Attack Trees, Security modelling for Agile Teams Michael - - PowerPoint PPT Presentation

▶
attack trees security
SMART_READER_LITE
LIVE PREVIEW

Attack Trees, Security modelling for Agile Teams Michael - - PowerPoint PPT Presentation

Mar 28, 2023 108 likes •772 views

Attack Trees, Security modelling for Agile Teams Michael Brunton-Spall @bruntonspall Michael Brunton-Spall He/His/Him Independent Cybersecurity Consultant Michael Brunton-Spall @bruntonspall Why Security Matters Michael Brunton-Spall

slide-1
SLIDE 1

Michael Brunton-Spall @bruntonspall

Attack Trees, Security modelling for Agile Teams

slide-2
SLIDE 2

Michael Brunton-Spall @bruntonspall

Michael Brunton-Spall He/His/Him Independent Cybersecurity Consultant

slide-3
SLIDE 3

Michael Brunton-Spall @bruntonspall

Why Security Matters

slide-4
SLIDE 4

05/03/2018 4

Michael Brunton-Spall @bruntonspall

slide-5
SLIDE 5

05/03/2018 5

Michael Brunton-Spall @bruntonspall

slide-6
SLIDE 6

05/03/2018 6

Michael Brunton-Spall @bruntonspall

slide-7
SLIDE 7

05/03/2018 7

Michael Brunton-Spall @bruntonspall

slide-8
SLIDE 8

Michael Brunton-Spall @bruntonspall

Criminal users on the internet

slide-9
SLIDE 9

Michael Brunton-Spall @bruntonspall

slide-10
SLIDE 10

Michael Brunton-Spall @bruntonspall

slide-11
SLIDE 11

Michael Brunton-Spall @bruntonspall

Advanced Persistent Threats

slide-12
SLIDE 12

Michael Brunton-Spall @bruntonspall

slide-13
SLIDE 13

Michael Brunton-Spall @bruntonspall

slide-14
SLIDE 14

Michael Brunton-Spall @bruntonspall

Security is not compliance

slide-15
SLIDE 15

Michael Brunton-Spall @bruntonspall

Certification Accreditation PCI ISO27001

slide-16
SLIDE 16

05/03/2018 18

Michael Brunton-Spall @bruntonspall

slide-17
SLIDE 17

05/03/2018 19

Michael Brunton-Spall @bruntonspall

slide-18
SLIDE 18

Michael Brunton-Spall @bruntonspall

Agile principles

slide-19
SLIDE 19

Michael Brunton-Spall @bruntonspall

In Individuals and in interactions over processes and tools Work rking soft ftware over comprehensive documentation Customers collaboration over contract negotiation Responding to change over following a plan

