Interaction-Based Privacy Threat Elicitation

Abstract

Threat modeling involves the systematic identification, elicitation, and analysis of privacy-and/or security-related threats in the context of a specific system. These modeling practices are performed at a specific level of architectural abstraction -the use of Data Flow Diagram (DFD) models, for example, is common in this context.To identify and elicit threats, two fundamentally different approaches can be taken: (1) elicitation on a per-element basis involves iteratively singling out individual architectural elements and considering the applicable threats, (2) elicitation at the level of system interactions (which involve the local context of three elements: a source, a data flow, and a destination) performs elicitation at the basis of system-level communication.Although not considering the local context of the element under investigation makes the former approach easier to adopt and use for human analysts, this approach also leads to threat duplication and redundancy, relies more extensively on implicit analyst expertise, and requires more manual effort.In this paper, we provide a detailed analysis of these issues with element-based threat elicitation in the context of LINDDUN, an element-driven privacy-by-design threat modeling methodology. Subsequently, we present a LINDDUN extension that implements interaction-based privacy threat elicitation and we provide indepth argumentation on how this approach leads to better process guidance and more concrete interpretation of privacy threat types, ultimately requiring less effort and expertise.A third standalone contribution of this work is a catalog of realistic and illustrative LINDDUN privacy threats, which in turn facilitates practical threat elicitation using LINDDUN.

Knowledge is Power: Systematic Reuse of Privacy Knowledge for Threat Elicitation

“…There are two main approaches. The original per-element approach [2], [4] iterates systematically over each element of the model, while the per-interaction approach [3], [14] considers each interaction (i.e. sender-flow-destination combination) in the model.…”

Towards Automated Security Design Flaw Detection

“…A final common class of design-level analysis approaches for security is threat modeling, which starts from a data flow diagram-based abstraction of the system to elicit security [10], [19] or privacy [21], [37] threats. Both the security and privacy threat modeling approaches support a systematic analysis of the system under consideration by iterating over every element (element-based [10], [19], [37]) or interaction (interactionbased [19], [38]). The knowledge-bases used in these approaches can also be extended for detecting additional threat types, but the element-or interaction-based approach limits the complexity of the criteria to assess as they remain limited to a single element or interaction.…”

Privacy Laws and Privacy by Design Schemes for the Internet of Things

“…Privacy by Design (PbD) [27] is a fairly new system that works to embed privacy practice more deeply and effectively into the development process [30,59]. REGULATION (EU) 2016/679 General Data Protection Regulation (GDPR) [1] confirms the importance of this and is applicable to all systems that manage personal data processing -a common feature of IoT applications.…”