Estimating Risks with Threat Models

EstimatingRiskswithThreatModels ComparingPhysicalvsCyberThreatstoControlSystems TerranceRIngoldsby IstheSkyFalling AndwhatsortofhatshouldIwear OpinionsdivergeonhostileinfrastructureriskDefenders operators AlliswellApresenteratanotherconferenceassertedthattheirinfrastructurewasburied safeSecurityexperts BronzeageisourfuturePhysicalexpertsblamecyberCyberexpertsblamephysical LoftyGoals RemovingtheSubjectivity Objectives ProvideanaccurateestimateoftheriskofhostileattackoncriticalinfrastructureComparetherisksfromphysicalvscyberattacksFindeffectivewaystoreducerisk HostileRiskModels Makingsenseofcomplexitythroughsimplification RealityistoocomplextounderstandEffectivemodelsSimplifythingstoapointwecanunderstandArecomplexenoughtocapturethekeydriversMakeusefulpredictionsHelpusmakesensiblechoices TheBalanceofPower TheInterplaybetweenAttackerandDefender Successfulattacksarepossibleif TheBalanceofPower IncidentProbability Vulnerability Threat Motivation SuccessfulattacksarepossibleifYouhaveweaknesses TheBalanceofPower IncidentProbability Vulnerability Threat Motivation SuccessfulattacksarepossibleifYouhaveweaknessesYouradversaryhasstrengths TheBalanceofPower IncidentProbability Vulnerability Threat Motivation SuccessfulattacksarepossibleifYouhaveweaknessesYouradversaryhasstrengthsYouradversarybelieveshewillgainsomething TheBalanceofPower IncidentProbability Vulnerability Threat Motivation SuccessfulattacksarepossibleifYouhaveweaknessesYouradversaryhasstrengthsYouradversarybelieveshewillgainsomething Itisn tallaboutyou Theadversaryisatleastasimportant KnowThineEnemy ArewefixatedonNavelGazing Knowtheenemyandknowyourself inahundredbattlesyouwillneverbeinperil Whenyouareignorantoftheenemybutknowyourself yourchancesofwinningorlosingareequal Ifignorantbothofyourenemyandofyourself youarecertainineverybattletobeinperil SunTzu TheArtofWar Risk Probability Risk EventProbability EventImpact LowprobabilityeventscanstillhavehighriskiftheimpactisveryhighExactlythecaseforinfrastructuresecurityNolargescaleattacksinNorthAmerica shistoryMinimalstatisticsavailabletopredictprobabilityFuturemaynotbethesameasthepast WillanAttackOccur IncidentProbability Vulnerability Threat Motivation Essenceofcapabilities basedmodeling IFtheywanttoANDtheycanTHENtheywillCapabilities whethertheadversarycanattackIftheycan t theywon tMotivation wantto Capabilities basedAnalysis IncidentProbability Vulnerability Threat Motivation Vulnerabilities How hard istheattack Objectivemeasuresof hardness FactorsthatexpertswillagreeonCostofattack technicalability time otherresourcesArethesetrulyobjectiveormerelymorespecific AssumptionsshouldbedocumentedandjustifiedDoestheattackerhavethecapabilityofexploitingthedefender svulnerabilities VulnerabilityModel NorthAmericanElectricPowerGrid Firstversionofthemodelcreatedin2004SAIC INL SpecialForces SCADAcompanyOngoingrefinementsModelsareneverfinished butstilluseful NeedmoreinvolvementfromSMEsShowswaystotakedowngridfordaysMeanttoillustrateconcepts AsLovelyasaTree ThePowerGridModel AttackTrees BlueprintsofAttacks Forsecurityreasons won tshow many specificattacksShapesdenotelogicANDORGrey rectanglesdenoteattackeractivities AttackTrees WhattheattackerdoesInteractionwithtargetResourcesrequiredBenefitstoattackerImpactstovictimDescriptivetoone skilledintheart LeafNodesRepresent AttackScenarios Pathsthroughthetreethatachieveattacker sgoal EachscenariohasListofadversary sactivitiessatisfyingAND ORsResourcesrequiredfromattackerBenefitstotheattacker i e motivation ImpactsonthedefenderMany manyscenariosinPowerGridmodel6 000majorscenarios 143 000minorscenarios Differentscenarios fit differentattackers AttackScenarios AllthisisgreatBUTWestillcan ttellwhichscenariosarelikelyWhichadversariespreferwhichscenariosWithoutlikelihood probability wecan testimaterisk ModellingtheAdversary AttackerBehavior Attackerdecisionsarebasedoncost benefitCostreferstotheeffortrequiredtodoexploitMustseecostthroughtheeyesoftheattackerEffortisrelatedtotheattacker sresourcesreq dEaseofAttack 1 AttackEffortAttackerspreferattackswithahighvalueofEaseofAttack BenefitsPreferredattackshavehighprobability UnderstandingyourEnemy Attacker sAffinitytoResources Willingnesstospenddecreasesw costDiffersbythreatagentLimitedbytheattacker sresourcesReluctanttospendhardtoreplaceresourcesResourcetradeoffspossible AdvancedAnalysis AttackerResourceAffinityUtilityFunctions DescriptionofadversaryEndpointsknown onehassomeuncertainty Curveshapeshowspsychology W i l l i n g n e s s t o B e D i s c o v e r e d 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9 1 0 0 2 0 1 0 4 0 3 0 6 0 5 0 8 0 7 1 0 0 9 Adversary sToleranceforDiscovery AdvancedAnalysis AttackerBenefitFunctions DesirabilityistheperceivedvalueoftherawbenefitsthethreatagenthopestoobtainT A isattractedbythecombinationofbenefitsOverallvaluetoattackeristhesumofindividualrewards AttackerMotivation Desirability measureofattractiontoascenario Reflectsadversary sobjectivesHarmeconomyvscauseterror influencepolicy A t t a c k e r s S a t i s f a c t i o n 0 1 0 2 0 3 0 4 0 5 0 6 0 7 0 8 0 9 1 0 1B 2B 3B 4B 5B 6B 7B 8B 9B 10B SatisfactionvsEconomicLoss ATaleofTwoAttackers State sponsoredAgent Homeland basedTerrorist FearsattributionIncapableofinsideattacksNopresenceinN AmericaHugebudget upto 10M HightechnicalabilityGoaltocrippleN AmericaAttackswhenorderedbasedonpoliticalissuesEstimatethereare 25hostilecyberwarfarecapablenations DesiresattributionCapableofinsideattacksPresentinN AmericaModestbudget 500K ModeratetechnicalabilityGoaltocreatefearAttackswheneverreadyNoaccesstointelligencedataGuessthereare25cells butonlyafewwithpowergridexpertise ThinkLikeanAttacker State sponsoredAgent Homeland basedTerrorist About220scenarioswithlikelihood 0 5Canyouflipacoin220timeswithoutgettingtails Broadrangeofattackvectors maytakealotofworktocreateadefenceSowhyarethelightson Noonehas activated thethreatagent yet About3 000scenarioswithnon zeroprobability Only5scenariosare 0 5About1 500scenariosareeliminatedifnoinsidersWhyarethelightson Modeldoesn ttakeintoaccountdeterrenceSmall ofpotentialscenariosOurestimateof ofterroristcellswiththesecapabilitiesmaybehigh Probability Risk Whataboutvictimimpact ImpactdependsonwhoisthevictimPowergeneration transmission distributionPowerconsumerNationalsecurityAmulti daygri