STRIDE, CIA and the Modern Adversary

Heinrich Gantenbein (Cybersecurity) — Tue, 07 Jun 2016 14:54:55 GMT

The modern adversary isn’t a script kiddie. She/he is a sophisticated professional hired by a nation state or criminal organization. Her organization will have done an ROI (Return on Investment) calculation to justify the cost of a targeted attack against a specific entity. This adversary also doesn’t attack linearly against the traditional network based defenses. The modern adversary uses graph thinking and going through multiple hops to get to the desired target such as credit card numbers or lists of employees. This can even include more than one company: first breach a trusted vendor, second abuse the trust to attack the actual target. This new reality made me think about the relationship between the goals of security known as CIA (Confidentiality, Integrity and Availability) and the threat modeling categorization approach known as STRIDE (Spoofing, Tampering, Repudiation, Information Disclosure, Denial of Service and Elevation of Privilege).

Meaning of each Letter

STRIDE is what an attacker can do. TID is the attack version of CIA:

Defenders want Confidentiality – attackers use Information Disclosure
Defenders want Integrity – attackers use Tampering
Defenders want Availability – attackers use Denial of Service.

But, what about Spoofing, Repudiation and Elevation of Privilege? Enter the (modern) non-linear attack:

Spoofing and Elevation of Privilege are the entry points to pry open the doors.
Repudiation is covering the adversary’s tracks during the initial compromise and the breach. This also happens when you cannot distinguish the attacker’s actions from the legitimate user ones. Note: sometimes repudiation is an attempt by a legitimate user (turned adversary) to dispute transactions (Dear Gullible Bank, I never transferred that money from my account; you owe me $20,000 in damages).

Non-Linear Attack

Graph thinking does not (primarily) worry about traditional network defenses, such as a firewalls, DMZs, VPNs and similar. Note: these defenses are still useful to some extent. Let’s construct a fictional scenario (any resemblance to actual attacks is coincidental):

Plan the attack (can take months for intelligence gathering).
Initial compromise to gain command and control (STIE)
- Social engineering attack (Spoofing)
- Deploy malware (Tampering the OS to facilitate Information Disclosure)
- Steal credentials (Information Disclosure in preparation of Spoofing)
- Attempt lateral traversal and escalating to Domain Administrator (Elevation of Privilege)
- Add additional high-privilege user accounts such as domain administrators (Elevation of Privilege and Spoofing)
Execute the attacker’s mission (Violate CIA through TID)
- Retrieve the data (Information Disclosure)
- Execute fraudulent transactions (Tampering)
- Encrypt for ransom demand (Denial of Service)
- Destroy data (Denial of Service and/or Tampering)
- Persist compromise for future exploits
Hide the tracks and hide Command and Control capability (Repudiation)
- Encrypt stolen data during exfiltration to avoid detection
- Erase logs
- Tamper with anti-malware and intrusion detection systems
- Use additional created credentials instead of the original high privilege account(s)

Prioritizing CIA and the Relative Importance of TID

STRIDE mitigations need to be prioritized. Therefore, you must consider the importance of C, I and A for your scenario:

Many industries (e.g. banking, health care insurance, …) value Confidentiality and Integrity almost equally and Availability much lower (but not at zero).
In other industries, such as SCADA (Supervisory Control and Data Acquisition) systems or any IoT, Availability trumps all else, followed closely by Integrity with Confidentiality lower. If you wonder why, just think about a nuclear power plant or a connected car: unavailability leads to a catastrophic failure.

Summary

Each letter of STRIDE maps to an adversaries and/or the defender’s goals. Of course the primary goals can also be useful during the initial compromise to open the door.

Goal	Defender	Attacker	Threat Category
Open the Door	Prevent door opening	Compromise	Spoofing
Integrity	Preserve	Violate	Tampering
Hide Activity	Preserve visibility	Hide Activity	Repudiation
Confidentiality	Preserve	Violate	Information Disclosure
Availability	Preserve	Deny	Denial of Service
Open the Door	Prevent door opening	Compromise	Elevation of Privilege

Acknowledgements

A special thank you goes to my colleagues Michael Howard, John Rodriguez and Walter Dominguez for their valuable feedback.

Extending WCF for Legacy Protocol Support

heinrichg — Thu, 07 Feb 2008 09:44:00 GMT

I recently had a customer with the following project. A new software system is being build based on a SOA approach. Unfortunately, at least one client is a legacy mainframe socket application with a positional message format. The traditional approach for this problem is to write custom threading and socket code. This often leads to unreliable and hard to maintain code that lacks flexibility to support additional message protocols in a coherent manner.

After a thorough investigation it was decided to utilize the extensibility points in Windows Communications Foundation’s (WCF) to implement the solution. I posted a derived (simplified) code sample and a whitepaper on https://code.msdn.microsoft.com/WcfBinaryTcpExt. Lenny Fenster and Simon Gurevich helped me with this effort.

I will discuss a few specific aspects of the source code in more detail at a later date.

Heinrich on Security