Improving Web Application Security: Threats and - CGISecurity

Chapter 3: Threat Modeling 57●●Use STRIDE to identify threats. Consider the broad categories of threats, such asspoofing, tampering, and denial of service, and use the STRIDE model fromChapter 2, “Threats and Countermeasures” to ask questions in relation to eachaspect of the architecture and design of your application. This is a goal-basedapproach where you consider the goals of an attacker. For example, could anattacker spoof an identity to access your server or Web application? Couldsomeone tamper with data over the network or in a store? Could someone denyservice?Use categorized threat lists. With this approach, you start with a laundry list ofcommon threats grouped by network, host, and application categories. Next,apply the threat list to your own application architecture and any vulnerabilitiesyou have identified earlier in the process. You will be able to rule some threats outimmediately because they do not apply to your scenario.Use the following resources to help you with the threat identification process:● For a list of threats organized by network, host, and application layers, as well asexplanations of the threats and associated countermeasures, see Chapter 2,“Threats and Countermeasures.”● For a list of threats by technology, see “Threats and Countermeasures” at thebeginning of each of the “Building” chapters in Part III of this guide.During this step, you perform the following tasks:● Identify network threats.●●Identity host threats.Identify application threats.Identify Network ThreatsThis is a task for network designers and administrators. Analyze the networktopology and the flow of data packets, together with router, firewall, and switchconfigurations, and look for potential vulnerabilities. Also pay attention to virtualprivate network (VPN) endpoints. Review the network defenses against the mostcommon network layer threats identified in Chapter 2, “Threats andCountermeasures.”Top network threats to consider during the design phase include:● Using security mechanisms that rely on the IP address of the sender. It is relativelyeasy to send IP packets with false source IP addresses (IP spoofing).● Passing session identifiers or cookies over unencrypted network channels. Thiscan lead to IP session hijacking.● Passing clear text authentication credentials or other sensitive data overunencrypted communication channels. This could allow an attacker to monitor thenetwork, obtain logon credentials, or obtain and possibly tamper with othersensitive data items.