3.1.3 General Threat Modelling Meth

3.1.3 General Threat Modelling Methodologies
STRIDE is not the only risk assessment methodology. Three common types of approaches exist: Asset-centric, attacker-centric, and software-centric. Asset-centric focusses on sensitive data, information or hardware, which needs to be protected. For each asset, the damaging methods and the overall impact of a loss are evaluated. STRIDE can be extended with DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) to gauge the potential chance or extent of an attack. Similarly, the Common Vulnerability Scoring System (CVSS) [66], an industry standard to rate and assess the potential of a security vulnerability, can be utilised to prioritise and identify security issues for individual assets. However, these models are not part of the scope of the thesis as they classify security priority and company loss, which is not relevant for theoretical frameworks, such as the model established in the previous chapter. The attack-centric method humanises, categorises attackers into several personalities (e.g the ”Script Kiddie” or ”Agent”) and estimates their capabilities in the current system. According to these capabilities, prevention methods are developed and applied. This approach is less concerned about the technical intricacies of the relevant system and more about the damage potential and risk of varyingly professional attackers. The software-centric approach is the most suitable methodology, as it disassembles the system into single interworking mechanisms, actors, dependencies, and trust boundaries. The software defined network can be interpreted as a large operating system structure and thus the software-centric model can aptly analyse and highlight potential vulnerabilities. Instead of DFDs, the software architecture can also be decomposed into UML diagrams, state-charts or Petri nets. Ariss, Wu, and Xu, 2011 [67] presented an approach to integrate attack trees into state charts to visualise the insecure state of a system. Nevertheless, these approaches are likely more suitable for software systems with processes and varying system states and not fluid, interaction-based structures as in SDN. The thesis OpenFlow - A Security Analysis [63] discusses further methodologies for threat modelling and presents extensions to already existing models.

Kết quả (Việt) 1:

3.1.3 mối đe dọa Tổng mô hình phương phápSTRIDE is not the only risk assessment methodology. Three common types of approaches exist: Asset-centric, attacker-centric, and software-centric. Asset-centric focusses on sensitive data, information or hardware, which needs to be protected. For each asset, the damaging methods and the overall impact of a loss are evaluated. STRIDE can be extended with DREAD (Damage, Reproducibility, Exploitability, Affected Users, Discoverability) to gauge the potential chance or extent of an attack. Similarly, the Common Vulnerability Scoring System (CVSS) [66], an industry standard to rate and assess the potential of a security vulnerability, can be utilised to prioritise and identify security issues for individual assets. However, these models are not part of the scope of the thesis as they classify security priority and company loss, which is not relevant for theoretical frameworks, such as the model established in the previous chapter. The attack-centric method humanises, categorises attackers into several personalities (e.g the ”Script Kiddie” or ”Agent”) and estimates their capabilities in the current system. According to these capabilities, prevention methods are developed and applied. This approach is less concerned about the technical intricacies of the relevant system and more about the damage potential and risk of varyingly professional attackers. The software-centric approach is the most suitable methodology, as it disassembles the system into single interworking mechanisms, actors, dependencies, and trust boundaries. The software defined network can be interpreted as a large operating system structure and thus the software-centric model can aptly analyse and highlight potential vulnerabilities. Instead of DFDs, the software architecture can also be decomposed into UML diagrams, state-charts or Petri nets. Ariss, Wu, and Xu, 2011 [67] presented an approach to integrate attack trees into state charts to visualise the insecure state of a system. Nevertheless, these approaches are likely more suitable for software systems with processes and varying system states and not fluid, interaction-based structures as in SDN. The thesis OpenFlow - A Security Analysis [63] discusses further methodologies for threat modelling and presents extensions to already existing models.