slide-20
SLIDE 20

Michael Brunton-Spall @bruntonspall

Risk methodologies

slide-21
SLIDE 21

Michael Brunton-Spall @bruntonspall

Component based

slide-22
SLIDE 22

Michael Brunton-Spall @bruntonspall

IS1, ISO27005, NIST SP-800-30

slide-23
SLIDE 23

Michael Brunton-Spall @bruntonspall

System based

slide-24
SLIDE 24

Michael Brunton-Spall @bruntonspall

TOGAF, SABSA, Attack Trees

slide-25
SLIDE 25

Michael Brunton-Spall @bruntonspall

Component Pro’s Thorough, Exhaustive, Objective

slide-26
SLIDE 26

Michael Brunton-Spall @bruntonspall

Systemic – Pro’s Subjective, Holistic, Interaction focused

slide-27
SLIDE 27

Michael Brunton-Spall @bruntonspall

Simple Systems – A bike

slide-28
SLIDE 28

Michael Brunton-Spall @bruntonspall

Complicated systems – A car

slide-29
SLIDE 29

Michael Brunton-Spall @bruntonspall

Complex Systems - Traffic

slide-30
SLIDE 30

Michael Brunton-Spall @bruntonspall

We don’t solve motorway congestion by assuring tires

slide-31
SLIDE 31

Michael Brunton-Spall @bruntonspall

Attack trees

slide-32
SLIDE 32

Michael Brunton-Spall @bruntonspall

Attack Tree Workshop System Scope Business needs Threats

slide-33
SLIDE 33

Michael Brunton-Spall @bruntonspall

Understand the business

slide-34
SLIDE 34

Michael Brunton-Spall @bruntonspall

Work out what’s in scope

slide-35
SLIDE 35

Michael Brunton-Spall @bruntonspall

Understand the threats

slide-36
SLIDE 36

Michael Brunton-Spall @bruntonspall

The Workshop

slide-37
SLIDE 37

Michael Brunton-Spall @bruntonspall

Who are the attackers?

slide-38
SLIDE 38

Michael Brunton-Spall @bruntonspall

What do they want?

slide-39
SLIDE 39

Michael Brunton-Spall @bruntonspall

How will they get it?

slide-40
SLIDE 40

05/03/2018 42

Michael Brunton-Spall @bruntonspall

Workshop the attacks

slide-41
SLIDE 41

05/03/2018 43

Michael Brunton-Spall @bruntonspall

Build trees

slide-42
SLIDE 42

Michael Brunton-Spall @bruntonspall

Breadth first

slide-43
SLIDE 43

Michael Brunton-Spall @bruntonspall

Understand impact of attacks

slide-44
SLIDE 44

Michael Brunton-Spall @bruntonspall

Ranking 1-6, often order of magnitude increase

slide-45
SLIDE 45

Michael Brunton-Spall @bruntonspall

Cost to the attacker

slide-46
SLIDE 46

Michael Brunton-Spall @bruntonspall

Complexity of the attack

slide-47
SLIDE 47

Michael Brunton-Spall @bruntonspall

Consequences on the attacker

slide-48
SLIDE 48

Michael Brunton-Spall @bruntonspall

Reward to the attacker

slide-49
SLIDE 49

Michael Brunton-Spall @bruntonspall

Damage to the organisation

slide-50
SLIDE 50

Michael Brunton-Spall @bruntonspall

How often can it be repeated

slide-51
SLIDE 51

05/03/2018 53

Michael Brunton-Spall @bruntonspall

slide-52
SLIDE 52

Michael Brunton-Spall @bruntonspall

Post workshop

slide-53
SLIDE 53

Michael Brunton-Spall @bruntonspall

Determine countermeasures

slide-54
SLIDE 54

Michael Brunton-Spall @bruntonspall

In place and planned

slide-55
SLIDE 55

Michael Brunton-Spall @bruntonspall

Planned countermeasures go

  • n the backlog
slide-56
SLIDE 56

Michael Brunton-Spall @bruntonspall

Repeat as needed

slide-57
SLIDE 57

Michael Brunton-Spall @bruntonspall

Fitting into the agile cycle

slide-58
SLIDE 58

Michael Brunton-Spall @bruntonspall

Workshop with whole team*

slide-59
SLIDE 59

Michael Brunton-Spall @bruntonspall

Visible outputs for walls

slide-60
SLIDE 60

Michael Brunton-Spall @bruntonspall

Threat Actor Personas

slide-61
SLIDE 61

Michael Brunton-Spall @bruntonspall

Misuse cases

slide-62
SLIDE 62

Michael Brunton-Spall @bruntonspall

Record decisions against stories

slide-63
SLIDE 63

Michael Brunton-Spall @bruntonspall

Record deferred security debt

slide-64
SLIDE 64

Michael Brunton-Spall @bruntonspall

Product Owner is in control

slide-65
SLIDE 65

Michael Brunton-Spall @bruntonspall

Attack Trees: System based risk methodology, for the whole team, iteratively updated

slide-66
SLIDE 66

Michael Brunton-Spall @bruntonspall

Any questions? @bruntonspall michael@brunton-spall.co.uk