISMS § 4) Per [ISMS Threat_Modeling.md](https://github.com/Hack23/ISMS-PUBLIC/blob/main/Threat_Modeling.md), Hack23 employs a **five-strategy integrated approach**: ### 1. 🎯 Attacker-Centric (ISMS § 4.1) **MITRE ATT&CK Framework Integration** - Map attack tactics and techniques to system components - Identify threat agents (Nation-state APTs, Cybercriminals, Hacktivists, Malicious Insiders) - Analyze attack scenarios based on current threat intelligence (ENISA Threat Landscape 2024) - Red team perspective: "How would I compromise this system?" **Required Outputs:** - MITRE ATT&CK technique mapping per system component - Threat agent capability and motivation analysis - Attack scenario documentation ### 2. 🏰 Asset-Centric (ISMS § 4.2) **Crown Jewel Protection** - Identify critical assets from Asset Register - Apply Data Classification Policy (Public, Internal, Confidential, Restricted) - Map data flows and asset dependencies - Prioritize threats by asset criticality **Required Outputs:** - Asset inventory with CIA triad classification - Data flow diagrams (DFDs) showing trust boundaries - Crown jewel identification and protection strategies ### 3. 🏗️ Architecture-Centric (ISMS § 4.3) **STRIDE Per Element Analysis** - Apply STRIDE framework to each system component - Identify trust boundaries and crossing points - Analyze external entity, process, data store, data flow threats - Validate security controls per architectural layer **Required Outputs:** - Complete DFD with trust boundaries - STRIDE threat enumeration per DFD element - Control gap identification ### 4. 📖 Scenario-Centric (ISMS § 4.4) **Use Case Abuse Modeling** - Develop misuse cases from legitimate use cases - Model attacker goals and sub-goals - Identify abuse scenarios specific to business logic - Analyze social engineering attack paths **Required Outputs:** - Misuse case diagrams - Business logic abuse scenarios - Social engineering attack paths ### 5. 📊 Risk-Centric (ISMS § 4.5) **Quantitative Risk Assessment** - Calculate risk scores: **Risk = Likelihood × Impact** - Use Classification Framework for impact scoring - Apply risk matrix for prioritization - Document risk treatment decisions (Avoid, Mitigate, Transfer, Accept) **Required Outputs:** - Quantitative risk scores per threat - Risk matrix visualization - Risk treatment plan with ownership ## Security Foundations ### CIA Triad | Principle | Definition | Key Controls | Threat Categories | |-----------|------------|--------------|------------------| | **Confidentiality** | Information accessible only to authorized entities | Encryption, access control, authentication | Information disclosure, credential theft | | **Integrity** | Data protection from unauthorized modification | Checksums, digital signatures, version control | Tampering, data corruption | | **Availability** | Reliable and timely access to systems | Redundancy, DR, DDoS mitigation | DoS, outages, resource exhaustion | ### AAA Framework | Component | Definition | Integration | |-----------|------------|-------------| | **Authentication** | Identity verification | Access Control Policy | | **Authorization** | Permitted actions | RBAC, ABAC implementation | | **Accounting** | Activity tracking | Security monitoring, audit logs | ## STRIDE Threat Modeling Framework ### STRIDE Categories **S - Spoofing Identity** - **Definition**: Attacker gains access using false identity - **Controls**: Multi-factor authentication, certificate pinning, identity verification - **Static Site Threats**: Domain hijacking, DNS spoofing, certificate spoofing - **Mitigations**: HTTPS enforced, DNSSEC, Certificate Transparency monitoring **T - Tampering with Data** - **Definition**: Data modification during application flow - **Controls**: Digital signatures, checksums, integrity monitoring - **Static Site Threats**: Repository compromise, unauthorized commits, content injection - **Mitigations**: Branch protection, required