Risk-based design security analysis

Abstract

Implementing security by design in practice often involves the application of threat modeling to elicit security threats and to aid designers in focusing efforts on the most stringent problems first. Existing threat modeling methodologies are capable of generating lots of threats, yet they lack even basic support to triage these threats, except for relying on the expertise and manual assessment by the threat modeler. Since the essence of creating a secure design is to minimize associated risk (and countermeasure costs), risk analysis approaches offer a very compelling solution to this problem. By combining risk analysis and threat modeling, elicited threats in a design can be enriched with risk analysis information in order to provide support in triaging and prioritizing threats and focusing security efforts on the high-risk threats. It requires the following inputs: the asset values, the strengths of countermeasures, and an attacker model. In his paper, we provide an integrated threat elicitation and risk analysis approach, implemented in a threat modeling tool prototype, and evaluate it using a real-world application, namely the SecureDrop whistleblower submission system. We show that the security measures implemented in SecureDrop indeed correspond to the high-risk threats identified by our approach. Therefore, the risk-based security analysis provides useful guidance on focusing security efforts on the most important problems first. CCS CONCEPTS • Security and privacy → Software security engineering; • Software and its engineering → Risk management;

An Architectural View for Data Protection by Design

“…Such analyses can be further enriched with the incorporation of the information from the data protection view: (i) data types and their sensitivity through DataStores and DataFlows, (ii) data subject types through ExternalEntities or via the DataTypes, (iii) the nature of the processing activities through the Processes. After identifying the threats in the previous step, a risk estimation can be performed [25] for each threat. This estimation step can again be improved with the inclusion of the aforementioned data protection artifacts as resources in the risk estimation.…”

“…It does not, however, cover all legal concepts. Other DFD extensions have been proposed in the literature [7], [25], [32], [33]. Examples are security or privacy solutions [7] to take existing countermeasures into account and enable the up-front elimination of inapplicable threats.…”

A Data Utility-Driven Benchmark for De-identification Methods

“…Nevertheless, establishing such thresholds is a challenging task, as it also has to reflect the type of attackers, their capabilities, and the availability of data related to the data set. Profiles of attackers that may be useful for establishing privacy requirements can be found in [16].…”

Privacy Risk Assessment for Data Subject-Aware Threat Modeling

“…This section elaborates on a number of risk perspectives that are relevant in the context of privacy threat modeling. Many existing risk assessment approaches focus on either technical failures (e.g., FMEA [12]) or the manifestation of security threats (e.g., FAIR [13], CORAS [14], security threat risk [15]). In these approaches, the risk impact depends on the value of business assets or the level of criticality of technical components or services.…”