Improving Web Application Security: Threats and - CGISecurity

60 Part I: Introduction to Threats and CountermeasuresCreating Attack TreesWhile several approaches can be used in practice, the accepted method is to identifygoals and sub-goals of an attack, as well as what must be done so that the attacksucceeds. You can use a hierarchical diagram to represent your attack tree, or use asimple outline. What is important in the end is that you have something that portraysthe attack profile of your application. You can then evaluate likely security risks,which you can mitigate with the appropriate countermeasures, such as correcting adesign approach, hardening a configuration setting, and other solutions.Start building an attack tree by creating root nodes that represent the goals of theattacker. Then add the leaf nodes, which are the attack methodologies that representunique attacks. Figure 3.5 shows a simple example.Threat #1Obtaining authenticationcredentials over thenetworkand1.1Clear text credentialssent over the network1.2Attacker uses networkmonitoring tools1.2.1Attacker recognizescredential dataFigure 3.5Representation of an attack treeYou can label leaf nodes with AND and OR labels. For example, in Figure 3.5, both1.1 and 1.2 must occur for the threat to result in an attack.Attack trees like the one shown above have a tendency to become complex quickly.They are also time-consuming to create. An alternative approach favored by someteams is to structure your attack tree using an outline such as the one shown below.1. Goal One1.1 Sub-goal one1.2 Sub-goal two2. Goal Two2.1 Sub-goal one2.2 Sub-goal two