CS338 Computer Security
Monday, 14 October 2024

+ This week
- A little threat modeling
- A little ethical analysis
- A little law

+ Threat models
- What's the point?
- Threat Modeling Manifesto
    https://www.threatmodelingmanifesto.org/
- Why have formal frameworks? 
- STRIDE as an example framework

+ STRIDE lab

- Spoofing
    - steal credentials by shoulder-surfing
        mitigation: visual barrier; use a card system...?
    - use Flipper Zero or similar to record door-opening signal and replay it
- Tampering
    - SQL injection
        mitigation: use tools to clean user input before using it
    - Physical tampering: access the lock mechanism
    - Physical tampering: break the door
    - Mess with the wifi
- Repudiation
    - "I know my username is in the logs, your honor, but that wasn't me"
        mitigation: CCTV, MFA or biometrics
    - or even change the logs so the question doesn't come up
        ???
- Information Disclosure
    - The "no such user name" error message tells you about valid user names
        mitigation: combine the two errors
    - People talk to each other about their passwords
    - Wireshark to watch the wifi traffic
- Denial of Service
    - Bike lock the door
        mitigation: no handles; security guard comes by now and then
    - Cut the power cable
        mitigation: power cable underground; backup battery power; build kiosk into the wall
    - Break or obscure the touch screen
- Elevation of Privilege
    - Arguably, holding the door for somebody elevates their privilege
    - Phish an admin password...question: does an admin password help?
    - Create an account for yourself somehow

+ In general
- Threat brainstorming is hard. There are *lots* of possibilities.
- Some mitigations are annoying [usability] or expensive [cost]
- "Shift left" is good: move the security/threat analysis as early
    in the development process as possible
- STRIDE is just one example of a framework for threat modeling

+ The upcoming homework assignments
- Wednesday: ethical analysis
- Friday: a reading response about some legal issues
- Monday: midterm break
- After that: authentication (including password cracking), authorization,
    pen-testing/ethical hacking,...