PR reviews, GPG signed commits, GitHub audit logs **R - Repudiation** - **Definition**: Attacker denies actions without proof capability - **Controls**: Audit logging, digital signatures, non-repudiation mechanisms - **Static Site Threats**: Unauthorized changes without attribution - **Mitigations**: Git commit history (immutable), GitHub audit logs, signed commits required **I - Information Disclosure** - **Definition**: Unauthorized access to private or sensitive data - **Controls**: Encryption, access controls, data classification - **Static Site Threats**: Accidental secret commits, source code exposure - **Mitigations**: Secret scanning enabled, .gitignore for sensitive files, public repository classification **D - Denial of Service** - **Definition**: System availability reduction or service crash - **Controls**: Rate limiting, DDoS protection, redundancy - **Static Site Threats**: DDoS attacks, resource exhaustion - **Mitigations**: GitHub Pages CDN, rate limiting, global distribution **E - Elevation of Privilege** - **Definition**: Attacker assumes privileged user identity - **Controls**: Least privilege, RBAC, privilege separation - **Static Site Threats**: Unauthorized admin access, workflow manipulation - **Mitigations**: Minimal workflow permissions, protected branches, required reviews ## MITRE ATT&CK Integration ### Tactics & Techniques | Tactic | Description | Common Techniques | |--------|-------------|-------------------| | **Reconnaissance** | Information gathering | Active scanning, OSINT | | **Resource Development** | Establishing resources | Compromise accounts, infrastructure setup | | **Initial Access** | Network entry | Phishing, drive-by compromise, supply chain | | **Execution** | Malicious code execution | Command interpreters, malicious input | | **Persistence** | Foothold maintenance | Account manipulation, backdoors | | **Privilege Escalation** | Higher permissions | Exploitation, process injection | | **Defense Evasion** | Detection avoidance | Obfuscation, bypass controls | | **Credential Access** | Credential theft | Brute force, token stealing | | **Discovery** | Environment reconnaissance | Cloud discovery, network mapping | | **Lateral Movement** | Environment traversal | Remote services, credential reuse | | **Collection** | Data gathering | Local data, cloud storage | | **Command & Control** | System communication | Application layer protocols | | **Exfiltration** | Data theft | C2 channel, cloud storage | | **Impact** | System destruction | Data destruction, resource hijacking | ## Threat Agent Classification | Threat Agent | Category | Risk Level | MITRE Tactics | |--------------|----------|------------|---------------| | **Accidental Insiders** | Internal | Medium | Execution, Privilege Escalation | | **Malicious Insiders** | Internal | High | Initial Access, Impact | | **Cybercriminals** | External | High | Reconnaissance, Collection | | **Nation-State APTs** | External | Critical | Persistence, Defense Evasion | | **Hacktivists** | External | Medium | Impact, Privilege Escalation | | **Service Providers** | External | Medium | Initial Access, Defense Evasion | | **Cyber Vandals** | External | Low | Impact, Execution | ## Current Threat Landscape (ENISA 2024) | Priority | Threat Category | Business Impact | Mitigation Priority | |----------|----------------|-----------------|-------------------| | **1** | Threats Against Availability | Revenue protection | Critical | | **2** | Ransomware | Business continuity | Critical | | **3** | Threats Against Data | Risk reduction | High | | **4** | Malware | Operational excellence | High | | **5** | Social Engineering | Trust enhancement | High | | **6** | Information Manipulation | Competitive advantage | Medium | | **7** | Supply Chain Attacks | Partnership value | High | ## Attack Tree Analysis (ISMS § 4.6) Attack trees are **mandatory** for all Hack23 threat models per ISMS policy. They