Download Information Assurance Homework 7: Threat Modeling and Common Criteria Evaluation and more Assignments Computer Science in PDF only on Docsity! Information Assurance: Homework 7 Due November 15, 2005. 1. A vendor is trying to convince you of the trustworthiness of his system. He gives you a series of assurance evidence. For each piece of evidence, identify a concern (if any) you would have with that evidence. a. First he tells you that product has been deployed in an Internet environment for 6 months and no breakins have been detected. b. Then he tells you that they hired a penetration testing team and fixed all the problems that team found. c. Then he tells you that they have passed Common Criteria evaluation for the LSPP profile at EAL 1. d. Then he tells you that they have passed Common Criteria evaluation for the LSPP profile at EAL 6. 2. This question involves using Threat Modeling techniques to help design the security of an access control library called “A. Datum Access Control API”. A data flow diagram (DFD) showing some of the interactions of key library components is shown on the next page. Here are the two potential threat profiles for the API. ID = 10 Name=Replace the list that maps users to constant ID’s, with a new list file. By replacing the user list file, you could map an unprivileged user name to a privileged user ID. STRIDE classification=Tampering, Spoofing Mitigated=? Entry points=User list file Assets=Ability to change the evaluation of the access control policy. ID=11 Name=Use non-standard path to trick API into granting access to user who should not have access. For example, using “..” to confuse the path parsing. STRIDE classification=Information disclosure. Mitigated=? Entry points=1.1.1 ACCheck.CheckAccess() Assets=Data protected by the access control policy. a. Write a threat tree for each threat profile b. Examine the DFD. Are the threats adequately mitigated now? If so now? If not, what could you change to mitigate?
a5
ACADatumOsfile
PathResolver.
Resolve()
Username,
resource path,
requested access
1414
Apnlication L————7accheck. eee
lusing the API CheckAccess() Normalized
Enter path
Granted/Denied/ 11.2 Normalized
Other result Find/act : “ 116
for reouested ath, AGResources.
resource Get()
ACResourc
Instance/Null
Granted/Denied/
Other result
Lida
ACAel.
CheckGroup
Access()
ACAc!
Instance Fropert
Property
Access
ACGroup
Instance arent
ACResource.
GetAcl)
Group
membership
request
1.1.10
ACUser.
GerGroup
Membership()
Granted/
Denied/
Other
result
ACGroup.
Instance/,
Null
ACUser
‘ACUser Instance/
Instance Null
11.9
ACAI.
CheckUser
Access(}
14.8
ACUsers.Get()
Group
name
Group List
ACGroup
Instance
ACResource
Instance
Resource
tree
ACUser
» Instance
User List
