Improving Web Application Security: Threats and - CGISecurity

Chapter 3: Threat Modeling 63Risk = Probability * Damage PotentialThis formula indicates that the risk posed by a particular threat is equal to theprobability of the threat occurring multiplied by the damage potential, whichindicates the consequences to your system if an attack were to occur.You can use a 1–10 scale for probability where 1 represents a threat that is veryunlikely to occur and 10 represents a near certainty. Similarly, you can use a 1–10scale for damage potential where 1 indicates minimal damage and 10 represents acatastrophe. Using this approach, the risk posed by a threat with a low likelihood ofoccurring but with high damage potential is equal to the risk posed by a threat withlimited damage potential but that is extremely likely to occur.For example, if Probability=10 and Damage Potential=1, then Risk = 10 * 1 = 10. IfProbability=1 and Damage Potential=10, then Risk = 1 * 10 = 10.This approach results in a scale of 1–100, and you can divide the scale into threebands to generate a High, Medium, or Low risk rating.High, Medium, and Low RatingsYou can use a simple High, Medium, or Low scale to prioritize threats. If a threat israted as High, it poses a significant risk to your application and needs to beaddressed as soon as possible. Medium threats need to be addressed, but with lessurgency. You may decide to ignore low threats depending upon how much effort andcost is required to address the threat.DREADThe problem with a simplistic rating system is that team members usually will notagree on ratings. To help solve this, add new dimensions that help determine whatthe impact of a security threat really means. At Microsoft, the DREAD model is usedto help calculate risk. By using the DREAD model, you arrive at the risk rating for agiven threat by asking the following questions:● Damage potential: How great is the damage if the vulnerability is exploited?●●●●Reproducibility: How easy is it to reproduce the attack?Exploitability: How easy is it to launch an attack?Affected users: As a rough percentage, how many users are affected?Discoverability: How easy is it to find the vulnerability?You can use above items to rate each threat. You can also extend the above questionsto meet your needs. For example, you could add a question about potentialreputation damage:Reputation: How high are the stakes? Is there a risk to reputation, which could leadto the loss of customer trust?