Threat Model Thursdays: Crispin Cowan
[no description provided]
Over at the Leviathan blog, Crispin Cowan writes about "The Calculus Of Threat Modeling." Crispin and I have collaborated and worked together over the years, and our approaches are explicitly aligned around the four question frame.
What are we working on?
One of the places where Crispin goes deeper is definitional. He's very precise about what a security principal is:
A principal is any active entity in system with access privileges that are in any way distinct from some other component it talks to. Corollary: a principal is defined by its domain of access (the set of things it has access to). Domains of access can, and often do, overlap, but that they are different is what makes a security principal distinct.
This also leads to the definition of attack surface (where principals interact), trust boundaries (the sum of the attack surfaces) and security boundaries (trust boundaries for which the engineers will fight). These are more well-defined than I tend to have, and I think it's a good set of definitions, or perhaps a good step forward in the discussion if you disagree.
What can go wrong?
His approach adds much more explicit description of principals who own elements of the diagram, and several self-check steps ("Ask again if we have all the connections..") I think of these as part of "did we do a good job?" and it's great to integrate such checks on an ongoing basis, rather than treating it as a step at the end.
What are we going to do about it?
Here Crispin has assessing complexity and mitigations. Assessing complexity is an interesting approach — a great many vulnerabilities appear on the most complex interfaces, and I think it's a useful strategy, similar to 'easy fixes first' for a prioritization approach.
He also has "c. Be sure to take a picture of the white board after the team is done describing the system." "d. Go home and create a threat model diagram." These are interesting steps, and I think deserve some discussion as to form (I think this is part of 'what are we working on?') and function. To function, we already have "a threat model diagram," and a record of it, in the picture of the whiteboard. I'm nitpicking here for two very specific reasons. First, the implication that what was done isn't a threat model diagram isn't accurate, and second, as the agile world likes to ask "why are you doing this work?"
I also want to ask, is there a reason to go from whiteboard to Visio? Also, as Crispin says, he's not simply transcribing, he's doing some fairly nuanced technical editing, "Collapse together any nodes that are actually executing as the same security principal." That means you can't hand off the work to a graphic designer, but you need an expensive security person to re-consider the whiteboard diagram. There are times that's important. If the diagram will be shown widely across many meetings; if the diagram will go outside the organization, say, to regulators; if the engineering process is waterfall-like.
Come together
Crispin says that tools are substitutes for expertise, and that (a? the?) best practice is for a security expert and the engineers to talk. I agree, this is a good way to do it — I also like to train the engineers to do this without security experts each time.
And that brings me to the we/you distinction. Crispin conveys the four question frame in the second person (What are you doing, what did you do about it), and I try to use the first person plural (we; what are we doing). Saying 'we' focuses on collaboration, on dialogue, on exploration. Saying 'you' frames this as a review, a discussion, and who knows, possibly a fight. Both of us used that frame at a prior employer, and today when I consult, I use it because I'm really not part of the doing team.
That said, I think this was a super-interesting post for the definitions, and for showing the diagram evolution and the steps taken from a whiteboard to a completed, colored diagram.
The image is the frontspiece of Leviathan by Thomas Hobbes, with its famous model of the state, made up of the people.