Security AnalysisPart I: Basics
Ketil Stølen, SINTEF & UiO
CORAS 1
Acknowledgments
The research for the contents of this tutorial has partly been funded by the European Commission through the FP7 project SecureChange and the FP7 network of excellence NESSoS
CORAS 2
Objectives for the three Lectures on Security Analysis
Classify security conceptsIntroduce, motivate and explain a basic apparatus for risk management in general and risk analysis in particularRelate risk management to system developmentDescribe the different processes that risk management involveMotivate and illustrate model-driven security risk analysis (or security analysis, for short)Demonstrate the use of risk analysis techniques
CORAS 3
The three Lectures onSecurity Analysis
Part I : Basics
Part II : Example-Driven Walkthrough of the CORAS Method
Part III : Change Management
CORAS 4
Overview of Part IWhat is security?What is risk?What is risk management?Central termsWhat is CORAS?Main conceptsThe CORAS processRisk modelingSemanticsLikelihood reasoningThe CORAS tool
CORAS 5
What is Security Analysis?
Security analysis is a specialized form of risk analysis focusing on security risks
CORAS 6
What is Security?security
integrity availability accountabilityconfidentiality
Only authorised actors have access to information
Only authorised actors can change, create or delete information
Authorised actors haveaccess toinformation they need whenthey need it
It is possible to audit the sequence of events in the system
CORAS 7
Security is more than Technology
From a technical standpoint, security solutions are available – but what good is security if no one can use the systems?
Security requires more than technical understandingSecurity problems are often of non-technical originA sound security evaluation requires a uniform description of the system as a whole
how it is used, the surrounding organisation, etc.
CORAS 8
Security – Part of System Development
Security is traditionally added as an “afterthought”
Solutions often reactive rather than proactiveSecurity issues often solved in isolationCostly redesignSecurity not completely integrated
Enforcing security only at the end of the development process “by preventing certain behaviors...may result in a so useless system that the complete development effort would be wasted” [Mantel'01].
“It would be desirable to consider security aspects already in the design phase, before a system is actually implemented, since removing security flaws in the design phase saves cost and time” [Jürjens'02].
CORAS 9
In what way is “Security” related to
safetyreliabilitydependabilitymaintainabilitydata protectionprivacytrustworthytrustpublic key infrastructure based on trusted third partyauthentication and authorization
CORAS 10
Oversettelse av Terminologi
asset aktivum (noe med verdi)
threat trussel
unwanted incident uønsket hendelse
risk risiko
vulnerability sårbarhet
consequence konsekvens
probability sannsynlighet
frequency frekvens/hyppighet
treatment behandling
CORAS 11
What is Risk?
Many kinds of riskContractual riskEconomic risk Operational risk Environmental riskHealth riskPolitical riskLegal riskSecurity risk
CORAS 12
Definition of Risk from ISO 31000
Risk: Effect of uncertainty on objectivesNOTE 1 An effect is a deviation from the expected — positive and/or negativeNOTE 2 Objectives can have different aspects (such as financial, health and safety, and environmental goals) and can apply at different levels (such as strategic, organization-wide, project, product and process)NOTE 3 Risk is often characterized by reference to potential eventsand consequences, or a combination of theseNOTE 4 Risk is often expressed in terms of a combination of the consequences of an event (including changes in circumstances) and the associated likelihood of occurrenceNOTE 5 Uncertainty is the state, even partial, of deficiency of information related to, understanding or knowledge of an event, its consequence, or likelihood
CORAS 13
What is Risk Management?Risk management:Coordinated activities to direct and control an organization with regard to risk[ISO 31000:2009]
CORAS 14
Com
mun
icat
e an
d co
nsul
t
Establish the context
Identify risks
Estimate risks
Evaluate risks
Treat risks
Mon
itor a
nd re
view
Ris
k as
sess
men
t
Risk Analysis InvolvesDetermining what can happen, why and howSystematic use of available information to determine the level of riskPrioritization by comparing the level of risk against predetermined criteriaSelection and implementation of appropriate options for dealing with risk
CORAS 15
Com
mun
icat
e an
d co
nsul
t
Establish the context
Identify risks
Estimate risks
Evaluate risks
Treat risks
Mon
itor a
nd re
view
Ris
k as
sess
men
t
Terms
CORAS 16
Asset Vulnerability
Threat
Risk
Need to introduce risk treatment
Reduced risk
17
Terms
Risk
Threat
Vulnerability
Unwanted incident
Worm
Computer running Outlook
Internet
- Infected twice per year- Infected mail send to all
contacts
Infected PC
V
Install virus scanner
Treatment
Security Analysis Using CORAS
18
Overview
What is CORAS?Main conceptsProcess of eight stepsRisk modelingSemanticsCalculusTool supportFurther reading
CORAS 19
What is CORAS?CORAS consists of
Method for risk analysisLanguage for risk modelingTool for editing diagrams
Stepwise, structured and systematic processDirected by assetsConcrete tasks with practical guidelinesModel-driven
Models as basis for analysisModels as documentation of results
Based on international standards
CORAS 20
Main Concepts
CORAS 21
Asset
Vulnerability
Threat
Consequence
Unwanted incident
Likelihood
Risk
Party
Treatment
DefinitionsAsset: Something to which a party assigns value and hence for which the party requires protectionConsequence: The impact of an unwanted incident on an asset in terms of harm or reduced asset valueLikelihood: The frequency or probability of something to occurParty: An organization, company, person, group or other body on whose behalf a risk analysis is conductedRisk: The likelihood of an unwanted incident and its consequence for a specific assetRisk level: The level or value of a risk as derived from its likelihood and consequenceThreat: A potential cause of an unwanted incidentTreatment: An appropriate measure to reduce risk levelUnwanted incident: An event that harms or reduces the value of an assetVulnerability: A weakness, flaw or deficiency that opens for, or may be exploited by, a threat to cause harm to or reduce the value of an asset
CORAS 22
Exercise I
How would you represent risk in UML sequence diagrams?
