Chapter 4 — Security architecture and engineering: core methods | Professional Security architecture and engineering

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Lesson map

Lesson 04 published. Map, example, EX016.

flowchart TD
  N0["Learning outcomes"]
  N1["4.1 Modelling the repairs service"]
  N2["4.2 Applying STRIDE"]
  N3["Lab — Ranking repairs threats by likelihood and impa"]
  N4["4.3 Ranking"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX016"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["4.1 Modelling the repairs service"]
  N2["4.2 Applying STRIDE"]
  N3["Lab — Ranking repairs threats by likelihood and impa"]
  N4["4.3 Ranking"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX016"]

[Learning outcomes]
    |
    v
[4.1 Modelling the repairs service]
    |
    v
[4.2 Applying STRIDE]
    |
    v
[Lab — Ranking repairs threats by likelihood and impa]
    |
    v
[4.3 Ranking]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX016]

Learning outcomes

You will (1) model a service's data flows; (2) apply STRIDE to find threats; (3) rank threats for treatment.

4.1 Modelling the repairs service

Owen models the repairs service: tenants report repairs through the portal or call centre; the repairs system creates jobs; jobs go to contractors through a supplier portal; contractors update jobs from phones; tenants receive text updates. He labels data on each flow, including tenant names, addresses, phone numbers and access notes such as key safe codes. He marks trust boundaries between Thornbury and contractors and between Thornbury and the text provider. The model takes two hours with the property team and becomes the basis for analysis.

4.2 Applying STRIDE

Owen applies STRIDE from Shostack (2014). Spoofing: a former contractor employee could still sign in to the supplier portal. Tampering: job notes could be altered to hide missed visits. Repudiation: contractors could deny receiving jobs if there is no record. Information disclosure: key safe codes are visible to every contractor rather than only the assigned one. Denial of service: the supplier portal has no fallback. Elevation of privilege: contractor accounts can see other contractors' jobs. He lists each threat with the element it affects.

Lab — Ranking repairs threats by likelihood and impact

# Rank repairs-service threats by likelihood x impact (1-3 scales, synthetic ratings).
threats = {"key safe codes visible to all contractors": (3, 3), "former contractor accounts still active": (2, 3),
           "contractors see other contractors' jobs": (3, 2), "job notes altered to hide missed visits": (2, 2),
           "no record of job receipt": (2, 1), "supplier portal outage without fallback": (1, 3)}
for i, (t, (l, imp)) in enumerate(sorted(threats.items(), key=lambda x: -x[1][0] * x[1][1]), 1):
    print(f"{i}. {t}: likelihood {l} x impact {imp} = {l * imp}")

Run with python3 lab_rank.py. Verified output:

1. key safe codes visible to all contractors: likelihood 3 x impact 3 = 9
2. former contractor accounts still active: likelihood 2 x impact 3 = 6
3. contractors see other contractors' jobs: likelihood 3 x impact 2 = 6
4. job notes altered to hide missed visits: likelihood 2 x impact 2 = 4
5. supplier portal outage without fallback: likelihood 1 x impact 3 = 3
6. no record of job receipt: likelihood 2 x impact 1 = 2

4.3 Ranking

Owen rates each threat for likelihood and impact on a scale of one to three with the property team, following the structure of NIST SP 800-30 Rev. 1, and multiplies them for a simple rank. The lab sorts the threats. Key safe code disclosure ranks highest, because it is likely and could let someone enter a vulnerable tenant's home. Former contractor accounts rank second. He presents the ranking with the reasons, noting that simple scores guide order of work but should not be treated as precise measurements.

Worked example

Owen models the repairs service, finds six STRIDE threats and ranks them with the property team, placing key safe code exposure first.

Synthetic case. The service and ratings are synthetic; Shostack (2014) and SP 800-30 Rev. 1 are real.

Errors and limits

Multiplied scores imply false precision. Models miss informal channels such as personal phones.

Exercises

EX016 — Sensitive note. Which sensitive data appeared in repairs access notes?
Show marking criteria
Rubric: 3 = key safe codes;; 2 = key codes;; 1 = vague;; 0 = none.
EX017 — Disclosure threat. What disclosure threat did STRIDE find?
Show marking criteria
Rubric: 3 = key safe codes visible to every contractor;; 2 = codes;; 1 = vague;; 0 = none.
EX018 — Top rank. Which threat ranked highest in the lab and with what score?
Show marking criteria
Rubric: 3 = key safe code disclosure, 9;; 2 = key codes;; 1 = portal outage;; 0 = none.
EX019 — Score caution. What caution did Owen give about scores?
Show marking criteria
Rubric: 3 = they guide order but are not precise measurements;; 2 = ordering;; 1 = vague;; 0 = none.
EX020 — Second rank. Which threat ranked second in the lab?
Show marking criteria
Rubric: 3 = former contractor accounts still active, 6;; 2 = former accounts;; 1 = vague;; 0 = none.

Synthesis

Modelling, STRIDE and simple ranking turn a service into a prioritised list of threats.

Continue studying — chapter 04 of 12

← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →