CS 3710: Intro to Cybersecurity (slides): Intro to the Defense

# Intro to the Defense
## CS 3710: Intro to Cybersecurity

</div>
  <div class="col">

</figcaption>
</figure>

</div>
</div>

===

<div>

## Threat modeling

*Credit: [Alex Curtiss](https://twitter.com/apccurtiss)*

</div>

</div>
  <div class="col">

*Source: [@thegrugq](https://twitter.com/thegrugq/status/864023197145944064)*

</figcaption>
</figure>

</div>
</div>

---

## What is threat modeling?

Chances are that you've done threat modeling at some point in your life, whether
you've realized it or not.

</div>
<div class="fragment" data-fragment-index=0>

Any time you've thought about *"what might go wrong"* and *"what can I do to
stop it from happening?"*, you've been implicitly threat modeling.

</div>

---

## Threat modeling

Threat modeling works in three steps:

1. Understand what we're protecting.

</div>
<div class="fragment fade-in-then-semi-out" data-fragment-index=0>

2. Identify potential threats.

</div>
<div class="fragment" data-fragment-index=1>

3. Determine how to prevent them.

</div>

---

## 1. Understand what we're protecting

The first step in threat modeling is *determining what you want to protect*.

</div>
<div class="fragment fade-in-then-semi-out" data-fragment-index=0>

These are often assets: money, vehicles, etc.,

</div>
<div class="fragment" data-fragment-index=1>

But they can also be things like time, physical and mental health, etc.

</div>

</figcaption>
</figure>

---

## The CIA triad

</figcaption>
</figure>

We will use the *CIA triad* as our model for what kinds of things we want to
protect.

</div>

---

## Confidentiality

_**Confidentiality:**_ is sensitive data kept private?

The Equifax breach is a classic example of a breach of confidentiality.

</div>
  <div class="col">

*Source: Federal Trade Commission*

</figcaption>
</figure>

</div>
</div>

---

## Integrity

_**Integrity:**_ are data or systems being tampered with?

</figcaption>
</figure>

</div>
  <div class="col">

</figcaption>
</figure>

</div>
</div>

---

## Availability

_**Availability:**_ are users able to access systems?

_**Example:**_ your ability to access a website; your ability to read your
emails, texts, etc.

</div>
  <div class="col">

<figure>
  <img src="../../img/malware/mirai_krebs.webp">
  <figcaption>
  
    
*Source: Krebs on Security*

</figcaption>
</figure>

</div>
</div>

---

## 2. Identify potential threats

Once we've identified what we want to protect, we should start thinking about
the *risks* that it faces.

</div>
<div class="fragment" data-fragment-index=0>

Part of our goal here is to think like the attacker. But it can be difficult to
anticipate all of the different ways in which something might be attacked!

</div>

---

## 2. Identify potential threats

*Source: [XKCD](https://xkcd.com/538/)*

</figcaption>
</figure>

---

## 2. Identify potential threats

*Source: [The Washington
Post](https://www.washingtonpost.com/news/innovations/wp/2017/07/21/how-a-fish-tank-helped-hack-a-casino/)*

</figcaption>
</figure>

notes:

Fish tank had IoT sensors to help control the temperature, food, and cleanliness
of the tank. Attackers pivoted off of that device to get further into the
casino's network and exfiltrate 10 GB of data.

---

## 2. Identify potential threats

When evaluating threats, it's important to understand the *risk* that they pose.

You can think of risk as

`risk = probability * severity`

</div>
</div>

---

## 2. Identify potential threats

In cybersecurity, threats can come from a lot of different areas:

_**Script kiddies:**_ less-skilled attackers who use relatively basic methods to
obtain access

_**Examples:**_ Mirai

</div>
  <div class="col">

</figcaption>
</figure>

</div>
</div>

</div>
  <div class="fragment fade-in-then-out" data-fragment-index=0>

_**Professional attackers, ransomware groups:**_ professional groups of
attackers who gain access to networks to ransom systems, exfiltrate data, sell
access, etc.

_**Examples:**_ REvil, Maze

</div>
  <div class="col">

</figcaption>
</figure>

</div>
</div>

</div>
  <div class="fragment fade-in-then-out" data-fragment-index=1>

_**Nation-state attackers:**_ state-sponsored groups that perform attacks
against digital infrastructure in order to advance military and intelligence
objectives.

_**Examples:**_ Fancy Bear / Cozy Bear, NSA / TAO

</div>
  <div class="col">

</figcaption>
</figure>

</div>
</div>

</div>

_**Partners, family members, and personal acquaintances:**_ have physical access
to the victim and know them personally; motives may vary.

</div>
  <div class="col">

</figcaption>
</figure>

</div>
</div>
</div>

_**Insider threat:**_ somebody who's already inside an organization and has
access to its infrastructure.

Often motivated by financial incentives, grievances against the organization,
etc.

</div>
  <div class="col">

*Kim Philby on a Soviet Union stamp*

</figcaption>
</figure>

</div>
</div>
</div>

*Source:
[Reuters](https://www.reuters.com/world/asia-pacific/us-warns-against-inadvertently-hiring-north-korean-it-workers-2022-05-16/)*

</figcaption>
</figure>

</div>

</div>

notes:

- Cambridge Five: https://en.wikipedia.org/wiki/Cambridge_Five
- The Cambridge Five were a group of spies for the Soviet Union that attained
  high positions in British intelligence services (MI5 and MI6).

---

## 2. Identify potential threats

_**Example:**_ which adversaries will each of these password storage /
memorization mechanisms face?

- Using the same long and complex password for everything

</div>
<div class="fragment fade-in-then-semi-out" data-fragment-index=0>

- Writing passwords in a journal

</div>
<div class="fragment fade-in-then-semi-out" data-fragment-index=1>

- Using password management software

</div>

---

## 3. Determine how to prevent threats

Once we've identified threats and the risk that they pose, we start thinking
about how to *prevent* those threats.

</figcaption>
</figure>

---

## 3. Determine how to prevent threats

Even if it's not possible to fully prevent a threat, you can often find
*mitigations* that can reduce its impact.

*Source: [Google
Cloud](https://cloud.google.com/logging/docs/log4j2-vulnerability)*

</figcaption>
</figure>

</div>
  <div class="fragment" data-fragment-index=0>

</figcaption>
</figure>

</div>
</div>

---

## Updating your threat model

A threat model adapts and evolves over time.

</div>
<div class="fragment" data-fragment-index=0>

It's often useful to update your threat model after a big change, e.g.:

- Adding infrastructure
- Obtaining new resources and assets
- Organizational and personnel shifts

</div>

</div>
  <div class="col">

*Source:
[@SchmiegSophie](https://twitter.com/SchmiegSophie/status/1370534372252606469)*

</figcaption>
</figure>

</div>
</div>