CORAS 23
Process of Eight Steps1. Preparations for the analysis2. Customer presentation of the target3. Refining the target description using
asset diagrams4. Approval of the target description5. Risk identification using threat diagrams6. Risk estimation using threat diagrams7. Risk evaluation using risk diagrams8. Risk treatment using treatment
diagrams
CORAS 24
Establish context
Assess risk
Treat risk
Risk ModelingThe CORAS language consists of five kinds of diagrams
Asset diagramsThreat diagramsRisk diagramsTreatment diagramsTreatment overview diagrams
Each kind supports concrete steps in the risk analysis processIn addition there are three kinds of diagrams for specific needs
High-level CORAS diagramsDependent CORAS diagramsLegal CORAS diagrams
CORAS 25
Example: Threat Diagram
CORAS 26
Server is infectedby computer virus
[possible]
Virus protection not up to date
Servergoes down[unlikely] Availability
of serverComputer
virus
Likelihood
Virus creates back door to server[possible]
Hacker
Hacker gets access to server[unlikely]
Integrity of server
Confidentialityof information
0.2
0.1
Vulnerability
Threat
Threat scenario Unwanted incident
Asset
Likelihood
Consequence
SemanticsHow to interpret and understand a CORAS diagram?Users need a precise and unambiguous explanation of the meaning of a given diagram
Natural language semanticsCORAS comes with rules for systematic translation of any diagram into sentences in English
Formal semanticsSemantics in terms of a probability space on traces
CORAS 27
ExampleElements
Computer virus is a non-human threat.Virus protection not up to date is a vulnerability.Threat scenario Server is infected by computer virus occurs with likelihood possible.Unwanted incident Server goes down occurs with likelihood unlikely.Availability of server is an asset.
RelationsComputer virus exploits vulnerability Virus protection not up to date to initiate Server is infected by computer virus with undefined likelihood.Server is infected by computer virus leads to Server goes down with conditional likelihood 0.2.Server goes down impacts Availability of server with consequencehigh.
CORAS 28
Calculus for Likelihood Reasoning
Relation
Mutually exclusive vertices
Statistically independent vertices
CORAS 29
Guidelines for Consistency Checking
CORAS 30
Tool SupportThe CORAS tool is a diagram editorSupports all kinds of CORAS diagramsSuited for on-the-fly modeling during workshopsEnsures syntactic correctnessMay be used during all the steps of a risk analysis
Documents input to the various tasksSelection and structuring of information during tasksDocumentation of analysis results
CORAS 31
Screenshot
CORAS 32
Pull-down menu
Palette
Tool bar
Outline
Canvas
Properties window
Where to Find the Tool
http://coras.sourceforge.net/Open source
CORAS 33
Mandatory Reading
Mass Soldal Lund, Bjørnar Solhaug, Ketil Stølen: Chapter 3 "A Guided Tour of the CORAS Method" in the book "Model-Driven Risk Analysis: The CORAS Approach", 2011. Springer. The chapter can be downloaded freely.
Mass Soldal Lund, Bjørnar Solhaug, Ketil Stølen: Risk Analysis of Changing and Evolving Systems Using CORAS, 2011. LNCS 6858, Springer. Pages 231-274.
ONLY FOR INF9150: Mass Soldal Lund, Bjørnar Solhaug, Ketil Stølen: Chapter 13 "Analysing Likelihood Using CORAS Diagrams" in the book "Model-Driven Risk Analysis: The CORAS Approach", 2011
CORAS 34
Criticism from System Developers
The CORAS language is too simplisticIt is too cumbersome to use graphicalicons
CORAS 35
Criticism from Risk Analysts
What’s new with the CORAS language?We have been using something similar for years, namely VISIO!
CORAS 36
Exercise II
Discuss the statements made by thecritics?Argue why the critics are wrong.
CORAS 37
Top Related