4 ms·
Some of my favourite threat actors to model are ones who developers can empathize with. What I call grad students and conference papers, where someone who is do
by motohagiography 6y ago
Some of my favourite threat actors to model are ones who developers can empathize with. What I call grad students and conference papers, where someone who is doing it for the professional prestige is pulling your feature or product apart.
A lot of threat modelling is story telling around your product. Who uses it, why, and how could someone else benefit from stealing what your company gets out of it? I formalized that threat story development it into a product a few years ago, and it actually generated security epics and stories, but ran out of runway for it and moved back into consulting, but the reason I think people get into security is precisely because of the threat modelling aspect of it. It's really the fun part of the field where you get to inhabit a kind of cyberpunk noir world of spies, opposition researchers, organized crime, hackers, and activists. I moved on from it because unfortunately 95% of the material demand for security is driven by Compliance, which is a set of methodologies designed to specifically avoid having to acknowledge your real threat model, because to do so and write it down creates discoverable liability for potential negligence in some enterprise cultures. Taking risks of all kinds is the game in business, and narrating the risk game and winning it at the same time can be hard to reconcile. However, a company that can look at its real risks and threat model and get everyone down to developers aligned on what they're doing and why is probably a 10x company culture. It might be worth looking at whether threat modelling could be used in product orgs as the founding narrative or story to get that kind of alignment that would supercharge their teams.
- mox1 6y agoWorked for a major medical device manufacturer in security for a few years. That was (and probably still is) their #1 threat model. Security Researchers at conferences moved the security needle far more than any other threat actor. I wont opine on whether this is good or bad, just interesting to note that this is real. The threat model is hard, because you have all this "meta" stuff. We also commonly ended up in "proving a negative" arguments with researches and regulators. Researcher X says "I can do this, so giving this other set of circumstances I can probably do this". We would say, "No, we looked into that, doesn't work that way." Researcher X "Prove it". We then enter a standstill where we try to figure out how we "prove" our product isn't vulnerable!?!? It eventually felt like trying to prove bigfoot was or wasn't real.
- suifbwish 6y agoIt’s probably safe to say that some major hacks have been made possible by security researchers publishing POCs for vulnerabilities that will inevitably never be completely patched by everyone. It’s not like a POC is just a tool that’s being abused, it literally has only one purpose.
- enkid 6y agoBlaming the security researcher is a bad idea. Without the security researcher, the tool would still be created and used by somebody. The security researcher highlights the problem and makes people understand the danger in it. Without the POC, is it highly likely people who know nothing about cyber security just wouldn't care about the vulnerability.
- suifbwish 6y agoI’m not blaming them in a bad way. I’m just saying it’s not completely not their fault. Releasing vulnerabilities and POCs for major applications should be handled with utmost care and responsibility unless they don’t care about the consequences of their actions. There are tons of script kiddies using POCs out there who would never be smart enough to create them themselves. It helps abstract the actual hacker process down to just grabbing a git library and executing it on a victim.
- SahAssar 6y agoHow do you properly test that you mitigated a vulnerability if you don't have a POC? POC's are useful for other purposes than malicious attacks.