Oredev: An Exploratory Tester's Lessons on Security Threat Modeling

transcript

@maaretp http://maaretp.com

An Exploratory Tester’s Lessons on

Security Threat Modeling

by Maaret Pyhäjärvi

Feedback fairy with a day-job at F-Secure. Tester, (Polyglot) Programmer, Speaker, Author, Community Facilitator, Conference Organizer.

Makers and Menders by Andrea Goulet https://www.slideshare.net/andrea_goulet/makers-and-menders

My dream job is cleaning up other

people’s code - M. Scott Ford

on Makers and Menders

Security Threat

Modeling

Exploratory Testing Learning with the Application

http://visible-quality.blogspot.fi/2017/03/from-appreciation-of-shallow-testing.html

She's like "I want to exploratory test your ApprovalTests" and I'm like "Yeah, go for it", cause it's all written test first and its code I'm very proud of. And she destroyed it in like an hour and a half.

Testers don’t break the code, they break your illusions about

the code. - Adapted from James Bach

Product is my external imagination

I am my developer’s external imagination

Threat Modeling Giving time for Security

The owner of priorities order it via an item on the backlog.

Threat Modeling is a whiteboard exercise used to uncover work

needed to further secure a system, so security work can be spent where it is worth them

Data Flow Diagram

Message Sequence Chart

S Spoofing T Tampering R Repudiation I Information Disclosure D Denial of Service E Elevation of Privilege

Threats to Privacy T Transferring Data Across

Borders R Retention Policy I Informed Consent M Minimization

Result: More Work to Do

•  Security testing for an interface •  Security mechanisms to implement • Architecture changes •  End user documentation • Validating an assumption

Combining the two Validating assumptions

Illusion type III: Product doing only what it is supposed

to do.

Doing threat modeling by yourself if fine if you have good team dynamics, are free from

cognitive biases, and have an up-to-date knowledge of common

attack vectors.

Serendipity and Perseverance

The more I practice, the luckier I get – Arnold Palmer

It’s not that I’m so smart, I just stay with the problems longer. – Albert Einstein

See also: http://blogs.scientificamerican.com/guest-blog/the-forgotten-life-of-einsteins-first-wife/

https://cybersecuritybase.github.io/

Maaret Pyhäjärvi Email: maaret@iki.fi Twitter: @maaretp Web: maaretp.com Blog: visible-quality.blogspot.fi (please connect with me through Twitter or LinkedIn)

Oredev: An Exploratory Tester's Lessons on Security Threat Modeling

Software