Chapter 23 — Information security: threat and failure analysis

Lesson map

Lesson 23 published. Map, example, EX067.

flowchart TD
  N0["Learning outcomes"]
  N1["23.1 Threat modelling"]
  N2["23.2 Attackers"]
  N3["23.3 Failure analysis"]
  N4["23.4 Linking to controls"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX067"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["23.1 Threat modelling"]
  N2["23.2 Attackers"]
  N3["23.3 Failure analysis"]
  N4["23.4 Linking to controls"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX067"]

[Learning outcomes]
    |
    v
[23.1 Threat modelling]
    |
    v
[23.2 Attackers]
    |
    v
[23.3 Failure analysis]
    |
    v
[23.4 Linking to controls]
    |
    v
[Worked example] --> [Exercise EX067]

Learning outcomes

You will (1) model threats systematically; (2) analyse failure modes; (3) link threats to controls.

23.1 Threat modelling

Lindiwe models threats to the dispatch system using a simple method: for each component and data flow, ask how an attacker could spoof identity, tamper with data, deny actions, disclose information, deny service or gain privilege. The driver app interface faces spoofing if drivers' credentials are stolen and tampering if confirmations can be altered. She records each threat with the component, the likely attacker and existing controls, producing a table the developers can act on. The developers review the table during their next planning meeting.

23.2 Attackers

Prof. Hale asks her to name realistic attackers rather than imagining a single all-powerful adversary. For Saltmarsh, she lists criminal groups seeking ransom, fraudsters redirecting deliveries of valuable goods, curious insiders and careless mistakes. Each has different goals and skills. Ransom groups target availability and backups; fraudsters target integrity of addresses; insiders target confidentiality of customer data. She learns that naming attackers sharpens priorities, since controls can be matched to the most likely threats. She notes the attacker type beside each threat in her table for clarity.

23.3 Failure analysis

Not every harm is malicious. Lindiwe applies failure mode analysis to dispatch: what happens if the database fails, the message queue fills or the mapping service becomes unavailable? For each, she estimates severity and how quickly it would be noticed. A full message queue would silently delay confirmations, so nobody would notice for hours. She recommends monitoring queue length. She learns that security and reliability analysis overlap, since availability failures look similar whatever their cause. The operations team sets an alert when the queue passes a set length.

23.4 Linking to controls

Lindiwe links each significant threat and failure to controls: credential theft to multi-factor authentication, address tampering to change alerts and approvals, queue failures to monitoring and ransomware to immutable backups. Some threats have no adequate control yet, such as insiders exporting customer lists. She records these as gaps for the risk register. Prof. Hale notes that an honest list of gaps is more useful than a long list of controls that implies nothing is missing. The security lead adds the insider gap to the risk register with an owner.

Worked example

Lindiwe models dispatch threats by category, names four realistic attacker types, analyses failure modes such as a full message queue and links threats to controls and gaps.

Synthetic case. Analyses are synthetic.

Errors and limits

Modelling only one powerful adversary misses common, simpler threats.

Exercises

• EX067 — Fraudster target. What do fraudsters target?
  Show marking criteria

  Rubric: 3 = integrity of delivery addresses;; 2 = partly correct;; 1 = other;; 0 = none.
• EX068 — Silent failure. Which failure would go unnoticed for hours?
  Show marking criteria

  Rubric: 3 = a full message queue;; 2 = partly correct;; 1 = other;; 0 = none.
• EX069 — Open gap. Which threat lacks an adequate control?
  Show marking criteria

  Rubric: 3 = insiders exporting customer lists;; 2 = partly correct;; 1 = vague;; 0 = none.