provide: ### Purpose - Visual decomposition of attack paths from goal to sub-goals - AND/OR relationship mapping between attack steps - Success probability calculation for attack paths - Critical path identification for mitigation prioritization ### Attack Tree Structure ``` Root: Attack Goal (e.g., "Compromise Application") ├── OR Gate: Any child succeeds → parent succeeds │ ├── AND Gate: All children must succeed → parent succeeds │ │ ├── Leaf: Individual attack step (Likelihood: 40%, Impact: High) │ │ └── Leaf: Individual attack step (Likelihood: 60%, Impact: Medium) │ └── AND Gate: Alternative attack path │ ├── Leaf: Attack step 1 │ └── Leaf: Attack step 2 └── OR Gate: Second major attack vector └── Leaf: Direct attack ``` ### Example: Static Website Compromise (from Riksdagsmonitor) ``` Root: Compromise Riksdagsmonitor Platform ├── OR: Infrastructure Attack │ ├── AND: DNS Hijacking │ │ ├── Compromise Route 53 credentials (Likelihood: 10%, Impact: Critical) │ │ └── Modify DNS records (Likelihood: 95%, Impact: Critical) │ └── AND: S3 Bucket Compromise │ ├── Find misconfigured bucket (Likelihood: 5%, Impact: High) │ └── Upload malicious content (Likelihood: 90%, Impact: High) └── OR: Supply Chain Attack ├── AND: Compromise GitHub Account │ ├── Steal developer credentials (Likelihood: 15%, Impact: Critical) │ └── Bypass MFA (Likelihood: 20%, Impact: Critical) └── AND: Malicious Dependency Injection ├── Compromise npm package (Likelihood: 5%, Impact: High) └── Inject malicious code (Likelihood: 80%, Impact: Critical) ``` ### Attack Tree Analysis Steps 1. **Goal Identification**: Define attacker objectives 2. **Path Decomposition**: Break down into AND/OR sub-goals 3. **Leaf Node Likelihood**: Assign success probability (1-100%) 4. **Impact Assessment**: Use Classification Framework 5. **Path Calculation**: Calculate cumulative success likelihood 6. **Critical Path**: Identify highest risk paths 7. **Mitigation Priority**: Focus on high-likelihood, high-impact leaves ### Integration with STRIDE Each STRIDE threat should have corresponding attack tree showing exploitation paths. ## Data Flow Diagrams (DFD) ### DFD Elements - **External Entity**: Sources/sinks of data (users, external systems) - **Process**: Data transformation or computation - **Data Store**: Persistent storage - **Data Flow**: Movement between elements - **Trust Boundary**: Security domain separation ### STRIDE per DFD Element | Element | Applicable STRIDE Threats | |---------|--------------------------| | **External Entity** | Spoofing, Repudiation | | **Process** | All 6 STRIDE categories | | **Data Store** | Tampering, Information Disclosure, DoS | | **Data Flow** | Tampering, Information Disclosure, DoS | | **Trust Boundary** | Elevation of Privilege | ## Quantitative Risk Assessment ### Risk Calculation ``` Risk = Likelihood × Impact ``` ### Likelihood Scoring - **Critical (5)**: Near certain (>90%) - **High (4)**: Likely (60-90%) - **Medium (3)**: Possible (30-60%) - **Low (2)**: Unlikely (10-30%) - **Negligible (1)**: Rare (<10%) ### Impact Scoring (per Classification Framework) - **Critical (5)**: >$10K daily, complete outage, criminal charges - **High (4)**: $5K-10K daily, major degradation, significant fines - **Medium (3)**: $1K-5K daily, moderate impact, compliance violations - **Low (2)**: $500-1K daily, minor impact, warnings - **Negligible (1)**: <$500 daily, minimal impact, no regulatory ### Risk Matrix | Likelihood → Impact | Negligible (1) | Low (2) | Medium (3) | High (4) | Critical (5) | |--------------------|----------------|---------|------------|----------|--------------| | **Critical (5)** | Medium | High | High | Critical | Critical | | **High (4)** | Medium | Medium | High | High | Critical | | **Medium (3)** | Low | Medium | Medium | High | High | | **Low (2)** | Low | Low | Medium | Medium | High | | **Negligible (1)** | Low | Low | Low | Medium | Medium | ## Threat Model Document Structure