Lab: Security Objectives

For this lab, you are going to work through the Threat Modeling process for an actual application and come up with a short list of Security Objectives.

You've been using a real-world application for many of the labs this semester and this one is no different. However, your group will need to decide on one of your applications that you all are familiar with.

Instructions

1. Begin the Threat Modeling process by brainstorming all the different Actors that might use your application. Most applications will have at least two, but often more.
2. Then start brainstorming all of the Assets. Your threat model will need at least five of them.
   • A good place to start is your database diagram that shows the unique entity types. Each entity is probably a separate Asset.
   • Pay attention to how your app actually works. Sometimes entities of the same type should be treated differently based on an attribute, like a published news article versus a saved draft.
   • To make this simpler, try to focus on the more tangible Assets. For the blog example, we discussed the articles as opposed to author accounts.
3. Add your Actors and Assets to a spreadsheet program, like Google Sheets or Microsoft Excel. Actors go across the x-axis and Assets down the y-axis. These headings need to span two columns or rows.
4. Now you can add the four CRUD operations to each Actor/Asset interaction. Color code them according to the Always, Sometimes, and Never possibilites. Take your time with this and discuss each circumstance with your group.
5. Open another sheet and make a list of your security objectives. You should have at least eight, but with two or three Actors and at least five Assets you could easily double that.
   • You can combine the CRUD operations of a single Actor/Asset interaction into a single objective if the response is the same.
   • Most responses will be simply to stop the interaction because mistakes happen more often than malicious intent.
6. Finally, you should sort your security objectives according to how dangerous they are to your application or your data.

Presentation

At the end of class, we'll take five minutes for each group to show off their threat model and list of objectives. You should split up the presentation among your group members. For example, one of you could introduce the app and the actors, another could explain the different assets, and so on.

Good luck and have fun!