Lab 6

Lab 6.
Threat modelling
Step 1. Description of the company
Developing a comprehensive description of the company and its assets is a crucial step in
building a cyber security threat model. The MITRE ATT&CK framework can then be applied
to identify potential threats and vulnerabilities. Here's a step-by-step guide:
Sections in red are obligatory to complete today!

1. Provide general description of the company (it will be hypothetical organization), give it
a name:
Gather information about the company's core business functions, industry, and any unique
aspects that might make it a target for cyber threats.
Identify critical business processes and assets.
2. Document Assets:
Create an inventory of all digital and physical assets. Include servers, workstations,
databases, networks, IoT devices, software applications, and any other technology used by
the company.
3. Identify Data and Information Flows:
Map the flow of sensitive data within the organization. Understand how data moves
through different systems and processes.
4. Categorize Data Sensitivity:
Classify data based on sensitivity (e.g., public, internal use only, confidential). This helps
prioritize protection efforts.
5. Identify Network Architecture:
Document the company's network architecture, including firewalls, routers, switches, and
other network devices. Understand how different segments of the network are connected.
6. Review Security Controls (not obligatory now, you can do it later):
Document existing security controls such as firewalls, intrusion detection/prevention

systems, antivirus solutions, and endpoint protection or any other security controls that you
consider necessary
7. Document Authentication and Authorization Mechanisms (not obligatory now, you can
do it later):
Identify how users and systems are authenticated and authorized. Document access control
mechanisms and user privileges.
8. Review Incident Response and Logging Mechanisms (not obligatory now, you can do it
later):
Document existing incident response procedures and logging mechanisms. This includes
reviewing logs from network devices, servers, and applications.
9. Evaluate Security Policies and Procedures (not obligatory now, you can do it later):
Understand and document existing security policies and procedures. This includes policies
related to data handling, access control, and acceptable use.
10. Assess Third-Party Relationships:
Identify any third-party vendors or partners that have access to the company's systems or
data. Evaluate the security controls in place for these relationships.
11. Identify Employee Roles and Responsibilities:
Document employee roles and responsibilities, especially those related to information

security. This includes both IT personnel and non-technical staff.
12. Review Physical Security Measures (not obligatory now, you can do it later):
Document physical security measures in place, such as access controls, surveillance systems,
and security personnel.
13. Understand Patch Management Processes:
Document how the company manages software and system updates. This includes the
patching process for operating systems, applications, and firmware.
14. Assess User Awareness and Training Programs (not obligatory now, you can do it
later):
Evaluate existing security awareness and training programs for employees. This is crucial for
preventing social engineering attacks.
15. Document Regulatory Compliance Requirements (not obligatory now, you can do it
later):
Identify any regulatory requirements that the company must adhere to. This could include
data protection laws, industry-specific regulations, or international standards.
Once you have a detailed description of the company and its assets, you can apply the
MITRE ATT&CK framework to analyse potential threat vectors and develop a robust threat
model. This involves mapping specific ATT&CK techniques and tactics to the identified assets
and understanding how adversaries might exploit vulnerabilities in the organization's
security posture.
This mapping helps you understand potential threats and attack vectors that align with
MITRE ATT&CK, allowing you to enhance your security posture and incident response
capabilities. Keep in mind that this is a simplified example, and a thorough threat model
would involve a more detailed analysis of each asset and potential attack scenarios.
Information sources:
1. MITRE ATT&CK®, https://attack.mitre.org/
2. Cybersecurity Alerts & Advisories: https://www.cisa.gov/news-events/cybersecurity-
advisories?f%5B0%5D=advisory_type%3A94
3. Example: https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-301a
Example of description of the company (DON’T COPY IT, IT IS EXAMPLE):

Let's consider a hypothetical company, ABC Tech Solutions, and go through the process of
building a description and a basic threat model using the MITRE ATT&CK framework.
1. Company Description:
ABC Tech Solutions is a technology company specializing in software development and IT
services. The company has 500 employees and operates in the finance and healthcare
sectors. Critical assets include a customer database (software), financial systems, and
proprietary software applications (list of such software). ABC Tech Solutions uses a hybrid
cloud infrastructure and has a remote workforce.
…
2. Asset Inventory:
Servers: AWS cloud servers hosting customer-facing applications.
Workstations: Windows and macOS machines used by employees.
Databases: MySQL database containing customer information.
Networks: On-premises and cloud-based networks connecting offices and remote workers.
Applications: Custom software applications for finance and healthcare services (list of such
software).
…
3. Data and Information Flows:

Customer data is collected through web applications and stored in the MySQL database.
Financial data flows between the on-premises finance system and the cloud-based analytics
platform.
…
4. Data Sensitivity:
Customer data is classified as confidential.
Financial data is classified as highly sensitive.
…
5. Network Architecture:
Hybrid cloud architecture with AWS servers and on-premises data centres.
Firewalls and intrusion detection systems protect the network perimeter.
…
6. Security Controls:
Antivirus software on all workstations.
Endpoint protection on servers.
Firewalls configured to restrict incoming and outgoing traffic.
…
7. Authentication and Authorization:

Active Directory for user authentication.
Role-based access control (RBAC) implemented for data access.
…
8. Incident Response and Logging:

Incident response plan outlines procedures for handling security incidents.
Logs from servers and network devices are centralized and monitored.
…
9. Security Policies and Procedures:

Acceptable use policy outlines proper use of company resources.
Data handling policy defines how sensitive data should be treated.
…
10. Third-Party Relationships:

ABC Tech Solutions uses a third-party cloud service provider for hosting applications.
Vendors have limited access, and contracts include security requirements.
…
11. Employee Roles and Responsibilities:

IT administrators manage network infrastructure and security controls.
Employees have specific access rights based on their roles.
…
12. Physical Security:

Access control systems and surveillance cameras in data centres.
Security personnel monitor physical access to offices.
…
13. Patch Management:

Regular patching of operating systems and applications is conducted.
Critical patches are prioritized and applied promptly.
…
14. User Awareness and Training:
Employees undergo annual cybersecurity awareness training.
Phishing simulations are conducted to enhance awareness.
…
15. Regulatory Compliance:

Compliance with GDPR for customer data protection.
Adherence to HIPAA for healthcare-related data.
…

Lab 6

Uploaded by

Copyright:

Available Formats

Lab 6

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Lab 6

Uploaded by

Copyright:

Available Formats

Lab 6.

Sections in red are obligatory to complete today!

3. Identify Data and Information Flows:

4. Categorize Data Sensitivity:

5. Identify Network Architecture:

6. Review Security Controls (not obligatory now, you can do it later):

Document existing security controls such as firewalls, intrusion detection/prevention

10. Assess Third-Party Relationships:

11. Identify Employee Roles and Responsibilities:

Document employee roles and responsibilities, especially those related to information

13. Understand Patch Management Processes:

Example of description of the company (DON’T COPY IT, IT IS EXAMPLE):

3. Data and Information Flows:

7. Authentication and Authorization:

8. Incident Response and Logging:

9. Security Policies and Procedures:

10. Third-Party Relationships:

11. Employee Roles and Responsibilities:

12. Physical Security:

13. Patch Management:

15. Regulatory Compliance:

You might also like

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.