The Odyssey: challenges to model privacy threats in a brave new - - PowerPoint PPT Presentation

▶
the odyssey challenges to model privacy threats in a
SMART_READER_LITE
LIVE PREVIEW

The Odyssey: challenges to model privacy threats in a brave new - - PowerPoint PPT Presentation

Dec 15, 2023 27 likes •157 views

The Odyssey: challenges to model privacy threats in a brave new world Rafa Glvez and Seda Grses Motivation imec - ESAT/COSIC, KU Leuven Threat Modeling 1. Characterize the system 2. Identify the threats 3. Threat and Risk analysis

slide-1
SLIDE 1

The Odyssey: challenges to model privacy threats in a brave new world

Rafa Gálvez and Seda Gürses

slide-2
SLIDE 2

imec - ESAT/COSIC, KU Leuven

Motivation

slide-3
SLIDE 3
  • 1. Characterize the

system

  • 2. Identify the threats
  • 3. Threat and Risk

analysis

  • 4. Validate

imec - ESAT/COSIC, KU Leuven

Threat Modeling

slide-4
SLIDE 4

imec - ESAT/COSIC, KU Leuven

Privacy goals

  • Confidentiality
  • Control
  • Practice
slide-5
SLIDE 5

Waterfall Agile

imec - ESAT/COSIC, KU Leuven

From waterfall to agile

slide-6
SLIDE 6

From monoliths to services

imec - ESAT/COSIC, KU Leuven

slide-7
SLIDE 7

imec - ESAT/COSIC, KU Leuven

Modeling threats today

slide-8
SLIDE 8

imec - ESAT/COSIC, KU Leuven

Traditional TM assumptions

slide-9
SLIDE 9
  • Frequent delivery
  • Working software
  • New requirements
  • Face to face meetings
  • Independent development
  • Independent deployment
  • Outsourced functionality to

third party services

imec - ESAT/COSIC, KU Leuven

New reality

slide-10
SLIDE 10
  • 1. Characterize the system
  • Keep the model up to date
  • Reflect implementation details
  • 2. Identify the threats
  • Threats can emerge, change
  • f vanish
  • Deriving threats is slow
  • 3. Threat and Risk analysis
  • Compositionality of services
  • 4. Validate
  • Lack of information to

automate testing

imec - ESAT/COSIC, KU Leuven

TM becomes challenging

slide-11
SLIDE 11

Agile provides grounds for

  • Solid and iterative

progress

  • Effective analysis of

complex problems Services enable

  • Verbose documentation
  • Parallelization

imec - ESAT/COSIC, KU Leuven

Opportunities

slide-12
SLIDE 12

imec - ESAT/COSIC, KU Leuven

  • Threat Modeling can help to comply with GDPR
  • Software landscape has changed, traditional TM is

challenging

  • TM methodologies need to take advantage of the new
  • pportunities
  • Can we automate privacy threat modeling
  • Can we do Privacy as a service?

Conclusions and open problems