Question

Write a 500 word essay on why you think it is important (or you feel it may not be important at all) to threat model prior to staring a project. In your essay, please answer the following:

1. What did you think threat modeling meant prior to signing up
2. Have you ever threat modeled before at your job?
3. Have you been involved in a project or know of a project that failed due to lack of threat modeling? Briefly explain what happened and what would have prevented the failure.
4. What expectations do you have for this?

Answer 1

As the years are passing by, security is growing as one of the most effective fields in the history of computers. There is a need of getting each one of the things secured with the help of internet security with ethical actions. There are many things happening on the web and promising safety without taking any tough measures is one of the impossible tasks nowadays. Hence, companies and individuals have moved to security tools and technologies to keep their information safe while connected to the internet.

Risk Assessment & Threat Vulnerability:

Nowadays, companies have moved on to the Agile or Rapid Application Development SDLC(Software Development Life Cycle) which has been resulting in reducing the development timeframe. Now, starting with the risk assessment, here we go,

1. Collecting Information:
   • The collection of information is one of the major parts that plays in the security of the organization. The URL of the target must be accessible to gain information.
   • Information caught in wrong hands can turn out to be chaos for any organization. Hence, information must always be safeguarded with levels of security.
2. Risk Profiling:
   • Checking the website for each and every type of risks/threats is a very important task and must be carried on with each and every module of the organization's availability in the internet space.
   • There must be things carried out like:
     • Automated threat scanning
     • Penetration Testing
     • Black Box Testing of the source codes
     • Assigning Risk Ratings to the Security Flaws
     • Reporting to higher Authorities
3. Updating Technology:
   • In the current world scenario, it has become very important to update the technologies that are been actively used and must be balanced accordingly.
   • The use of older versions will come with a bunch of vulnerabilities and threats along with the destruction of certain aspects of the organization.
4. Application Fingerprinting:
   • In an organization, there are certain things that must be checked for the known vulnerabilities and exposures. If there, one must always keep it the priority to overcome certain threats in order to run the organization smoothly.
   • The application fingerprinting consists of different levels of assessment. Here are some of the different scopes:
     • Defining Objectives
     • Devising Strategy to overcome threats
     • Role-Based Access Control Matrix
     • Choosing Appropriate Security Tools

Everyone must keep in mind that being safe on the internet is an integral part of the virtual life and must carry on managing the security each time there is any interference of threats or vulnerability. One must also stay updated if using any third-party application as there are many zero-day fixes coming in the applications which help us to stay immune to malware and viruses that have affected the software in the past time.

Prevention Techniques:

There are much prevention techniques to be handled but understanding the threat modeling and how to get it prevented in a real-life scenario, I would like you to read the below example which actually happened in the real-life and through which I will try to explain to you what we must do to prevent such things. So here we start,

• The vulnerability which we are going to talk today is one of the most critical ones and for one of the largest companies "Adobe". This vulnerability left lakhs of the user under danger of getting breached.
• The name of the vulnerability is "Flash Player Vulnerability" with an identification code "CVE-2018-5002". This vulnerability has been affecting densely in the Middle East region and was brought into vision in June 2018.
• What actually was the security flaw here? The security flaw was one of the stack-based buffer overflow bugs that have been able to execute arbitrary code.
• The following vulnerability was allowing the attackers to maliciously craft the Flash object which would help them in executing codes in the victim machine and then execute the range of payloads & actions.

How would have this been prevented?

• The applications are been vulnerable to buffer overflow bugs when there are certain programming errors or memory leaks left in the programming.
• Hence, this can be prevented using right programming methods and also putting best programming techniques to use so that none of the vulnerabilities are left in open to ruin the applications.
• There must be thorough testing of the application done before releasing the application publicly and must also make the application good enough for working against the vulnerabilities.

Hence, these are the methods in which the vulnerability could have been prevented.

How did this vulnerability actually work?

• The vulnerability was allowing the attacker to provide a word file to download and once executed in the victim PC the adobe flash exploits would start running.
• This file once executed starts executing the shellcode which will then enable the attacker to command and control the servers from which the attacker would gain complete access to the victim machine.

Patch For Vulnerability:

• The company has declared the patch for the vulnerability and can be patched automatically by installing the updated Flash Player as this was a critical zero-day attack.
• The patch is available only for the users from East Asia as the vulnerability was highly active in that region.

Hence, this was all on the threat modeling and what we should do to prevent any attack from happening in our organization.